[BUG] Claude Desktop 3P (Bedrock SSO): credential resolver ignores HTTPS_PROXY — DNS fails on restricted networks

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Desktop in 3P mode (AWS Bedrock with SSO credentials) fails to authenticate on networks where:

• Internal DNS does not resolve public AWS domains (by design)
• External traffic must go through a local HTTPS proxy (e.g., Zscaler Client Connector)

The error:

API Error: DNSException: getaddrinfo ENOTFOUND portal.sso.eu-west-1.amazonaws.com

The HTTPS_PROXY and HTTP_PROXY environment variables are correctly set and visible inside the Claude Desktop process, but the custom-3p credential resolver (SSO token refresh + Bedrock auth) does not use them.

The credential resolver calls portal.sso.eu-west-1.amazonaws.com directly via Node.js https.request() → triggers getaddrinfo() → fails because the local DNS cannot resolve AWS domains.

What Should Happen?

When HTTPS_PROXY is set, the AWS SDK calls for SSO credential resolution should route through the proxy (using a ProxyAgent), just like the AWS CLI (Python SDK) does.

The custom-3p credential resolver should configure a ProxyAgent on the AWS SDK clients when HTTPS_PROXY is defined.

Error Messages/Logs

Claude Desktop fails immediately with:

API Error: DNSException: getaddrinfo ENOTFOUND portal.sso.eu-west-1.amazonaws.com

### Evidence

| Test | Result |
|---|---|
| `HTTPS_PROXY` in process env (confirmed via PowerShell `Get-Process`) | `http://127.x.x.x:xxxx` |
| `curl --proxy http://127.x.x.x:xxxx https://portal.sso.eu-west-1.amazonaws.com` | Works (HTTP 404 from AWS) |
| `aws sts get-caller-identity --profile <bedrock-profile>` | Works |
| `aws sso login --profile <bedrock-profile>` | Works |
| Claude Desktop with `set HTTPS_PROXY=... && claude.exe` | Still fails with DNS error |
| Claude Desktop with `--proxy-server="http://127.x.x.x:xxxx"` | Still fails (expected — Chromium flag doesn't affect Node.js calls) |

### Relevant logs (`%LOCALAPPDATA%\Claude-3p\logs\main.log`)


[warn] [CCD] System proxy resolution failed: Error: resolveProxy timed out after 2000ms
[info] [CCD] Resolved system proxy for Code sessions: http://127.x.x.x:xxxx
[warn] [custom-3p] AWS profile SSO refresh rejected (terminal) { errorType: 'InvalidGrantException', status: 400 }
...
error_message: 'API Error: DNSException: getaddrinfo ENOTFOUND portal.sso.eu-west-1.amazonaws.com'


Note: CCD (Code sessions) eventually resolves and uses the proxy. The `custom-3p` module does not.

Steps to Reproduce

Configure Claude Desktop 3P with AWS Bedrock SSO
Set HTTPS_PROXY=<local-proxy> in Windows environment
Block public DNS resolution at the network level (only local DNS resolves)
Launch Claude Desktop and try to use a session
Expected: Session initializes successfully, using the proxy for AWS auth calls

Actual: Immediate DNS failure, cannot authenticate

Versions:

Claude Desktop: 1.24012.1 (Windows, MSIX)
Mode: 3P Bedrock with SSO (MDM managed config)

Claude Model

Not sure / Multiple models

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Claude Desktop: 1.18286.0 (Windows, MSIX)

Claude Code Version

Claude Desktop: 1.24012.1 (Windows, MSIX)

Platform

AWS Bedrock

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

github_issue_claude_proxy_bug.md