Headless shells need 0600 token files
Remote terminal sessions can't open the Mac's password vault, so they need separate locked-down token files.
how it works
Keychain is unreadable from ssh security sessions; seed 0600 files at the console with hidden prompts; Claude Code's OAuth token lives in its own Keychain item that /login doesn't update.
Technique: A pattern or hard-won lesson, written down so it isn't learned twice.
The code for this one lives in a private repo. This page explains the idea so you can build your own.