claude-aws-mfa 1.2.0 → 1.2.2

package/.github/workflows/release.yml

@@ -110,9 +110,17 @@ jobs:
           echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
           echo "Detected version=$VERSION prerelease=$PRERELEASE"
 
-  release:
+  # v1.2.0 shipped while the Test workflow was red: the release ran its own
+  # `bun test` on ubuntu only, so a Windows-only failure never reached it.
+  # Gate on the whole matrix instead, and only when actually releasing.
+  test:
     needs: detect-release
     if: needs.detect-release.outputs.version != ''
+    uses: ./.github/workflows/test.yml
+
+  release:
+    needs: [detect-release, test]
+    if: needs.detect-release.outputs.version != ''
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -128,8 +136,6 @@ jobs:
 
       - run: bun install --frozen-lockfile
 
-      - run: bun test
-
       - name: Set package version
         run: |
           VERSION="${{ needs.detect-release.outputs.version }}"

package/.github/workflows/test.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  # Called by the release workflow so a release runs this exact matrix, rather
+  # than a subset of it that can be green while this one is red.
+  workflow_call:
 
 jobs:
   test:

package/CHANGELOG.md

@@ -22,10 +22,22 @@ Releases are automated via CI. To create a new release:
 Stable versions (e.g. `v1.2.0`) publish to npm `@latest`. Pre-release versions
 (e.g. `v1.2.0-rc.1`) publish to npm `@next` and create a GitHub pre-release.
 
+## [v1.2.2] - 2026-10-09
+
+### Changed
+- Changed GitHub username
+
+## [v1.2.1] - 2026-08-10
+
+### Fixed
+- **Profile scoping works on Windows.** The per-profile config filename encoded only `/` and `.`, so a Windows `CLAUDE_CONFIG_DIR` kept its backslashes and drive colon — `~/.config/claude-aws-mfa<encoded>.json` then named an NTFS alternate data stream instead of a per-profile file. Separators are normalized and the colon encoded, so a Windows profile gets its own config and lock like everywhere else.
+- **A release can no longer publish over a red build.** The release workflow ran its own `bun test` on Linux only, so v1.2.0 shipped while the Test workflow's Windows leg was failing. It now calls that workflow directly and waits for the full matrix — every OS, GUI tests included — before publishing.
+- Dialog titles on Windows showed the full `C:\Users\you\.claude-profiles\work` instead of `~/.claude-profiles/work`: the home-prefix shortening only recognized `/` as a separator.
+
 ## [v1.2.0] - 2026-08-10
 
 ### Added
-- **Claude Code profile awareness**: `--setup` now reads and writes `$CLAUDE_CONFIG_DIR/settings.json` rather than always `~/.claude/settings.json`, so a tool like [claude-as](https://github.com/p120ph37/claude-as) can give one project a Bedrock profile while others stay on OAuth. The saved config and lock file are scoped to the profile as well (`~/.config/claude-aws-mfa<encoded-config-dir>.json`), since separate profiles generally mean separate AWS accounts and a shared cached session would otherwise hand a profile credentials for the wrong account. The default `~/.claude` is unsuffixed, so existing installs keep their current config file with no migration. Since the lock is per-profile, two profiles can prompt at the same time, so the credential, error, and setup dialogs all name their profile in the window title and in a banner under the heading. The default config dir is named too — to a multi-profile user an unlabelled dialog reads equally as "this is the default profile" and "this build does not label profiles".
+- **Claude Code profile awareness**: `--setup` now reads and writes `$CLAUDE_CONFIG_DIR/settings.json` rather than always `~/.claude/settings.json`, so a tool like [claude-as](https://github.com/aaronmeriwether/claude-as) can give one project a Bedrock profile while others stay on OAuth. The saved config and lock file are scoped to the profile as well (`~/.config/claude-aws-mfa<encoded-config-dir>.json`), since separate profiles generally mean separate AWS accounts and a shared cached session would otherwise hand a profile credentials for the wrong account. The default `~/.claude` is unsuffixed, so existing installs keep their current config file with no migration. Since the lock is per-profile, two profiles can prompt at the same time, so the credential, error, and setup dialogs all name their profile in the window title and in a banner under the heading. The default config dir is named too — to a multi-profile user an unlabelled dialog reads equally as "this is the default profile" and "this build does not label profiles".
 - **`--no-ui` mode**: skip the GUI entirely and drive the tool from the command line — useful for scripting and for letting an LLM operate the tool during setup/debugging. Prints credentials JSON to stdout on success, keeping stdout cleanly parsable; on failure, prints the underlying error (or names the specific missing config field(s) when the config is incomplete) to stderr. Never imports the GUI toolkit, so it also works in headless environments.
 - **Error dialog**: authentication failures (STS or MFA command) now show a native dialog box instead of writing to stderr, since Claude Code doesn't surface a failing command's stderr to the user. Suppressed in `--no-ui` mode, where the error is printed to stderr instead.
 

