claude-aws-mfa 1.1.0 → 1.2.1

package/.github/workflows/release.yml

@@ -8,28 +8,36 @@ on:
 jobs:
   detect-release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.parse.outputs.version }}
       prerelease: ${{ steps.parse.outputs.prerelease }}
     steps:
       - uses: actions/checkout@v4
-        with:
-          fetch-tags: true
 
       - name: Parse latest changelog version
         id: parse
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          # Extract the first heading that matches: ## [vX.Y.Z...] - YYYY-MM-DD
-          # The date is required — headings without a date are treated as drafts.
-          HEADING=$(grep -P '^## \[v[^\]]+\]\s+-\s+\d{4}-\d{2}-\d{2}' CHANGELOG.md | head -1)
+          # The topmost `## [...]` heading governs, dated or not.
+          #
+          # Deliberately NOT "the topmost *dated* heading": that made a typo in
+          # the newest entry's date invisible. The heading simply failed to
+          # match, the search fell through to an older entry — or to nothing —
+          # and the run reported success having done nothing at all. A heading
+          # that was meant to release has to fail loudly, not silently.
+          HEADING=$(grep -m1 -P '^## \[' CHANGELOG.md || true)
 
           if [ -z "$HEADING" ]; then
-            echo "No dated release heading found — nothing to release."
+            echo "No version headings in CHANGELOG.md — nothing to release."
             echo "version=" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           VERSION=$(echo "$HEADING" | grep -oP '(?<=\[)[^\]]+')
+          REST=$(echo "$HEADING" | sed -E 's/^## \[[^]]*\]//')   # whatever follows the version
 
           # Must be valid semver with v prefix
           if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9._-]+)?$ ]]; then
@@ -37,24 +45,56 @@ jobs:
             exit 1
           fi
 
-          # Verify the date is today (UTC +/- 12h to accommodate any timezone)
-          ENTRY_DATE=$(echo "$HEADING" | grep -oP '\d{4}-\d{2}-\d{2}')
-          YESTERDAY=$(date -u -d '-12 hours' +%Y-%m-%d)
-          TODAY=$(date -u +%Y-%m-%d)
-          TOMORROW=$(date -u -d '+12 hours' +%Y-%m-%d)
-          if [[ "$ENTRY_DATE" != "$YESTERDAY" && "$ENTRY_DATE" != "$TODAY" && "$ENTRY_DATE" != "$TOMORROW" ]]; then
-            echo "::error::Changelog date $ENTRY_DATE does not match today — expected $YESTERDAY, $TODAY, or $TOMORROW"
-            exit 1
+          # Has this already shipped? This check has to come BEFORE any
+          # validation of the entry, because a released entry keeps sitting at
+          # the top of the changelog: every later push to main re-parses it.
+          # Validating first rejects an already-published entry as a malformed
+          # new release — that's what used to turn main red after every release.
+          #
+          # Ask the remote rather than the local clone: checkout doesn't
+          # reliably bring tags down, so a missing local tag proves nothing.
+          if [ -n "$(git ls-remote --tags origin "refs/tags/$VERSION")" ]; then
+            echo "Tag $VERSION already exists — already released, nothing to do."
+            echo "version=" >> "$GITHUB_OUTPUT"
+            exit 0
           fi
 
