[BUG] Windows 11 - claude.exe hangs indefinitely due to CRYPT_E_NO_REVOCATION_CHECK schannel TLS error

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Code VS Code extension spins indefinitely and never responds. The CLI (claude.exe --print "hello") also hangs with no output.

What Should Happen?

claude.exe should response to simple commands and not hang.

Error Messages/Logs

Windows schannel fails with CRYPT_E_NO_REVOCATION_CHECK (0x80092012) when attempting TLS connection to api.anthropic.com. The server performs a double TLS renegotiation during handshake which appears to trigger the failure.
curl.exe -v https://api.anthropic.com returns:
schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012)

Steps to Reproduce

Execute a this command:
claude.exe "say hello"

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

2.1.100 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

curl.exe --ssl-no-revoke https://api.anthropic.com returns a proper 401 response, confirming the connection works when revocation checking is bypassed.
Debug output shows claude.exe makes calls to /api/event_logging/v2/batch and /api/claude_code/settings then hangs and exits with code 1.
Things that did NOT fix it:

Clearing certutil URL cache (certutil -urlcache * delete)
Disabling "Check for server certificate revocation" in Internet Options
Setting HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CertificateRevocationCheck to 0
Setting NODE_TLS_REJECT_UNAUTHORIZED=0
Setting git config --global http.schannelCheckRevoke false
Clean reinstall of Claude Code extension
Rebooting

Workaround needed:
claude.exe needs a way to bypass schannel revocation checking, similar to curl's --ssl-no-revoke flag. Possibly via NODE_OPTIONS or an app-level setting.