[Bug]: Claude (Max OAuth) verifies OK but every generation 401s — only inside T3; CLI + Agent SDK both work standalone

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server/dist/bin.mjs

Steps to reproduce

Same ~/.claude Max-OAuth credential works in every context EXCEPT T3, which isolates the bug to T3's invocation.

In T3:

1. Authenticate Claude Code with a Max subscription (claude → /login). Confirm claude -p "hi" works in a terminal.
2. In T3, select the claudeAgent provider — it correctly shows Authenticated as <email> · Claude Max Subscription.
3. Send any message to the Claude agent.
4. Every turn 401s, retried 10× via api_retry.

Negative controls — same credential, all succeed (only T3 fails):

# ✅ CLI entrypoint
claude -p "reply with: ok"

# ✅ forcing the sdk-ts entrypoint marker
CLAUDE_CODE_ENTRYPOINT=sdk-ts claude -p "reply with: ok"

# ✅ vanilla Agent SDK query() — same library + entrypoint T3 uses
bun add @anthropic-ai/claude-agent-sdk
bun -e 'import {query} from "@anthropic-ai/claude-agent-sdk"; for await (const m of query({prompt:"reply with: ok",options:{maxTurns:1}})) console.log(m.type)'
#   → system/init → assistant "ok" → result success
All three standalone paths succeed against the Max-OAuth credential. Only T3's invocation 401s, so the differentiator is in the query() options / spawn env T3 builds. Captured subprocess env shows no ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY / custom CLAUDE_CONFIG_DIR.




### Expected behavior

With the Claude provider showing `Authenticated · Claude Max Subscription`, sending a message should generate a normal response — exactly as the same credential does via `claude -p` and via a vanilla Agent SDK `query()`.

### Actual behavior

The auth probe passes (UI shows the correct email + "Claude Max Subscription"), but every generation fails:

Claude system message 'api_retry' — attempt: 1 · max_retries: 10 · retry_delay_ms: 600.8…
Claude system message 'api_retry' — attempt: 2 · max_retries: 10 · retry_delay_ms: 1197.1…
Failed to authenticate. API Error: 401 The socket connection was closed unexpectedly. For more information, pass verbose: true in the second argument to fetch()
Failed to authenticate. API Error: 401 Invalid authentication credentials

The two 401 messages alternate between turns (one "socket connection closed", one "invalid credentials"), suggesting an intermittent/connection issue rather than a hard auth rejection. Retries all fail.

NOT fixed by: re-login, app restart, full reboot, clearing T3 cookies/local-storage, or deleting `cloud-auth-token.json` + the `claudeAgent.json` cache.

Distinct from #2653: there the auth *probe* fails ("Could not verify… / Limited"). Here the probe **succeeds** and only generation 401s.

### Impact

Blocks work completely

### Version or commit

T3 Code (Alpha) 0.0.27

### Environment

- T3 Code (Alpha): 0.0.27 - OS: macOS 26.4.1, Apple Silicon (arm64) - Claude Code CLI: 2.1.186 - Claude Agent SDK: 0.3.186 (T3 runtime reported CLAUDE_AGENT_SDK_VERSION=0.3.170) - Bun: 1.3.11 · Node: v25.9.0 - Provider/model: claudeAgent · claude-opus-4-8 · effort high · context 200k · runtime full-access - Auth: Claude Max via OAuth (~/.claude/.credentials.json, apiKeySource="none"), no API key, token valid/not expired

### Logs or stack traces

```shell
Claude system message 'api_retry' — attempt: 1 · max_retries: 10 · retry_delay_ms: 600.8891432105554
Claude system message 'api_retry' — attempt: 2 · max_retries: 10 · retry_delay_ms: 1197.1064880127174
Failed to authenticate. API Error: 401 The socket connection was closed unexpectedly. For more information, pass verbose: true in the second argument to fetch()
Failed to authenticate. API Error: 401 Invalid authentication credentials
(Ask for maintainers: since the credential + SDK are proven good in isolation, please log the exact query() options + outgoing request headers T3 builds for claudeAgent so the offending difference can be pinned.)

Screenshots, recordings, or supporting files

Screenshot 2026-06-23 at 18.44.27.png
Screenshot 2026-06-23 at 18.44.47.png

Workaround

None found that fixes T3 itself. The underlying claude CLI keeps working in a terminal, so usable as a fallback outside T3. Re-login / restart / reboot / clearing T3 auth caches did not help.

Start at apps/server/dist/bin.mjs and the claudeAgent provider's query() invocation; compare its options and spawned environment with the standalone Agent SDK and CLI commands described in the report. Done means a valid Claude Max credential produces a normal response in T3 without 401 retries.