Update CHANGELOG.md

Author: ratulsarna

CHANGELOG.md

@@ -13,23 +13,15 @@
 - CI/tooling reliability improved via pinned lint tools, deterministic macOS test execution, and PTY timing test
   stabilization plus Node 24-ready GitHub Actions upgrades (#292, #312, #290).
 
-### Claude OAuth & Keychain (net result)
-- Claude OAuth refresh ownership now keeps Claude CLI as the refresh-token owner for CLI-managed credentials; CodexBar
-  delegates a refresh handoff instead of rotating those tokens in its own cache.
-- Claude Auto mode now performs at most one delegated Claude CLI refresh handoff and one OAuth retry before normal
-  `web -> cli` fallback.
-- Claude OAuth-only mode now keeps strict OAuth semantics (no silent Web/CLI fallback) after delegated retry.
-- Reduce repeated keychain prompts by preferring silent/non-interactive reads in background/availability paths and
-  respecting cooldown gates (#245, #305). Thanks @manikv12!
-- Sync CodexBar's OAuth cache when Claude keychain credentials actually change, with fingerprint-based detection and
-  protections against regressing to stale/expired tokens (#305).
-- Show the in-app Claude keychain pre-alert only when preflight suggests interaction is likely; suppress unnecessary
-  alerts on silent-success paths (#308).
-- Distinguish terminal vs transient OAuth auth failures:
-  - `invalid_grant` and equivalent auth rejections are terminal-blocked until auth state changes.
-  - transient failures use bounded backoff and automatically unblock on successful auth/reauth (#309).
-- Ensure usable Claude OAuth credentials are accepted in non-interactive scenarios and fix Claude auto debug pipeline
-  ordering follow-up.
+### Claude OAuth & Keychain (upgrade-relevant behavior)
+- Claude Auto mode prefers `oauth -> web -> cli` without triggering Keychain prompts during availability checks.
+- If Claude OAuth credentials are present but expired, CodexBar performs at most one delegated refresh handoff to the
+  Claude CLI and one OAuth retry before falling back to Web/CLI in Auto mode.
+- Claude OAuth-only mode stays strict: OAuth failures do not silently fall back to Web/CLI.
+- Keychain prompting is hardened (cooldowns after denial/cancel + pre-alert only when interaction is likely) to reduce
+  repeated prompts during background refresh.
+- CodexBar syncs its cached OAuth token when the Claude Code Keychain entry changes, so updated auth is picked up
+  without requiring a restart.
 
 ### Provider & Usage Fixes
 - Cursor: compute usage against `plan.limit` rather than `breakdown.total` to avoid incorrect limit interpretation