claude-aws-mfa 1.1.0 → 1.2.1

package/src/dialog-html.ts

@@ -1,4 +1,6 @@
 import { STANDARD_DURATIONS } from "./sts";
+import { AUTOSIZE_CSS, AUTOSIZE_SCRIPT } from "./autosize-html";
+import { DEFAULT_PROFILE, type ActiveProfile } from "./config";
 
 export const FIELDS = ["region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "duration", "mfaMode", "mfaCode", "mfaCommand"] as const;
 
@@ -13,7 +15,30 @@ export const FIELD_PATTERNS: Record<string, string> = {
   mfaCommand: "^.+$",
 };
 
-export function buildHtml(config: Record<string, string>) {
+/**
+ * Banner naming the Claude Code profile a dialog belongs to. Always shown, so
+ * its absence never has to be interpreted. The name is never truncated — it is
+ * what tells two dialogs apart — while the path ellipsizes beside it. It sits
+ * inside `#fit`, so the window grows to fit it (see `./autosize`).
+ */
+export const PROFILE_STYLE = /*css*/ `
+  .profile {
+    display: flex; gap: 6px; align-items: baseline;
+    font-size: 12px; color: #6e6e73; background: #e8e8ed;
+    border: 1px solid #d2d2d7; border-radius: 6px;
+    padding: 6px 8px; margin: -8px 0 16px;
+  }
+  .profile b { color: #1d1d1f; font-weight: 600; flex-shrink: 0; }
+  .profile span { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+`;
+
+export function profileBanner(profile: ActiveProfile): string {
+  return /*html*/ `<div class="profile" title="${escapeHtml(profile.path)}">Profile <b>${escapeHtml(
+    profile.name,
+  )}</b><span>${escapeHtml(profile.path)}</span></div>`;
+}
+
+export function buildHtml(config: Record<string, string>, profile: ActiveProfile = DEFAULT_PROFILE) {
   return /*html*/ `<!DOCTYPE html>
 <html>
 <head>
@@ -22,8 +47,9 @@ export function buildHtml(config: Record<string, string>) {
   * { box-sizing: border-box; margin: 0; padding: 0; }
   body {
     font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
-    padding: 20px; background: #f5f5f7; color: #1d1d1f;
+    background: #f5f5f7; color: #1d1d1f;
   }
+${AUTOSIZE_CSS}
   h2 { font-size: 16px; font-weight: 600; margin-bottom: 16px; }
   .field { margin-bottom: 12px; }
   label { display: block; font-size: 12px; font-weight: 500; margin-bottom: 4px; transition: color 0.15s; }
@@ -51,10 +77,13 @@ export function buildHtml(config: Record<string, string>) {
   }
   .radio-field input[type="text"] { flex: 1; width: 0; min-width: 0; }
   input:disabled { background: #f0f0f0; color: #999; cursor: not-allowed; }
+${PROFILE_STYLE}
 </style>
 </head>
 <body>
+<div id="fit">
   <h2>Claude AWS MFA</h2>
+  ${profileBanner(profile)}
   <div class="field"><label>AWS Region</label><input id="region" placeholder="us-east-1"></div>
   <div class="field"><label>Access Key ID</label><input id="accessKeyId" type="password" placeholder="AKIA..."></div>
   <div class="field"><label>Secret Access Key</label><input id="secretAccessKey" type="password"></div>
@@ -76,7 +105,8 @@ export function buildHtml(config: Record<string, string>) {
     <button onclick="_cancel()">Cancel</button>
     <button class="primary" onclick="submit()">OK</button>
   </div>
-  <script>
+</div>
+  <script>${AUTOSIZE_SCRIPT}
     document.querySelectorAll("input").forEach(el => {
       el.setAttribute("autocorrect", "off");
       el.setAttribute("autocomplete", "off");
@@ -177,3 +207,46 @@ export function buildHtml(config: Record<string, string>) {
 </body>
 </html>`;
 }
+
+function escapeHtml(s: string): string {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+export function buildErrorHtml(message: string, profile: ActiveProfile = DEFAULT_PROFILE): string {
+  return /*html*/ `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+  * { box-sizing: border-box; margin: 0; padding: 0; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+    background: #f5f5f7; color: #1d1d1f;
+  }
+${AUTOSIZE_CSS}
+  h2 { font-size: 16px; font-weight: 600; margin-bottom: 12px; color: #ff3b30; }
+  p { font-size: 13px; line-height: 1.5; white-space: pre-wrap; word-break: break-word; margin-bottom: 16px; }
+  .buttons { display: flex; justify-content: flex-end; }
+  button {
+    padding: 8px 20px; border-radius: 6px; font-size: 14px; cursor: pointer;
+    border: 1px solid #d2d2d7; background: #0071e3; color: #fff;
+  }
+  button:hover { filter: brightness(0.95); }
+${PROFILE_STYLE}
+</style>
+</head>
+<body>
+<div id="fit">
+  <h2>Authentication Failed</h2>
+  ${profileBanner(profile)}
+  <p>${escapeHtml(message)}</p>
+  <div class="buttons"><button onclick="_ok()">OK</button></div>
+</div>
+  <script>${AUTOSIZE_SCRIPT}
+    document.addEventListener("keydown", e => {
+      if (e.key === "Enter" || e.key === "Escape") _ok();
+    });
+  </script>
+</body>
+</html>`;
+}

