[BUG] Remote Control: POST /bridge returns 401 with fresh full-scope token while createCodeSession and archive succeed (v2.1.212)

Summary

Remote Control fails on v2.1.212 with a 401 from one specific endpoint. After a fresh full-scope /login, the bridge init sequence does:

1. createCodeSession → succeeds (session cse_01UiCc2ueZHiKWiBdPBgZwFR created)
2. POST /bridge (fetchRemoteCredentials) → 401 "Authentication failed", all 3 retries
3. Archive of that same session → status 200

The same OAuth token — minted ~3 minutes earlier, full scopes including user:sessions:claude_code — is accepted by the session-create and archive endpoints and rejected only by /bridge, seconds apart. This looks like a server-side per-endpoint auth rejection rather than a stale client token.

Environment

• Claude Code v2.1.212 (npm-global), macOS Darwin 24.6.0, zsh
• Auth: claude.ai OAuth (/login, not setup-token), subscription max, personal org (stripe_subscription) — no Team/Enterprise policy in play
• No ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN in the environment
• settings.json: "remoteControlAtStartup": true
• Network fine: claude.ai and api.anthropic.com reachable (<150 ms)

Debug log (sanitized)

Before re-login, both the startup attempt (remoteControlAtStartup) and manual /remote-control failed one step earlier — at session create:

18:02:13.378 [DEBUG] [code-session] Session create failed 401: Authentication failed
18:02:13.378 [DEBUG] [remote-bridge] createCodeSession failed (attempt 1/3), retrying in 500ms
18:02:13.952 [DEBUG] [code-session] Session create failed 401: Authentication failed
18:02:15.120 [DEBUG] [code-session] Session create failed 401: Authentication failed
18:02:15.120 [DEBUG] [bridge:repl] handleStateChange state=failed detail="Session creation failed — see debug log"

Then ran /login (successful), and /remote-control again ~3 minutes later:

18:05:50.559 [DEBUG] [bridge] Prerequisites passed, enabling bridge
18:05:50.807 [DEBUG] [remote-bridge] Created session cse_01UiCc2ueZHiKWiBdPBgZwFR
18:05:50.870 [DEBUG] [code-session] /bridge failed 401: Authentication failed
18:05:50.870 [DEBUG] [remote-bridge] fetchRemoteCredentials failed (attempt 1/3), retrying in 482ms
18:05:51.435 [DEBUG] [code-session] /bridge failed 401: Authentication failed
18:05:52.785 [DEBUG] [code-session] /bridge failed 401: Authentication failed
18:05:52.786 [DEBUG] [remote-bridge] Creds failed; onStateChange set, msg="Remote credentials fetch failed — see debug log"
18:05:52.959 [DEBUG] [code-session] Archive session_01UiCc2ueZHiKWiBdPBgZwFR status=200

(Timestamps UTC, 2026-07-17.)

Token state at time of the /bridge 401

Verified from the stored credential (values redacted):

• scopes: user:file_upload, user:inference, user:mcp_servers, user:profile, user:sessions:claude_code
• minted: 18:05:34 (about 16 s before the failing call), expiry ~4 h out
• subscriptionType: max

Why this isn't the known race

• #78598 attributes the 401 to remoteControlAtStartup racing a token refresh at cold start — here the failing attempt was a manual /remote-control with a token minted 3 minutes earlier by an explicit /login, and no refresh was in flight.
• #78597 reports the in-session path failing while standalone claude remote-control works, hypothesizing a stale in-memory token — here the in-memory token was just replaced by /login and was accepted by createCodeSession in the same sequence; only /bridge rejected it.

Related: #78597, #78598

Expected

POST /bridge accepts the same valid full-scope token that createCodeSession and archive accept, and Remote Control connects.