package/README.md

@@ -58,7 +58,7 @@ On subsequent runs, all fields are pre-populated from the saved config — just
 
 ### Claude Code profiles
 
-Claude Code reads its settings from `$CLAUDE_CONFIG_DIR` when that is set, which tools such as [claude-as](https://github.com/p120ph37/claude-as) use to give each project its own credentials. This tool follows suit:
+Claude Code reads its settings from `$CLAUDE_CONFIG_DIR` when that is set, which tools such as [claude-as](https://github.com/aaronmeriwether/claude-as) use to give each project its own credentials. This tool follows suit:
 
 - `--setup` reads and writes `$CLAUDE_CONFIG_DIR/settings.json`, so a profile can be Bedrock-only while others stay on OAuth.
 - The config file is scoped per profile — `~/.config/claude-aws-mfa<profile>.json`, where `<profile>` is the config dir path encoded the way Claude encodes project dirs (`/` and `.` both become `-`). Different profiles usually mean different AWS accounts, and a shared cached session would hand a profile credentials for the wrong one.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "claude-aws-mfa",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "type": "module",
-  "repository": "https://github.com/p120ph37/claude-aws-mfa",
+  "repository": "https://github.com/aaronmeriwether/claude-aws-mfa",
   "bin": {
     "claude-aws-mfa": "./src/index.ts"
   },

package/src/config.ts

@@ -57,15 +57,18 @@ export interface Config {
 export function profileSuffix(dir = process.env.CLAUDE_CONFIG_DIR): string {
   if (!dir) return "";
   const canonical = (p: string) => {
+    let real: string;
     try {
-      return realpathSync(p);
+      real = realpathSync(p);
     } catch {
-      return resolve(p);
+      real = resolve(p);
     }
+    return real.replace(/\\/g, "/");
   };
   const real = canonical(dir);
   if (real === canonical(join(homedir(), ".claude"))) return "";
-  return real.replace(/[/.]/g, "-");
+  // `:` goes too, or a Windows drive letter would make the filename an NTFS stream.
+  return real.replace(/[/.:]/g, "-");
 }
 
 export interface ActiveProfile {
@@ -87,11 +90,12 @@ export const DEFAULT_PROFILE: ActiveProfile = { name: "default", path: "~/.claud
  */
 export function activeProfile(dir = process.env.CLAUDE_CONFIG_DIR): ActiveProfile {
   if (!dir || !profileSuffix(dir)) return DEFAULT_PROFILE;
-  const clean = dir.replace(/\/+$/, "");
+  const clean = dir.replace(/[/\\]+$/, "");
   const home = homedir();
+  const underHome = clean === home || (clean.startsWith(home) && /^[/\\]/.test(clean.slice(home.length)));
   return {
     name: basename(clean),
-    path: clean === home || clean.startsWith(home + "/") ? "~" + clean.slice(home.length) : clean,
+    path: underHome ? ("~" + clean.slice(home.length)).replace(/\\/g, "/") : clean,
   };
 }
 

