squad-kit 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.1] — 2026-08-24
+
+### Bug fixes
+
+- `squad auth login` ended a **successful** browser login with
+  `could not verify the login (unknown)` and a warning that the credential "may
+  be invalid or expired". The token was fine. `accountInfo()` resolves from the
+  Agent SDK's `initialize` response, and for `CLAUDE_CODE_OAUTH_TOKEN` auth that
+  response carries `{tokenSource, apiProvider}` and **never** an account — for a
+  valid token exactly as much as for a bogus one. 0.12.0 treated a missing
+  account as a failed credential, which flagged every healthy login through the
+  primary documented flow.
+
+  The probe now separates three outcomes instead of two: an account came back
+  (verified, shown); a credential *source* came back without an account
+  (reported as resolved, with the honest caveat that token validity can only be
+  confirmed by an actual planning run); or nothing came back at all (still
+  treated as unverified). `squad auth login`'s summary and `squad doctor`'s
+  planner credential row both reflect which applies, and neither claims a
+  verification the SDK cannot perform.
+
+  Workspaces that authenticate through the OS credential store are unaffected —
+  those do report an account and are still verified as before.
+
 ## [0.12.0] — 2026-08-24
 
 ### What's new

package/dist/cli.js

@@ -1456,9 +1456,13 @@ function readAccount(raw) {
   if (typeof o.organization === "string") account.organization = o.organization;
   if (typeof o.subscriptionType === "string") account.subscriptionType = o.subscriptionType;
   const apiKeySource = typeof o.apiKeySource === "string" ? o.apiKeySource : void 0;
+  const tokenSource = typeof o.tokenSource === "string" ? o.tokenSource : void 0;
+  const apiProvider = typeof o.apiProvider === "string" ? o.apiProvider : void 0;
   return {
     account: Object.keys(account).length > 0 ? account : void 0,
-    apiKeySource
+    apiKeySource,
+    tokenSource,
+    apiProvider
   };
 }
 var EXPIRED_HINT = /expire|refresh|revoked|no longer valid/i;
@@ -1535,15 +1539,23 @@ async function probeClaudeAuth(auth2, opts = {}) {
         detail: `The Claude auth check did not answer within ${timeoutMs}ms.`
       };
     }
-    const { account, apiKeySource } = readAccount(info2);
-    if (auth2.mode === "subscription" && !account && !apiKeySource) {
+    const { account, apiKeySource, tokenSource, apiProvider } = readAccount(info2);
+    const base = { ...apiKeySource ? { apiKeySource } : {}, ...account ? { account } : {} };
+    if (auth2.mode !== "subscription") return { ok: true, ...base };
+    if (account) return { ok: true, ...base };
+    if (tokenSource || apiProvider) {
       return {
-        ok: false,
-        kind: "unknown",
-        detail: "The Claude login did not report an account, so it could not be verified. The credential may be invalid or expired \u2014 run `squad auth login` to sign in again."
+        ok: true,
+        ...base,
+        ...tokenSource ? { credentialSource: tokenSource } : {},
+        unverifiable: `The Agent SDK resolved ${tokenSource ?? "a credential"}, but token auth reports no account, so its validity can only be confirmed by an actual planning run.`
       };
     }
-    return { ok: true, ...apiKeySource ? { apiKeySource } : {}, ...account ? { account } : {} };
+    return {
+      ok: false,
+      kind: "unknown",
+      detail: "The Claude login reported neither an account nor a credential source, so it could not be verified. Run `squad auth login` to sign in again."
+    };
   } catch (err2) {
     return mapProbeFailure(err2, auth2);
   } finally {
@@ -1894,6 +1906,12 @@ async function verifyAndSummarise(planner) {
     warning(probe.detail);
     return;
   }
+  if (probe.unverifiable) {
+    spin.succeed("login stored");
+    if (probe.credentialSource) kv("credential", probe.credentialSource, 15);
+    info(probe.unverifiable);
+    return;
+  }
   spin.succeed("login verified");
   const account = [probe.account?.email, probe.account?.organization, probe.account?.subscriptionType].filter(Boolean).join(" \xB7 ");
   if (account) kv("account", account, 15);
@@ -9064,7 +9082,13 @@ function describeProbeAccount(probe) {
   const bits = [];
   const email = probe.account?.email;
   const plan = probe.account?.subscriptionType;
-  bits.push(email ? `signed in as ${email}${plan ? ` (${plan})` : ""}` : "Claude login verified");
+  if (email) {
+    bits.push(`signed in as ${email}${plan ? ` (${plan})` : ""}`);
+  } else if (probe.unverifiable) {
+    bits.push(`credential resolved (${probe.credentialSource ?? "token auth"}) \xB7 not verifiable without a run`);
+  } else {
+    bits.push("Claude login verified");
+  }
   if (probe.account?.organization) bits.push(probe.account.organization);
   if (probe.apiKeySource) bits.push(`apiKeySource=${probe.apiKeySource}`);
   return bits.join(" \xB7 ");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squad-kit",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "author": "Momen Yasser <momenysr@gmail.com>",
   "description": "Plan once, execute cheap. A token-efficient, 3-step SDD workflow CLI (stories → plans → implementation).",
   "keywords": [