Chrome bridge permanently rejects valid OAuth token with "Invalid token or user mismatch" (v2.1.92, macOS arm64)

Bug Description

Chrome MCP tools always fail with "Browser extension is not connected". Debug logs reveal the actual error: the WebSocket bridge at wss://bridge.claudeusercontent.com permanently rejects the connection with "Invalid token or user mismatch" (close code 1008).

This persists after exhaustive client-side troubleshooting over several hours.

Environment

• Claude Code: v2.1.92 (both native arm64 binary and npm-global tested)
• OS: macOS Darwin 25.4.0, Apple M4
• Chrome: latest
• Chrome Extension: Claude v1.0.66 (fcoeoabgfenejglbffodgkkbkcdhcgfn)
• Auth: claude.ai (firstParty), Max plan, same account (partylogo@gmail.com) on both CLI and Chrome extension
• OAuth token: Confirmed present in macOS Keychain with correct scopes including user:sessions:claude_code

Debug Log (key lines)

[Claude in Chrome] Fetching OAuth token for bridge connection
[Claude in Chrome] Connecting to bridge: wss://bridge.claudeusercontent.com/chrome/30c28730-bbdb-4107-bd94-a9f0779e957c
[Claude in Chrome] WebSocket connected, sending connect message
[Claude in Chrome] Bridge received: {"type":"error","error":"Invalid token or user mismatch"}
[Claude in Chrome] Bridge error: Invalid token or user mismatch
[Claude in Chrome] Bridge connection closed (code: 1008, duration: 0ms)

The WebSocket handshake succeeds (status 101) but the application-level auth is immediately rejected. This loops indefinitely with reconnect attempts.

What was verified

| Check | Result |
|-------|--------|
| Accounts match (CLI + Chrome extension) | ✅ Same email |
| OAuth token in Keychain | ✅ Present with correct scopes |
| Token not expired | ✅ Valid for 8+ hours |
| Native messaging (ping/pong) | ✅ Works |
| Extension installed & enabled | ✅ v1.0.66 |
| Socket exists & process running | ✅ |
| claude auth logout + claude auth login | ❌ Still rejected |
| Chrome extension logout + re-login | ❌ Still rejected |
| Clear claude.ai cookies + full re-auth both sides | ❌ Still rejected |
| Remove & reinstall Chrome extension | ❌ Still rejected |
| Remove Claude.app native host conflict | ❌ Still rejected |
| CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 workaround | ❌ Previously worked, now fails |
| Native binary (arm64) instead of npm-global | ❌ Same error |
| installMethod corrected from native to npm-global | ❌ Same error |

Additional observation

Google Calendar and Plaid MCP servers also report "MCP server requires authentication but no OAuth token is configured", suggesting the OAuth token may not be reaching the bridge connection layer despite being present in Keychain.

Related issues

• #27055 — Same bridge error, server-side stale state suspected (closed)
• #32011 — Two distinct root causes behind same error message
• #25736 — Same bridge error on macOS
• #41879 — Socket works but MCP client can't connect

Expected behavior

Bridge should accept valid OAuth token and establish Chrome extension connection.

Actual behavior

Bridge permanently rejects with "Invalid token or user mismatch" regardless of any client-side action.