From 08453b0456825c0f47152db0cc2765306a76319a Mon Sep 17 00:00:00 2001
From: Guy Elia <guy2607@gmail.com>
Date: Thu, 29 Jan 2026 19:27:02 +0200
Subject: [PATCH] fix: treat AWS SSO token errors as auth for model failover

---
 src/agents/pi-embedded-helpers/errors.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/agents/pi-embedded-helpers/errors.ts b/src/agents/pi-embedded-helpers/errors.ts
index 849c4293e..5e478051c 100644
--- a/src/agents/pi-embedded-helpers/errors.ts
+++ b/src/agents/pi-embedded-helpers/errors.ts
@@ -388,6 +388,10 @@ const ERROR_PATTERNS = {
     /\b403\b/,
     "no credentials found",
     "no api key found",
+    // AWS SSO / aws-sdk auth resolution errors (e.g. Bedrock)
+    "sso session token",
+    "error loading sso token",
+    "was not found or is invalid",
   ],
   format: [
     "string should match pattern",