From eb70928b16826111b3291f43c511988a83ab73a2 Mon Sep 17 00:00:00 2001 From: "pi@mbp-m1-2020" Date: Mon, 12 Oct 2026 09:20:48 +0200 Subject: [PATCH] changelog(unreleased): AWS SSO keeper (pi-extensions f885199); pi-studio v0.9.63 named pi-extensions 143a214 -> f885199 adds aws-sso.ts: renews the Bedrock SSO session just after IdC ends it (end read from AWS's token cap), local mode via the host browser, remote mode via device code + ntfy push. Measured on mbp-m1-2020 2026-10-11/12. pi-studio moved upstream 641aa32 -> fae3ad3 (v0.9.63) and CI's newest-tag resolution will bake it; named so check-doc-drift passes, not yet reviewed. --- CHANGELOG.md | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2dd91f6..24a9725 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,76 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`). --- +## Unreleased + +### Components that move with the next build + +| Component | Baked in v1.10.2 | Next build | Why | +|---|---|---|---| +| pi-extensions | `143a214` | **`f885199`** (or later: CI resolves `main` at build time) | new `aws-sso.ts` extension: keeps the Bedrock SSO session alive (below) | +| pi-studio | `v0.9.61` (`641aa32`) | **`v0.9.63`** (`fae3ad3`) | upstream releases (v0.9.62, v0.9.63), picked up by CI's newest-tag resolution; `-studio` variant only; **not reviewed yet**: [compare](https://github.com/omaclaren/pi-studio/compare/641aa3288a6bfd4a7eb37a3a4847836de85e0593...fae3ad38d23c9666981bfc29f9a4e06d56f8de84) | + +### Added + +- **Long Bedrock runs no longer die at "Token is expired" when the AWS SSO + session ends: `/aws-sso` (pi-extensions `aws-sso.ts`) runs `aws sso login` for + you just after the session ends.** Off until `/aws-sso on` (or + `PI_AWS_SSO_REFRESH=1`), so other devices stay as they are. + + Why this is needed: pi's AWS SDK already renews the 1-hour access token by itself. + The limit is the IAM Identity Center session behind it, the browser's AWS sign-in, + which the IdC admin caps (8 h here, measured three times). After it, AWS refuses + every renewal, and a long or overnight run stops. Renewing on a clock does not + work: a login while the browser sign-in is still valid completes silently but + *inherits* its end. Only a login after the end starts a new session. + + How it finds the end: in the session's last hour AWS still issues tokens, but caps + them at the end. The keeper makes the SDK's own renewal attempt as soon as the + SDK's 5-minute window opens and reads the result from the token cache: a token + issued for under 55 min gives the end, and the login runs 30 s after it. A refused + renewal triggers the login at once. If a request fails anyway (pi closed, laptop + asleep), it logs in and sends `continue`, so the run resumes. It never handles + passwords or MFA, and tokens appear only as `sha256[:8]` fingerprints. + + Two modes, set per device with `/aws-sso local|remote` or `PI_AWS_SSO_MODE`: + `local` (default) runs the login on the Docker host over `~/.ssh-local/config`, + so the host's signed-in browser normally completes it silently. `remote` + (headless server, ssh + tmux) uses the device-code flow in the container: link + and code shown in pi and pushed to the phone via [ntfy](https://ntfy.sh) + (`PI_AWS_SSO_NTFY`; the topic name is a secret, shown only as a fingerprint). + Pushes also report a `local` login waiting for you, a failed login and a renewal. + + Measured on mbp-m1-2020 (macOS host, `local`), 2026-10-11/12: overnight, two + unattended silent logins with nobody at the Mac. Then, with the final rule: the + end was read from the cap at 08:08:57 (session end 08:47:55), and the login ran + at 08:48:40 and completed in 7 s with a new full-hour token, before any request + failed. + + `.env.example` documents the `PI_AWS_SSO_*` variables. The setup guide (modes + per device type, ntfy, log reference, troubleshooting) is pi-extensions + [`docs/aws-sso.md`](https://gitea.jordbo.se/joakimp/pi-extensions/src/branch/main/docs/aws-sso.md). + `.env` changes need a container recreate. To try a variable without one, run a + second pi as the right user: `docker exec` defaults to **root** here (the image + sets no `USER`), and root has no `~/.aws` ("Could not load credentials from any + providers"). Use + `docker exec -it -u developer -e PI_AWS_SSO_NTFY=… pi-devbox bash -lc pi`. + +### Still open + +- `remote` mode end to end (code → push → approve on the phone) is unit-tested and + its push path is verified against ntfy.sh, but no live device-code renewal has + run yet. +- `local` is verified on a macOS host only. On a Linux or Windows host, the login + started over SSH may not reach the desktop browser; `PI_AWS_SSO_LOCAL_CMD` + overrides the host command. +- AWS refused renewals twice with time left in the session (a probe 5 min before + the end, a failed request about 2 h before it). The cause is unknown; both times + a login then worked at once. +- The real fix is administrative: the IdC admin can raise the session length (up to + 90 days), after which the keeper has almost nothing to do. + +--- + ## v1.10.2 — 2026-10-02 **v1.10.0 and v1.10.1 were both tagged and never published.** Neither failure