package/src/dialog.ts

@@ -1,9 +1,21 @@
 import { Webview, SizeHint } from "webview-bun";
 import { lib } from "webview-bun/src/ffi";
-import type { Config } from "./config";
-import { buildHtml } from "./dialog-html";
+import { activeProfile, type Config } from "./config";
+import { buildHtml, buildErrorHtml } from "./dialog-html";
+import { START_HEIGHT, bindAutosize } from "./autosize";
 import { version } from "../package.json";
 
+const DIALOG_WIDTH = 440;
+const DIALOG_MAX_HEIGHT = 800;
+
+const ERROR_WIDTH = 420;
+const ERROR_MAX_HEIGHT = 640;
+
+/** Window title, naming the profile so stacked dialogs are told apart in the window list too. */
+export function dialogTitle(suffix = ""): string {
+  return `Claude AWS MFA v${version} — ${activeProfile().name}${suffix}`;
+}
+
 
 export interface DialogResult {
   region: string;
@@ -33,11 +45,12 @@ function clipboardCommand(): string[] {
 
 export function showDialog(defaults: Partial<Config>): DialogResult | null {
   const webview = new Webview(false, {
-    width: 440,
-    height: 670,
+    width: DIALOG_WIDTH,
+    height: START_HEIGHT,
     hint: SizeHint.FIXED,
   });
-  webview.title = `Claude AWS MFA v${version}`;
+  webview.title = dialogTitle();
+  bindAutosize(webview, DIALOG_WIDTH, DIALOG_MAX_HEIGHT);
 
   let result: DialogResult | null = null;
 
@@ -70,8 +83,25 @@ export function showDialog(defaults: Partial<Config>): DialogResult | null {
     duration: defaults.duration != null ? String(defaults.duration) : "",
     mfaCommand: defaults.mfaCommand ?? "",
     mfaMode: defaults.mfaMode ?? "code",
-  }));
+  }, activeProfile()));
 
   webview.run();
   return result;
 }
+
+/** Show a modal dialog reporting an authentication failure (Claude Code doesn't surface stderr). */
+export function showErrorDialog(message: string): void {
+  const webview = new Webview(false, {
+    width: ERROR_WIDTH,
+    height: START_HEIGHT,
+    hint: SizeHint.FIXED,
+  });
+  webview.title = dialogTitle(" — Error");
+  bindAutosize(webview, ERROR_WIDTH, ERROR_MAX_HEIGHT);
+
+  const handle = webview.unsafeHandle;
+  webview.bind("_ok", () => lib.symbols.webview_terminate(handle));
+
+  webview.setHTML(buildErrorHtml(message, activeProfile()));
+  webview.run();
+}

package/src/flags.ts

@@ -3,6 +3,7 @@ export interface CliFlags {
   cacheSession: boolean | undefined;  // undefined = use config default
   autoMfa: boolean | undefined;
   singleInstanceLock: boolean | undefined;
+  noUi: boolean;
 }
 
