fix(auth): keep Claude OAuth named pools and stop provider hops

packages/ai/CHANGELOG.md

@@ -10,6 +10,8 @@
 
 ### Fixed
 
+- Login no longer double-appends a provider-owned OAuth account pool as a fake `login-N` slot copied from the flat compatibility sentinel.
+
 ### Removed
 
 ## [2026.9.2] - 2026-09-02

packages/ai/src/auth/pool/slots.ts

@@ -146,6 +146,9 @@ function nextLoginSlotName(credential: PooledCredential): string {
  * user's stored bytes change until a second credential actually exists.
  */
 export function appendLoginSlot(current: PooledCredential | undefined, flat: Credential): Credential {
+	if ("accounts" in flat && Array.isArray(flat.accounts) && flat.accounts.length > 0) {
+		return flat;
+	}
 	if (!current || !Array.isArray(current.accounts) || current.accounts.length === 0) {
 		return flat;
 	}

packages/ai/src/changes.md

@@ -1,3 +1,22 @@
+## Preserve provider-owned credential pools during login (2026-09-02)
+
+### What changed
+
+- `packages/ai/src/auth/pool/slots.ts`: `appendLoginSlot` now accepts an OAuth credential whose provider already returned a populated `accounts` pool as the complete post-login credential instead of appending its flat compatibility fields as another generated slot.
+- `packages/ai/test/credential-pool-resolve-slot.test.ts`: covers a provider-owned named account pool and still appends unnamed flat credentials as `login-N`.
+
+### Why
+
+- The shared login layer automatically appends ordinary flat credentials. The Claude SDK OAuth provider already returns its current pool plus the newly named account, so applying the generic append a second time stored the provider's managed top-level sentinel as a fake `login-2` account.
+
+### Why an extension could not handle it
+
+- The double append happens after the provider login returns, inside the shared credential-pool write path. Providers cannot prevent the runtime from reinterpreting their completed pool as a flat credential.
+
+### Expected merge conflict zones
+
+- LOW: `auth/pool/slots.ts` at the start of `appendLoginSlot`.
+
 ## Cursor conversation cache eviction cannot break a live request (2026-08-31)
 
 ### What changed

packages/ai/test/credential-pool-resolve-slot.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "vitest";
 import { InMemoryCredentialStore } from "../src/auth/credential-store.ts";
 import { envApiKeyAuth } from "../src/auth/helpers.ts";
-import { listSlots, type PooledCredential } from "../src/auth/pool/slots.ts";
+import { appendLoginSlot, listSlots, type PooledCredential } from "../src/auth/pool/slots.ts";
 import { resolveProviderAuth } from "../src/auth/resolve.ts";
 import type { OAuthCredential } from "../src/auth/types.ts";
 import { createProvider, type Provider } from "../src/models.ts";
@@ -63,6 +63,35 @@ function oauthProvider(refreshed: (credential: OAuthCredential) => OAuthCredenti
 }
 
 describe("slot-scoped auth resolution", () => {
+	test("login preserves a provider-owned pooled credential instead of double-appending its flat sentinel", () => {
+		const current = pooledOAuthEntry();
+		const providerOwned: PooledCredential = {
+			...current,
+			accounts: [
+				...(current.accounts ?? []),
+				{ name: "work", access: "named-access", refresh: "r-named", expires: FUTURE, source: "login" },
+			],
+		};
+
+		expect(appendLoginSlot(current, providerOwned)).toEqual(providerOwned);
+	});
+
+	test("unnamed flat oauth still appends as login-N", () => {
+		const current = pooledOAuthEntry();
+		const next = appendLoginSlot(current, {
+			type: "oauth",
+			access: "new-access",
+			refresh: "r-new",
+			expires: FUTURE,
+		}) as PooledCredential;
+
+		expect(listSlots(next).map((slot) => slot.name)).toEqual(["default", "alt", "login-2"]);
+		expect(listSlots(next).find((slot) => slot.name === "login-2")).toMatchObject({
+			access: "new-access",
+			refresh: "r-new",
+		});
+	});
+
 	test("slotName resolves the named api_key slot instead of the flat projection", async () => {
 		const store = new InMemoryCredentialStore();
 		await store.modify("slottest", async () => pooledApiKeyEntry());