-          # Check if this tag already exists on the remote
-          if git rev-parse "refs/tags/$VERSION" >/dev/null 2>&1; then
-            echo "Tag $VERSION already exists — skipping release."
+          # Past this point the entry is genuinely unreleased.
+
+          # No date at all is a draft: mergeable to main without releasing.
+          if [ -z "${REST//[[:space:]]/}" ]; then
+            echo "$VERSION has no date — draft entry, nothing to release."
             echo "version=" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
-          # Check if a GitHub release already exists
+          # Anything else has to be a date. The `-` separator is optional, so
+          # both `] - 2026-07-31` and `] 2026-07-31` release; anything else is a
+          # typo in an entry that was clearly meant to ship, and fails here
+          # rather than being mistaken for a draft and skipped in silence.
+          if [[ ! "$REST" =~ ^[[:space:]]*-?[[:space:]]*([0-9]{4}-[0-9]{2}-[0-9]{2})[[:space:]]*$ ]]; then
+            echo "::error::Changelog heading for $VERSION trails '$(echo "$REST" | xargs)', which is not a YYYY-MM-DD date. Use '## [$VERSION] - YYYY-MM-DD' to release it, or drop the trailing text to keep it a draft."
+            exit 1
+          fi
+          ENTRY_DATE="${BASH_REMATCH[1]}"
+
+          if ! date -u -d "$ENTRY_DATE" >/dev/null 2>&1; then
+            echo "::error::Changelog date $ENTRY_DATE for $VERSION is not a real date"
+            exit 1
+          fi
+
+          # The date marks an entry as ready to publish, not as fresh. It may be
+          # in the past: when a release attempt fails (say, on tests) the entry
+          # stays untagged and the next push to main retries it — the documented
+          # behaviour. A date in the future is a typo, though; this workflow has
+          # no way to defer a release, so the entry would publish immediately.
+          LATEST=$(date -u -d '+12 hours' +%Y-%m-%d)   # +12h so any timezone's "today" is accepted
+          if [[ "$ENTRY_DATE" > "$LATEST" ]]; then
+            echo "::error::Changelog date $ENTRY_DATE for $VERSION is in the future — expected $LATEST or earlier"
+            exit 1
+          fi
+
+          # A release with no tag means an earlier run half-completed.
           if gh release view "$VERSION" >/dev/null 2>&1; then
             echo "::error::GitHub release $VERSION already exists but tag does not — manual cleanup needed"
             exit 1
@@ -70,9 +110,17 @@ jobs:
           echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
           echo "Detected version=$VERSION prerelease=$PRERELEASE"
 
-  release:
+  # v1.2.0 shipped while the Test workflow was red: the release ran its own
+  # `bun test` on ubuntu only, so a Windows-only failure never reached it.
+  # Gate on the whole matrix instead, and only when actually releasing.
+  test:
     needs: detect-release
     if: needs.detect-release.outputs.version != ''
+    uses: ./.github/workflows/test.yml
+
+  release:
+    needs: [detect-release, test]
+    if: needs.detect-release.outputs.version != ''
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -88,12 +136,14 @@ jobs:
 
       - run: bun install --frozen-lockfile
 
-      - run: bun test
-
       - name: Set package version
         run: |
           VERSION="${{ needs.detect-release.outputs.version }}"
-          npm version "${VERSION#v}" --no-git-tag-version
+          # The changelog is the source of truth; package.json's committed
+          # version is only a placeholder. --allow-same-version because
+          # `npm version` treats "already that version" as an error, which
+          # would fail the release whenever the two happen to agree.
+          npm version "${VERSION#v}" --no-git-tag-version --allow-same-version
 
       - name: Extract changelog entry
         id: changelog
@@ -104,13 +154,30 @@ jobs:
           # Write to file for the release body
           echo "$BODY" > /tmp/release-body.md
 
-      - name: Create Git tag
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      # npm publish runs BEFORE the tag exists, because detect-release treats
+      # the tag as proof the version shipped. Tagging first meant a failed
+      # publish (bad npm credentials, say) left a tag behind that made every
+      # later run skip the version as already released — the release could
+      # never be retried without deleting the tag by hand. Failing here now
+      # leaves nothing behind, so the next push to main just tries again.
+      - name: Publish to npm
         run: |
-          VERSION="${{ needs.detect-release.outputs.version }}"
-          git tag "$VERSION"
-          git push origin "$VERSION"
+          TAG="latest"
+          if [ "${{ needs.detect-release.outputs.prerelease }}" = "true" ]; then
+            TAG="next"
+          fi
+          npm publish --access public --tag "$TAG"
 