package/test/config.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "bun:test";
 import { chmodSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, rmSync, statSync, openSync, closeSync } from "fs";
-import { join } from "path";
+import { join, resolve } from "path";
 import { tmpdir } from "os";
 import { homedir } from "os";
 import { activeProfile, missingConfigFields, profileSuffix } from "../src/config";
@@ -13,10 +13,14 @@ describe("profileSuffix", () => {
   });
 
   test("encodes the full path, not the basename, with / and . both as -", () => {
-    expect(profileSuffix("/opt/profiles/work")).toBe("-opt-profiles-work");
+    // resolve() puts a drive letter in front on Windows: "-" on POSIX, "D--" there.
+    const root = resolve("/").replace(/[/\\:]/g, "-");
+    expect(profileSuffix("/opt/profiles/work")).toBe(root + "opt-profiles-work");
     // basename alone would collide; the full path keeps them distinct
     expect(profileSuffix("/a/work")).not.toBe(profileSuffix("/b/work"));
-    expect(profileSuffix("/home/me/.claude-profiles/work")).toBe("-home-me--claude-profiles-work");
+    expect(profileSuffix("/home/me/.claude-profiles/work")).toBe(root + "home-me--claude-profiles-work");
+    // whatever the platform, the result has to be usable as a filename component
+    expect(profileSuffix("/opt/profiles/work")).not.toMatch(/[/\\:]/);
   });
 });
 

package/test/gui-screenshot.test.ts

@@ -41,7 +41,10 @@ describe.skipIf(!process.env.GUI_TEST)("GUI screenshot tests", () => {
     typeof import("node-screenshots").Window
   > | null = null;
 
+  let titles: string[] = [];
+
   beforeAll(async () => {
+    const start = Date.now();
     windowModule = await import("node-screenshots");
 
     mkdirSync(SCREENSHOT_DIR, { recursive: true });
@@ -52,28 +55,42 @@ describe.skipIf(!process.env.GUI_TEST)("GUI screenshot tests", () => {
       stderr: "inherit",
     });
 
-    // Poll for the window to appear (up to 20s).
-    // Window.all() may throw if the window manager hasn't registered
-    // EWMH atoms yet (e.g. _NET_CLIENT_LIST_STACKING on Linux), so
-    // we catch and retry.
-    const deadline = Date.now() + 20_000;
+    // Poll for the window to appear. The budget is 90s rather than a snug
+    // multiple of the ~8s a warm runner takes: on Windows the first WebView2
+    // launch on a fresh image bootstraps its runtime and user-data folder
+    // before any window exists, which is what made this test flaky in CI.
+    // Waiting longer costs nothing when the window shows up on schedule.
+    //
+    // Window.all() may throw if the window manager hasn't registered EWMH
+    // atoms yet (e.g. _NET_CLIENT_LIST_STACKING on Linux), so we catch and
+    // retry.
+    const deadline = Date.now() + 90_000;
     while (Date.now() < deadline) {
       try {
         const windows = windowModule.Window.all();
-        const match = windows.find((w) => {
-          try { return w.title()?.includes("Claude AWS MFA"); }
-          catch { return false; }
+        titles = windows.map((w) => {
+          try { return w.title() ?? ""; } catch { return ""; }
         });
-        if (match) {
-          foundWindow = match;
+        const i = titles.findIndex((t) => t.includes("Claude AWS MFA"));
+        if (i >= 0) {
+          foundWindow = windows[i]!;
           break;
         }
       } catch {
         // Window.all() not yet available — WM still initializing
       }
+      // A dead launcher will never produce a window; stop and let the
+      // "app launches without error" assertion report the exit code.
+      if (proc.exitCode !== null) break;
       await Bun.sleep(500);
     }
-  }, 30_000);
+    if (!foundWindow) {
+      // Without this a failure is a bare `null` — no way to tell "window never
+      // opened" from "opened under a title we didn't match".
+      console.log(`No matching window after ${Math.round((Date.now() - start) / 1000)}s.`);
+      console.log(`Launcher exitCode: ${proc.exitCode}. Visible titles: ${JSON.stringify(titles)}`);
+    }
+  }, 120_000);
 
   afterAll(() => {
     proc?.kill();