 export function parseFlags(argv: string[]): CliFlags {
@@ -11,6 +12,7 @@ export function parseFlags(argv: string[]): CliFlags {
     cacheSession: undefined,
     autoMfa: undefined,
     singleInstanceLock: undefined,
+    noUi: false,
   };
   for (const arg of argv.slice(2)) {
     switch (arg) {
@@ -36,6 +38,9 @@ export function parseFlags(argv: string[]): CliFlags {
       case "--no-single-instance-lock":
         flags.singleInstanceLock = false;
         break;
+      case "--no-ui":
+        flags.noUi = true;
+        break;
     }
   }
   return flags;

package/src/index.ts

@@ -25,8 +25,7 @@ if (flags.setup) {
 }
 
 import type { CachedSession, Config } from "./config";
-import { loadConfig, saveConfig, seedDefaults, tryAcquireLock, releaseLock, waitForLock } from "./config";
-import { showDialog } from "./dialog";
+import { loadConfig, saveConfig, seedDefaults, tryAcquireLock, releaseLock, waitForLock, missingConfigFields } from "./config";
 import { assumeRoleWithMfa, STANDARD_DURATIONS } from "./sts";
 
 // --- Resolve effective flags (CLI overrides config defaults) ---
@@ -34,9 +33,9 @@ import { assumeRoleWithMfa, STANDARD_DURATIONS } from "./sts";
 const config = loadConfig();
 const defaults: Partial<Config> = config ?? await seedDefaults();
 
-const useCache = flags.cacheSession ?? defaults.cacheSession ?? false;
-const useAutoMfa = flags.autoMfa ?? defaults.autoMfa ?? false;
-const useLock = flags.singleInstanceLock ?? defaults.singleInstanceLock ?? false;
+const useCache = flags.cacheSession ?? defaults.cacheSession ?? true;
+const useAutoMfa = flags.autoMfa ?? defaults.autoMfa ?? true;
+const useLock = flags.singleInstanceLock ?? defaults.singleInstanceLock ?? true;
 
 // --- Helper: check if a cached session is still valid ---
 
@@ -57,59 +56,73 @@ function outputCredentials(session: CachedSession): void {
   }));
 }
 
+// --- Helper: report a failure, respecting --no-ui (dialog is never shown in that mode) ---
+
+async function reportFailure(message: string): Promise<never> {
+  if (flags.noUi) {
+    // stdout is reserved for cleanly-parsable credentials JSON on success.
+    process.stderr.write(`${message}\n`);
+  } else {
+    const { showErrorDialog } = await import("./dialog");
+    showErrorDialog(message);
+  }
+  process.exit(2);
+}
+
 // --- Helper: run MFA command and attempt to obtain credentials without dialog ---
+// Throws (rather than returning null) on failure so callers can decide whether to
+// fall back to the dialog (interactive) or surface the error directly (--no-ui).
 
 async function tryAutoMfa(cfg: Partial<Config>): Promise<CachedSession | null> {
   if (!cfg.mfaCommand || cfg.mfaMode !== "command") return null;
   if (!cfg.region || !cfg.accessKeyId || !cfg.secretAccessKey || !cfg.mfaArn || !cfg.roleArn) return null;
 
