[BUG] Bedrock Guardrails - subsequent prompts are blocked if one prompt is blocked

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

I followed the steps to add a bedrock guardrail to the settings.json config file
the guardrail blocks political, hate speech and questions about the weather
this is what the config param looks like: "ANTHROPIC_CUSTOM_HEADERS": "X-Amzn-Bedrock-GuardrailIdentifier:
arn:aws:bedrock:<region>:<account-id>:guardrail/<guardrail-id>\nX-Amzn-Bedrock-GuardrailVersion: 1"\

normal prompts work fine, if i send a prompt that matches the guard rail, "what are your political leanings?", i get the "⏺ Sorry, the model cannot answer this question." as configured, but when followed by a legit question it respond with the same message "⏺ Sorry, the model cannot answer this question."

workaround: /clear or restarting the session works.

This root cause analysis was generated by Claude Code:

When a Bedrock guardrail blocks a response, Claude Code correctly handles the assistant-side error by:

1. Creating a synthetic assistant message with isApiErrorMessage: true
2. Filtering that message out when building API requests (via the SQ7 check in the EI function)

But it does NOT remove the user message that triggered the guardrail block. Here's what cascades:

1. You send a message that triggers the guardrail → blocked
2. The assistant error message is stored with isApiErrorMessage: true
3. You send a new (innocent) message
4. Claude Code builds the API request: it filters out the error assistant message, but keeps your

original blocked user message

1. Since two consecutive user messages can't be sent to the API, they get merged (via hQ7) into a single

user message containing both the blocked content AND your new message

1. The guardrail scans the merged input and blocks again because the original offending content is still

there

1. This repeats forever within the session

This is a bug in Claude Code

The message-building function (EI at the relevant line in cli.js) filters SQ7 (API error assistant
messages) but doesn't also filter the preceding user message. The fix would need to be in the Claude
Code source itself.

Workarounds

Within the current version, you can:

1. Start a new conversation after a guardrail block — each session starts fresh with no history, so the

blocked content won't carry over

1. Use /clear to clear the conversation history within the same session

Recommendation

File a bug at https://github.com/anthropics/claude-code/issues requesting that the user message
preceding an isApiErrorMessage assistant response also be excluded from the API message history. The fix
is straightforward — in the EI function, when SQ7(Y) returns true for an assistant message, the
immediately preceding user message should also be dropped.

What Should Happen?

If a user send a prompt with a query that matches a bedrock guardrail rule, e.g. political question, bedrock should respond with the precanned message configured on the guard rail. if the user follows with a legit prompt "write a python script that counts from 1 to 10" claude code

Error Messages/Logs

Steps to Reproduce

• create a bedrock guardrail
• add it to claude code settings.json as per the doc: https://code.claude.com/docs/en/amazon-bedrock
• start claude code
• send a prompt that matches the guardrail
• send a prompt that does not match the guardrail

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.63

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

iTerm2

Additional Information

_No response_