claude-aws-mfa 1.0.0-rc.4 → 1.0.0

package/README.md

@@ -14,25 +14,19 @@ bun install -g claude-aws-mfa@latest
 
 ### Guided Setup
 
-Run `claude-aws-mfa --setup`, to access a configuration UI for easy setup of this tool.  You will be presented with a checkbox to enable credential-handling, and fields to customize a few key settings.   Specifically, you can pin specific versions of the Anthropic models to use for Opus, Sonnet, and Haiku, in case your Bedrock policy does not allow you access to the latest default models that Claude Code will try to use.  You can also set the "max output tokens" and "max thinking tokens" values; in a corporate environment these often have recommended values to help manage costs.
+Run `claude-aws-mfa --setup`, to access a configuration UI for easy setup of this tool.  You will be presented with a checkbox to enable Bedrock via claude-aws-mfa, and fields to customize a few key settings.   Specifically, you can pin specific versions of the Anthropic models to use for Opus, Sonnet, and Haiku, in case your Bedrock policy does not allow you access to the latest default models that Claude Code will try to use.
 
 Once you have enabled credential-handling and saved the settings, you can launch Claude Code and begin work.  You will automatically prompted for your AWS credentials, and Claude will connect to the specified AWS Bedrock account rather than to the Anthropic servers.
 
