[BUG] awsAuthRefresh is not working properly after upgrade to claude code 2.0

I would like to include awsCredentialExport to this, as I guess they work pretty similar

same issue. had to revert

I've also run into this issue on windows.

What seems to be happening is when you run the command "aws sso login --profile profile-name"

the text
"Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open, open the following URL:

{url}
"
gets printed to the console. The extension seems to want that to be json, which it isn't. I've tried some work arounds, like "aws sso login --profile profile-name --output json" or "aws sso login --profile pofile-name 1> /dev/null". The first one does nothing, the second one stops this error from happening but then the extension just seems to hang

I also see this on Windows.

Sometimes it results in Unexpected token 'A', "Attempting"... is not valid JSON as OP shows, but sometimes it also presents as:

2025-10-03 16:28:47.383 [error] Error from Claude (on channel pul6moyf67): SyntaxError: Unexpected token 'C', "Claude con"... is not valid JSON

I'm running claude code 2.0.5 and the awsAuthRefresh issue seems to be resolved on my machine

It appears that claude is attempting to run the awsAuthRefresh command (aws sso login --profile <AWS_PROFILE>), which as WSL doesn't generally support launching browser windows causes it to hang silently in the background. In versions 2.0.9 and previous the tool would dump the link out to the console allowing users to auth manually.

A simple work-a-round is that still uses SSO involves using wslu to allow WSL to launch your browser in windows.

1. Install wslu:

The wslu package provides utilities specifically designed to improve the integration between WSL and Windows, including a more robust xdg-open implementation that can leverage Windows applications.

sudo add-apt-repository ppa:wslutilities/wslu
sudo apt update
sudo apt install wslu

1. Configure the BROWSER environment variable:

You can explicitly tell xdg-open which browser to use by setting the BROWSER environment variable. This is particularly useful if you have a specific browser installed in your WSL environment or want to use a Windows browser.

    export BROWSER=/mnt/c/Program\ Files/Mozilla\ Firefox/firefox.exe         # Example for Firefox
    export BROWSER=/mnt/c/Program\ Files/Google/Chrome/Application/chrome.exe # Example for Chrome
    export BROWSER=/mnt/c/Program\ Files/Internet\ Explorer/iexplore.exe      # Untested example for IE

Add this line to your ~/.bashrc or ~/.zshrc file for persistence and then source the file:

``` shell
source ~/.bashrc

Found a potential workaround.

To get the v1 CLI behavior for this we had to set up the rule like so to maintain the session across claude instances and also to not rely on the AWS CLI cache for session status we had to remove the cache before checking token validity in case of token expiration

{
  "awsAuthRefresh": "rm -rf ~/.aws/cli/cache/* 2>/dev/null; aws sts get-caller-identity --profile claude || aws sso login --profile claude"
...
}

1. Clear out CLI cache to ensure we have the true status of the token
2. Check the token status

a. If token is valid, skip
b. If token is invalid, go through SSO flow

Version 2.0.30 of the extension should now display the output of this command, allowing navigation to links which are emitted.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.