[Bug] OAuth token exchange fails on CGNAT/IPv6 carrier networks

Bug Description
Title: OAuth login fails on CGNAT/IPv6 mobile-carrier networks (CLI + Desktop), works on other networks Environment: - Claude Code CLI 2.1.217 (installed via nvm, Node v22.20.0) - Claude Desktop for Linux (beta) - Debian/Ubuntu-based Linux, MATE Terminal, X11 What's wrong: OAuth login fails on a Telenor (Norway) mobile hotspot across every method: - CLI browser-open flow: "OAuth error: Socket is closed" - CLI manual code paste: "OAuth error: Invalid code" - Desktop app: "Couldn't connect to Claude - Unknown error" The same account/machine logs in fine on a different (non-carrier) network. Key diagnostics: - curl over plain TCP to https://api.anthropic.com/v1/models returns 401, so basic TCP reachability to the API exists. - Manual-code-paste failing rules out the loopback callback / port forwarding as the cause — the token exchange itself fails. - Forcing TCP by REJECTing outbound UDP 443 (iptables + ip6tables) did NOT fix it on the failing network, so it's not purely QUIC fallback. - Telenor mobile is CGNAT and likely IPv6-only (NAT64/464XLAT). Hypothesis: The OAuth token-exchange transport is fragile on carrier CGNAT / IPv6-only paths in a way that ordinary TCP HTTPS (curl) is not. Multiple clients (Bun-based CLI, Electron desktop) affected identically → shared transport layer, not the login UI.

Environment Info

• Platform: linux
• Terminal: vte-based
• Version: 2.1.217
• Feedback ID: 4c56532d-403a-4283-b875-f124c93bc782

Errors

[]