-      - name: Create GitHub Release
+      # One step, not two: gh creates the tag at --target when it doesn't
+      # already exist, so there is no window where the tag is visible but the
+      # release isn't — which detect-release would read as "already shipped"
+      # and skip in silence.
+      - name: Create Git tag and GitHub Release
         env:
           GH_TOKEN: ${{ secrets.RELEASE_PAT }}
         run: |
@@ -121,19 +188,7 @@ jobs:
             FLAGS="--prerelease"
           fi
           gh release create "$VERSION" \
+            --target "$GITHUB_SHA" \
             --title "$VERSION" \
             --notes-file /tmp/release-body.md \
             $FLAGS
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-
-      - name: Publish to npm
-        run: |
-          TAG="latest"
-          if [ "${{ needs.detect-release.outputs.prerelease }}" = "true" ]; then
-            TAG="next"
-          fi
-          npm publish --access public --tag "$TAG"

package/.github/workflows/test.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  # Called by the release workflow so a release runs this exact matrix, rather
+  # than a subset of it that can be green while this one is red.
+  workflow_call:
 
 jobs:
   test:

package/CHANGELOG.md

@@ -22,6 +22,29 @@ Releases are automated via CI. To create a new release:
 Stable versions (e.g. `v1.2.0`) publish to npm `@latest`. Pre-release versions
 (e.g. `v1.2.0-rc.1`) publish to npm `@next` and create a GitHub pre-release.
 
+## [v1.2.1] - 2026-08-10
+
+### Fixed
+- **Profile scoping works on Windows.** The per-profile config filename encoded only `/` and `.`, so a Windows `CLAUDE_CONFIG_DIR` kept its backslashes and drive colon — `~/.config/claude-aws-mfa<encoded>.json` then named an NTFS alternate data stream instead of a per-profile file. Separators are normalized and the colon encoded, so a Windows profile gets its own config and lock like everywhere else.
+- **A release can no longer publish over a red build.** The release workflow ran its own `bun test` on Linux only, so v1.2.0 shipped while the Test workflow's Windows leg was failing. It now calls that workflow directly and waits for the full matrix — every OS, GUI tests included — before publishing.
+- Dialog titles on Windows showed the full `C:\Users\you\.claude-profiles\work` instead of `~/.claude-profiles/work`: the home-prefix shortening only recognized `/` as a separator.
+
+## [v1.2.0] - 2026-08-10
+
+### Added
+- **Claude Code profile awareness**: `--setup` now reads and writes `$CLAUDE_CONFIG_DIR/settings.json` rather than always `~/.claude/settings.json`, so a tool like [claude-as](https://github.com/p120ph37/claude-as) can give one project a Bedrock profile while others stay on OAuth. The saved config and lock file are scoped to the profile as well (`~/.config/claude-aws-mfa<encoded-config-dir>.json`), since separate profiles generally mean separate AWS accounts and a shared cached session would otherwise hand a profile credentials for the wrong account. The default `~/.claude` is unsuffixed, so existing installs keep their current config file with no migration. Since the lock is per-profile, two profiles can prompt at the same time, so the credential, error, and setup dialogs all name their profile in the window title and in a banner under the heading. The default config dir is named too — to a multi-profile user an unlabelled dialog reads equally as "this is the default profile" and "this build does not label profiles".
+- **`--no-ui` mode**: skip the GUI entirely and drive the tool from the command line — useful for scripting and for letting an LLM operate the tool during setup/debugging. Prints credentials JSON to stdout on success, keeping stdout cleanly parsable; on failure, prints the underlying error (or names the specific missing config field(s) when the config is incomplete) to stderr. Never imports the GUI toolkit, so it also works in headless environments.
+- **Error dialog**: authentication failures (STS or MFA command) now show a native dialog box instead of writing to stderr, since Claude Code doesn't surface a failing command's stderr to the user. Suppressed in `--no-ui` mode, where the error is printed to stderr instead.
+
+### Changed
+- **Dialogs size themselves to their content.** Every window (main dialog, setup, error) opens small and grows to exactly fit what it renders, instead of using a hardcoded height that had to be guessed and re-guessed whenever the layout changed. Content taller than the cap scrolls rather than being clipped — long error messages are now fully readable. Measured on Linux/WebKitGTK: the main dialog settles at 610px (was hardcoded to 670) and setup at 419px (was 480).
+- `--cache-session`, `--auto-mfa`, and `--single-instance-lock` are now **enabled by default**; use `--no-cache-session`, `--no-auto-mfa`, or `--no-single-instance-lock` to opt out.
+- `--setup` no longer hardcodes an absolute script path into `awsCredentialExport` when the tool is installed and resolvable via `PATH` — it records just the bin name so the setting keeps working across reinstalls/machines. An explicit absolute path is only written as a fallback when running against a local checkout that isn't on `PATH`.
+
+### Fixed
+- **Release workflow no longer fails on every push after a release.** The changelog entry for a shipped version stays at the top of the file, so each later push to `main` re-parsed it — and because the entry was validated *before* the already-released check, it was rejected as a malformed new release (`Changelog date … does not match today`). The already-released check now runs first, and asks the remote for the tag rather than trusting whatever tags `checkout` happened to fetch.
+- A dated-but-unreleased entry is no longer rejected for having a past date, so the documented "re-attempted on each subsequent push to `main`" retry after a failed release actually works. A date in the *future* is still an error, since the workflow has no way to defer a release.
+
 ## [v1.1.0] - 2026-06-04
 
