fix(anthropic): repair Claude subscription login (moved OAuth endpoints + Cloudflare UA)

[ericleepi314]

Summary

The interactive clawcodex login → anthropic → subscription flow failed for a real user at the token-exchange step:

Claude subscription login failed: Claude OAuth request failed (403): error code: 1010

error code: 1010 is a Cloudflare bot block, not an OAuth error — the request never reached Anthropic. The Claude subscription OAuth (added in #697, ported from opencode) was only ever exercised via an imported token; the actual login endpoints were never hit until now. Live diagnosis found two root causes:

1. Stale token endpoint

The login flow migrated off console.anthropic.com to platform.claude.com (authoritative: the in-repo upstream typescript/src/constants/oauth.ts PROD_OAUTH_CONFIG). The old console.anthropic.com/v1/oauth/token now 404s behind Cloudflare. Updated:

• TOKEN_URL → https://platform.claude.com/v1/oauth/token
• REDIRECT_URI → https://platform.claude.com/oauth/code/callback (the manual copy/paste redirect)
• SCOPES → the full ALL_OAUTH_SCOPES the real CLI requests (adds user:sessions:claude_code, user:mcp_servers, user:file_upload)
• AUTHORIZE_URL → https://claude.com/cai/oauth/authorize — the subscriber entrypoint. A default claude login sets loginWithClaudeAi = !useConsole = true (cli/handlers/auth.ts:133-135); it 307-redirects to claude.ai/oauth/authorize, the consent page a Pro/Max user signs in against. (platform.claude.com/oauth/authorize is the --console/API-account path, which a pure subscriber may not complete.)

2. Missing User-Agent → Cloudflare 1010

urllib defaults to Python-urllib/x.y, whose signature Cloudflare bot-blocks with error code: 1010. The real CLI reaches the endpoint via axios (which sends its own UA); any genuine UA passes. _post_json now sends the same claude-cli User-Agent the inference path uses (and subscription_headers points at the shared constant).

CLIENT_ID is unchanged (it already matched upstream).

Validation

Verified live against the real endpoints (I can't drive the browser consent step autonomously, but every reachable hop is confirmed):

• bare urllib → 403 error code: 1010 (reproduces the user's failure)
• after the fix, complete_login() reaches OAuth: a fake code returns {"error":"invalid_grant","error_description":"Invalid 'code' in request."} — the correct rejection, proving the request now gets through
• authorize URL claude.com/cai/oauth/authorize → 307 → claude.ai/oauth/authorize (the exact consent page the user's original attempt already authorized against — it only died at the dead token host)
• token endpoint returns invalid_grant, not redirect_uri_mismatch, confirming the authorize/redirect/token triple is a consistent registered combo

Regression tests pin the platform.claude.com token endpoint, the subscriber authorize base, and the load-bearing User-Agent. Full suite: 8486 passed, 3 skipped. Critic-reviewed: APPROVE (verified the authorize-URL correction and the refresh-scope / UA / redirect-consistency questions).

Note

src/auth/oauth.py's separate OAuthFlow (API-key creation, unrelated to subscription login) still references the old console.anthropic.com hosts — flagged for a separate follow-up, not in scope here.

🤖 Generated with Claude Code