-  try {
-    const proc = Bun.spawnSync(["sh", "-c", cfg.mfaCommand]);
-    if (proc.exitCode !== 0) return null;
-    const mfaCode = proc.stdout.toString().trim();
-    if (!mfaCode) return null;
-
-    const { credentials, duration } = await assumeRoleWithMfa({
-      region: cfg.region,
-      accessKeyId: cfg.accessKeyId,
-      secretAccessKey: cfg.secretAccessKey,
-      mfaArn: cfg.mfaArn,
-      roleArn: cfg.roleArn,
-      mfaCode,
-      duration: cfg.duration ?? STANDARD_DURATIONS[0],
-    });
-
-    const session: CachedSession = {
-      AccessKeyId: credentials.AccessKeyId,
-      SecretAccessKey: credentials.SecretAccessKey,
-      SessionToken: credentials.SessionToken,
-      Expiration: credentials.Expiration,
-    };
-
-    saveConfig({
-      region: cfg.region,
-      accessKeyId: cfg.accessKeyId,
-      secretAccessKey: cfg.secretAccessKey,
-      mfaArn: cfg.mfaArn,
-      roleArn: cfg.roleArn,
-      duration,
-      mfaMode: cfg.mfaMode,
-      mfaCommand: cfg.mfaCommand,
-      cacheSession: cfg.cacheSession,
-      autoMfa: cfg.autoMfa,
-      singleInstanceLock: cfg.singleInstanceLock,
-      ...(useCache ? { cachedSession: session } : {}),
-    });
-
-    return session;
-  } catch {
-    return null;
+  const proc = Bun.spawnSync(["sh", "-c", cfg.mfaCommand]);
+  if (proc.exitCode !== 0) {
+    throw new Error(`MFA command failed: ${proc.stderr.toString().trim()}`);
   }
+  const mfaCode = proc.stdout.toString().trim();
+  if (!mfaCode) throw new Error("MFA command produced no output");
+
+  const { credentials, duration } = await assumeRoleWithMfa({
+    region: cfg.region,
+    accessKeyId: cfg.accessKeyId,
+    secretAccessKey: cfg.secretAccessKey,
+    mfaArn: cfg.mfaArn,
+    roleArn: cfg.roleArn,
+    mfaCode,
+    duration: cfg.duration ?? STANDARD_DURATIONS[0],
+  });
+
+  const session: CachedSession = {
+    AccessKeyId: credentials.AccessKeyId,
+    SecretAccessKey: credentials.SecretAccessKey,
+    SessionToken: credentials.SessionToken,
+    Expiration: credentials.Expiration,
+  };
+
+  saveConfig({
+    region: cfg.region,
+    accessKeyId: cfg.accessKeyId,
+    secretAccessKey: cfg.secretAccessKey,
+    mfaArn: cfg.mfaArn,
+    roleArn: cfg.roleArn,
+    duration,
+    mfaMode: cfg.mfaMode,
+    mfaCommand: cfg.mfaCommand,
+    cacheSession: cfg.cacheSession,
+    autoMfa: cfg.autoMfa,
+    singleInstanceLock: cfg.singleInstanceLock,
+    ...(useCache ? { cachedSession: session } : {}),
+  });
+
+  return session;
 }
 
 // --- Helper: show dialog and obtain credentials ---
 
 async function obtainViaDialog(cfg: Partial<Config>): Promise<void> {
+  const { showDialog } = await import("./dialog");
   const result = showDialog(cfg);
   if (!result) {
     process.stderr.write("User cancelled dialog.\n");
@@ -120,8 +133,7 @@ async function obtainViaDialog(cfg: Partial<Config>): Promise<void> {
   if (result.mfaMode === "command") {
     const proc = Bun.spawnSync(["sh", "-c", result.mfaCommand]);
     if (proc.exitCode !== 0) {
-      process.stderr.write(`MFA command failed: ${proc.stderr.toString()}\n`);
-      process.exit(2);
+      throw new Error(`MFA command failed: ${proc.stderr.toString().trim()}`);
     }
     mfaCode = proc.stdout.toString().trim();
   }
@@ -177,14 +189,29 @@ try {
 
   // 2. If auto-mfa is enabled, try to obtain credentials without dialog
   if (useAutoMfa) {
-    const session = await tryAutoMfa(defaults);
-    if (session) {
-      outputCredentials(session);
-      process.exit(0);
+    try {
+      const session = await tryAutoMfa(defaults);
+      if (session) {
+        outputCredentials(session);
+        process.exit(0);
+      }
+    } catch (err) {
+      // In --no-ui mode there's no dialog to fall back to — surface the error directly.
+      if (flags.noUi) throw err;
     }
   }
 
-  // 3. If single-instance-lock is enabled, acquire lock before showing dialog
+  // 3. In --no-ui mode, never show a dialog — report why credentials couldn't be obtained.
+  if (flags.noUi) {
+    const missing = missingConfigFields(defaults);
+    if (missing.length) {
+      await reportFailure(`Missing config: ${missing.join(", ")}`);
+    } else {
+      await reportFailure("Unable to obtain credentials without UI: auto-MFA did not succeed.");
+    }
+  }
+
+  // 4. If single-instance-lock is enabled, acquire lock before showing dialog
   if (useLock) {
     if (!tryAcquireLock()) {
       // Another instance holds the lock — wait for it
@@ -232,6 +259,7 @@ try {
   const masked = raw
     .replace(/(?:AKIA|ASIA)[A-Z0-9]{16}/g, "****")
     .replace(/[A-Za-z0-9/+=]{40}/g, "****");
-  process.stderr.write(`STS AssumeRole failed: ${masked}\n`);
-  process.exit(2);
+  // Claude Code does not surface stderr to the user, so failures are reported via
+  // a dialog box instead (or to stderr in --no-ui mode, keeping stdout parsable).
+  await reportFailure(`Authentication failed: ${masked}`);
 }

