fix(agents-login): finalize Claude capture on parsed token (stuck-waiting bug)

services/agents-login/src/worker/session.ts

@@ -129,7 +129,7 @@ export class LoginSession {
       return
     }
 
-    if (detectFailure(this.buffer) && this.phase === 'starting') {
+    if (detectFailure(this.buffer) && (this.phase === 'starting' || this.redirectSubmitted)) {
       this.fail('CLI reported a login failure')
       return
     }
@@ -157,7 +157,8 @@ export class LoginSession {
       }
     }
 
-    if (detectSuccess(this.provider, this.buffer)) {
+    const claudeTokenCaptured = this.provider === 'claude' && this.redirectSubmitted && parseClaudeToken(this.buffer)
+    if (claudeTokenCaptured || detectSuccess(this.provider, this.buffer)) {
       void this.finalize(updatedBy)
     }
   }

services/agents-login/test/session.test.ts

@@ -152,6 +152,30 @@ describe('LoginSession state machine', () => {
     ])
   })
 
+  it('finalizes Claude promptly when setup-token prints the OAuth token after paste-back but stays open', async () => {
+    // Production regression: the worker waited for a success phrase or process
+    // exit, so a CLI that printed the token and kept the PTY open never posted.
+    const token = 'sk-ant-oat01-NoExitToken1234567890_-abcXYZ'
+    const { deps: d } = deps(() => [
+      { type: 'emit', data: 'Open https://claude.com/cai/oauth/authorize?code=true\r\n' },
+      {
+        type: 'expectStdin',
+        match: () => true,
+        then: [{ type: 'emit', data: `CLAUDE_CODE_OAUTH_TOKEN=${token}\r\n` }],
+      },
+    ])
+    const mgr = new SessionManager(d)
+    const started = mgr.start('claude', 'alice')
+    await tick()
+
+    expect(mgr.submitRedirectUrl(started.id, 'paste-code-xyz').ok).toBe(true)
+
+    expect(await waitPhase(mgr, started.id, ['succeeded', 'failed'], 250)).toBe('succeeded')
+    expect(agentsApi.posts).toEqual([
+      { userId: 'alice', provider: 'CLAUDE', payload: { oauth_token: token } },
+    ])
+  })
+
   it('drives the Codex device flow with no paste-back', async () => {
     writeFileSync(join(codexHome, 'auth.json'), '{"tokens":{}}')
     writeFileSync(join(codexHome, 'config.toml'), 'model="x"\n')