packages/coding-agent/CHANGELOG.md

@@ -6,6 +6,10 @@
 
 ### Fixed
 
+- Claude SDK OAuth readiness now treats a rotation-selected concrete OAuth slot as configured, so a second login no longer fails every request with `Provider is not configured: claude-sdk-oauth`.
+- `Provider is not configured:` is no longer a hard-error model fallback, so an auth miss on Claude SDK OAuth does not eject the turn onto another provider.
+- OAuth login no longer paints two live `>` prompts when the browser callback finishes before the paste-code field is submitted.
+
 ### New Features
 
 ### Breaking Changes

packages/coding-agent/src/core/agent-session.ts

@@ -7378,6 +7378,7 @@ export class AgentSession {
 	private _isHardErrorFallbackEligible(message: AssistantMessage): boolean {
 		return (
 			!message.errorMessage?.startsWith(TURN_RETRY_SUPPRESSION_PREFIX) &&
+			!message.errorMessage?.startsWith("Provider is not configured:") &&
 			message.stopReason === "error" &&
 			!isContextOverflow(message, this.model?.contextWindow ?? 0) &&
 			!this._isCursorPayloadOverflow(message) &&

packages/coding-agent/src/core/changes.md

@@ -1,5 +1,24 @@
 # changes
 
+## 2026-09-02 - Do not hard-fallback a provider-not-configured auth miss
+
+### What changed
+
+- `packages/coding-agent/src/core/agent-session.ts`: `_isHardErrorFallbackEligible` no longer treats `Provider is not configured:` as a model hard-error that ejects onto another provider.
+- `packages/coding-agent/test/suite/retry-fallback-hard-error.test.ts`: a configured fallback chain stays unused when the current model fails with that auth miss.
+
+### Why
+
+- Auth wiring failures were classified as hard-error and immediately switched `claude-sdk-oauth/claude-opus-5` onto a different provider (for example `opengateway/anthropic/claude-opus-5`) instead of staying on Claude SDK OAuth or its sibling accounts.
+
+### Why an extension could not handle it
+
+- Hard-error fallback eligibility is decided in `AgentSession` before extension failover runs.
+
+### Expected merge conflict zones
+
+- LOW: `_isHardErrorFallbackEligible` in `agent-session.ts`.
+
 ## 2026-08-31 - Session activity contract for host occupancy decisions
 
 ### What changed

packages/coding-agent/src/core/extensions/builtin/claude-sdk-oauth/changes.md

@@ -1,5 +1,24 @@
 # claude-sdk-oauth
 
+## 2026-09-02 - Preserve selected OAuth slots during provider preflight
+
+### What changed
+
+- `oauth-login.ts`: readiness now recognizes a concrete OAuth credential selected by the shared credential-rotation layer, while still excluding the provider's synthetic managed sentinel.
+- `test/claude-sdk-oauth-login.test.ts`: projected non-sentinel slots pass `check`; projected sentinels do not.
+
+### Why
+
+- With two or more Claude logins, shared credential rotation passes one selected OAuth slot to provider auth resolution. The Claude readiness predicate counted only the parent credential's `accounts` array, so the selected slot appeared empty and the request failed with `Provider is not configured: claude-sdk-oauth` even though both accounts were valid.
+
+### Why an extension could not handle it
+
+- Readiness is this provider's `oauth.check` predicate. An external extension cannot change how a selected slot is counted once rotation has already projected it.
+
+### Expected merge conflict zones
+
+- LOW in `oauth-login.ts` `configuredFor` account counting.
+
 ## 2026-08-21 - Cache provider settings loads by mtime+size to cut lock convoy
 
 ### What changed

packages/coding-agent/src/core/extensions/builtin/claude-sdk-oauth/oauth-login.ts

