changelog(unreleased): AWS SSO keeper (pi-extensions f885199); pi-studio v0.9.63 named
pi-extensions 143a214 -> f885199 adds aws-sso.ts: renews the Bedrock SSO session just after IdC ends it (end read from AWS's token cap), local mode via the host browser, remote mode via device code + ntfy push. Measured on mbp-m1-2020 2026-10-11/12. pi-studio moved upstream 641aa32 -> fae3ad3 (v0.9.63) and CI's newest-tag resolution will bake it; named so check-doc-drift passes, not yet reviewed.
This commit is contained in:
pi@mbp-m1-2020
@@ -11,6 +11,76 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
|
||||
|
||||
---
|
||||
|
||||
## Unreleased
|
||||
|
||||
### Components that move with the next build
|
||||
|
||||
| Component | Baked in v1.10.2 | Next build | Why |
|
||||
|---|---|---|---|
|
||||
| pi-extensions | `143a214` | **`f885199`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` extension: keeps the Bedrock SSO session alive (below) |
|
||||
| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) |
|
||||
|
||||
### Added
|
||||
|
||||
- **Long Bedrock runs no longer die at "Token is expired" when the AWS SSO
|
||||
session ends: `/aws-sso` (pi-extensions `aws-sso.ts`) runs `aws sso login` for
|
||||
you just after the session ends.** Off until `/aws-sso on` (or
|
||||
`PI_AWS_SSO_REFRESH=1`), so other devices stay as they are.
|
||||
|
||||
Why this is needed: pi's AWS SDK already renews the 1-hour access token by itself.
|
||||
The limit is the IAM Identity Center session behind it, the browser's AWS sign-in,
|
||||
which the IdC admin caps (8 h here, measured three times). After it, AWS refuses
|
||||
every renewal, and a long or overnight run stops. Renewing on a clock does not
|
||||
work: a login while the browser sign-in is still valid completes silently but
|
||||
*inherits* its end. Only a login after the end starts a new session.
|
||||
|
||||
How it finds the end: in the session's last hour AWS still issues tokens, but caps
|
||||
them at the end. The keeper makes the SDK's own renewal attempt as soon as the
|
||||
SDK's 5-minute window opens and reads the result from the token cache: a token
|
||||
issued for under 55 min gives the end, and the login runs 30 s after it. A refused
|
||||
renewal triggers the login at once. If a request fails anyway (pi closed, laptop
|
||||
asleep), it logs in and sends `continue`, so the run resumes. It never handles
|
||||
passwords or MFA, and tokens appear only as `sha256[:8]` fingerprints.
|
||||
|
||||
Two modes, set per device with `/aws-sso local|remote` or `PI_AWS_SSO_MODE`:
|
||||
`local` (default) runs the login on the Docker host over `~/.ssh-local/config`,
|
||||
so the host's signed-in browser normally completes it silently. `remote`
|
||||
(headless server, ssh + tmux) uses the device-code flow in the container: link
|
||||
and code shown in pi and pushed to the phone via [ntfy](https://ntfy.sh)
|
||||
(`PI_AWS_SSO_NTFY`; the topic name is a secret, shown only as a fingerprint).
|
||||
Pushes also report a `local` login waiting for you, a failed login and a renewal.
|
||||
|
||||
Measured on mbp-m1-2020 (macOS host, `local`), 2026-10-11/12: overnight, two
|
||||
unattended silent logins with nobody at the Mac. Then, with the final rule: the
|
||||
end was read from the cap at 08:08:57 (session end 08:47:55), and the login ran
|
||||
at 08:48:40 and completed in 7 s with a new full-hour token, before any request
|
||||
failed.
|
||||
|
||||
`.env.example` documents the `PI_AWS_SSO_*` variables. The setup guide (modes
|
||||
per device type, ntfy, log reference, troubleshooting) is pi-extensions
|
||||
[`docs/aws-sso.md`](https://gitea.jordbo.se/joakimp/pi-extensions/src/branch/main/docs/aws-sso.md).
|
||||
`.env` changes need a container recreate. To try a variable without one, run a
|
||||
second pi as the right user: `docker exec` defaults to **root** here (the image
|
||||
sets no `USER`), and root has no `~/.aws` ("Could not load credentials from any
|
||||
providers"). Use
|
||||
`docker exec -it -u developer -e PI_AWS_SSO_NTFY=… pi-devbox bash -lc pi`.
|
||||
|
||||
### Still open
|
||||
|
||||
- `remote` mode end to end (code → push → approve on the phone) is unit-tested and
|
||||
its push path is verified against ntfy.sh, but no live device-code renewal has
|
||||
run yet.
|
||||
- `local` is verified on a macOS host only. On a Linux or Windows host, the login
|
||||
started over SSH may not reach the desktop browser; `PI_AWS_SSO_LOCAL_CMD`
|
||||
overrides the host command.
|
||||
- AWS refused renewals twice with time left in the session (a probe 5 min before
|
||||
the end, a failed request about 2 h before it). The cause is unknown; both times
|
||||
a login then worked at once.
|
||||
- The real fix is administrative: the IdC admin can raise the session length (up to
|
||||
90 days), after which the keeper has almost nothing to do.
|
||||
|
||||
---
|
||||
|
||||
## v1.10.2 — 2026-10-02
|
||||
|
||||
**v1.10.0 and v1.10.1 were both tagged and never published.** Neither failure
|
||||
|
||||
Reference in New Issue
Block a user