 ### Manual Setup
 
-Add to your Claude Code settings (`~/.claude/settings.json`):
-
-```json
-{
-  "awsCredentialExport": "claude-aws-mfa"
-}
-```
-
-If you have an existing `~/.aws/credentials` file, you will likely need to suppress Claude's use of that file so it will correctly invoke the `awsCredentialExport` tool instead.
+Add this (plus any addtitional config you prefer) to your Claude Code settings (`~/.claude/settings.json`):
 
 ```json
 {
+  "awsCredentialExport": "claude-aws-mfa",
   "env": {
+    "CLAUDE_CODE_USE_BEDROCK": "1",
     "AWS_SHARED_CREDENTIALS_FILE": "/dev/null"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-aws-mfa",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0",
   "type": "module",
   "repository": "https://github.com/p120ph37/claude-aws-mfa",
   "bin": {

package/src/dialog-html.ts

@@ -1,3 +1,5 @@
+import { STANDARD_DURATIONS } from "./sts";
+
 export const FIELDS = ["region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "duration", "mfaMode", "mfaCode", "mfaCommand"] as const;
 
 export const FIELD_PATTERNS: Record<string, string> = {
@@ -58,7 +60,7 @@ export function buildHtml(config: Record<string, string>) {
   <div class="field"><label>Secret Access Key</label><input id="secretAccessKey" type="password"></div>
   <div class="field"><label>MFA Device ARN</label><input id="mfaArn" placeholder="arn:aws:iam::123456789012:mfa/user"></div>
   <div class="field"><label>Role ARN</label><input id="roleArn" placeholder="arn:aws:iam::123456789012:role/MyRole"></div>
-  <div class="field"><label>Session Duration (seconds)</label><input id="duration" placeholder="43200"></div>
+  <div class="field"><label>Session Duration (seconds)</label><input id="duration" placeholder="${STANDARD_DURATIONS[0]}"></div>
   <hr>
   <div class="radio-field">
     <input type="radio" name="mfaMode" id="mfaModeCode" value="code" checked>

package/src/dialog.ts

@@ -4,6 +4,7 @@ import type { Config } from "./config";
 import { buildHtml } from "./dialog-html";
 import { version } from "../package.json";
 
+
 export interface DialogResult {
   region: string;
   accessKeyId: string;
@@ -66,7 +67,7 @@ export function showDialog(defaults: Partial<Config>): DialogResult | null {
     secretAccessKey: defaults.secretAccessKey ?? "",
     mfaArn: defaults.mfaArn ?? "",
     roleArn: defaults.roleArn ?? "",
-    duration: String(defaults.duration ?? 43200),
+    duration: defaults.duration != null ? String(defaults.duration) : "",
     mfaCommand: defaults.mfaCommand ?? "",
     mfaMode: defaults.mfaMode ?? "code",
   }));

package/src/index.ts

@@ -23,7 +23,7 @@ if (arg === "setup" || arg === "--setup") {
 
 import { loadConfig, saveConfig, seedDefaults } from "./config";
 import { showDialog } from "./dialog";
-import { assumeRoleWithMfa } from "./sts";
+import { assumeRoleWithMfa, STANDARD_DURATIONS } from "./sts";
 
 const defaults = loadConfig() ?? await seedDefaults();
 
@@ -51,7 +51,7 @@ try {
     mfaArn: result.mfaArn,
     roleArn: result.roleArn,
     mfaCode,
-    duration: parseInt(result.duration, 10) || 43200,
+    duration: parseInt(result.duration, 10) || STANDARD_DURATIONS[0],
   });
 
   saveConfig({

package/src/setup-html.ts

@@ -1,31 +1,19 @@
 import type { ClaudeSettings } from "./claude-settings";
 
-export const ENV_CHECKBOXES = [
-  { key: "CLAUDE_CODE_USE_BEDROCK", value: "1", label: "Enable Bedrock" },
-] as const;
-
 export const TEXT_FIELDS = [
   { key: "ANTHROPIC_DEFAULT_OPUS_MODEL", label: "Opus Model", placeholder: "global.anthropic.claude-opus-4-6" },
   { key: "ANTHROPIC_DEFAULT_SONNET_MODEL", label: "Sonnet Model", placeholder: "global.anthropic.claude-sonnet-4-6" },
   { key: "ANTHROPIC_DEFAULT_HAIKU_MODEL", label: "Haiku Model", placeholder: "global.anthropic.claude-haiku-4-5" },
   { key: "CLAUDE_CODE_SUBAGENT_MODEL", label: "Subagent Model", placeholder: "global.anthropic.claude-sonnet-4-6" },
-  { key: "CLAUDE_CODE_MAX_OUTPUT_TOKENS", label: "Max Output Tokens", placeholder: "32000" },
-  { key: "CLAUDE_CODE_MAX_THINKING_TOKENS", label: "Max Thinking Tokens", placeholder: "31999" },
 ] as const;
 
 export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSettings, credentialExportCmd: string) {
-  const envCheckboxesHtml = ENV_CHECKBOXES.map(cb => {
-    const checked = env[cb.key] === cb.value ? "checked" : "";
-    return `<div class="checkbox-field">
-      <input type="checkbox" id="${cb.key}" ${checked}>
-      <label for="${cb.key}">${cb.label}</label>
-    </div>`;
-  }).join("\n  ");
-
-  const mfaEnabled = settings.awsCredentialExport !== undefined || env.AWS_SHARED_CREDENTIALS_FILE === "/dev/null";
-  const mfaCheckboxHtml = `<div class="checkbox-field">
-      <input type="checkbox" id="enableMfa" ${mfaEnabled ? "checked" : ""}>
-      <label for="enableMfa">Enable claude-aws-mfa</label>
+  const bedrockMfaEnabled = env.CLAUDE_CODE_USE_BEDROCK === "1"
+    && settings.awsCredentialExport !== undefined
+    && env.AWS_SHARED_CREDENTIALS_FILE === "/dev/null";
+  const bedrockMfaCheckboxHtml = `<div class="checkbox-field">
+      <input type="checkbox" id="enableBedrockMfa" ${bedrockMfaEnabled ? "checked" : ""}>
