claude-aws-mfa 1.2.1 → 1.3.0

package/CHANGELOG.md

@@ -22,6 +22,16 @@ Releases are automated via CI. To create a new release:
 Stable versions (e.g. `v1.2.0`) publish to npm `@latest`. Pre-release versions
 (e.g. `v1.2.0-rc.1`) publish to npm `@next` and create a GitHub pre-release.
 
+## [v1.3.0] - 2026-10-14
+
+### Added
+- Configurable STS session name in the credentials dialog (defaults to `claude-aws-mfa`).
+
+## [v1.2.2] - 2026-10-09
+
+### Changed
+- Changed GitHub username
+
 ## [v1.2.1] - 2026-08-10
 
 ### Fixed
@@ -32,7 +42,7 @@ Stable versions (e.g. `v1.2.0`) publish to npm `@latest`. Pre-release versions
 ## [v1.2.0] - 2026-08-10
 
 ### Added
-- **Claude Code profile awareness**: `--setup` now reads and writes `$CLAUDE_CONFIG_DIR/settings.json` rather than always `~/.claude/settings.json`, so a tool like [claude-as](https://github.com/p120ph37/claude-as) can give one project a Bedrock profile while others stay on OAuth. The saved config and lock file are scoped to the profile as well (`~/.config/claude-aws-mfa<encoded-config-dir>.json`), since separate profiles generally mean separate AWS accounts and a shared cached session would otherwise hand a profile credentials for the wrong account. The default `~/.claude` is unsuffixed, so existing installs keep their current config file with no migration. Since the lock is per-profile, two profiles can prompt at the same time, so the credential, error, and setup dialogs all name their profile in the window title and in a banner under the heading. The default config dir is named too — to a multi-profile user an unlabelled dialog reads equally as "this is the default profile" and "this build does not label profiles".
+- **Claude Code profile awareness**: `--setup` now reads and writes `$CLAUDE_CONFIG_DIR/settings.json` rather than always `~/.claude/settings.json`, so a tool like [claude-as](https://github.com/aaronmeriwether/claude-as) can give one project a Bedrock profile while others stay on OAuth. The saved config and lock file are scoped to the profile as well (`~/.config/claude-aws-mfa<encoded-config-dir>.json`), since separate profiles generally mean separate AWS accounts and a shared cached session would otherwise hand a profile credentials for the wrong account. The default `~/.claude` is unsuffixed, so existing installs keep their current config file with no migration. Since the lock is per-profile, two profiles can prompt at the same time, so the credential, error, and setup dialogs all name their profile in the window title and in a banner under the heading. The default config dir is named too — to a multi-profile user an unlabelled dialog reads equally as "this is the default profile" and "this build does not label profiles".
 - **`--no-ui` mode**: skip the GUI entirely and drive the tool from the command line — useful for scripting and for letting an LLM operate the tool during setup/debugging. Prints credentials JSON to stdout on success, keeping stdout cleanly parsable; on failure, prints the underlying error (or names the specific missing config field(s) when the config is incomplete) to stderr. Never imports the GUI toolkit, so it also works in headless environments.
 - **Error dialog**: authentication failures (STS or MFA command) now show a native dialog box instead of writing to stderr, since Claude Code doesn't surface a failing command's stderr to the user. Suppressed in `--no-ui` mode, where the error is printed to stderr instead.
 

package/README.md

@@ -47,7 +47,7 @@ Add this (plus any addtitional config you prefer) to your Claude Code settings (
 ## How it works
 
 1. On first run, seeds the dialog with credentials from your existing AWS config (`~/.aws/credentials`, environment variables, SSO, etc.)
-2. Shows a native GUI dialog with fields for region, access key, secret key, MFA ARN, role ARN, and session duration
+2. Shows a native GUI dialog with fields for region, access key, secret key, MFA ARN, role ARN, session duration, and STS session name (defaults to `claude-aws-mfa`)
 3. Collects the MFA token — either type a 6-digit code directly, or switch to **MFA Command** mode and provide a shell command that outputs the code (e.g. `op item get --otp …` for 1Password CLI)
 4. Calls `sts:AssumeRole` with the MFA token
 5. If the requested session duration is rejected, automatically retries with shorter durations (12h → 6h → 2h → 1h)
@@ -58,7 +58,7 @@ On subsequent runs, all fields are pre-populated from the saved config — just
 