 ### Added

package/README.md

@@ -20,7 +20,7 @@ Once you have enabled credential-handling and saved the settings, you can launch
 
 ### Manual Setup
 
-Add this (plus any addtitional config you prefer) to your Claude Code settings (`~/.claude/settings.json`):
+Add this (plus any addtitional config you prefer) to your Claude Code settings (`~/.claude/settings.json`, or `$CLAUDE_CONFIG_DIR/settings.json` if you use per-project profiles):
 
 ```json
 {
@@ -34,14 +34,15 @@ Add this (plus any addtitional config you prefer) to your Claude Code settings (
 
 ## CLI Flags
 
-All flags can be negated with a `--no-` prefix (e.g. `--no-cache-session`). CLI flags override values saved in the config file.
+`--cache-session`, `--auto-mfa`, and `--single-instance-lock` are all **on by default**; use the `--no-` prefix to disable one (e.g. `--no-cache-session`). CLI flags override values saved in the config file.
 
 | Flag | Description |
 |------|-------------|
 | `--setup` | Launch the guided setup wizard |
-| `--cache-session` | Cache STS session credentials and reuse them until they expire |
-| `--auto-mfa` | Automatically run the configured MFA command and obtain credentials without showing the dialog (requires MFA Command mode) |
-| `--single-instance-lock` | Prevent multiple concurrent instances from showing overlapping dialogs; subsequent invocations wait for the first to finish and reuse its cached session |
+| `--cache-session` | Cache STS session credentials and reuse them until they expire (default: on) |
+| `--auto-mfa` | Automatically run the configured MFA command and obtain credentials without showing the dialog, requires MFA Command mode (default: on) |
+| `--single-instance-lock` | Prevent multiple concurrent instances from showing overlapping dialogs; subsequent invocations wait for the first to finish and reuse its cached session (default: on) |
+| `--no-ui` | Never show any GUI dialog. Prints credentials JSON to stdout on success, or an error to stderr on failure — useful for scripting or letting an LLM drive the tool during setup/debugging |
 
 ## How it works
 
@@ -55,6 +56,21 @@ All flags can be negated with a `--no-` prefix (e.g. `--no-cache-session`). CLI
 
 On subsequent runs, all fields are pre-populated from the saved config — just enter a fresh MFA code and hit OK. If you use the command mode, the TOTP code is fetched automatically so no manual entry is needed at all.
 
+### Claude Code profiles
+
+Claude Code reads its settings from `$CLAUDE_CONFIG_DIR` when that is set, which tools such as [claude-as](https://github.com/p120ph37/claude-as) use to give each project its own credentials. This tool follows suit:
+
+- `--setup` reads and writes `$CLAUDE_CONFIG_DIR/settings.json`, so a profile can be Bedrock-only while others stay on OAuth.
+- The config file is scoped per profile — `~/.config/claude-aws-mfa<profile>.json`, where `<profile>` is the config dir path encoded the way Claude encodes project dirs (`/` and `.` both become `-`). Different profiles usually mean different AWS accounts, and a shared cached session would hand a profile credentials for the wrong one.
+- The default `~/.claude` gets no suffix, so existing installs keep using `~/.config/claude-aws-mfa.json` unchanged.
+- Because the lock is per profile too, two profiles can have a dialog open at once. Every dialog names its profile — in the window title and in a banner under the heading — so you can tell which AWS account a prompt is asking for. The default config dir is named `default` rather than left unlabelled, so a blank banner never has to be interpreted.