package/src/setup-html.ts

@@ -1,4 +1,7 @@
 import type { ClaudeSettings } from "./claude-settings";
+import { AUTOSIZE_CSS, AUTOSIZE_SCRIPT } from "./autosize-html";
+import { DEFAULT_PROFILE, type ActiveProfile } from "./config";
+import { PROFILE_STYLE, profileBanner } from "./dialog-html";
 
 export const TEXT_FIELDS = [
   { key: "ANTHROPIC_DEFAULT_OPUS_MODEL", label: "Opus Model", placeholder: "global.anthropic.claude-opus-4-6" },
@@ -7,7 +10,12 @@ export const TEXT_FIELDS = [
   { key: "CLAUDE_CODE_SUBAGENT_MODEL", label: "Subagent Model", placeholder: "global.anthropic.claude-sonnet-4-6" },
 ] as const;
 
-export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSettings, credentialExportCmd: string) {
+export function buildSetupHtml(
+  env: Record<string, string>,
+  settings: ClaudeSettings,
+  credentialExportCmd: string,
+  profile: ActiveProfile = DEFAULT_PROFILE,
+) {
   const bedrockMfaEnabled = env.CLAUDE_CODE_USE_BEDROCK === "1"
     && settings.awsCredentialExport !== undefined
     && env.AWS_SHARED_CREDENTIALS_FILE === "/dev/null";
@@ -32,8 +40,9 @@ export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSett
   * { box-sizing: border-box; margin: 0; padding: 0; }
   body {
     font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
-    padding: 20px; background: #f5f5f7; color: #1d1d1f;
+    background: #f5f5f7; color: #1d1d1f;
   }
+${AUTOSIZE_CSS}
   h2 { font-size: 16px; font-weight: 600; margin-bottom: 16px; }
   .field { margin-bottom: 12px; }
   label { display: block; font-size: 12px; font-weight: 500; margin-bottom: 4px; color: #1d1d1f; }
@@ -59,10 +68,13 @@ export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSett
   }
   button.primary { background: #0071e3; color: #fff; border-color: #0071e3; }
   button:hover { filter: brightness(0.95); }
+${PROFILE_STYLE}
 </style>
 </head>
 <body>
+<div id="fit">
   <h2>Claude Code Bedrock Setup</h2>
+  ${profileBanner(profile)}
 
   ${bedrockMfaCheckboxHtml}
 
@@ -74,8 +86,9 @@ export function buildSetupHtml(env: Record<string, string>, settings: ClaudeSett
     <button onclick="_cancel()">Cancel</button>
     <button class="primary" onclick="save()">Save</button>
   </div>
+</div>
 
-  <script>
+  <script>${AUTOSIZE_SCRIPT}
     const TEXT_FIELDS = ${JSON.stringify(TEXT_FIELDS)};
     const originalEnv = ${JSON.stringify(env)};
     const originalSettings = ${JSON.stringify(settings)};

package/src/setup.ts

@@ -1,32 +1,29 @@
-import { resolve } from "path";
 import { Webview, SizeHint } from "webview-bun";
 import { lib } from "webview-bun/src/ffi";
 import { loadClaudeSettings, saveClaudeSettings } from "./claude-settings";
+import { activeProfile } from "./config";
 import { buildSetupHtml } from "./setup-html";
+import { getCredentialExportCommand } from "./credential-export";
+import { START_HEIGHT, bindAutosize } from "./autosize";
 import { version } from "../package.json";
 
