Bedrock: AWS SSO credentials re-fetched and browser re-auth triggered on every session start despite valid cached STS credentials (regression, v2.1.218)

Environment

• Claude Code version: 2.1.218 (Windows, VS Code extension)
• Provider: Amazon Bedrock (CLAUDE_CODE_USE_BEDROCK=1)
• Auth: AWS IAM Identity Center (SSO) profile, awsAuthRefresh: "aws sso login"

Summary

Every claude -p invocation (and, in the VS Code extension, apparently every session start / tool-heavy turn) re-triggers a full AWS SSO browser re-authentication, even though:

• the cached STS credentials (~/.aws/cli/cache/*.json) are valid for another ~11 hours
• aws sts get-caller-identity succeeds instantly outside Claude Code
• the SSO refresh token itself is valid for months

Reproduction (3x independent, via --debug-file)

Every run shows the identical sequence within ~4 seconds of startup:

[API:auth] AWS credential resolve start
Fetching AWS caller identity for AWS auth refresh command
... (unrelated MCP/startup work) ...
Running AWS auth refresh command          <- decided refresh is needed
Attempting to open your default browser   <- full interactive OIDC flow,
                                              not a silent refresh-token exchange
Successfully logged into Start URL: ...
AWS auth refresh completed successfully
[API:auth] resolving default AWS provider chain
[ERROR] Bedrock ListInferenceProfiles failed: JSON Parse error: Unrecognized token '<'
Failed to list Bedrock inference profiles, falling back to hardcoded models

In real usage this fires multiple times within seconds during a single session (observed 5 separate browser popups within ~12 seconds, all from one claude.exe process), making Bedrock unusable behind a corporate SSO setup that requires interactive browser confirmation each time.

Notes

• This looks like a regression of a previously-fixed issue: the 2.1.207 changelog entry says "Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request" — the current build (2.1.218) appears to have reintroduced the same behavior.
• The subsequent Bedrock ListInferenceProfiles failed: JSON Parse error: Unrecognized token '<' on every run suggests the credential-refresh code path may be misinterpreting a non-JSON (proxy/error page) response as an auth failure, though this is unconfirmed.

Workaround

Removed awsAuthRefresh from settings.json and now run aws sso login manually before starting work. This avoids the repeated browser popups but means Claude Code no longer self-heals when the SSO session expires mid-session.