+
+Child processes inherit `CLAUDE_CONFIG_DIR`, so credential export picks up the right profile automatically. `--setup` run from an ordinary shell does not — it configures whatever profile the shell is in, normally the default. To set up a specific profile, export the variable first:
+
+```bash
+CLAUDE_CONFIG_DIR=~/.claude-profiles/work claude-aws-mfa --setup
+```
+
 ### Session caching
 
 With `--cache-session` (or `"cacheSession": true` in the config file), temporary credentials are saved to the config file and reused on subsequent runs until they expire. This avoids prompting for MFA on every invocation.
@@ -65,7 +81,15 @@ With `--auto-mfa` (or `"autoMfa": true` in the config file), when a MFA command
 
 ### Single-instance lock
 
-With `--single-instance-lock` (or `"singleInstanceLock": true` in the config file), only one instance of the tool will show a dialog at a time. Additional invocations will wait for the first to finish and then reuse its cached session (when session caching is also enabled). The lock file is stored at `~/.config/claude-aws-mfa.lock` and is automatically cleaned up after 2 minutes if the holding process crashes.
+With `--single-instance-lock` (or `"singleInstanceLock": true` in the config file), only one instance of the tool will show a dialog at a time. Additional invocations will wait for the first to finish and then reuse its cached session (when session caching is also enabled). The lock file is stored alongside the config file (`~/.config/claude-aws-mfa.lock`, per profile) and is automatically cleaned up after 2 minutes if the holding process crashes.
+
+### Authentication failures
+
+Claude Code does not surface a failing command's stderr to the user, so when MFA/STS authentication fails, the error is shown in a native dialog box instead of being written to stderr.
+
+### `--no-ui` mode
+
+With `--no-ui`, no GUI is ever shown — not even the error dialog above — and the tool never imports the GUI toolkit, so it also works in headless environments without a display. On success, credentials are printed to stdout as usual, keeping stdout cleanly parsable. On failure, an error message is printed to **stderr** instead (e.g. `Missing config: roleArn, mfaCommand` if the config is incomplete, or the underlying STS error if authentication itself failed) and the process exits non-zero. This is intended for scripting and for letting an LLM drive the tool directly while setting up or debugging a configuration — full non-interactive operation requires **MFA Command mode**, since a static "code" mode value can't be re-entered headlessly. The command doesn't need to be a real TOTP generator: for a one-off test or debugging run, `mfaCommand` can simply be `echo <code>` with a fresh, not-yet-used code from your authenticator — it only needs to produce a valid code once.
 
 ## System requirements
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-aws-mfa",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "type": "module",
   "repository": "https://github.com/p120ph37/claude-aws-mfa",
   "bin": {

package/src/autosize-html.ts

@@ -0,0 +1,31 @@
+/**
+ * Page-side half of the self-sizing window contract (see `./autosize`).
+ *
+ * Kept free of webview-bun so the HTML builders — and their unit tests — never
+ * dlopen the native GUI library, which isn't present on a headless runner.