@@ -109,9 +109,13 @@ export function createOAuthConfig(deps: {
 		environment?: Record<string, string>,
 	): Promise<boolean> => {
 		const storedAccounts = stored?.type === "oauth" && Array.isArray(stored.accounts) ? stored.accounts : [];
+		const selectedStoredAccount =
+			stored?.type === "oauth" &&
+			stored.access !== SENTINEL_OAUTH_FIELDS.access &&
+			stored.refresh !== SENTINEL_OAUTH_FIELDS.refresh;
 		const effectiveEnvironment = environment ?? (await claudeEnvironment(ctx));
 		const environmentTokenCount = Object.values(effectiveEnvironment).filter(Boolean).length;
-		const accountCount = storedAccounts.length + environmentTokenCount;
+		const accountCount = storedAccounts.length + (selectedStoredAccount ? 1 : 0) + environmentTokenCount;
 		const settings = deps.readSettings?.();
 		const lane = settings?.tokenInjection ?? (accountCount > 0 ? "oauth-slots" : "ambient");
 		if (lane === "ambient") {

packages/coding-agent/src/modes/interactive/changes.md

@@ -1,5 +1,24 @@
 # changes
 
+## 2026-09-02 - Do not paint two live login inputs
+
+### What changed
+
+- `packages/coding-agent/src/modes/interactive/components/login-dialog.ts`: `showManualInput` and `showPrompt` remount the single Input widget instead of adding it twice, so a browser-callback login no longer shows two stacked `>` prompts.
+- `packages/coding-agent/test/suite/regressions/5433-extension-oauth-prompt-input.test.ts`: covers an unsubmitted paste-code prompt followed by the account-name prompt.
+
+### Why
+
+- Anthropic OAuth completes via localhost callback while the paste-code input is still mounted. The name prompt then added the same Input child again, and the TUI painted two live `>` rows.
+
+### Why an extension could not handle it
+
+- Login chrome is the interactive LoginDialogComponent, not an extension surface.
+
+### Expected merge conflict zones
+
+- LOW: `showManualInput` / `showPrompt` in `login-dialog.ts`.
+
 ## 2026-09-01 - Never swallow an interactive quit request
 
 ### What changed

packages/coding-agent/src/modes/interactive/components/login-dialog.ts

@@ -15,6 +15,7 @@ export class LoginDialogComponent extends Container implements Focusable {
 	private abortController = new AbortController();
 	private inputResolver?: (value: string) => void;
 	private inputRejecter?: (error: Error) => void;
+	private liveHint?: Text;
 	private onComplete: (success: boolean, message?: string) => void;
 
 	// Focusable implementation - propagate to input for IME cursor positioning
@@ -80,6 +81,16 @@ export class LoginDialogComponent extends Container implements Focusable {
 		);
 	}
 
+	/** The Input widget is a single instance; mounting it twice paints two live `>` rows. */
+	private remountInput(hint: Text): void {
+		this.contentContainer.children = this.contentContainer.children.filter(
+			(child) => child !== this.input && child !== this.liveHint,
+		);
+		this.contentContainer.addChild(this.input);
+		this.liveHint = hint;
+		this.contentContainer.addChild(hint);
+	}
+
 	private cancel(): void {
 		this.abortController.abort();
 		if (this.inputRejecter) {
@@ -137,8 +148,7 @@ export class LoginDialogComponent extends Container implements Focusable {
 		this.input.setValue("");
 		this.contentContainer.addChild(new Spacer(1));
 		this.contentContainer.addChild(new Text(theme.fg("dim", prompt), 1, 0));
-		this.contentContainer.addChild(this.input);
-		this.contentContainer.addChild(new Text(`(${keyHint("tui.select.cancel", "to cancel")})`, 1, 0));
+		this.remountInput(new Text(`(${keyHint("tui.select.cancel", "to cancel")})`, 1, 0));
 		this.tui.requestRender();
 
 		return new Promise((resolve, reject) => {
@@ -157,8 +167,7 @@ export class LoginDialogComponent extends Container implements Focusable {
 		if (placeholder) {
 			this.contentContainer.addChild(new Text(theme.fg("dim", `e.g., ${placeholder}`), 1, 0));
 		}
-		this.contentContainer.addChild(this.input);
-		this.contentContainer.addChild(
+		this.remountInput(
 			new Text(
 				`(${keyHint("tui.select.cancel", "to cancel,")} ${keyHint("tui.select.confirm", "to submit")})`,
 				1,

