[Desktop/Windows] SSH remote sessions unusable on TOTP 2FA hosts: each connect opens 3-6 separate SSH logins needing fresh one-time codes

Environment: Claude desktop app (Code tab), Windows 11, SSH remote session to an HPC login node that requires keyboard-interactive password + TOTP (Duo/Google Authenticator style, codes rotate every 30s and cannot be reused).

What happens:

1. Sign-in succeeds (password + TOTP) — log: master ready for <host> (prompts shown: 2).
2. Immediately after, the app opens another SSH process for the SFTP binary deployment. On Windows there is no ControlMaster multiplexing, so the server demands full auth again.
3. The app replays the remembered password but prompts for the TOTP again ~3–5 s later. The authenticator still shows the same code, the server rejects a reused code, and the prompt loops.
4. Result: SFTP session open failed: SFTP subsystem exited before the handshake completed → Connection failed: Couldn't open an SFTP session → auto-reconnect starts the cycle again. Users see repeated sign-in popups ("~10 errors") and the session can't connect. This has been happening for about a month.

Log excerpt (%LOCALAPPDATA%\Claude\logs\ssh.log, host redacted):

15:23:41 prompt answered: kind=keyboard-interactive
15:23:43 master ready for <user>@<host> (prompts shown: 2)
15:23:43 keyboard-interactive prompt from another process of this connection answered from memory
15:23:43 prompt: kind=keyboard-interactive length=51        <- TOTP asked again
15:23:46 prompt answered: kind=keyboard-interactive       <- same 30s window, code reused
15:23:49 prompt: kind=keyboard-interactive length=43        <- auth restarted
15:23:58 a channel process's authentication prompt was abandoned; ending that channel
15:23:58 SFTP session open failed: SFTP subsystem exited before the handshake completed
15:23:58 Connection failed (26121ms, trigger: start_session, attempt 1): Couldn't open an SFTP session

Additional findings (same day):

• After the auto-update of the SSH component (89cb… → 5fd0…), the app stopped the old remote server. Redeploying the new one needed more than 5 separate SSH connections, and each one needed its own TOTP. The new server started (Remote server started), then the bridge connection's prompt failed, and the server received SIGTERM in the same second. From then on, every connect has to "start fresh", which needs even more prompts.
• The log shows not remembering the password — this sign-in took more than the one password, so "Remember password" has no effect on 2FA hosts.
• Retries can trigger the host's lockout for repeated failures. After that, even correct credentials in a plain terminal get Permission denied.
• Windows OpenSSH has no ControlMaster. Git-for-Windows ssh ControlMaster fails for sessions (mm_send_fd: sendmsg ... send fds failed). There is no client-side workaround.

Expected: After one successful interactive sign-in, all channels (SFTP, exec, server) share that authenticated connection, as ControlMaster does on macOS/Linux. Failing that, the app should warn that a new one-time code is needed and wait for it to rotate.