v0.5.2

Fix: Claude 401 on auto runs ("OAuth access token is invalid")

Root cause. orch login read the token from the claude setup-token screen by stripping ANSI codes from the terminal stream. Claude Code's renderer is differential: it moves the cursor and skips cells that did not change. As a result, the saved token could silently lose characters, and every run then failed with a 401. v0.5.1 also cleared the server's "login invalid" flag on any report that said a token was present, which caused a loop of re-offers and new failures.

What changed

• orch login
  • Reads the token from a real terminal emulation of the setup screen.
  • Checks its shape (sk-ant-oat…, length) before saving.
  • If it cannot read the token reliably, asks you to paste it (hidden input). Wrapped pastes are handled.
  • Then verifies the token with a real one-turn Claude call and prints ✓ Claude login verified or ✗ Claude rejected this token (401). Run orch login again.
• orch doctor (new): shows the Claude binary and version, whether the token is present and well-formed, and runs the same real check.
• Automatic re-check: the agent re-checks the token whenever the token file changes. It stores a hash, never the token. The result goes to the server as the new claude.auth message.
• Server: only a successful real check, or a successful run, clears the "Claude login invalid" flag. A flagged agent gets no automatic offers. My Server, Pool and the getting-started checklist show when the login was last verified and why it failed.
• Task sandbox: ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL and the provider switches are blanked, so a repository image or containerEnv cannot override your Claude token.
• CI: the agent image is smoke-tested ($ORCH_CLAUDE_BIN --version).

Upgrade

Update the server first, then each agent with orch update. Then run orch login again (the stored token may be corrupt) and orch doctor.
Agents still on v0.5.1 that are flagged stay flagged until they update and pass the check.