Windows: VS Code panel shows 'OAuth session expired and could not be refreshed' although re-login succeeds (stale-process refresh race + resumed session re-renders old auth error)

Bug: VS Code extension appears stuck in "Failed to authenticate: OAuth session expired and could not be refreshed" even after successful re-login

Environment

• Windows 11 Pro (10.0.26200)
• VS Code extension anthropic.claude-code 2.1.263 (bundled native binary 2.1.263)
• CLI claude 2.1.263 (native install, ~\.local\bin\claude.exe)
• Auth: claude.ai OAuth (Team plan), credentials in %USERPROFILE%\.claude\.credentials.json (plaintext file store; tengu_windows_credman flag is off, no Credential Manager entries)
• Other Claude surfaces running on the same machine: CLI sessions in terminals, Claude Desktop app

Symptom

The VS Code side panel showed "Failed to authenticate: OAuth session expired and could not be refreshed" while a concurrently running CLI session in a plain PowerShell terminal worked fine with the same .credentials.json. Repeated sign-outs and browser sign-ins from the panel appeared to change nothing — the panel showed the same error immediately after completing each browser OAuth flow, for over an hour.

What log forensics showed

Digging through the exthost logs (Claude VSCode.log) and correlating with .credentials.json mtimes revealed the sign-ins were actually succeeding the whole time:

1. Panel login ({"type":"login","method":"claudeai"}) delegates to a spawned SDK claude.exe session (loginViaQuery → claudeAuthenticate → claudeOAuthWaitForCompletion).
2. After completing the browser flow, a fresh valid token was written to .credentials.json (verified: mtime updated seconds after the browser redirect, new expiresAt ~8h out, and the extension's own bundled native-binary\claude.exe run headless from a terminal with that file authenticated fine and answered a -p prompt).
3. Yet the panel surfaced the "OAuth session expired and could not be refreshed" error (which is generated inside the CLI binary — the authentication_failed / sY error path) right as/after login completed.

Contributing factors observed:

• Multiple concurrent claude.exe processes are spawned by the extension (config-cache loader + chat session + login helper), plus independent CLI terminal sessions and the Desktop app. With refresh-token rotation, a stale process holding a rotated-away refresh token keeps failing and its error surfaces in the panel — the binary even ships a sibling message for this ("Failed to refresh OAuth token: another Claude Code process is refreshing it or exited mid-refresh"), but what the user is shown is the misleading "session expired" variant. This looks like the Windows-file-store analog of #79685 / #72017.
• /logout in the panel vs the Claude Code: Logout command clear different state. The panel /logout + re-login path never cleared the extension-side auth state, so the extension kept reporting the stale copy ("OAuth tokens found in secure storage") while fresh logins landed in the file. Only the Command Palette Claude Code: Logout produced "No authentication found".
• The final UX trap: after everything was actually fixed (valid token on disk, extension reading it, fetchUtilization: 200, bootstrap ok, session hooks running), reopening VS Code resumed the previous conversation, which re-renders the historical auth-error bubble as the newest content in the panel. This is indistinguishable from a live auth failure and makes the user believe re-login failed again — sending any new message works fine. This alone probably explains many "re-login doesn't help" reports.

Suggested fixes

1. Render historical/transcript error bubbles from resumed sessions visually distinct from live errors (or timestamp them), so a restored conversation can't impersonate a current auth failure.
2. In the login completion path, don't surface a refresh failure from a different/stale process while claudeOAuthWaitForCompletion has actually succeeded; re-check the credential store after the exchange before reporting failure.
3. Serialize token refresh across processes on Windows (lockfile around .credentials.json refresh) to avoid rotation races between the extension's spawned processes, terminal CLI sessions, and the Desktop app.
4. Make panel /logout and Claude Code: Logout clear the same state, or remove one.

Workaround that ended the loop

1. Command Palette → Claude Code: Logout (not /logout in the panel) — this actually cleared auth state ("No authentication found").
2. Sign in once from the panel (browser flow) — writes a fresh token family to .credentials.json.
3. Fully close VS Code so no stale claude.exe helpers survive, reopen — panel is authenticated; ignore the stale error bubble at the end of the resumed conversation.