 ### Claude Code profiles
 
-Claude Code reads its settings from `$CLAUDE_CONFIG_DIR` when that is set, which tools such as [claude-as](https://github.com/p120ph37/claude-as) use to give each project its own credentials. This tool follows suit:
+Claude Code reads its settings from `$CLAUDE_CONFIG_DIR` when that is set, which tools such as [claude-as](https://github.com/aaronmeriwether/claude-as) use to give each project its own credentials. This tool follows suit:
 
 - `--setup` reads and writes `$CLAUDE_CONFIG_DIR/settings.json`, so a profile can be Bedrock-only while others stay on OAuth.
 - The config file is scoped per profile — `~/.config/claude-aws-mfa<profile>.json`, where `<profile>` is the config dir path encoded the way Claude encodes project dirs (`/` and `.` both become `-`). Different profiles usually mean different AWS accounts, and a shared cached session would hand a profile credentials for the wrong one.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "claude-aws-mfa",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "type": "module",
-  "repository": "https://github.com/p120ph37/claude-aws-mfa",
+  "repository": "https://github.com/aaronmeriwether/claude-aws-mfa",
   "bin": {
     "claude-aws-mfa": "./src/index.ts"
   },

package/src/config.ts

@@ -28,6 +28,7 @@ export interface Config {
   mfaArn: string;
   roleArn: string;
   duration: number;
+  sessionName?: string;
   mfaMode?: "code" | "command";
   mfaCommand?: string;
   cacheSession?: boolean;

package/src/dialog-html.ts

@@ -1,8 +1,8 @@
-import { STANDARD_DURATIONS } from "./sts";
+import { DEFAULT_SESSION_NAME, STANDARD_DURATIONS } from "./sts";
 import { AUTOSIZE_CSS, AUTOSIZE_SCRIPT } from "./autosize-html";
 import { DEFAULT_PROFILE, type ActiveProfile } from "./config";
 
-export const FIELDS = ["region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "duration", "mfaMode", "mfaCode", "mfaCommand"] as const;
+export const FIELDS = ["region", "accessKeyId", "secretAccessKey", "mfaArn", "roleArn", "duration", "sessionName", "mfaMode", "mfaCode", "mfaCommand"] as const;
 
 export const FIELD_PATTERNS: Record<string, string> = {
   region: "^[a-z]{2}(-[a-z]+-\\d+)$",
@@ -11,6 +11,8 @@ export const FIELD_PATTERNS: Record<string, string> = {
   mfaArn: "^arn:aws:iam::\\d{12}:mfa/.+$",
   roleArn: "^arn:aws:iam::\\d{12}:role/.+$",
   duration: "^[1-9]\\d*$",
+  // AWS RoleSessionName constraint.
+  sessionName: "^[\\w+=,.@-]{2,64}$",
   mfaCode: "^\\d{6}$",
   mfaCommand: "^.+$",
 };
@@ -90,6 +92,7 @@ ${PROFILE_STYLE}
   <div class="field"><label>MFA Device ARN</label><input id="mfaArn" placeholder="arn:aws:iam::123456789012:mfa/user"></div>
   <div class="field"><label>Role ARN</label><input id="roleArn" placeholder="arn:aws:iam::123456789012:role/MyRole"></div>
   <div class="field"><label>Session Duration (seconds)</label><input id="duration" placeholder="${STANDARD_DURATIONS[0]}"></div>
+  <div class="field"><label>Session Name</label><input id="sessionName" placeholder="${DEFAULT_SESSION_NAME}"></div>
   <hr>
   <div class="radio-field">
     <input type="radio" name="mfaMode" id="mfaModeCode" value="code" checked>

package/src/dialog.ts

@@ -3,6 +3,7 @@ import { lib } from "webview-bun/src/ffi";
 import { activeProfile, type Config } from "./config";
 import { buildHtml, buildErrorHtml } from "./dialog-html";
 import { START_HEIGHT, bindAutosize } from "./autosize";
+import { DEFAULT_SESSION_NAME } from "./sts";
 import { version } from "../package.json";
 
 const DIALOG_WIDTH = 440;
@@ -24,6 +25,7 @@ export interface DialogResult {
   mfaArn: string;
   roleArn: string;
   duration: string;
+  sessionName: string;
   mfaMode: "code" | "command";
   mfaCode: string;
   mfaCommand: string;
@@ -81,6 +83,7 @@ export function showDialog(defaults: Partial<Config>): DialogResult | null {
     mfaArn: defaults.mfaArn ?? "",
     roleArn: defaults.roleArn ?? "",
     duration: defaults.duration != null ? String(defaults.duration) : "",
+    sessionName: defaults.sessionName ?? DEFAULT_SESSION_NAME,
     mfaCommand: defaults.mfaCommand ?? "",
     mfaMode: defaults.mfaMode ?? "code",
   }, activeProfile()));

