Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

In a Claude Code Remote Routine (scheduled task in an ephemeral cloud container), all configured MCP OAuth servers (Slack, Notion, Google-Calendar) start every session with accessToken: "" (empty string) in ~/.claude/.credentials.json. The server registrations are present — serverUrl, clientId, redirectUri, discoveryState — but the tokens themselves are blank.

Every MCP tool call immediately triggers an auth prompt. When re-auth is attempted via /mcp, it fails with a client registration rate limit error, because each fresh container tries to register a new dynamic OAuth client on boot.

Secondary symptom: the Notion MCP credential blob is also missing clientId and redirectUri (unlike Slack and Google-Calendar), causing the Notion server to disconnect entirely at session start rather than surface authenticate/complete_authentication tools.

This was working correctly in previous sessions.

What Should Happen?

MCP OAuth access tokens should be available at the start of every Remote Routine session — either via credential sync into the container at session start (the previous behavior), or via a session-scoped token refresh path that doesn't require browser redirect interaction.

Error Messages/Logs

# ~/.claude/.credentials.json — all three servers have empty accessToken
mcpOAuth.Slack: accessToken="" (len=0), clientId present, redirectUri present
mcpOAuth.Notion: accessToken="" (len=0), clientId MISSING, redirectUri MISSING
mcpOAuth.Google-Calendar: accessToken="" (len=0), clientId present, redirectUri present

# mcp-needs-auth-cache.json populated at container boot (~1 min uptime)
{"Slack":{"timestamp":1779381068724},"Notion":{"timestamp":1779379173932},"Google-Calendar":{"timestamp":1779381068720}}

# Error when attempting manual /mcp re-auth
SDK auth failed: You have exceeded the rate limit for client registration requests.
Ask the user to run /mcp and authenticate manually.

# Relevant env vars in this container build
CLAUDE_CODE_REMOTE_SKIP_SETTINGS_SYNC=1
CLAUDE_CODE_USE_CCR_V2=true
USE_SHTTP_MCP=true
CLAUDE_CODE_DISABLE_BUILTIN_ANTMCP=1
CLAUDE_CODE_ENVIRONMENT_RUNNER_VERSION=release-b5ac58d65-ext

Steps to Reproduce

1. Configure a Claude Code Remote Routine (scheduled task on claude.ai/code) with Slack, Notion, and Google-Calendar MCP servers, previously authenticated.
2. Trigger the routine — a fresh ephemeral container starts.
3. Attempt any tool call from those MCP servers.
4. Observe: all three servers immediately show "needs authentication."
5. Inspect ~/.claude/.credentials.json — all accessToken values are empty strings ("").
6. Attempt re-auth via /mcp — fails with client registration rate limit error.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

unknown — worked within 24h prior; broke on env-runner build release-b5ac58d65-ext

Claude Code Version

2.1.42

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Root cause hypothesis: CLAUDE_CODE_REMOTE_SKIP_SETTINGS_SYNC=1 (new in this build) is preventing the routine runner from syncing the user's MCP OAuth state into the fresh container at session start. The container template includes MCP server registrations but no access tokens.

Previously the runner appears to have synced credentials in — today's build skips that step, leaving accessToken="" for all servers.

The rate limit failure is a downstream effect: with empty tokens, every fresh container attempts a new dynamic OAuth client registration, and multiple routine sessions per day exhaust the per-client registration limit.

Container details: CLAUDE_CODE_REMOTE_ENVIRONMENT_TYPE=cloud_default, uptime ~1 min at session start, no persistent volumes mounted (/opt/global-persistent-data does not exist).