[BUG] macOS: "Keychain is not writable" reported while security add-generic-password succeeds; login never persists (v2.1.276)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

After /login reports "Login successful", Claude Code should persist the OAuth
credential — to the macOS login Keychain as the generic password item
"Claude Code-credentials", or to ~/.claude/.credentials.json as the documented
fallback — and subsequent prompts should be authenticated.

With no stored credential present, claude should show the login method
selection screen rather than starting in API Usage Billing mode.

claude doctor should not report "macOS Keychain is not writable" when the
login Keychain is in fact writable.

What Should Happen?

After /login reports "Login successful", Claude Code should persist the OAuth
credential — to the macOS login Keychain as the generic password item
"Claude Code-credentials", or to ~/.claude/.credentials.json as the documented
fallback — and subsequent prompts should be authenticated.

With no stored credential present, claude should show the login method
selection screen rather than starting in API Usage Billing mode.

claude doctor should not report "macOS Keychain is not writable" when the
login Keychain is in fact writable.

Error Messages/Logs

Steps to Reproduce

1. Confirm no Claude credential exists:

security find-generic-password -a "$USER" -s "Claude Code-credentials"
→ "The specified item could not be found in the keychain."
ls -l ~/.claude/.credentials.json
→ "No such file or directory"

1. Confirm the login Keychain is writable:

security add-generic-password -a "$USER" -s "keychain-write-test" -w "test123"
→ succeeds, no error
security delete-generic-password -s "keychain-write-test"
→ "password has been deleted."

1. Run claude doctor

→ warns "macOS Keychain is not writable. Console login will fail to save
your API key." (contradicts step 2)
→ also reports: "Not signed in to claude.ai",
"claude.ai subscription auth not active",
"Sign-in is missing the user:profile scope",
"Organization not resolved"

1. Run claude — the banner reads "API Usage Billing" even though no

credential is stored and no login method was ever offered.

1. Run /login → "Login successful"

1. Re-run the two checks from step 1

→ neither the Keychain item nor the fallback file was created

1. Send any prompt

→ "Not logged in · Please run /login"

Also tried, with identical results:

• claude auth login. The OAuth URL requests scope org:create_api_key and

redirects to platform.claude.com — i.e. the Console flow — with no method
selection prompt, despite the account being a Pro subscription.

• security unlock-keychain ~/Library/Keychains/login.keychain-db — warning unchanged
• security set-keychain-password ~/Library/Keychains/login.keychain-db

(resynced to the account password) — warning unchanged

• Full uninstall and clean reinstall:

rm -rf ~/.local/share/claude ~/.claude ~/.claude.json ~/.local/bin/claude
curl -fsSL https://claude.ai/install.sh | bash
→ warning and all symptoms reproduce on the fresh install

Ruled out:

• No ANTHROPIC_ or CLAUDE_ environment variables

(env | grep -o -i -E "ANTHROPIC[A-Z_]|CLAUDE[A-Z_]" → empty, exit 1)

• No apiKeyHelper, no env block, no forceLoginMethod in ~/.claude/settings.json
• Only one installation (native at ~/.local/bin/claude, no npm global)
• No duplicate or hash-suffixed "Claude Code-credentials-<hash>" Keychain items

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.276 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

_No response_