VS Code extension: email-code login (submit_oauth_code) fails with 400

Description

The official VS Code extension's email-code login flow ("Log in with Claude.ai" → code sent by email → paste code) consistently fails with a 400 error when submitting the code, across multiple separate attempts on the same day.

Environment

• Extension: anthropic.claude-code v2.1.220
• VS Code: 1.131.0
• OS: macOS (Darwin 21.6.0)
• Login method used: claudeai (email verification code, not browser OAuth redirect)

Steps to reproduce

1. Open the Claude Code sidebar in VS Code, click Login
2. Choose the "Log in with Claude.ai" flow
3. Receive the verification code by email
4. Enter the code in the extension's login box
5. Submission fails with Request failed with status code 400

This happened 3 separate times in about 40 minutes (different VS Code window/session each time), each with a freshly issued email code — ruling out an expired/reused code.

Relevant logs

2026-07-31 09:21:26.522 [info] Received message from webview: {"type":"request","requestId":"mnfjkplq9w","request":{"type":"login","method":"claudeai"}}
2026-07-31 09:22:27.041 [info] Received message from webview: {"type":"request","requestId":"gge6gzplwad","request":{"type":"submit_oauth_code","code":"897254"}}
2026-07-31 09:22:27.440 [info] From claude: 2026-07-31T07:22:27.440Z [INFO] claude_authenticate flow ended: AxiosError: Request failed with status code 400
2026-07-31 09:22:27.441 [error] Error processing client request: Error: Request failed with status code 400
2026-07-31 09:22:27.441 [warning] claude_oauth_callback rejected: Error: Request failed with status code 400

2026-07-31 09:58:50.408 [info] Received message from webview: {"type":"request","requestId":"8jkq34pkay2","request":{"type":"login","method":"claudeai"}}
2026-07-31 10:00:58.000 [info] Received message from webview: {"type":"request","requestId":"1niwxau7r5d","request":{"type":"submit_oauth_code","code":"304315"}}
2026-07-31 10:00:58.283 [info] From claude: 2026-07-31T08:00:58.283Z [INFO] claude_authenticate flow ended: AxiosError: Request failed with status code 400
2026-07-31 10:00:58.284 [error] Error processing client request: Error: Request failed with status code 400
2026-07-31 10:00:58.284 [warning] claude_oauth_callback rejected: Error: Request failed with status code 400

2026-07-31 10:05:07.130 [info] Received message from webview: {"type":"request","requestId":"72k9wun9bia","request":{"type":"login","method":"claudeai"}}
2026-07-31 10:05:43.524 [info] Received message from webview: {"type":"request","requestId":"r3ee1si8lv","request":{"type":"submit_oauth_code","code":"086352"}}
2026-07-31 10:05:43.799 [info] From claude: 2026-07-31T08:05:43.799Z [INFO] claude_authenticate flow ended: AxiosError: Request failed with status code 400
2026-07-31 10:05:43.801 [warning] claude_oauth_callback rejected: Error: Request failed with status code 400
2026-07-31 10:05:43.801 [error] Error processing client request: Error: Request failed with status code 400

Additional context

• System clock is accurate (checked via sntp, offset ~46ms), so this isn't a time-skew/PKCE-expiry issue.
• The account previously had another Claude account registered under a different email, which was deleted. Not confirmed as the cause, but flagging in case the login/verification-code endpoint has any leftover association with that deleted account.
• Logging in instead via the integrated terminal (claude CLI, browser-based OAuth) worked without issue on the same machine/account, so this appears specific to the extension's email-code (claudeai) login path, not the account itself.
• This is a distinct symptom from #61923 (which covers the silent daily refresh-token 400 from concurrent windows) — this failure happens on the initial manual code submission, not a background refresh.

Expected behavior

Submitting a freshly received, unexpired verification code should successfully complete login via the extension sidebar.