packages/coding-agent/test/claude-sdk-oauth-login.test.ts

@@ -101,4 +101,24 @@ describe("claude-sdk-oauth oauth login config", () => {
 		const credential = await config.login({});
 		expect(await config.refreshToken(credential)).toBe(credential);
 	});
+
+	it("treats a projected non-sentinel OAuth slot as configured", async () => {
+		const config = createOAuthConfig({ readCurrent: async () => undefined, loginFlow: fakeFlow(fresh) });
+		const ctx = { env: async () => undefined, fileExists: async () => false };
+		const check = await config.check({
+			ctx,
+			credential: { type: "oauth", access: "slot-access", refresh: "slot-refresh", expires: Date.now() + 60_000 },
+		});
+		expect(check).toEqual({ source: "Claude SDK OAuth", type: "oauth" });
+	});
+
+	it("does not treat a projected managed sentinel as configured", async () => {
+		const config = createOAuthConfig({ readCurrent: async () => undefined, loginFlow: fakeFlow(fresh) });
+		const ctx = { env: async () => undefined, fileExists: async () => false };
+		const check = await config.check({
+			ctx,
+			credential: { type: "oauth", ...SENTINEL_OAUTH_FIELDS },
+		});
+		expect(check).toBeUndefined();
+	});
 });

packages/coding-agent/test/suite/regressions/5433-extension-oauth-prompt-input.test.ts

@@ -96,6 +96,24 @@ describe("LoginDialogComponent OAuth prompts", () => {
 		expect(output).toContain("Enter API key:");
 	});
 
+	test("does not paint two live inputs when a later prompt starts before the first is submitted", () => {
+		const dialog = createDialog();
+
+		dialog.showAuth("https://example.invalid/login");
+		void dialog.showManualInput("Complete login in your browser, or paste the authorization code / redirect URL here:");
+		dialog.showProgress("Exchanging authorization code for tokens...");
+		void dialog.showPrompt("Name for this account (existing: default)", "account-2");
+		dialog.handleInput("jgplabs");
+
+		const lines = renderDialog(dialog);
+		const output = lines.join("\n");
+		expect(output).toContain("https://example.invalid/login");
+		expect(output).toContain("Exchanging authorization code for tokens...");
+		expect(output).toContain("Name for this account (existing: default)");
+		expect(countRenderedValue(lines, "jgplabs")).toBe(1);
+		expect(lines.filter((line) => /^>\s*$/.test(line.trim()) || line.trim() === ">").length).toBe(0);
+	});
+
 	test("keeps previous manual input stable when a later prompt is active", async () => {
 		const dialog = createDialog();
 

packages/coding-agent/test/suite/retry-fallback-hard-error.test.ts

@@ -206,6 +206,22 @@ describe("retry fallback hard errors", () => {
 		expect(harness.eventsOfType("retry_fallback_applied")).toEqual([]);
 	});
 
+	it("does not switch providers on a provider-not-configured auth miss", async () => {
+		const harness = await createHarness({
+			models: [{ id: "faux-1" }, { id: "faux-2" }],
+			settings: { retry: { enabled: true, baseDelayMs: 1, fallbackChains: { [primary]: [fallback] } } },
+		});
+		harnesses.push(harness);
+		const authMiss = "Provider is not configured: claude-sdk-oauth";
+		harness.setResponses([fauxAssistantMessage("", { stopReason: "error", errorMessage: authMiss })]);
+
+		await harness.session.prompt("hello");
+
+		expect(harness.faux.getCallLog().map((call) => call.modelId)).toEqual(["faux-1"]);
+		expect(harness.eventsOfType("retry_fallback_applied")).toEqual([]);
+		expect(harness.session.state.messages.at(-1)).toMatchObject({ errorMessage: authMiss });
+	});
+
 	it("does not treat an aborted response as a hard-error fallback", async () => {
 		const harness = await createHarness({
 			models: [{ id: "faux-1" }, { id: "faux-2" }],