+ */
+
+/**
+ * CSS a page must carry for {@link AUTOSIZE_SCRIPT} to measure correctly.
+ *
+ * `#fit` is the measured element: `height: auto` shrink-wraps it to its
+ * content. Page padding belongs on `#fit` rather than `body` so it counts
+ * toward that measurement. Keep floated layout out of `#fit` — a float
+ * contributes nothing to its parent's height.
+ */
+export const AUTOSIZE_CSS = /*css*/ `
+  html, body { height: 100%; }
+  /* always-on scrollbar: lets #fit exceed the window and still report its own height */
+  body { overflow-y: scroll; }
+  #fit { padding: 20px; }
+`;
+
+/** Client-side measurement. Pair with {@link AUTOSIZE_CSS} and a `<div id="fit">` wrapper. */
+export const AUTOSIZE_SCRIPT = /*js*/ `
+  // Wait for fonts to settle — otherwise reflow moves the height right after we snap to it.
+  (document.fonts?.ready ?? Promise.resolve()).then(() => requestAnimationFrame(() => {
+    const box = document.getElementById("fit").getBoundingClientRect();
+    const delta = Math.ceil(box.height) - innerHeight;
+    if (delta) _grow(delta);
+  }));
+`;

package/src/autosize.ts

@@ -0,0 +1,39 @@
+import { SizeHint, Webview } from "webview-bun";
+
+/**
+ * Self-sizing webview windows.
+ *
+ * A webview can't be asked how tall its content is from the Bun side, so the
+ * page measures itself and reports back. Three things make that measurement
+ * trustworthy, and all three are load-bearing:
+ *
+ *  - The window opens at {@link START_HEIGHT}, comfortably above any OS
+ *    minimum window height. Open it shorter and the WM silently clamps it, so
+ *    the delta below would be measured against a height we never actually had.
+ *  - The page reports a *delta* — how much the client area must change — not a
+ *    target height. `set_size` sizes the whole frame, so a delta cancels out
+ *    the titlebar, which the page has no way to measure.
+ *  - The body scrolls, so the measured element may exceed the window and still
+ *    report its own height instead of being clipped to the viewport.
+ *
+ * The page-side half of the contract lives in `./autosize-html`.
+ */
+
+/** Opening height, above any OS minimum so the reported delta isn't measured against a clamped window. */
+export const START_HEIGHT = 160;
+
+/**
+ * Bind the `_grow` callback the page calls with its measured delta.
+ *
+ * Must be called before `setHTML`, and the window must have been created at
+ * {@link START_HEIGHT} for the delta to land on the right height.
+ */
+export function bindAutosize(webview: Webview, width: number, maxHeight: number): void {
+  webview.bind("_grow", (delta: number) => {
+    webview.size = {
+      width,
+      height: Math.min(START_HEIGHT + delta, maxHeight),
+      hint: SizeHint.FIXED,
+    };
+  });
+}

package/src/claude-settings.ts

@@ -2,7 +2,16 @@ import { homedir } from "os";
 import { join } from "path";
 import { mkdirSync, readFileSync, writeFileSync } from "fs";
 
-const SETTINGS_PATH = join(homedir(), ".claude", "settings.json");
+/**
+ * Claude Code reads its settings from $CLAUDE_CONFIG_DIR when set, so tools that
+ * pin a per-project config dir (e.g. claude-as) get their own settings.json —
+ * which is what makes a Bedrock-only profile possible. Child processes inherit
+ * the variable, so the credential-export path sees it automatically; `--setup`
+ * run from a plain shell does not, and configures the default profile.
+ */
