Remote Control: desktop app sessions always fail with HTTP 403 (CLI sessions connect fine)

Summary

Remote Control cannot be enabled for any Code session in the Claude desktop app for macOS. Every attempt fails immediately with:

[remote-control] bridge_state: "failed" — "Remote Control server rejected the request (HTTP 403) — run /remote-control to retry"

Correction: Remote Control works for terminal CLI sessions — those show up on the phone. It fails only for desktop-app Code sessions, which are the ones I actually work in. Same machine, same account, same network.

It worked before; it broke after an app update / machine restart.

Environment

• Claude desktop app 2.2553.1 (Code tab)
• macOS 26.6.2, Apple silicon (arm64)
• Plan: Max
• Network: direct residential connection, no VPN/proxy (scutil --proxy empty, Tailscale running without exit node)

What I tried

• Signed out and back in, in the app and on claude.ai — 3 times
• Full quit (Cmd+Q) and relaunch
• Logged out of all active sessions from claude.ai → Settings → Account
• Deleted the cached OAuth tokens (oauth:tokenCache, oauth:tokenCacheV2 in ~/Library/Application Support/Claude/config.json) and bridge-state.json, then signed in again

None of it changed anything: every enable attempt still returns 403.

Related symptom (same 403)

Plugin state loading fails the same way, which suggests the problem is account-wide rather than Remote-Control-specific:

[RemotePluginManager] Failed to fetch enabled state; defaulting to all-enabled Failed to fetch plugin enabled state (HTTP 403)

And MCP tool calls against claude.ai return:

{"type":"error","error":{"type":"permission_error","message":"Invalid authorization",
 "details":{"error_code":"account_session_invalid","error_visibility":"user_facing"}}}
url: https://claude.ai/api/organizations/<org-uuid>/mcp/servers/<id>/tools/call

Meanwhile OAuth itself looks healthy in the log ([oauth-v2] performing fresh /authorize, credential widened to user:plugins, token refresh scheduled).

Possible backend inconsistency

After clearing the token cache and signing in again, the app receives the same org UUID from the server:

[LocalSessionManager] Initialization succeeded — accountId=<uuid>, orgId=<org-uuid>, existingSessions=84

But support (Fin chat, conversation ID 215476012771594) stated: "I don't see any organization associated with your account on our end". If the account really has no organization server-side while the client is handed an org UUID at login, that mismatch would explain both the 403 and account_session_invalid.

Expected

Remote Control connects, so sessions on this computer can be continued from claude.ai/code and the mobile app.

Actual

403 on every attempt, for every desktop-app session. CLI sessions connect fine, so the account and network are not the problem — the desktop app's Remote Control requests specifically are rejected.

Account and org UUIDs plus the full log excerpt are available — happy to send them privately to whoever picks this up; I left them out of a public issue.

Compare the desktop-app Code requests with working CLI sessions, starting from the HTTP 403, account_session_invalid, bridge-state.json, and config.json evidence in the report. Done means desktop-app sessions enable Remote Control and the related plugin and MCP requests no longer return 403; no repository file or test is identified.