Repository navigation
Conversation
…fail If no profile is selected and the default credentials do not work, setup and status ask which profile to use. The picker lists the profiles with an SSO session first, with the account, region, and role of each. It shows 10 profiles at most and scrolls in place. Press / to search. If the profile has no region, the command asks for one. Without a terminal, the command does not ask. With --yes, it uses the one signed-in profile. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…light The huh select moved its window to the highlighted row on every key, so the highlight stayed on the first row and the rows above it were hidden. The new picker shows all rows of a list with 10 rows or fewer. In a longer list, the highlight moves down to the last row, and then the list scrolls under it. Typing searches at once, and Esc clears the search. The title and the highlighted row use the accent color of the sync pickers. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit af70fbd. Configure here.
| noProfile := errors.Is(err, awsdevops.ErrNoCredentials) || | ||
| errors.Is(err, awsdevops.ErrNoRegion) && !awsdevops.HasProfile("default") | ||
| if !noProfile { | ||
| return l.clientsAfter(ctx, region, profile, clients, err) |
There was a problem hiding this comment.
Default section skips profile picker
High Severity
A [default] section with no region makes load treat missing region as a selected profile, so the picker never runs. NewClients fails on region before credentials, and clientsAfter then asks for a region and retries default instead of asking which profile to use. A leftover empty or output-only [default] is enough to trigger this when AWS_REGION is unset.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit af70fbd. Configure here.
Requirements
Describe the solution you've provided
With this PR, if no profile is selected and the default credentials do not work,
setupandstatusask which profile to use:~/.aws/configand~/.aws/credentials. It shows the account, region, and role of each profile. It reads only those keys, so a secret access key never leaves the file.~/.aws/sso/cachehas a✓and comes first. All the profiles that share an SSO session share one token.Using AWS profile X. To skip this question, pass --profile X or run export AWS_PROFILE=X.aws sso loginoffer runs after the choice.--yes, it uses the one signed-in profile if there is exactly one. Otherwise it returns the current error.--profile,AWS_PROFILE, orAWS_ACCESS_KEY_IDskips the picker.The picker is a small
bubbleteamodel with abubblestext input. It runs inline, not in the alternate screen, so the output above it stays visible. It cuts each line to the terminal width, because a wrapped line breaks the redraw. It uses the accent color of thesyncpickers. Thehuhselect was not usable here: inhuhv1.0.0,Select.Updatesets the window offset to the highlighted row on every key, so the highlight stayed on the first row.Describe alternatives you've considered
#962 improves the error messages and does not ask. It lists five profiles with account and role, and tells the user to pass
--profile. The two PRs can merge together. They both changeNewClientserrors andloadClients, so the second one to merge needs a small rebase.Additional context
The command is hidden, so users do not see this yet.
To try it, unset
AWS_PROFILEandAWS_REGION, make sure that no default profile works, and run./ldcli aws-devops-agent status.🤖 Generated with Claude Code
Note
Overview
When default AWS credentials fail and no profile is explicitly selected, aws-devops-agent
setup/statusnow guide setup in an interactive terminal: a searchable bubbletea picker for profile (SSO-signed-in profiles first, with ✓) and, if needed, for a supported region. The chosen profile is written back to--profileand the user gets hints to setAWS_PROFILE/AWS_REGION.Client loading is refactored through
ssoLogin.load/clientsAfter: profile prompting runs only on “default fallback” (no--profile/AWS_PROFILE/env keys); non-TTY and--yeskeep prior behavior (--yesauto-picks the sole signed-in SSO profile). Existing aws sso login on expired tokens still runs after resolution.New
internal/awsdevopsprofile discovery parses~/.aws/configand credentials for display metadata only (no secret keys), checks SSO cache token expiry, and exposesDefaultFallback/HasProfile. Command help text documents the flow. Broad unit tests cover load paths and picker UX (search, scroll, cancel).Reviewed by Cursor Bugbot for commit af70fbd. Bugbot is set up for automated code reviews on this repo. Configure here.