+export const claudeConfigDir = (): string => process.env.CLAUDE_CONFIG_DIR || join(homedir(), ".claude");
+
+const settingsPath = () => join(claudeConfigDir(), "settings.json");
 
 export interface ClaudeSettings {
   env?: Record<string, string>;
@@ -11,14 +20,13 @@ export interface ClaudeSettings {
 
 export function loadClaudeSettings(): ClaudeSettings {
   try {
-    return JSON.parse(readFileSync(SETTINGS_PATH, "utf-8"));
+    return JSON.parse(readFileSync(settingsPath(), "utf-8"));
   } catch {
     return {};
   }
 }
 
 export function saveClaudeSettings(settings: ClaudeSettings): void {
-  const dir = join(homedir(), ".claude");
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2) + "\n");
+  mkdirSync(claudeConfigDir(), { recursive: true });
+  writeFileSync(settingsPath(), JSON.stringify(settings, null, 2) + "\n");
 }

package/src/config.ts

@@ -1,11 +1,12 @@
 import { homedir } from "os";
-import { join, dirname } from "path";
+import { join, dirname, resolve, basename } from "path";
 import {
   chmodSync,
   closeSync,
   mkdirSync,
   openSync,
   readFileSync,
+  realpathSync,
   rmSync,
   statSync,
   writeFileSync,
@@ -35,7 +36,70 @@ export interface Config {
   cachedSession?: CachedSession;
 }
 
-const CONFIG_PATH = join(homedir(), ".config", "claude-aws-mfa.json");
+/**
+ * Suffix that scopes the config (role ARN, keys, cached STS session) to the
+ * Claude Code profile in use, since separate profiles generally mean separate
+ * AWS accounts — sharing one cached session across them would hand a profile
+ * credentials for the wrong account.
+ *
+ * Empty for the default `~/.claude`, so existing installs keep the unsuffixed
+ * file and need no migration. Otherwise the full path is encoded the way Claude
+ * encodes project dirs (`/` and `.` both become `-`), rather than the basename,
+ * which is not unique across config-dir tools.
+ *
+ * DETAIL: the encoding is lossy — `/a/b-c` and `/a-b/c` both yield `-a-b-c` —
+ * and a hash would not be. That is a deliberate trade: these filenames sit in a
+ * directory people read and prune by hand, and approximating the original words
+ * is worth more than closing a collision that requires two config dirs whose
+ * paths differ only in `/` versus `-`. Claude makes the same trade for
+ * `~/.claude/projects`.
+ */
+export function profileSuffix(dir = process.env.CLAUDE_CONFIG_DIR): string {
+  if (!dir) return "";
+  const canonical = (p: string) => {
+    let real: string;
+    try {
+      real = realpathSync(p);
+    } catch {
+      real = resolve(p);
+    }
+    return real.replace(/\\/g, "/");
+  };
+  const real = canonical(dir);
+  if (real === canonical(join(homedir(), ".claude"))) return "";
+  // `:` goes too, or a Windows drive letter would make the filename an NTFS stream.
+  return real.replace(/[/.:]/g, "-");
+}
+
+export interface ActiveProfile {
+  name: string;
+  path: string;
+}
+
+export const DEFAULT_PROFILE: ActiveProfile = { name: "default", path: "~/.claude" };
+
+/**
+ * The profile to name in dialog titles and headings. Because the single-instance
+ * lock is per-profile, two profiles can have a dialog on screen at once, asking
+ * for credentials to different AWS accounts — so which is which has to be
+ * visible.
+ *
+ * The default config dir is named too, rather than left blank: a multi-profile
+ * user facing a single unlabelled dialog cannot tell "this is the default
+ * profile" from "this build doesn't label profiles".
+ */