-/** Build the command string that Claude Code should use to invoke this tool. */
-function getCredentialExportCommand(): string {
-  const script = Bun.argv[1];
-  // If the script has a .ts or .js extension, it was launched via interpreter
-  if (/\.[tj]sx?$/.test(script)) {
-    return `${process.execPath} ${resolve(script)}`;
-  }
-  // Otherwise it's an installed bin — use the bin path directly
-  return script;
-}
+const SETUP_WIDTH = 480;
+const SETUP_MAX_HEIGHT = 720;
 
 export function runSetup(): boolean {
   const settings = loadClaudeSettings();
   const env = (settings.env ?? {}) as Record<string, string>;
   const credentialExportCmd = getCredentialExportCommand();
 
+  // Setup edits $CLAUDE_CONFIG_DIR/settings.json, so name the profile it will land in.
+  const profile = activeProfile();
   const webview = new Webview(false, {
-    width: 480,
-    height: 480,
+    width: SETUP_WIDTH,
+    height: START_HEIGHT,
     hint: SizeHint.FIXED,
   });
-  webview.title = `Claude Code Bedrock Setup v${version}`;
+  webview.title = `Claude Code Bedrock Setup v${version} — ${profile.name}`;
+  bindAutosize(webview, SETUP_WIDTH, SETUP_MAX_HEIGHT);
 
   let saved = false;
   const handle = webview.unsafeHandle;
@@ -65,7 +62,7 @@ export function runSetup(): boolean {
 
   webview.bind("_cancel", () => lib.symbols.webview_terminate(handle));
 
-  webview.setHTML(buildSetupHtml(env, settings, credentialExportCmd));
+  webview.setHTML(buildSetupHtml(env, settings, credentialExportCmd, profile));
   webview.run();
 
   return saved;

package/test/autosize.test.ts

@@ -0,0 +1,56 @@
+import { describe, test, expect } from "bun:test";
+import { AUTOSIZE_CSS, AUTOSIZE_SCRIPT } from "../src/autosize-html";
+import { buildHtml, buildErrorHtml } from "../src/dialog-html";
+import { buildSetupHtml } from "../src/setup-html";
+
+const PAGES: Record<string, string> = {
+  dialog: buildHtml({ region: "us-east-1" }),
+  error: buildErrorHtml("something went wrong"),
+  setup: buildSetupHtml({}, {}, "claude-aws-mfa"),
+};
+
+describe("autosize contract", () => {
+  for (const [name, html] of Object.entries(PAGES)) {
+    describe(name, () => {
+      test("carries the measurement CSS and script", () => {
+        expect(html).toContain(AUTOSIZE_CSS);
+        expect(html).toContain(AUTOSIZE_SCRIPT);
+      });
+
+      test("wraps its content in the measured #fit element", () => {
+        expect(html).toContain(`<div id="fit">`);
+        // The wrapper must close before </body>, or it would measure nothing.
+        expect(html.indexOf(`<div id="fit">`)).toBeLessThan(html.indexOf("</body>"));
+      });
+
+      test("keeps page padding on #fit, not body", () => {
+        // Padding on body sits outside #fit's box and would be measured away.
+        const bodyRule = html.match(/\n  body \{[^}]*\}/)?.[0] ?? "";
+        expect(bodyRule).not.toContain("padding");
+      });
+    });
+  }
+});
+
+describe("AUTOSIZE_SCRIPT", () => {
+  test("reports a delta rather than an absolute height", () => {
+    // set_size sizes the whole frame; only a delta cancels out the titlebar.
+    expect(AUTOSIZE_SCRIPT).toContain("- innerHeight");
+    expect(AUTOSIZE_SCRIPT).toContain("_grow(delta)");
+  });
+
+  test("waits for fonts before measuring", () => {
+    expect(AUTOSIZE_SCRIPT).toContain("document.fonts?.ready");
+    expect(AUTOSIZE_SCRIPT).toContain("requestAnimationFrame");
+  });
+
+  test("skips the resize when the content already fits", () => {
+    expect(AUTOSIZE_SCRIPT).toContain("if (delta)");
+  });
+});
+
+describe("AUTOSIZE_CSS", () => {
+  test("keeps the body scrollable so #fit can exceed the viewport", () => {
+    expect(AUTOSIZE_CSS).toContain("overflow-y: scroll");
+  });
+});

