sync-claude-accountslisted

Distribute full OAuth Claude Code credentials (claude-accounts.json) from a single designated refresh-authority Mac to the rest of a fleet, and operate the scheduled automation that does it — the com.claude.fleet-refresh and com.claude.fleet-health LaunchAgents, their logs, and the proactive refresh that keeps receivers from ever rotating a token themselves. Use when syncing or propagating Claude Code logins across Macs or a fleet, when setting up, auditing, or reading a cycle of the recurring credential push, when a scheduled push seems to have stopped, when checking whether the fleet is healthy, or when the user mentions claude-accounts.json, cswap import, cux add, claude-swap, refresh authority, or fleet-refresh-credentials. To repair an account that is already dead — "re-login needed", EXPRD, null headroom — use the refresh-claude-account skill instead.
soulmachine/skills · ★ 3 · AI & Automation · score 76

Install: claude install-skill soulmachine/skills

# Sync Claude Accounts Distributing Claude Code OAuth credentials across a macOS fleet, and running the scheduled automation that keeps them alive. The push mechanism and the agents that drive it are one system, documented together. > **The 29 hard-won constraints that make this fiddly live in [REFERENCE.md](REFERENCE.md).** > Read it when something surprises you — an import that reports success but changes nothing, a > `keychain unavailable` that isn't a lock, a cux slot number that doesn't match cswap's. ## The model this skill implements Three decisions hold this together. Changing any one breaks the other two. 1. **Full OAuth credentials only — never setup-tokens.** Automatic rotation is driven by usage data. `cswap auto` is *purely usage-polling*, and cux is built around the `/login` credential bundle (`accessToken` + `refreshToken` + `expiresAt` + full scopes). A setup-token carries `user:inference` alone, so `/api/oauth/usage` answers **403** and the account is permanently unmeasurable — invisible to both rotators. Setup-tokens simply do not fit the model; the export must contain OAuth accounts. 2. **One machine refreshes; the rest only consume.** An OAuth refresh token is single-use and rotates server-side on every use, so N machines sharing an account means N−1 eventually get `invalid_grant`. Designating a single **refresh authority** that pushes its live credentials to everyone else removes the race at the source — a machine that only s