joakimp/pi-extensions
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

aws-sso: keep the Bedrock SSO session alive by running aws sso login before it ends

Browse Source 
Like Claude Code's awsAuthRefresh: the user still approves each login.
mode mac runs it on the Docker host over SSH (own browser); mode device shows
the device code in pi for SSH/tmux use. Off by default (/aws-sso on).
Session start inferred from refresh-token changes; 8 h default, measured.
This commit is contained in:
pi@mbp-m1-2020
2026-10-11 17:06:04 +02:00
parent 143a2145e1
commit efdaba606e
4 changed files with 530 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+32
View File
@@ -356,6 +356,38 @@ Each extension is a TypeScript module loaded by [jiti](https://github.com/unjs/j
---
### `aws-sso.ts`
Keeps a Bedrock **AWS SSO** session alive, like Claude Code's `awsAuthRefresh`:
shortly before the IAM Identity Center session ends (or when a request fails on
an expired token) it runs `aws sso login` for you. **You still approve the login.**
Off until you enable it.
| Command | Effect |
|---|---|
| `/aws-sso on` / `off` | Enable/disable (persisted in `~/.pi/agent/aws-sso/state.json`) |
| `/aws-sso status` | Mode, profile chain, time left, last login |
| `/aws-sso now` | Log in now |
| `/aws-sso mode mac` | Run `aws sso login` on the Docker host over SSH (`~/.ssh-local/config`, host alias `host` or `$PI_AWS_SSO_SSH_HOST`): your own browser opens. Default when the sidecar config exists. |
| `/aws-sso mode device` | Run `aws sso login --use-device-code --no-browser` here and show link + code in pi; approve on any device. For SSH/tmux sessions. |
| `/aws-sso hours <n>` | Session length if your IdC admin changed it (default 8 h, measured) |
`PI_AWS_SSO_REFRESH=1` / `=0` force it on / off regardless of the saved state.
**How it knows when the session ends.** The AWS SDK already refreshes the 1-hour
access token inside a session; only the session itself expires (admin-set; 8 h
measured on 2026-10-10). Its start is not stored anywhere, so the extension
treats a new *refresh token* in `~/.aws/sso/cache/<sha1(sso-session)>.json` as a
new session and remembers when it first saw it. Tokens are only ever logged as
`sha256[:8]` fingerprints (`~/.pi/agent/aws-sso/events.jsonl`).
**Triggers:** a 60 s timer (20 min before the end; one attempt per session, so an
ignored login does not loop), `before_agent_start` (if the session has already
expired, log in and wait before sending the prompt), and `message_end` (a request
failed with an expired-token error → log in, then tell you to send `continue`).
Only interactive sessions act; print/JSON children (`task`, `fork`) stay inert.
A lock file stops several pi processes from starting several logins.
## Deploying on a new machine
```bash