Desktop app update wipes `claudeAiOauth` from .credentials.json, silently logging out Claude Code and killing Remote Control sessions (Windows)

Summary

After the Claude Desktop app updated on 2026-08-21, %USERPROFILE%\.claude\.credentials.json was rewritten with the claudeAiOauth block removed, leaving only mcpOAuth. Claude Code was silently logged out. Every claude invocation failed with Not logged in · Please run /login, and the Remote Control session running on the machine died — messages sent from the mobile/desktop client queued with no response and the session showed "Remote control connection lost".

No warning, no prompt, no re-auth flow. The user lost a working day before the cause was identified.

Environment

| | |
|---|---|
| OS | Windows 11 x64 |
| Claude Desktop | 1.34493.1 (Electron 42.9.2, Node 24.18.1) |
| Claude Code | @anthropic-ai/claude-code 2.1.233 (installed 2026-08-16, unchanged) |
| Node / npm | v25.8.2 / 11.11.1 |
| Install method | npm global (%APPDATA%\npm) |
| Plan | Max |

Timeline (local time, UTC+9)

| Time | Event |
|---|---|
| 11:58:48 | .claude\.credentials.json rewritten — claudeAiOauth block gone |
| 11:59:22 | Last write to the active Remote Control session transcript; host process dies |
| 12:20:50 | %LOCALAPPDATA%\Claude directory mtime (app update) |
| 12:00–17:00 | All claude invocations fail; Remote Control session unreachable from client |
| 17:11:57 | Manual /login restores claudeAiOauth; CLI works again |

Evidence

Credentials file after the update — only mcpOAuth survived:

top keys: mcpOAuth
claudeAiOauth: STILL MISSING
mtime: 08/21/2026 11:58:48

CLI binary itself was fine — the failure was purely auth state:

> claude --version
2.1.233 (Claude Code)

> claude -p "reply exactly PONG"
Not logged in · Please run /login

After running /login, both blocks are present and the CLI works:

top keys: claudeAiOauth, mcpOAuth
subscriptionType: max
hasAccessToken: True
expiresAt: 08/22/2026 01:11:57

> claude -p "reply exactly PONG"
PONG

No claude CLI process was running during the outage window, confirming the Remote Control host had exited rather than merely disconnected.

Impact

1. Silent logout. Nothing in the desktop app indicated that the CLI's credentials had been altered. The desktop app itself kept working, so there was no obvious signal pointing at auth.
2. Remote Control sessions die and pass the 4-hour reattach window. The session's host process exited at 11:59. By the time the cause was found (17:11), the documented ~4-hour reconnect window had long expired, so the client-side session could not be reattached.
3. Misleading symptom. The client shows "Remote control connection lost — turn remote control back on for this session to reconnect", which points the user at networking or at the remote machine being asleep, not at a credentials file that was overwritten locally.

Expected behavior

• The desktop app should not remove the claudeAiOauth block when writing mcpOAuth to the shared .credentials.json. If both components write this file, the write should be a merge, not a replace.
• If credentials are invalidated for any reason, the user should be told, rather than discovering it through a generic "not logged in" on the next CLI run.
• Losing auth should not silently terminate a running Remote Control session's host process without a recoverable path beyond the 4-hour window.

Workaround

claude
/login

mcpOAuth survives the re-login, so MCP server authorizations do not need to be redone.

To recover the orphaned Remote Control session, from the project directory:

claude --resume <session-id>
/remote-control

Additional note

The affected session's transcript at ~/.claude/projects/<project>/<session-id>.jsonl had grown to 371 MB, which makes --resume extremely slow and is likely a separate problem worth looking at. /compact on a transcript that size was already struggling before this incident.