[BUG] CLI is unrecoverable when returning to an expired session — /login and all inputs fail with 403

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

When returning to a Claude Code terminal after the session/token has expired (e.g., the next day), the CLI is in a completely unresponsive
state. Every input — including the suggested /login command — returns the same error with no way to recover. The user is forced to kill the
process and start a new one.

To reproduce

1. Start a Claude Code session (claude)
2. Leave the terminal open overnight (or until the auth token expires)
3. Return to the terminal and attempt to continue using the session
4. Observe that every input returns a 403 error
5. Type /login as instructed by the error message — same 403 error
6. Try other commands (ca refresh, awsmyid login, etc.) — all fail with same error
7. No way to recover without force-killing the process

Observed behavior

❯ continue
⎿ Please run /login · API Error: 403 The security token included in the request is expired

❯ /login
⎿ Please run /login · API Error: 403 The security token included in the request is expired

❯ ca refresh
⎿ Please run /login · API Error: 403 The security token included in the request is expired

❯ awsmyid login
⎿ Please run /login · API Error: 403 The security token included in the request is expired

All inputs produce the same error. The CLI is entirely non-functional. Even re-authenticating in a separate terminal does not revive the stuck
session.

Workaround

1. Force-kill the stuck Claude process (Ctrl+C repeatedly or close the terminal)
2. Open a new terminal and run claude login
3. Resume the previous conversation with claude --continue

This works but the user loses the terminal context and has to discover this workaround on their own, since the CLI's own error message (Please
run /login) is misleading.

Impact

• The error message suggests a fix (/login) that doesn't work — circular and confusing
• Users in corporate/SSO environments with short-lived tokens (8-12h TTL) encounter this every morning
• The terminal where the user has been working becomes unusable — they must force-kill and restart
• claude --continue recovers conversation history, but the UX of discovering that is poor

Environment

• OS: macOS (Darwin 25.2.0)
• Shell: zsh
• Auth: Corporate SSO / federated credentials with short-lived tokens
• Claude Code version: (add output of claude --version)

What Should Happen?

Any of the following would be acceptable:

1. /login should work regardless of current auth state — it's the recovery command and must not require a valid token to execute (preferred)
2. The CLI should detect the expired state on resume and automatically prompt for re-authentication
3. The CLI should gracefully exit with a clear message: "Session expired. Run claude login then claude --continue to resume your conversation."
4. The CLI should detect that credentials have been refreshed on disk (e.g., user authenticated in another terminal) and automatically recover
5. At minimum, Ctrl+C should cleanly exit rather than requiring repeated force-kills

Error Messages/Logs

❯ ca refresh

❯ awsmyid login
  ⎿  Please run /login · API Error: 403 The security token included in the request is expired

✻ Sautéed for 2m 58s

❯ ca refresh
  ⎿  Please run /login · API Error: 403 The security token included in the request is expired

✻ Cogitated for 3m 6s

❯ continue
  ⎿  Interrupted · What should Claude do instead?

❯ run /logi
  ⎿  Please run /login · API Error: 403 The security token included in the request is expired
     
✻ Baked for 2m 59s

❯ run /login
  ⎿  Please run /login · API Error: 403 The security token included in the request is expired

Steps to Reproduce

Open the terminal which has been used yesterday for Claude CLI, it expirtes after 8 hours of inactivity.
Open try to run anything in Claude it says:

⎿  Please run /login · API Error: 403 The security token included in the request is expired

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

_No response_

Claude Code Version

Opus 4.6 v2.1.144

Platform

AWS Bedrock

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

Workaround

1. Force-kill the stuck Claude process (Ctrl+C repeatedly or close the terminal)
2. Open a new terminal and run claude login
3. Resume the previous conversation with claude --continue

This works but the user loses the terminal context and has to discover this workaround on their own, since the CLI's own error message (Please
run /login) is misleading.

Impact

• The error message suggests a fix (/login) that doesn't work — circular and confusing
• Users in corporate/SSO environments with short-lived tokens (8-12h TTL) encounter this every morning
• The terminal where the user has been working becomes unusable — they must force-kill and restart
• claude --continue recovers conversation history, but the UX of discovering that is poor