claude auth login` / `claude setup-token` fail with OAuth 403 "missing user:profile scope" on Windows, while Claude Desktop login works fine

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Claude Code CLI's OAuth login (`claude auth login` / `claude setup-token` / `/login`) fails with a 403 error and "missing user:profile scope", even though the browser authorization step completes successfully. Claude Desktop app on the same machine/account logs in fine, so the account itself works — the issue seems specific to the CLI's OAuth token exchange.

Full diagnostic details, steps to reproduce, and what I've already ruled out are below.

### What Should Happen?

`claude auth login` / `claude setup-token` should successfully exchange the OAuth authorization for a token with the full required scopes (including `user:profile`), so that `claude auth status` reports `loggedIn: true` and Claude Code can be used with my Pro/Max subscription — consistent with how Claude Desktop already authenticates successfully with the same account on the same machine.

### Error Messages/Logs

```shell
$ claude setup-token
You already have authentication configured via environment variable or API key helper
(request failed with) 403

$ claude
> /login
> Select: Claude account with subscription
Login
OAuth error: Request failed with status code 403

$ claude doctor
Remote Control
Remote Control requires a claude.ai subscription. Run claude auth login to sign in with your claude.ai account.
- Not signed in to claude.ai
- claude.ai subscription auth not active
- Sign-in is missing the user:profile scope

No installation issues found.
```

### Steps to Reproduce

```
1. On Windows 11, install Claude Code CLI via `npm install -g @anthropic-ai/claude-code` (version 2.1.215).
2. Run `claude auth login` in PowerShell.
3. Browser opens the OAuth consent page; complete authorization — browser shows "authorization successful".
4. Back in the terminal, run `claude auth status` → reports `loggedIn: false`.
5. Run `claude setup-token` → fails with "You already have authentication configured via environment variable or API key helper", then HTTP 403.
6. Confirmed no ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY / ANTHROPIC_BASE_URL / apiKeyHelper / CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX set anywhere (process, user, machine env, settings.json, managed-settings.json) — error persists regardless.
7. Run `claude` → `/login` → select "Claude account with subscription" → immediately fails with `OAuth error: Request failed with status code 403`.
8. Run `claude doctor` → confirms "Not signed in", "Sign-in is missing the user:profile scope".
9. Claude Desktop app, installed on the same machine under the same account, logs in via OAuth successfully with no issues.
```

### Claude Model

None

### Is this a regression?

Yes, this worked in a previous version

### Last Working Version

_No response_

### Claude Code Version

2.1.215

### Platform

Anthropic API

### Operating System

Windows

### Terminal/Shell

PowerShell

### Additional Information

# Title
`claude auth login` / `claude setup-token` fail with OAuth 403 "missing user:profile scope" on Windows, while Claude Desktop login works fine

## Environment
- OS: Windows 11 Home (10.0.26200), x64
- Claude Code CLI version: 2.1.215 (npm-global install, `@anthropic-ai/claude-code`)
- Install path: `%APPDATA%\npm\node_modules\@anthropic-ai\claude-code\bin\claude.exe`
- Node.js via npm global wrapper (`claude.ps1` / `claude.cmd`) — verified unmodified, standard npm-generated wrapper
- Claude Desktop app: installed and logged in successfully on the same machine/account

## Steps to reproduce
1. Run `claude auth login` in PowerShell
2. Browser opens, OAuth consent page completes, browser shows "authorization successful"
3. Back in terminal, `claude auth status` still reports `loggedIn: false`
4. Run `claude setup-token`:
- First attempt: error `"You already have authentication configured via environment variable or API key helper"`, followed by HTTP 403
5. Run `claude` → `/login` interactively, select "Claude account with subscription":
- Fails immediately with: `OAuth error: Request failed with status code 403`

## `claude doctor` output (relevant section)
```
Remote Control
Remote Control requires a claude.ai subscription. Run claude auth login to sign in with your claude.ai account.
- Not signed in to claude.ai
- claude.ai subscription auth not active
- Sign-in is missing the user:profile scope

No installation issues found.
```

## What I've already ruled out locally
- `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_API_KEY`, `ANTHROPIC_BASE_URL`, `ANTHROPIC_MODEL`, `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_VERTEX` — confirmed unset at process, user (`HKCU\Environment`), and machine (`HKLM\...\Environment`) scope
- No `~/.claude/settings.json`, `~/.claude/settings.local.json`, or project-level `.claude/settings.json` exist (so no `apiKeyHelper`)
- No enterprise managed policy file at `C:\ProgramData\ClaudeCode\managed-settings.json`
- `claude.ps1` / `claude.cmd` wrapper scripts are unmodified npm-generated boilerplate (no injected env vars)
- No Windows hosts file entries for anthropic.com / claude.ai domains
- No stray credentials in Windows Credential Manager (`cmdkey /list`) related to claude/anthropic
- System clock/timezone correct (China Standard Time, verified against actual time)
- `curl -v` to `https://console.anthropic.com` and `https://api.anthropic.com` both complete TLS handshake normally with expected HTTP responses (301 redirect and 403-for-unauthenticated-GET respectively) — no certificate interception detected
- Tested through a home-network local HTTP/SOCKS proxy (residential IP, same egress as a mobile device on the same network) — same 403 result regardless

## Additional notes
- Claude Desktop app on the same machine/account is already logged in via OAuth and works normally, suggesting the account itself can authenticate somewhere, but the standalone CLI's OAuth flow specifically cannot obtain a token with the `user:profile` scope.
- I have not yet tested from a completely different network/IP (in progress).

## Request
Could you help identify why the CLI-specific OAuth flow returns 403 / is missing the `user:profile` scope, while Desktop login for the same account succeeds? Is this likely account-side rate limiting/anti-abuse, or a client-side OAuth scope negotiation issue in `2.1.215`? Happy to provide additional logs if needed (redacting secrets).