docs(roadmap): add #350 — doctor auth check false-positive: misses CLI session tokens

ROADMAP.md

@@ -6282,4 +6282,4 @@ Original filing (2026-04-18): the session emitted `SessionStart hook (completed)
 
 341. **Resume-safe `/tasks --output-format json` emits an unsupported-command JSON error only on stderr and mixes `kind` with `type` classification vocabularies** — dogfooded 2026-04-29 for the 16:00 nudge on current `origin/main` / rebuilt `./rust/target/debug/claw` with embedded `git_sha` `58569131`. Running `./rust/target/debug/claw --resume latest /tasks --output-format json` wrote no stdout bytes, but wrote a JSON error object to stderr: `{"command":"/tasks","error":"/tasks is not yet implemented in this build","kind":"unsupported_command","type":"error"}`. The unsupported command envelope therefore has two separate top-level classification vocabularies (`kind=unsupported_command` and `type=error`) and places the only parseable payload on stderr, while successful JSON commands use stdout and a `kind`-only classification. This is distinct from #340 because it is not session help; it shows implemented-but-unsupported command stubs can emit a dual-vocabulary error envelope. **Required fix shape:** (a) in `--output-format json` mode, emit the primary JSON envelope on stdout for unsupported resumed slash commands such as `/tasks`; (b) document and use one error discriminator, preferably `kind:"error"` plus `code:"unsupported_command"`, or `kind:"unsupported_command"` plus `status:"error"`, but not `type`; (c) reserve stderr for non-primary diagnostics or text-mode prose, never as the sole JSON payload; (d) add regression coverage for `/tasks` under `--resume` with JSON output proving stdout contains the structured error envelope, stderr is not the only parseable stream, and the envelope uses the documented single-vocabulary discriminator. **Why this matters:** claws need the same stdout JSON contract for implemented successes and implemented-but-unsupported stubs. If `/tasks` errors can silently move to stderr and advertise both `kind` and `type`, automation must special-case command stubs instead of applying one JSON error parser. Source: gaebal-gajae dogfood follow-up for the 16:00 nudge on rebuilt `./rust/target/debug/claw` `58569131`.
 
-345. **`claw status --output-format json` and `/status --output-format json` do not include the active session ID in the JSON output, and `workspace.session_id` is always `null` even when resumed with `--resume latest`** — dogfooded 2026-04-30 by Jobdori on `5856913`. Running `claw --output-format json --resume latest /status` returns `workspace.session_id: null` and `workspace.session: "live-repl"` — impossible to confirm which session is active from `status` output alone. Also `workspace.changed_files: 3` while `staged_files: 0, unstaged_files: 0, untracked_files: 3` — if `changed_files` counts only tracked changes it should be 0; if it counts everything it duplicates `untracked_files`. Counter semantics are ambiguous. **Fix:** populate `workspace.session_id` when resumed; clarify `changed_files` vs `staged+unstaged+untracked` counter semantics. Source: Jobdori live dogfood, mengmotaHost, `5856913`, 2026-04-30.
+350. **`doctor --output-format json` auth check reports `status: "warn"` with `"no supported auth env vars were found"` even when a valid CLI session token or browser-based OAuth token is present in the claw config directory** — dogfooded 2026-04-30 by Jobdori on `f65b2b4`. Running `/doctor --output-format json` returns `{"name":"auth","status":"warn","summary":"no supported auth env vars were found","api_key_present":false,"auth_token_present":false,"legacy_refresh_token_present":false,...}`. In the same environment, `claw --resume latest` successfully resumes a session (meaning a valid auth token exists in `~/.claw/` or the session store) — but `doctor` does not check that path and reports a false-positive warning. The auth check appears to only probe environment variables (`ANTHROPIC_API_KEY`, `CLAW_AUTH_TOKEN`, etc.) and legacy OAuth refresh token fields, but does not probe: (a) the CLI session token stored in `~/.claw/auth.json` or equivalent; (b) the OAuth access token in `~/.claw/settings.json`; (c) valid unexpired session credentials that the runtime uses to authenticate actual API calls. A claw running `doctor` before starting work gets a false `auth` warning and cannot distinguish "genuinely no auth" from "auth exists but not in env vars". **Required fix shape:** (a) expand auth check to probe all credential paths the runtime actually uses in priority order, including CLI session tokens, OAuth tokens in config files, and environment variables; (b) report which credential source passed (e.g. `"auth_source": "settings_oauth"` or `"auth_source": "env_api_key"`); (c) report `status: "ok"` when any working credential path exists, even if env vars are absent; (d) add regression coverage proving that a machine with a valid `~/.claw/` session token reports `auth.status: "ok"` in doctor output. **Why this matters:** `doctor` is the bootstrap health check surface — if it false-positives on auth, every claw health-check pipeline will flag the system as unhealthy and may abort legitimate work. Source: Jobdori live dogfood, mengmotaHost, `f65b2b4`, 2026-04-30.