Description

When AWS Bedrock credentials expire during an active Claude Code session, the CLI becomes unresponsive instead of gracefully handling the authentication failure.

Expected Behavior

Claude Code should:

1. Detect when AWS Bedrock credentials have expired
2. Automatically attempt to refresh credentials, OR
3. Display a clear error message prompting the user to re-authenticate
4. Allow the session to recover after credentials are refreshed

Actual Behavior

Claude Code becomes stuck/unresponsive when credentials expire, requiring the user to:

• Manually terminate the session
• Refresh AWS credentials externally
• Restart Claude Code entirely

Steps to Reproduce

1. Start a Claude Code session with valid AWS Bedrock credentials
2. Wait for AWS credentials to expire (or manually expire them)
3. Attempt to interact with Claude Code
4. Observe that Claude Code becomes unresponsive

Environment

• Platform: macOS (Darwin 25.3.0)
• Shell: zsh
• Model: Sonnet 4.5 (us.anthropic.claude-sonnet-4-5-20250929-v1:0)
• Claude Code Interface: CLI

Impact

This significantly degrades the user experience, especially for:

• Long-running sessions
• Users with short-lived AWS session tokens
• SSO-based authentication that expires frequently

Suggested Solution

Implement credential refresh logic that:

1. Catches AWS authentication errors (ExpiredToken, InvalidAccessKeyId, etc.)
2. Attempts automatic credential refresh using the AWS SDK's credential chain
3. Falls back to a user-friendly error message if automatic refresh fails
4. Allows the session to continue after credentials are restored

Additional Context

This issue was reported during active development work where AWS SSO sessions expired mid-session, causing workflow interruption.