Claude in Chrome: Bridge WebSocket rejects valid OAuth token with "Invalid token or user mismatch"

Environment

• Claude Code: 2.1.63
• OS: macOS Darwin 25.3.0 (Apple Silicon)
• Chrome: 145.0.7632.117
• Chrome Extension: Claude v1.0.56
• Subscription: Max (default_claude_max_5x)

Problem

claude --chrome cannot connect to Chrome. The CLI uses the WebSocket bridge (wss://bridge.claudeusercontent.com) but the bridge repeatedly rejects the connection with:

{"type":"error","error":"Invalid token or user mismatch"}

The connection is attempted, WebSocket opens successfully, but is immediately closed with code 1008 after the connect message is sent.

Debug log (from ~/.claude/debug/)

[INFO] Bridge URL: wss://bridge.claudeusercontent.com
[INFO] Connecting to bridge: wss://bridge.claudeusercontent.com/chrome/<account-uuid>
[INFO] WebSocket connected, sending connect message
[DEBUG] Bridge received: {"type":"error","error":"Invalid token or user mismatch"}
[WARN] Bridge error: Invalid token or user mismatch
[INFO] Bridge connection closed (code: 1008, duration: 0ms)
[INFO] Bridge reconnecting in 30000ms (attempt 8)

This repeats indefinitely across all retry attempts.

What I've tried (none resolved the issue)

• Re-login via claude /login (fresh OAuth token generated, verified not expired)
• Re-login on claude.ai in Chrome (same account, same email)
• Restarting Chrome completely
• Restarting Claude Code (claude --chrome) in a new terminal
• Killing and respawning the Chrome native host process
• Verified same account email on both CLI and Chrome
• Verified OAuth token in macOS keychain is valid, has correct scopes (user:inference, user:mcp_servers, user:profile, user:sessions:claude_code), and is not expired
• Verified Chrome extension has nativeMessaging permission granted
• Verified the native host process spawns correctly and its Unix socket accepts connections

Analysis

• The tengu_copper_bridge feature flag routes the CLI through the WebSocket bridge instead of local Unix sockets
• The native host + local Unix socket work correctly when tested manually (socket connects, length-prefixed protocol works, native host responds)
• The OAuth token is valid (verified not expired, correct scopes, stored in keychain)
• The bridge server consistently rejects the token on every connection attempt
• The CLI never falls back to the local socket path when the bridge fails
• The Claude Desktop native messaging host config was previously renamed to .bak to avoid conflicts — this is unrelated to the bridge issue