package/test/config.test.ts

@@ -1,7 +1,50 @@
 import { describe, test, expect } from "bun:test";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, rmSync, statSync, openSync, closeSync } from "fs";
-import { join } from "path";
+import { join, resolve } from "path";
 import { tmpdir } from "os";
+import { homedir } from "os";
+import { activeProfile, missingConfigFields, profileSuffix } from "../src/config";
+
+describe("profileSuffix", () => {
+  test("is empty for no profile and for the default config dir", () => {
+    expect(profileSuffix("")).toBe(""); // CLAUDE_CONFIG_DIR unset
+    expect(profileSuffix(join(homedir(), ".claude"))).toBe("");
+    expect(profileSuffix(join(homedir(), ".claude") + "/")).toBe(""); // trailing slash still grandfathered
+  });
+
+  test("encodes the full path, not the basename, with / and . both as -", () => {
+    // resolve() puts a drive letter in front on Windows: "-" on POSIX, "D--" there.
+    const root = resolve("/").replace(/[/\\:]/g, "-");
+    expect(profileSuffix("/opt/profiles/work")).toBe(root + "opt-profiles-work");
+    // basename alone would collide; the full path keeps them distinct
+    expect(profileSuffix("/a/work")).not.toBe(profileSuffix("/b/work"));
+    expect(profileSuffix("/home/me/.claude-profiles/work")).toBe(root + "home-me--claude-profiles-work");
+    // whatever the platform, the result has to be usable as a filename component
+    expect(profileSuffix("/opt/profiles/work")).not.toMatch(/[/\\:]/);
+  });
+});
+
+describe("activeProfile", () => {
+  test("names the default config dir rather than returning nothing", () => {
+    // A blank banner would be ambiguous: "default profile" vs "build doesn't label profiles".
+    expect(activeProfile("")).toEqual({ name: "default", path: "~/.claude" });
+    expect(activeProfile(join(homedir(), ".claude"))).toEqual({ name: "default", path: "~/.claude" });
+  });
+
+  test("names the profile and shortens the home prefix", () => {
+    expect(activeProfile(join(homedir(), ".claude-profiles", "work"))).toEqual({
+      name: "work",
+      path: "~/.claude-profiles/work",
+    });
+    expect(activeProfile("/opt/profiles/work")).toEqual({ name: "work", path: "/opt/profiles/work" });
+    expect(activeProfile("/opt/profiles/work/")).toEqual({ name: "work", path: "/opt/profiles/work" });
+  });
+
+  test("does not shorten a sibling directory that merely shares the home prefix", () => {
+    const sibling = homedir() + "-other/work";
+    expect(activeProfile(sibling)?.path).toBe(sibling);
+  });
+});
 
 describe("config serialization", () => {
   const config = {
@@ -80,6 +123,44 @@ describe("config file I/O", () => {
   });
 });
 
+describe("missingConfigFields", () => {
+  const complete = {
+    region: "us-west-2",
+    accessKeyId: "AKIAIOSFODNN7EXAMPLE",
+    secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+    mfaArn: "arn:aws:iam::123456789012:mfa/user",
+    roleArn: "arn:aws:iam::123456789012:role/TestRole",
+    mfaMode: "command" as const,
+    mfaCommand: "op item get --otp myitem",
+  };
+
+  test("returns empty array when everything needed for headless operation is present", () => {
+    expect(missingConfigFields(complete)).toEqual([]);
+  });
+
+  test("reports each missing base field by name", () => {
+    const { region, ...rest } = complete;
+    expect(missingConfigFields(rest)).toContain("region");
+  });
+
+  test("requires mfaCommand even if other fields are present", () => {
+    const { mfaCommand, ...rest } = complete;
+    expect(missingConfigFields(rest)).toContain("mfaCommand");
+  });
+
+  test("requires mfaMode to be \"command\", not just mfaCommand set", () => {
+    const codeMode = { ...complete, mfaMode: "code" as const };
+    expect(missingConfigFields(codeMode)).toContain("mfaCommand");
+  });
+
+  test("reports everything missing for an empty config", () => {
+    const missing = missingConfigFields({});
+    expect(missing).toEqual([
+      "region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "mfaCommand",
+    ]);
+  });
+});
+
 const isWindows = process.platform === "win32";
 
 // Unix file-permission semantics don't apply on Windows.