[BUG] Cowork remote-surface OTel events missing user identity attributes (user.email, organization.id)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork OTel events tagged cowork_surface="remote" omit all account-identity attributes — user.email, user.account_uuid, user.account_id, and organization.id are all absent. Only user.id is present, which per the docs is an anonymous, non-reversible identifier. This makes remote-surface cost/usage permanently unattributable to a user.

This affects both genuine Cowork cloud sessions and — as far as we can tell from timestamp correlation against our own usage — ordinary claude.ai chat sessions that invoke the code execution / file creation tool, which appear to share the same cloud sandbox backend and get logged under service_name="cowork" as a result.

Local/desktop-surface events (cowork_surface absent or "local") correctly populate all four account attributes for the same org.

What Should Happen?

Per the Cowork monitoring reference, user.email is "always included in event attributes" on first-party deployments, with no exception noted for session surface. cowork_surface="remote" events should carry the same account attributes as local-surface events, since the session is still tied to an authenticated Anthropic account in both cases.

Error Messages/Logs

No errors — the exporter runs correctly and delivers events; the identity fields are simply absent from the payload. Example api_request event (redacted):

{
  "event_name": "api_request",
  "service_name": "cowork",
  "cowork_surface": "remote",
  "cost_usd": "0.0374692",
  "model": "claude-sonnet-5",
  "session_id": "90412886-64a4-5e0c-b158-775e6b94a721",
  "prompt_id": "1ca2e9ba-e5d6-47f6-8f90-0881cd64bdef",
  "user_id": "de8fee07d1a98adcaceccaab666cc17f805eb7f958d10e12324ac7a3d773eeeb"
  // no user_email, user_account_uuid, user_account_id, or organization_id present
}

Steps to Reproduce

Environment:
Plan: Claude Team
Export: Cowork OTel → Grafana Cloud (Loki)

1. On a Claude Team org, configure Cowork OTel export to a collector (Admin settings > Cowork > OTLP endpoint/protocol/headers).
2. Generate cowork_surface="remote" traffic — either a Cowork session started from claude.ai web/mobile, or a regular claude.ai chat session that invokes the code execution / file creation tool.
3. Query the collector for api_request (or user_prompt) events from that session by session_id or prompt_id.
4. Compare attributes against an equivalent local-desktop Cowork session from the same org: local events include user_email, user_account_uuid, user_account_id, organization_id; remote events include none of them, only user_id.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

service.version observed in affected events: 2.1.245

Platform

Anthropic API

Operating System

Other

Terminal/Shell

Other

Additional Information

Impact: Claude Team plans do not have Compliance API access (Enterprise-only), so unlike Enterprise orgs, there is no fallback path to recover identity for this traffic via GET /v1/compliance/apps/sessions/remote. For Team-tier orgs exporting Cowork OTel data, this category of traffic — which can represent a meaningful share of total spend — is currently permanently unattributable to a user.

Proposed fix: Populate the same account attributes on cowork_surface="remote" events as are already populated on local-surface events. If there's a reason these can't be populated at the same pipeline stage (e.g. the remote/cloud agent loop uses a different instrumentation path than the desktop wrapper), an acceptable alternative would be an explicit, documented mechanism for Team-tier orgs to resolve session_id → user identity without requiring Enterprise/Compliance API access.