opencode-plugin-aws-auth-refresh

An OpenCode plugin that automatically detects AWS authentication errors and refreshes credentials via aws sso login.

Installation

From npm

Add to your opencode.json:

{
  "plugin": ["@devtheops/opencode-plugin-aws-auth-refresh"]
}

Local Installation

Place in .opencode/plugins/aws-auth-refresh.ts or ~/.config/opencode/plugins/.

Configuration

OpenCode plugin entries can be either a string or a [pluginName, options] tuple. To pass options to this plugin, use the tuple form:

{
  "plugin": [
    [
      "@devtheops/opencode-plugin-aws-auth-refresh",
      {
        "profile": "my-aws-profile",
        "autoRetry": true,
        "maxRetries": 1,
        "ssoLoginCommand": "aws sso login --profile my-aws-profile --no-browser"
      }
    ]
  ]
}

If you do not need any plugin-specific options, use the string form instead:

{
  "plugin": ["@devtheops/opencode-plugin-aws-auth-refresh"]
}

If you prefer not to set profile in config, the plugin falls back to AWS_PROFILE, then to default.

Options

Option	Type	Default	Description
profile	string	AWS_PROFILE env or "default"	AWS profile to use
autoRetry	boolean	true	Automatically retry the failed command after refresh
maxRetries	number	1	Maximum number of retry attempts
ssoLoginCommand	string	aws sso login --profile <profile>	Custom SSO login command

How It Works

1. Hooks into tool.execute.after to inspect tool outputs
2. Detects AWS authentication error patterns:
   • ExpiredToken
   • TokenRefreshRequired
   • The security token included in the request is expired
   • Unable to locate credentials
   • And more...
3. Runs aws sso login with your configured profile
4. Optionally retries the failed command

Detected Error Patterns

• ExpiredToken
• TokenRefreshRequired
• The security token included in the request is expired
• credentials expired
• Unable to locate credentials
• Missing credentials
• credentials could not be found
• Error retrieving credentials
• EC2MetadataServiceError

Requirements

• AWS CLI v2 installed
• Valid SSO configuration in ~/.aws/config

Example Output

[aws-auth-refresh] AWS credentials expired, running: aws sso login --profile default
[aws-auth-refresh] AWS credentials refreshed successfully
[aws-auth-refresh] Retrying tool after credential refresh

License

Mozilla Public License 2.0