- Export KeychainAccessError from session.ts; thrown when getPassword() fails (platform error like locked keychain), not when an entry is missing (undefined)
- resumeSession() now rethrows KeychainAccessError without clearing metadata, so temporarily locked keychains no longer wipe stored credentials
- Add ensureAuthenticated(client) to auth-helpers.ts: on KeychainAccessError,
attempts to unlock the keychain via
security unlock-keychain(macOS only), retries once, then falls back to a clear error message with manual instructions - Replace 7 repeated inline auth-check blocks in issue.ts with ensureAuthenticated()
- Add/update tests for KeychainAccessError propagation and ensureAuthenticated behavior
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com