[BUG] Remote Control: resumed sessions created before enabling Trusted Devices fail with permanent HTTP 403; /remote-control retries the dead session instead of starting a new one

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet (related but different: #100170, #100362)
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

After turning on Require trusted devices (Max plan), every CLI conversation whose Remote Control session was created before the toggle fails with a permanent HTTP 403 when it is resumed, even after this machine has been enrolled as a trusted device. /remote-control keeps retrying the same dead remote session, so it never recovers:

Remote Control disconnected — Remote Control server rejected the request (HTTP 403) — run /remote-control to retry

New sessions on the same machine, account and network connect normally. A --fork-session of the same conversation also connects normally.

The docs say pre-existing sessions "continue without the device requirement until they end" (Trusted Devices > Enable). They don't say that such a session can never be brought back after its process ends. The CLI also doesn't tell you this: there is no "Previous session is unavailable — run /remote-control to start a new one" and no trusted-device message, only a generic 403 plus a retry hint that cannot work.

What Should Happen?

When a resumed conversation points to a remote session that the Trusted Devices policy rejects, one of these:

1. Claude Code detects it and creates a new Remote Control session for the conversation, as the "Previous session is unavailable" path does, or
2. Claude Code shows a specific message, for example "this Remote Control session was created before Trusted Devices was enabled and can't be resumed — run /remote-control to start a new one", and /remote-control then actually starts a new session instead of retrying the rejected one.

The docs (Resume sessions / Troubleshooting) should also mention this case.

Timeline (local time, UTC+8, 2026-10-08)

| Time | Event |
|---|---|
| 10-03 → 10-08 09:00 | Same conversations (auto-connect via remoteControlAtStartup: true) resumed across 5 reboots and reattached to the same cse_… remote session each time, with no errors |
| afternoon | Turned on Require trusted devices in Claude Desktop → Settings → Account |
| 19:01 | Reboot |
| 19:12:58 | 6 conversations resumed with claude --resume <id> (each in its own terminal) |
| 19:13:10–20 | All 7 pre-existing conversations (the 6 above plus one more) get HTTP 403. A manual /remote-control retry also gets 403 |
| 19:46 | First new session prints This computer was enrolled as a trusted device for your account and connects fine. All later new sessions connect fine |
| 22:26–22:28 | claude --resume <id> --fork-session for each broken conversation: each gets a new remote session and connects |
| 22:30 | Control test: plain claude --resume <id> of one original conversation on the now-enrolled machine still gets HTTP 403 (two entries, at 22:30:53 and 22:31:14: auto-connect and a manual /remote-control) |

So enrollment of the machine is not the issue. A remote session created before the toggle can never be reattached, and the client gives no way out except discovering --fork-session.

Steps to Reproduce

1. With remoteControlAtStartup: true, start claude and confirm Remote Control is connected. Note the session ID.
2. Turn on Require trusted devices (Desktop → Settings → Account, or claude.ai/settings/account).
3. Exit the CLI (or reboot).
4. Start any new claude session once, so this machine enrolls (This computer was enrolled as a trusted device…). It connects.
5. claude --resume <id from step 1> → Remote Control server rejected the request (HTTP 403).
6. /remote-control → same 403, every time.
7. claude --resume <id> --fork-session → connects with a new remote session (workaround).

Claude Desktop shows the old conversations in the Code sidebar flashing with "Remote Control 已中斷連線 / Remote Control disconnected" while the local CLI processes are still running.

Workaround

claude --resume <id> --fork-session (keeps the conversation and gets a new remote session).

Environment

• Claude Code CLI 2.1.294 (native install), Windows 11 Home 10.0.26300, PowerShell, running inside a terminal multiplexer
• Claude Desktop 2.26454.2 (MSIX), same machine
• Max plan, personal organization, OAuth login (no API key, no ANTHROPIC_BASE_URL, no telemetry env vars)
• Remote Control auto-connect via remoteControlAtStartup: true in ~/.claude/settings.json

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vc8JrfSc8rC3Mnoi9fjU44