VS Code extension: /design-login "isn't available in this environment" — no path to grant user:design scopes, /design-consent dead-ends with 403

## Environment

- Claude Code VS Code extension `anthropic.claude-code-2.1.251-linux-x64`
- WSL2 (Ubuntu) on Windows 11
- Account has an active paid Claude subscription
- Separately-installed CLI on PATH is `2.1.220`

## What's wrong

The VS Code extension exposes `/design-consent` but has no working `/design-login`, so there is no in-extension path to authorize Claude Design / `/design-sync`:

1. `/design-consent` →
```
Couldn't record Design agent access for your Claude Design projects — Request failed with status code 403. Try again, or run /design-login to authorize Claude Design for this account.
```
2. `/design-login` →
```
/design-login isn't available in this environment.
```

Token scopes in `~/.claude/.credentials.json` after a normal `/login`:

```
user:file_upload user:inference user:mcp_servers user:profile user:sessions:claude_code
```

No `user:design:read` / `user:design:write`. The `/design-consent` 403 is downstream of the missing scopes, and the command it points to for the fix (`/design-login`) is blocked in the same environment.

## Mechanism

From the extension's bundled binary (2.1.251):

- `design-login` — `type: "local-jsx"`, no `supportsNonInteractive` flag
- `design-consent` — `type: "local"`, `supportsNonInteractive: true`, `isHidden: true`
- `design-revoke` — `type: "local"`, `supportsNonInteractive: true`, `isHidden: true`

So the interactive grant command (`design-login`) is filtered out of the extension environment, while the headless fallback that cannot self-authorize (`design-consent`) is what remains. Net effect: a user whose token lacks design scopes cannot get them from the VS Code extension by any route.

## Docs gap

Neither https://code.claude.com/docs/en/commands nor the Claude Design setup guide (https://support.claude.com/en/articles/14604416-get-started-with-claude-design) mentions that `/design-login` requires a standalone terminal or is unavailable in the IDE extension. The only documented availability caveat for `/design-sync` is Bedrock / Vertex / Foundry / AWS ("the underlying tool can't reach claude.ai").

## Expected

Any of:

- `/design-login` works in the VS Code extension
- an in-extension consent dialog adds the design scopes on first `/design-consent` / `DesignSync` use
- the docs state the standalone-terminal requirement explicitly and `/design-consent` points there

## Workaround

Run `/design-login` once in a standalone WSL terminal on the latest CLI; the scopes then land in the shared `~/.claude/.credentials.json` and the extension inherits them.

## Related

- #69496 (feature request: add `user:design` OAuth scopes)
- #71490 (Claude Desktop, same missing-scope + no-grant-path, closed as duplicate)
- #85872 (scope-failure error names `/login` instead of `/design-login`)
- #75041 (`/design-login` produces no visible flow)

Start by reproducing in the VS Code extension on WSL2: run /design-consent and /design-login, then inspect ~/.claude/.credentials.json for missing user:design scopes. Read the command registration/filtering for design-login, design-consent, and design-revoke, plus the linked command docs and Design setup guide. Done means the extension provides a grant path or the errors/docs clearly direct users to the standalone CLI workaround.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.