[Bug]: Signed-out Claude instance shows as authenticated and ready, so every turn fails #16130

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

1. Add a second Claude provider instance with its own homePath, e.g. ~/.claude_dev_home (exported as CLAUDE_CONFIG_DIR).
2. Let that config dir become signed out. Here the OAuth session was lost on its own; CLAUDE_CONFIG_DIR=~/.claude_dev_home claude auth logout gives the same state.
3. Confirm the CLI agrees it is signed out: CLAUDE_CONFIG_DIR=~/.claude_dev_home claude auth status reports "loggedIn": false, "authMethod": "none".
4. Wait for the next provider status refresh, then send messages in threads on that instance.

Expected behavior

The status check marks the instance unauthenticated. The picker and settings show it as signed out with the claude auth login hint before anyone sends a message.

Actual behavior

The instance stays status: "ready", auth.status: "authenticated" (from the cached provider status, refreshed every few minutes while the CLI says signed out). Every turn on it fails with:

Claude could not authenticate. For subscription login, run claude auth login on this environment's machine … with CLAUDE_CONFIG_DIR set to "…/.claude_dev_home", then start a new thread.

Nothing in the UI flags the instance, so it looks healthy and gets retried. Over about 15 minutes, every turn in three threads failed this way before the cause was found.

Cause

probeClaudeCapabilities reads init.account from the SDK initialization result. A signed-out first-party CLI still finishes initialization and returns:

{ "tokenSource": "none", "apiProvider": "firstParty" }

(no email, no subscriptionType). checkClaudeProviderStatus only treats a missing capabilities object as unverified (L570). Any other result falls through to status: "authenticated" (L620), whatever tokenSource says.

A possible fix: when apiProvider is firstParty (or absent) and tokenSource is none, with no API key in effect, return auth: { status: "unauthenticated" } and the sign-in hint instead of ready. Bedrock leaves the Anthropic token fields empty because it authenticates with AWS credentials, so the check should stay limited to first-party.

#7878 fixed how the failed turn is shown. This report is about the status check that should prevent those turns.

Impact

Major degradation or frequent failure

Version or commit

T3 Code (Alpha) desktop 0.0.45; code above checked against main @ 31f9d83

Environment

macOS 26.6.2, Claude Code 2.1.289, two claudeAgent instances (default home and a homePath instance)

Workaround

Run CLAUDE_CONFIG_DIR=<homePath> claude auth login, then start a new thread.