cloudsesame

Appearance

cloudsesameOpen sesame for your clouds.

Checks that you're online and logged in to gcloud, aws and az before you work, and logs you in when you're not.

Get started
Recipes
GitHub
A vault door in a brick wall, swung open on a golden glow

Connectivity first

It knows you're offline before it tries to log you in. predev lets you carry on offline; auth stops.

predev

Every login that matters

gcloud user and Application Default Credentials, AWS SSO and console login, Azure. Tokens are tested, not just cached.

Providers

The right account

Pin the gcloud account, project and quota project, the AWS account ID, the Azure tenant and subscription. Optionally check IAM permissions on GCP and Azure.

Configuration

One-key fixes

It runs the exact command for you, like aws sso login --profile prod, then checks again. Or skip, or stop.

auth

Safe in CI and agents

No terminal, no prompt. Clear exit codes, the command to run, --json output, and an Agent Skill for coding agents.

CI and AI agents

Config in your repo

A typed sesame.config.ts (or JSON with a schema) with no secrets. Commit it and everyone checks the same things.

Configuration

Why

Catch the expired login before your command does ​

You run bun dev or tofu plan. Halfway through, it dies with invalid_grant, ExpiredToken or AADSTS700082. You look up the right login command, log in, and run it again.

cloudsesame checks everything in a few seconds before you start, and offers the exact fix:

  • Log in runs the provider's login, then checks again.
  • Skip carries on without that provider.
  • Stop exits, so nothing runs half-authenticated.
$ bunx cloudsesame infra
✔ online
✖ gcloud user  me@acme.dev  reauthentication required
  → gcloud auth login --update-adc
✔ gcloud adc
✔ gcloud quota project  acme-billing
✔ aws prod  arn:aws:sts::222222222222:assumed-role/Admin/me

? gcloud isn't ready.
❯ Log in (l)  gcloud auth login --update-adc
  Skip (s)
  Stop (x)

Install

Pick your package manager ​

The npm package runs on Node ≥ 18 or Bun; the interactive UI needs Node ≥ 22 (older versions get plain output). Standalone binaries need no runtime.

sh
bunx cloudsesame            # run without installing
npx cloudsesame
npm install -g cloudsesame  # or: bun add -g cloudsesame
sh
brew install NexiHealth/tap/cloudsesame
sh
scoop bucket add NexiHealth https://github.com/NexiHealth/scoop-bucket
scoop install cloudsesame
sh
choco install cloudsesame
sh
# Download the archive for your platform from
# https://github.com/NexiHealth/cloudsesame/releases/latest
# extract it and put `cloudsesame` on your PATH.

Configure

One file, committed with your code ​

cloudsesame init writes a starter config from the CLIs you have installed. It holds no secrets: just what to check and what counts as ready.

No config at all? cloudsesame checks every cloud CLI you have installed, with default settings.

Then hook it into your scripts: predev runs before dev and is lenient, a group like infra makes sure everything a tofu plan needs is logged in.

Configuration reference
ts
import type { Config } from "cloudsesame";

export default {
  gcloud: { credentials: "adc", project: "acme-dev" },
  aws: [
    { profile: "staging", accountId: "111111111111" },
    { profile: "prod", accountId: "222222222222" },
  ],
  groups: { infra: ["gcloud", "aws"] },
} satisfies Config;
json
{
  "$schema": "https://unpkg.com/cloudsesame/dist/schema.json",
  "gcloud": { "credentials": "adc", "project": "acme-dev" },
  "aws": [
    { "profile": "staging", "accountId": "111111111111" },
    { "profile": "prod", "accountId": "222222222222" }
  ],
  "groups": { "infra": ["gcloud", "aws"] }
}
jsonc
{
  "scripts": {
    "predev": "cloudsesame predev",          // before `dev`: lenient, skipping is fine
    "auth": "cloudsesame infra",             // log in to everything infra needs
    "plan": "cloudsesame infra && tofu plan" // never start a plan with expired credentials
  }
}

Automation

Never hangs, always says why ​

Without a terminal, prompts become failures with the command to run, or skips with --skip. Scripts, CI and agents branch on the exit code.

0Ready
1Unexpected error
2Invalid arguments or config
3Offline
4A provider isn't ready
5You chose Stop
130Interrupted with Ctrl-C

Stop rerunning tofu plan after a login.

Set it up once in your repo, and every run starts online and logged in to the right accounts.

Get startedBrowse recipes