[BUG] OAuth login fails with "Unknown scope: user:sessions" in headless/container terminals (not a copy/paste issue) — related to #26874, #57246

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [ ] - [x] This is a single bug report (please file separate reports for different bugs)
• [ ] - [x] I am using the latest version of Claude Code

What's Wrong?

OAuth subscription login (/login -> "Claude account with subscription (Pro/Max/Team/Enterprise)") fails with "Invalid OAuth Request - Unknown scope: user:sessions".

This is the same failure mode reported in #26874 (closed/locked, reproduced on v2.1.45/2.1.47 with a trailing %) and #57246 (SSH session, trailing :claude_). Filing a new issue because #26874 is locked and I have additional evidence that rules out copy/paste corruption as the cause.

Environment: Claude Code CLI v2.1.215, running in a Home Assistant add-on terminal (headless, containerized, no browser) - originally reported against the add-on itself at robsonfelix/robsonfelix-hass-addons#36, but this looks like a Claude Code CLI bug, not an add-on bug.

To rule out URL-wrapping/copy-paste corruption (see #20), I widened the terminal so the URL still wrapped across two lines, then manually transcribed both halves character-by-character (with overlapping re-reads to confirm no characters were dropped or altered) and opened the reconstructed URL directly, rather than using the terminal's text selection/copy. Got the exact same error. This points to the scope string already being malformed at the point Claude Code generates the authorize URL, not at the copy/paste stage.

The authorize request used client_id=9d1c250a-e61b-44d9-88ed-5944d1962f5e and scope=org:create_api_key user:profile user:inference user:sessions user:claude_code user:mcp_servers user:file_upload. Note that user:sessions is immediately followed by a space and the next scope - which lines up with the trailing corrupted characters reported in #26874 (%) and #57246 (:claude_), suggesting a shared root cause in how the scope list is joined/encoded.

Common thread across all three reports (bare headless server, SSH session, containerized add-on): non-interactive/remote terminal environments where Claude Code has to build the OAuth authorize URL itself without a local browser to hand off to.

Only known workaround is API key authentication instead of subscription OAuth login.

What should happen?

OAuth authorization should complete successfully in headless/container/SSH terminals, the same as it does with a local browser.

Error Messages/Logs

Invalid OAuth Request
Unknown scope: user:sessions

Steps to Reproduce

1. Open a terminal in a headless/containerized environment (e.g. Home Assistant add-on terminal, or SSH - see #57246)
2. 2. Run claude
3. 3. /login then select "Claude account with subscription (Pro/Max/Team/Enterprise)"
4. 4. Get redirected to an authorize URL, approve it
5. 5. Also tried claude auth login (reads the pasted code from stdin instead of requiring a manual URL copy/paste) - same result

Claude Model

None

Is this a regression?

Unknown - not tested on an earlier Claude Code version in this specific environment. (Reported as a regression in the related #26874, which affected v2.1.45/2.1.47.)

Last Working Version

_No response_

Claude Code Version

2.1.215

Platform

Anthropic API

Operating System

Unknown/unconfirmed - Linux container (Home Assistant OS add-on), not macOS. Exact distro not confirmed.

Terminal/Shell

Home Assistant add-on web terminal (not a traditional desktop terminal app)

Additional Information

Related: robsonfelix/robsonfelix-hass-addons#36 (where this was originally reported against the add-on itself), #26874 (locked), #57246. Platform/OS/Terminal fields above corrected from GitHub form defaults (which incorrectly pre-filled macOS/Terminal.app) - filing from a Home Assistant add-on terminal (Linux container), exact underlying OS distro not confirmed.