[BUG] Extension 2.1.207 breaks Bedrock SSO auth (UnauthorizedException: Session token not found or invalid) — 2.1.206 works

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Regression: extension 2.1.206 works, 2.1.207 broken (confirmed by direct downgrade test)
Auth: AWS Bedrock via IAM Identity Center SSO (sso-session config), profile bedrock, region eu-west-2
Model: eu.anthropic.claude-opus-4-8
Symptom: extension chat panel fails every request with UnauthorizedException: Session token not found or invalid, ~24ms after dispatch — CLI (v2.1.201, and manually invoked from VS Code's own integrated terminal) works fine with identical credentials/model/profile
Log detail: GetCallerIdentity check succeeds first ("skipping AWS auth refresh command"), then failure specifically during "resolving default AWS provider chain" for the actual invoke
Ruled out: stale env vars, SSO cache staleness, static vs. SSO credentials, model ID validity, env/awsAuthRefresh settings — all confirmed fine independently
Related: #51108 (same CLI-works/extension-fails divergence, different environment/trigger)

What Should Happen?

Should not get UnauthorizedException for a valid session

Error Messages/Logs

Every request fails immediately with:

2026-07-13T10:23:48.635Z [DEBUG] [API:auth] AWS credential resolve start
2026-07-13T10:23:48.635Z [DEBUG] Fetching AWS caller identity for AWS auth refresh command
2026-07-13T10:23:49.542Z [DEBUG] Fetched AWS caller identity, skipping AWS auth refresh command
2026-07-13T10:23:49.542Z [DEBUG] [API:auth] AWS credential resolve done in 907ms
2026-07-13T10:23:49.542Z [DEBUG] [API:timing] dispatching to bedrock model=eu.anthropic.claude-opus-4-8[1m]
2026-07-13T10:23:49.543Z [DEBUG] [API:auth] resolving default AWS provider chain (region: eu-west-2)
2026-07-13T10:23:49.567Z [ERROR] API error (attempt 3/4): UnauthorizedException: Session token not found or invalid
2026-07-13T10:23:49.567Z [ERROR] Error in API request: UnauthorizedException: Session token not found or invalid

Note the ~24ms gap between dispatch (.543) and failure (.567) — too fast for a real network round-trip to Bedrock, suggesting the failure happens locally before the signed request is actually sent. Also note the GetCallerIdentity check succeeds first, then the failure occurs specifically during a *separate* "resolving default AWS provider chain" step for the actual invoke — suggesting the extension's request-signing path is not using the same resolved credentials as its own identity check.

Steps to Reproduce

Environment

• OS: Linux
• Extension version (broken): 2.1.207
• Extension version (confirmed working): 2.1.206
• Claude Code CLI version (confirmed working, run manually): v2.1.201
• Auth method: AWS Bedrock via IAM Identity Center SSO (sso-session config block)
• AWS profile: bedrock
• Region: eu-west-2
• Model: eu.anthropic.claude-opus-4-8

~/.aws/config

[profile bedrock]
sso_session = bedrock
sso_account_id = 921274142329
sso_role_name = BedrockInvoker
region = eu-west-2

[sso-session bedrock]
sso_start_url = https://d-906786c92b.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

Claude Code settings (~/.claude/settings.json)

{
"awsAuthRefresh": "aws sso login --profile bedrock",
"env": {
"AWS_PROFILE": "bedrock",
"AWS_REGION": "eu-west-2"
},
"model": "eu.anthropic.claude-opus-4-8",
"effortLevel": "xhigh",
"theme": "dark"
}

Steps to reproduce

1. Configure Bedrock access via AWS IAM Identity Center SSO as above.
2. Run aws sso login --profile bedrock — succeeds.
3. Open VS Code with the Claude Code extension (2.1.207) installed.
4. Send any prompt via the extension's chat panel.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.206

Claude Code Version

2.1.207

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_

  {
    "awsAuthRefresh": "aws sso login --profile <profile> --use-device-code",
    "env": {
      "CLAUDE_CODE_USE_BEDROCK": "1",
      "AWS_REGION": "eu-central-1",
      "AWS_PROFILE": "<profile>"
    }
  }

"awsCredentialExport": "aws configure export-credentials --profile <profile> --format process"