[Bug] frequent claude code login for multi account setup

Prince via Discord

Still hitting the Claude re-auth loop on Orca 1.4.176 + Claude Code 2.1.224 (macOS 26.4). #6234 got marked not-reproducible, but it's very much alive.

caught it live today: at 13:24 ~/.claude/.credentials.json had just been written — but the token in it had expired at 10:25, so 3h dead on arrival. rewritten at 13:28 with the live one. anything reading in that window gets an already-rotated token, replaying it revokes the whole family, and that's why /login never sticks. my actual login was healthy the whole time (good till ~Aug 27) — it's only the stored copy going stale. 4 stores for one lineage here: 3 keychain items + the file.

same mechanism as #9582 and the PR at #6864

what I'd most want: #12002 (setup-token support) — no refresh token to rotate = no race. failing that, just don't overwrite a newer token with an older snapshot (#9754)

The "don't overwrite newer with older" guard doesn't exist on `main` yet

Checked the write paths against current main, since that was your fallback ask.

No write compares token freshness before overwriting. expiresAt / expires_at is read in exactly one place in runtime-auth-service.ts (:934-935), and not as a write guard. keychain.ts has no expiry, staleness or ordering comparison at all:

rg -n 'expiresAt|expires_at' src/main/claude-accounts/runtime-auth-service.ts   # → only :934-935
rg -n 'expiresAt|expires_at|newer|stale' src/main/claude-accounts/keychain.ts   # → no matches

Meanwhile the writers are plural, which lines up with the "4 stores for one lineage" you observed:

runtime-auth-service.ts:426 and :550 — writeActiveClaudeKeychainCredentialsForRuntime
runtime-auth-service.ts:1030 — writeManagedClaudeKeychainCredentials
runtime-auth-service.ts:1033 — writeClaudeManagedAuthFile(... '.credentials.json' ...)
runtime-auth-service.ts:1530 — writeActiveClaudeKeychainCredentials

Every one of those is an unconditional write. So a snapshot captured before a rotation can land on top of a newer one from any of these paths, which matches your 13:24 capture (a file written with a token that had already expired at 10:25, then corrected at 13:28).

On #9754 — that PR keeps a failed refresh from clobbering a fresh login. That is a real fix for one path, but it is narrower than a general monotonic guard: it keys on the failure case rather than on "is the credential I am about to write older than the one already there".

Not opening a PR for this — it is credential code with several writers and a live PR already moving in the area, and I would rather not have two overlapping changes to token storage. But if a maintainer wants the general guard as a separate change, comparing expiresAt at each write site and refusing a regression looks tractable and testable, and I am happy to write it.

(Verified against main with Claude Opus 5; no repro attempted on Windows/Linux.)

thanks for reporting. looking into it

Prince via Discord

please look into this -> looks like its becoming more frequent!

indosaram via Discord

Because of this I want to opt out from Claude usage tracking

This looks like the same credential-clobber / 401 re-auth loop as #9582, with #12002 as a requested alternative (setup-token, no refresh race). Leaving this open for the multi-account / 4-store capture and write-guard analysis; please treat #9582 as the primary 401 investigation and #12002 as the setup-token feature.

fix(claude-auth): refuse stale same-identity credential overwrites

are we still working on this one? its now making the agents unusable in day to day life -> frequent logins prompts are happening

@nwparker

any update on this, also why we remove p0 from this? @nwparker / @brennanb2025

@hmrserver

@hmrserver we removed p0 from all issues -- nothing personal, I promise. But that's another topic.

Yeah I'm pining @brennanb2025 and will bring up w/ him in the morning

Make the CLI's scoped Keychain item the single credential owner

@AmethystLiang

any update on this? its been more than a month
@AmethystLiang @brennanb2025 @nwparker ?

@brennanb2025

Not sure why it got closed ...
but this has stalled I presumed since it's hard to reproduce? @brennanb2025 ?

nwparker via Discord

Prince sorry this didn't get looked at ... hmmm
Brennan --- I know it's been awhile but do you mind taking a glance?

Fixed

Navigation Menu

Repository navigation

[Bug] frequent claude code login for multi account setup #13165

The "don't overwrite newer with older" guard doesn't exist on `main` yet

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug] frequent claude code login for multi account setup #13165

Description

Activity

manuaudio commented on Aug 8, 2026

The "don't overwrite newer with older" guard doesn't exist on main yet

AmethystLiang commented on Aug 8, 2026

orca-discord-issues commented on Aug 12, 2026

orca-discord-issues commented on Aug 13, 2026

AmethystLiang commented on Aug 14, 2026

hmrserver commented on Aug 20, 2026

hmrserver commented on Aug 31, 2026

nwparker commented on Aug 31, 2026

hmrserver commented on Sep 14, 2026

nwparker commented on Sep 30, 2026

orca-discord-issues commented on Sep 30, 2026

nwparker commented on Oct 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The "don't overwrite newer with older" guard doesn't exist on `main` yet