fix(opencode): handle AWS SSO session expiry with automatic re-login

packages/opencode/src/plugin/codex.ts

@@ -374,6 +374,7 @@ export async function CodexAuthPlugin(input: PluginInput): Promise<Hooks> {
           "gpt-5.3-codex",
           "gpt-5.4",
           "gpt-5.4-mini",
+          "gpt-5.5",
         ])
         for (const [modelId, model] of Object.entries(provider.models)) {
           if (modelId.includes("codex")) continue

packages/opencode/src/provider/provider.ts

@@ -1,4 +1,5 @@
 import os from "os"
+import { spawn } from "child_process"
 import fuzzysort from "fuzzysort"
 import { Config } from "@/config/config"
 import { mapValues, mergeDeep, omit, pickBy, sortBy } from "remeda"
@@ -28,6 +29,8 @@ import { withStatics } from "@/util/schema"
 
 import * as ProviderTransform from "./transform"
 import { ModelID, ProviderID } from "./schema"
+import { Bus } from "@/bus"
+import { TuiEvent } from "@/cli/cmd/tui/event"
 
 const log = Log.create({ service: "provider" })
 
@@ -309,7 +312,39 @@ function custom(dep: CustomDep): Record<string, CustomLoader> {
         // Build credential provider options (only pass profile if specified)
         const credentialProviderOptions = profile ? { profile } : {}
 
-        providerOptions.credentialProvider = fromNodeProviderChain(credentialProviderOptions)
+        const rawProvider = fromNodeProviderChain(credentialProviderOptions)
+        providerOptions.credentialProvider = async () => {
+          try {
+            return await rawProvider()
+          } catch (e) {
+            if (e instanceof Error && e.name === "CredentialsProviderError") {
+              void Bus.publish(TuiEvent.ToastShow, {
+                variant: "warning",
+                message: "AWS SSO session expired — re-authenticating...",
+                duration: 5000,
+              })
+              await new Promise<void>((resolve, reject) => {
+                const args = ["sso", "login", ...(profile ? ["--profile", profile] : [])]
+                const child = spawn("aws", args, { stdio: "pipe" })
+                child.on("exit", (code) => {
+                  if (code === 0) {
+                    void Bus.publish(TuiEvent.ToastShow, {
+                      variant: "success",
+                      message: "AWS SSO re-authentication successful",
+                      duration: 5000,
+                    })
+                    resolve()
+                  } else {
+                    reject(e)
+                  }
+                })
+                child.on("error", () => reject(e))
+              })
+              return await rawProvider()
+            }
+            throw e
+          }
+        }
       }
 
       // Add custom endpoint if specified (endpoint takes precedence over baseURL)