Explicit ~/.claude Claude home path switches to a different keychain login (API key instead of subscription) #29674

What happened

In the desktop app, every Claude turn failed with "Credit balance is too low", then "Claude gave up after repeated API errors." Running claude in a terminal showed a Pro subscription login for the same user. The Claude provider's home path was set explicitly to ~/.claude, which is the default location.

Diagnosis

makeClaudeEnvironment (apps/server/src/provider/Drivers/ClaudeHome.ts, ~L38-45 on main) returns the inherited env only when homePath is empty. Any non-empty value sets CLAUDE_CONFIG_DIR, even when it resolves to the default ~/.claude.

Claude Code picks its macOS Keychain credential item based on whether CLAUDE_CONFIG_DIR is set, not on its value:

• unset: item Claude Code-credentials, authMethod claude.ai, subscriptionType pro
• CLAUDE_CONFIG_DIR=~/.claude: item Claude Code-<hash>, authMethod api_key, apiKeySource "/login managed key". This is a stale Console org login with no credits.

So an explicit ~/.claude silently swaps a subscription login for an old API-key login.

Ruled out: no ANTHROPIC_API_KEY in the launchd, login-shell, or Claude settings env; no apiKeyHelper or primaryApiKey in any Claude config.

Suggested fix: treat a homePath that resolves to $HOME/.claude as empty and do not set CLAUDE_CONFIG_DIR. This matches the normalization done for #12616. Separately, show the effective authMethod and apiKeySource in the provider status, so an API-key login is visible.

Steps to reproduce

1. macOS. Log in to Claude Code with a subscription (claude auth login). Have an older API-key/Console login stored under the config-dir-specific keychain item. This can happen from any earlier run with CLAUDE_CONFIG_DIR set.
2. Compare outside T3:
   • claude auth status gives authMethod claude.ai
   • CLAUDE_CONFIG_DIR=$HOME/.claude claude auth status gives authMethod api_key
3. In T3 Settings > Providers > Claude, set the home path to ~/.claude.
4. Start a Claude thread. Turns bill the API-key login ("Credit balance is too low").
5. Clear the home path and restart T3. Turns use the subscription.

Version

0.1.5 (stable), T3 Code desktop app with its desktop-managed local server. Code refs are from main as of 2026-11-02, where the behavior is unchanged. Triage CLI: 0.1.6.

Environment

macOS (Darwin 27.0.0, arm64), desktop app against its local server. Claude Code 2.1.316. Node v26.12.1.

Evidence

`claude auth status` with and without `CLAUDE_CONFIG_DIR=$HOME/.claude` shows different authMethod, keychain item and subscriptionType (see Diagnosis). T3 errors: "Credit balance is too low" / "Claude gave up after repeated API errors." Clearing the home path fixed it right away.

Related issues

• [Bug]: Claude instances with empty vs. "~/.claude" CLAUDE_CONFIG_DIR get different continuation group keys #12616: empty vs explicit ~/.claude homePath gives different continuation group keys. Same root mismatch, different symptom.
• [Bug]: Signed-out Claude instance shows as authenticated and ready, so every turn fails #16130: a Claude instance shows as authenticated while its turns fail.
• [Bug]: API-key Claude instances fail with "Credit balance is too low" on subscriber API credits since the t3-code entrypoint #29393: same "Credit balance is too low" error on intentional API-key instances. Different cause.
• [Bug]: Claude (Max OAuth) verifies OK but every generation 401s — only inside T3; CLI + Agent SDK both work standalone #3530: OAuth works in the CLI but fails in T3. Possibly related.

Fix applied or workaround

Clear the Claude home path (leave it empty) in Settings > Providers > Claude and restart T3.

Filed by

Claude Code (Opus 5.5, claude-opus-5-5) via t3 triage.