Remote Control bridges die on desktop auto-update relaunch; rcAutoEnable only re-arms on a local turn

Remote Control bridges die on desktop auto-update relaunch and only re-arm from the Mac

Summary

The Claude desktop app's auto-update "stealth relaunch" tears down every local
session process and every Remote Control bridge with it. The existing
rcAutoEnable recovery path does re-enable Remote Control — but only on
first_turn / warm_send, i.e. when the session takes its next turn. After a
relaunch that turn can only be driven locally, because the bridge is exactly
what the phone talks to. Net effect for a phone-driven workflow: Remote Control
is silently dead until the user walks back to the Mac and re-runs /rc.

Environment

• macOS 26.6.2 (build 25G83, Darwin 25.6.0), MacBook Pro M1 Pro, 32 GB
• Claude desktop app, Code tab, local sessions
• Sessions driven from the iOS app via Remote Control

Evidence (from ~/Library/Logs/Claude/main.log)

Auto-update relaunches — 8 in 4 days:

2026-09-01 23:23:37 2026-09-03 09:53:28 2026-09-04 12:17:36
2026-09-02 11:02:04 2026-09-04 01:04:13 2026-09-04 17:39:12
2026-09-02 17:12:49 2026-09-04 23:49:57

Teardown on each one:

[info] onQuitCleanup: local-session-stop-all
[info] onQuitCleanup: local-session-pty-cleanup
[info] onQuitCleanup: remote-server-cleanup
[info] [stealth-relaunch] Detected via marker file (windowVisible=true, ...)
[info] [stealth-relaunch] Restoring navigation (50 entries, active=49, dropped=0)

Note the window/navigation state IS restored, so the UI looks untouched — but
the bridges are gone. There is no bridge_state log line for this teardown at
all, so nothing surfaces to the user either locally or on the phone.

Recovery only ever fires on a locally-driven turn:

2026-09-04 17:44:19 [rcAutoEnable] verdict: enable=true source=explicit_pref trigger=warm_send
2026-09-04 19:46:27 [rcAutoEnable] verdict: enable=true source=explicit_pref trigger=first_turn
2026-09-05 08:41:36 [rcAutoEnable] verdict: enable=true source=explicit_pref trigger=first_turn

Every recovery in a month of logs is trigger=first_turn or trigger=warm_send.
None is a startup trigger, despite remote_control_at_startup /
remote_control_was_on existing in the bundle.

For contrast, the failure modes that are surfaced are rare — 3 in a month:

bridge_state: "failed" — "this session was ended or archived from another device or app (code 4090)"
bridge_state: "reconnecting" — "presence heartbeats failing — reconnecting"

And idle timeout correctly exempts bridged sessions, which is the right behavior:

[CCD] Skipping pause for session local_4f48... - remote control is active (explicit bridge)

Why this is a gap

1. No user-facing way to defer updates. disableAutoUpdates and

autoUpdaterEnforcementHours exist, but both are appBehaviorOnly managed
policy keys (MDM plist / managed-settings.json), scoped to IT admins, with
documentation that assumes "IT has another distribution path." An individual
user on a personal Mac has no supported switch — the only options are an
MDM-shaped hack or nothing. DISABLE_AUTOUPDATER governs the CLI's own
self-update, not the Electron app updater, so it does not help here.

1. The recovery trigger is unreachable from the phone. rcAutoEnable is

the right mechanism, but gating it on a session turn means the one situation
where you need it most — user is away from the Mac, driving from the phone —
is the one situation it cannot fire in.

1. Silent failure. Window state is restored, so nothing looks wrong. The

phone just stops getting responses. There is no notification, no bridge_state
transition logged for this path, and no indication on either device.

Requested fixes, in priority order

1. Re-arm Remote Control at startup for sessions that had it on, using the

already-persisted explicit_pref / remote_control_was_on state — rather
than waiting for a local turn. This alone closes the gap.

1. Notify on bridge loss. If a bridge dies and cannot be restored, push a

notification to the paired device. Silent death is the worst part.

1. Defer updates while a bridge is live. Do not stealth-relaunch a session

that has an active Remote Control bridge; hold the update until it is idle or
the user is back at the machine.

1. A user-level update preference. "Check for updates but install on quit /

on my say-so," without requiring an MDM profile.

Workaround today

None that is both supported and effective. Quitting and reopening the app
deliberately before leaving the Mac at least makes the re-/rc happen on the
user's terms; long unattended work has to move to a cloud session.