[FEATURE] Running sessions should adopt a fresh Claude apps gateway login instead of each needing its own /login

Priority: High - Significant impact on productivity
Category: Configuration and settings

Problem Statement

When a Claude apps gateway session can no longer be refreshed (the IdP rejects the refresh grant, e.g. because its SSO session has ended), every running Claude Code session on the machine shows:

API Error: Cloud gateway session expired — run /login to reconnect

Running /login in one of those sessions recovers that session only. Signing in writes a fresh gateway credential to the Keychain, and every new session picks it up without prompting, but the other sessions that were already running stay expired. Each one needs its own /login and a full gateway SSO round trip. With several long-lived sessions open, one expiry turns into N identical sign-ins.

Proposed Solution

When a gateway session's refresh fails, or a request or /managed/settings returns invalid-token, re-read the stored credential before declaring the session expired. If another process has written a newer gateway credential, adopt it and carry on. Only show the expiry message if the stored credential is also dead.

The claude.ai login already works this way. 2.1.81 fixed "multiple concurrent Claude Code sessions requiring repeated re-authentication when one session refreshes its OAuth token", and 2.1.271 made the organization policy refresh "when the credential changes mid-session". This request is to give gateway sessions the same behaviour.

Alternative Solutions

• If re-reading on every failure is undesirable, re-read when the user runs /login in an expired session. The session would skip the SSO flow if a valid credential is already stored.
• Workaround today: /login in each session, or quit each one and resume it with claude --continue / --resume.

Use Case Example

1. Open four Claude Code sessions against a self-hosted Claude apps gateway (forceLoginMethod: "gateway" in managed settings).
2. Let the IdP's SSO session lapse, so the next refresh fails with invalid_grant.
3. All four sessions report "Cloud gateway session expired".
4. Run /login in one of them and complete the gateway sign-in. That session recovers, and new sessions start authenticated.
5. Expected: the other three recover on their next request. Actual: each of the three needs its own /login and SSO round trip.

Additional Context

• Claude Code 2.1.278, macOS, native install. Credential is in the Keychain item Claude Code-credentials. Self-hosted Claude apps gateway, OIDC IdP with refresh tokens.
• In-session /login does offer the gateway sign-in on 2.1.278, so #80000 appears fixed; this request is about not having to repeat it per session.
• Related: #80000, #80085 and #94464 (claude.ai sessions sharing one Keychain credential).