v0.5.0

What's New

Credential Sync

Optionally sync AWS session credentials to remote machines after every successful login. Supports three sync types:

• SSH — Copy credentials to remote ~/.aws/credentials via SSH (key-based or sshpass)
• Webhook — POST credentials to an HTTPS endpoint
• Command — Pipe credential JSON to a custom shell command's stdin

Features

• Fires proactively (each prompt when creds are fresh) and reactively (after auto-login re-auth)
• Debounced via configurable syncCooldownSeconds (default: 60s)
• Refuses to sync long-lived IAM keys (session token required)
• HTTPS-only enforcement for webhooks
• Atomic remote writes (write to .tmp, then mv)
• Credentials piped via stdin — never in CLI arguments or env vars
• sshArgs accepts both string and array form

Security Hardening

• remotePath validated against safe-path regex (blocks shell injection)
• sshpass -e (env var) instead of -p (no password in ps output)
• Capped stderr buffers at 8KB
• Webhook URL validated early with clear error messages
• Documented TOFU trade-off for SSH host key verification

Configuration

New fields in ~/.config/cc-aws-keepalive/config.json:

{
  "syncTargets": [],
  "syncTimeoutSeconds": 15,
  "syncCooldownSeconds": 60
}

See README — Credential sync for full documentation.