[Remote MCP] Successful device verification returns terminated Supabase session

Summary

Desktop Commander Remote MCP device authorization completes successfully, but the session returned by the service cannot be established. The device exits immediately after verification with either:

Authorization successful!
Failed to set session: terminated
Device startup failed: terminated

or, intermittently:

Authorization successful!
Failed to get user: fetch failed
Device startup failed: fetch failed

No access tokens, refresh tokens, email addresses, device IDs, or local paths are included in this report.

Environment

• OS: Windows 11
• Desktop Commander: reproduced on 0.2.46 and 0.2.47
• Node.js: reproduced on 24.13.0 and 22.23.2
• Execution: desktop-commander remote
• Fresh npm cache and fresh local device configuration
• New device authorization flow/device assignment on every clean attempt

Connectivity checks

Both the MCP service and Supabase endpoint are reachable:

• https://mcp.desktopcommander.app/api/mcp-info succeeds
• Supabase /auth/v1/health returns HTTP 200 from PowerShell
• Supabase /auth/v1/health returns HTTP 200 from Node
• Node was also tested with --use-system-ca --use-env-proxy

The local Desktop Commander MCP subprocess starts and connects successfully. Failure occurs only after the browser device-verification flow returns tokens and the remote client calls Supabase auth setSession() / getUser().

Steps to reproduce

1. On Windows 11, install @wonderwhy-er/[email protected].
2. Remove or move %USERPROFILE%\.desktop-commander-device\device.json so the device flow starts cleanly.
3. Run:
   powershell复制

   node --use-system-ca --use-env-proxy node_modules/@wonderwhy-er/desktop-commander/dist/index.js remote

4. Open the verification URL and enter the displayed device code.
5. Observe Authorization successful!.
6. Immediately afterward, observe Failed to set session: terminated (or occasionally Failed to get user: fetch failed), followed by device shutdown.

Expected behavior

After successful verification, the returned Supabase session should be valid, the remote channel should subscribe, and the device should remain online.

Actual behavior

The freshly issued session is reported as terminated or cannot complete getUser(). The device never reaches Channel subscribed / Device ready.

Additional observations

• Reinstalling the package and clearing npm cache do not help.
• Replacing the persisted device configuration and assigning a new device ID do not help.
• Downgrading Node from 24 to 22 does not help.
• The same account/device flow had worked previously, so this appears consistent with a server-side auth/session regression rather than a local installation failure.
• Debug mode can print authentication material in the shutdown spawnargs error path. Those values are intentionally omitted here; redacting that output would be a useful defense-in-depth improvement.