package/src/index.ts

@@ -92,6 +92,7 @@ async function tryAutoMfa(cfg: Partial<Config>): Promise<CachedSession | null> {
     roleArn: cfg.roleArn,
     mfaCode,
     duration: cfg.duration ?? STANDARD_DURATIONS[0],
+    sessionName: cfg.sessionName,
   });
 
   const session: CachedSession = {
@@ -108,6 +109,7 @@ async function tryAutoMfa(cfg: Partial<Config>): Promise<CachedSession | null> {
     mfaArn: cfg.mfaArn,
     roleArn: cfg.roleArn,
     duration,
+    sessionName: cfg.sessionName,
     mfaMode: cfg.mfaMode,
     mfaCommand: cfg.mfaCommand,
     cacheSession: cfg.cacheSession,
@@ -146,6 +148,7 @@ async function obtainViaDialog(cfg: Partial<Config>): Promise<void> {
     roleArn: result.roleArn,
     mfaCode,
     duration: parseInt(result.duration, 10) || STANDARD_DURATIONS[0],
+    sessionName: result.sessionName,
   });
 
   const session: CachedSession = {
@@ -162,6 +165,7 @@ async function obtainViaDialog(cfg: Partial<Config>): Promise<void> {
     mfaArn: result.mfaArn,
     roleArn: result.roleArn,
     duration,
+    sessionName: result.sessionName || undefined,
     mfaMode: result.mfaMode,
     mfaCommand: result.mfaCommand || undefined,
     cacheSession: defaults.cacheSession,

package/src/sts.ts

@@ -1,5 +1,7 @@
 import { STSClient, AssumeRoleCommand } from "@aws-sdk/client-sts";
 
+export const DEFAULT_SESSION_NAME = "claude-aws-mfa";
+
 export const STANDARD_DURATIONS = [129600, 86400, 43200, 28800, 21600, 14400, 7200, 3600];
 
 export function isDurationError(err: unknown): boolean {
@@ -25,6 +27,7 @@ export async function assumeRoleWithMfa(params: {
   roleArn: string;
   mfaCode: string;
   duration: number;
+  sessionName?: string;
 }) {
   const client = new STSClient({
     region: params.region,
@@ -37,7 +40,7 @@ export async function assumeRoleWithMfa(params: {
     try {
       const { Credentials: c } = await client.send(new AssumeRoleCommand({
         RoleArn: params.roleArn,
-        RoleSessionName: "claude-aws-mfa",
+        RoleSessionName: params.sessionName || DEFAULT_SESSION_NAME,
         SerialNumber: params.mfaArn,
         TokenCode: params.mfaCode,
         DurationSeconds: ladder[i],

package/test/dialog-html.test.ts

@@ -103,7 +103,7 @@ describe("buildHtml", () => {
   test("FIELDS list matches expected form fields", () => {
     expect(FIELDS).toEqual([
       "region", "accessKeyId", "secretAccessKey",
-      "mfaArn", "roleArn", "duration", "mfaMode", "mfaCode", "mfaCommand",
+      "mfaArn", "roleArn", "duration", "sessionName", "mfaMode", "mfaCode", "mfaCommand",
     ]);
   });
 
@@ -128,6 +128,7 @@ describe("buildHtml", () => {
       mfaArn: "arn:aws:iam::123456789012:mfa/user",
       roleArn: "arn:aws:iam::123456789012:role/TestRole",
       duration: "43200",
+      sessionName: "claude-aws-mfa",
       mfaCode: "123456",
       mfaCommand: "op item get --otp myitem",
     };
@@ -138,6 +139,7 @@ describe("buildHtml", () => {
       mfaArn: "not-an-arn",
       roleArn: "not-an-arn",
       duration: "abc",
+      sessionName: "has spaces",
       mfaCode: "12",
       mfaCommand: "",
     };

package/test/sts.test.ts

@@ -117,6 +117,12 @@ describe("assumeRoleWithMfa", () => {
     });
   });
 
+  test("passes a custom session name to STS", async () => {
+    await assumeRoleWithMfa({ ...BASE_PARAMS, sessionName: "alice-laptop" });
+
+    expect(capturedCommands[0].RoleSessionName).toBe("alice-laptop");
+  });
+
   test("falls back to shorter duration on duration error", async () => {
     let callCount = 0;
     mockSend = mock(() => {