+      <label for="enableBedrockMfa">Enable Bedrock via claude-aws-mfa</label>
     </div>`;
 
   const textFieldsHtml = TEXT_FIELDS.map(f => {
@@ -76,8 +64,7 @@ export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSett
 <body>
   <h2>Claude Code Bedrock Setup</h2>
 
-  ${envCheckboxesHtml}
-  ${mfaCheckboxHtml}
+  ${bedrockMfaCheckboxHtml}
 
   <hr>
 
@@ -89,7 +76,6 @@ export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSett
   </div>
 
   <script>
-    const ENV_CHECKBOXES = ${JSON.stringify(ENV_CHECKBOXES)};
     const TEXT_FIELDS = ${JSON.stringify(TEXT_FIELDS)};
     const originalEnv = ${JSON.stringify(env)};
     const originalSettings = ${JSON.stringify(settings)};
@@ -99,26 +85,21 @@ export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSett
       const env = {};
       const top = {};
 
-      for (const cb of ENV_CHECKBOXES) {
-        const el = document.getElementById(cb.key);
-        if (el.checked) {
-          env[cb.key] = cb.value;
-        } else if (originalEnv[cb.key] === cb.value) {
-          env[cb.key] = null;
-        }
-      }
-
-      // Combined "Enable claude-aws-mfa" checkbox controls both
-      // awsCredentialExport (top-level) and AWS_SHARED_CREDENTIALS_FILE (env)
-      const mfaChecked = document.getElementById("enableMfa").checked;
-      if (mfaChecked) {
-        top["awsCredentialExport"] = credentialExportCmd;
-        env["AWS_SHARED_CREDENTIALS_FILE"] = "/dev/null";
-      } else {
-        if (originalSettings["awsCredentialExport"] !== undefined) {
+      // Combined checkbox controls CLAUDE_CODE_USE_BEDROCK,
+      // awsCredentialExport (top-level), and AWS_SHARED_CREDENTIALS_FILE (env).
+      // Only save changes when the checkbox state differs from load time.
+      const wasEnabled = originalEnv["CLAUDE_CODE_USE_BEDROCK"] === "1"
+        && originalSettings["awsCredentialExport"] !== undefined
+        && originalEnv["AWS_SHARED_CREDENTIALS_FILE"] === "/dev/null";
+      const enabled = document.getElementById("enableBedrockMfa").checked;
+      if (enabled !== wasEnabled) {
+        if (enabled) {
+          env["CLAUDE_CODE_USE_BEDROCK"] = "1";
+          top["awsCredentialExport"] = credentialExportCmd;
+          env["AWS_SHARED_CREDENTIALS_FILE"] = "/dev/null";
+        } else {
+          env["CLAUDE_CODE_USE_BEDROCK"] = null;
           top["awsCredentialExport"] = null;
-        }
-        if (originalEnv["AWS_SHARED_CREDENTIALS_FILE"] === "/dev/null") {
           env["AWS_SHARED_CREDENTIALS_FILE"] = null;
         }
       }

package/src/setup.ts

@@ -23,7 +23,7 @@ export function runSetup(): boolean {
 
   const webview = new Webview(false, {
     width: 480,
-    height: 640,
+    height: 480,
     hint: SizeHint.FIXED,
   });
   webview.title = `Claude Code Bedrock Setup v${version}`;

package/src/sts.ts

@@ -1,6 +1,6 @@
 import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts";
 
-const STANDARD_DURATIONS = [43200, 21600, 7200, 3600];
+export const STANDARD_DURATIONS = [129600, 86400, 43200, 28800, 21600, 14400, 7200, 3600];
 
 export function isDurationError(err: unknown): boolean {
   const msg = String(err).toLowerCase();

package/test/sts.test.ts

@@ -47,7 +47,7 @@ beforeEach(() => {
 
 describe("durationLadder", () => {
   test("standard duration returns it and all smaller standard values", () => {
-    expect(durationLadder(43200)).toEqual([43200, 21600, 7200, 3600]);
+    expect(durationLadder(43200)).toEqual([43200, 28800, 21600, 14400, 7200, 3600]);
   });
 
   test("mid-range standard duration", () => {
@@ -59,7 +59,7 @@ describe("durationLadder", () => {
   });
 
   test("non-standard duration is tried first, then smaller standard values", () => {
-    expect(durationLadder(50000)).toEqual([50000, 43200, 21600, 7200, 3600]);
+    expect(durationLadder(50000)).toEqual([50000, 43200, 28800, 21600, 14400, 7200, 3600]);
   });
 
   test("non-standard mid-range duration", () => {
@@ -125,24 +125,24 @@ describe("assumeRoleWithMfa", () => {
 
     const result = await assumeRoleWithMfa(BASE_PARAMS);
 
-    expect(result.duration).toBe(21600);
+    expect(result.duration).toBe(28800);
     expect(capturedCommands).toHaveLength(2);
     expect(capturedCommands[0].DurationSeconds).toBe(43200);
-    expect(capturedCommands[1].DurationSeconds).toBe(21600);
+    expect(capturedCommands[1].DurationSeconds).toBe(28800);
   });
 
   test("tries all durations in ladder on repeated duration errors", async () => {
     let callCount = 0;
     mockSend = mock(() => {
       callCount++;
-      if (callCount < 4) return Promise.reject(new Error("DurationSeconds exceeds the maximum"));
+      if (callCount < 6) return Promise.reject(new Error("DurationSeconds exceeds the maximum"));
       return Promise.resolve(MOCK_CREDENTIALS);
     });
 
     const result = await assumeRoleWithMfa(BASE_PARAMS);
 
     expect(result.duration).toBe(3600);
-    expect(capturedCommands).toHaveLength(4);
+    expect(capturedCommands).toHaveLength(6);
   });
 
   test("throws non-duration errors immediately without retry", async () => {