+export function activeProfile(dir = process.env.CLAUDE_CONFIG_DIR): ActiveProfile {
+  if (!dir || !profileSuffix(dir)) return DEFAULT_PROFILE;
+  const clean = dir.replace(/[/\\]+$/, "");
+  const home = homedir();
+  const underHome = clean === home || (clean.startsWith(home) && /^[/\\]/.test(clean.slice(home.length)));
+  return {
+    name: basename(clean),
+    path: underHome ? ("~" + clean.slice(home.length)).replace(/\\/g, "/") : clean,
+  };
+}
+
+const CONFIG_PATH = join(homedir(), ".config", `claude-aws-mfa${profileSuffix()}.json`);
 
 // Unix file-permission enforcement is skipped on Windows where chmod is a no-op.
 const IS_UNIX = process.platform !== "win32";
@@ -119,7 +183,8 @@ export function saveConfig(config: Config) {
 
 // --- Single-instance lock ---
 
-const LOCK_PATH = join(homedir(), ".config", "claude-aws-mfa.lock");
+// Per-profile too: a profile must not block on, then inherit, another profile's session.
+const LOCK_PATH = join(homedir(), ".config", `claude-aws-mfa${profileSuffix()}.lock`);
 const LOCK_POLL_MS = 500;
 const LOCK_STALE_MS = 120_000; // 2 minutes — assume stale if holder crashed
 
@@ -177,6 +242,22 @@ export async function waitForLock(): Promise<void> {
   }
 }
 
+/**
+ * Fields required to obtain credentials with no dialog shown at all (used by
+ * --no-ui). A static typed-in MFA code can't be reused headlessly, so
+ * command mode with a configured mfaCommand is mandatory here.
+ */
+export function missingConfigFields(cfg: Partial<Config>): string[] {
+  const missing: string[] = [];
+  if (!cfg.region) missing.push("region");
+  if (!cfg.accessKeyId) missing.push("accessKeyId");
+  if (!cfg.secretAccessKey) missing.push("secretAccessKey");
+  if (!cfg.mfaArn) missing.push("mfaArn");
+  if (!cfg.roleArn) missing.push("roleArn");
+  if (cfg.mfaMode !== "command" || !cfg.mfaCommand) missing.push("mfaCommand");
+  return missing;
+}
+
 export async function seedDefaults(): Promise<Partial<Config>> {
   const defaults: Partial<Config> = {};
   try {

package/src/credential-export.ts

@@ -0,0 +1,32 @@
+import { realpathSync } from "fs";
+import { resolve } from "path";
+import { bin } from "../package.json";
+
+const BIN_NAME = Object.keys(bin)[0];
+
+/**
+ * Build the command string that Claude Code should use to invoke this tool.
+ *
+ * Bun always normalizes Bun.argv[1] to an absolute, symlink-resolved path —
+ * identically whether launched via a bare PATH-resolved name, a relative path,
+ * or an absolute path — so there's no way to recover how this process was
+ * actually invoked. Instead, we check whether the bin name resolves via PATH
+ * to this same script; if so Claude Code will resolve it the same way, so we
+ * record just the bin name and avoid hardcoding a path that could go stale
+ * across reinstalls or machines. Only fall back to an explicit path when this
+ * isn't on PATH at all (e.g. running against a local dev checkout).
+ *
+ * This lives in its own module (rather than setup.ts) so it can be imported
+ * without pulling in webview-bun, whose native library is loaded at import
+ * time and isn't available in headless/unit-test environments.
+ */
+export function getCredentialExportCommand(): string {
+  const script = Bun.argv[1];
+  const onPath = Bun.which(BIN_NAME);
+  if (onPath) {
+    try {
+      if (realpathSync(onPath) === realpathSync(script)) return BIN_NAME;
+    } catch {}
+  }
+  return `${process.execPath} ${resolve(script)}`;
+}