juggernaut-bedrock 4.0.3 → 4.1.0

package/README.md

@@ -50,7 +50,7 @@ juggernaut apply --auth=iam
 That one command:
 
 1. **Writes** Bedrock config to `~/.claude/settings.json` (or project scope)
-2. **Sets** model IDs, region, effort level, and `CLAUDE_CODE_USE_BEDROCK=1` — only after credentials check out
+2. **Sets** model IDs, region, effort level, permission mode, and `CLAUDE_CODE_USE_BEDROCK=1` — only after credentials check out
 3. **Installs** a `claude` launcher shim that reads your token from the keychain and execs the real binary
 
 No `.bashrc` edits. No copying API keys into env vars. No "why isn't Bedrock routing?" at 2am.
@@ -87,14 +87,51 @@ No `.bashrc` edits. No copying API keys into env vars. No "why isn't Bedrock rou
 
 ## Default models
 
-| Tier | Model |
-|------|-------|
-| **Primary** | Claude Sonnet 4.6 |
-| **Opus** | Claude Opus 4.7 |
-| **Fast** | Claude Haiku 4.5 |
+| Tier | Model | Global inference profile |
+|------|-------|--------------------------|
+| **Primary** | Claude Sonnet 4.6 | `global.anthropic.claude-sonnet-4-6` |
+| **Opus** | Claude Opus 4.8 | `global.anthropic.claude-opus-4-8` |
+| **Fast** | Claude Haiku 4.5 | `global.anthropic.claude-haiku-4-5-20251001-v1:0` |
 
 Override any tier: `juggernaut apply --auth=iam --model=global.anthropic.claude-sonnet-4-6`
 
+## Effort levels
+
+Controls adaptive thinking depth. Valid values: `low | medium | high | xhigh | max`
+
+```bash
+juggernaut apply --auth=iam --effort=max
+```
+
+Default: `xhigh`. On Opus 4.8/4.7, effort level controls adaptive thinking depth — manual thinking mode is not supported.
+
+## Permission modes
+
+Controls how Claude Code handles tool-use approvals:
+
+| Mode | Behavior |
+|------|----------|
+| `default` | Prompts for each action |
+| `acceptEdits` | Auto-approves file edits |
+| `plan` | Propose only, no execution |
+| `auto` | Agentic safety classifier |
+| `bypassPermissions` | Skip all prompts (containers/VMs only) |
+
+```bash
+juggernaut apply --auth=iam --mode=auto
+```
+
+Auto mode on Bedrock requires `CLAUDE_CODE_ENABLE_AUTO_MODE=1` — Juggernaut sets this automatically.
+
+## Other options
+
+```bash
+--always-thinking       # enable extended thinking by default (alwaysThinkingEnabled)
+--service-tier=flex     # Bedrock service tier: default | flex | priority
+--opusplan              # route /plan to Opus 4.8, execution to Sonnet 4.6
+--scope=project         # write to ./.claude/settings.json instead of ~/.claude/
+```
+
 ## Troubleshooting
 
 Stuck? Start here:
@@ -115,4 +152,4 @@ Full docs, IAM policy, migration guide, and platform notes:
 
 MIT — see [LICENSE](https://github.com/jpvelasco/juggernaut/blob/main/LICENSE).
 
-Juggernaut is an independent tool, not affiliated with Anthropic or Amazon Web Services.
+Juggernaut is an independent tool, not affiliated with Anthropic or Amazon Web Services.

package/install.js

@@ -3,17 +3,55 @@
 const https = require("https");
 const fs = require("fs");
 const path = require("path");
-const { Readable } = require("stream");
+const os = require("os");
 const crypto = require("crypto");
+const { execFile, execFileSync } = require("child_process");
+const { promisify } = require("util");
+
+const execFileAsync = promisify(execFile);
 
 const REPO = "jpvelasco/juggernaut";
-const BIN_DIR = path.join(__dirname, "bin");
+const PACKAGE_DIR = __dirname;
+const BIN_DIR = path.join(PACKAGE_DIR, "bin");
+const TMP_PREFIX = path.join(os.tmpdir(), "juggernaut-install-");
+const ARCHIVE_TAR = "archive.tar.gz";
+const ARCHIVE_ZIP = "archive.zip";
+const BIN_NAME = "juggernaut";
 const ALLOWED_HOSTS = new Set([
   "github.com",
   "api.github.com",
   "release-assets.githubusercontent.com"
 ]);
 
+function joinUnder(base, ...segments) {
+  if (base.indexOf("\0") !== -1) {
+    throw new Error("Invalid base path");
+  }
+  for (const seg of segments) {
+    if (seg.indexOf("..") !== -1 || seg.indexOf("/") !== -1 || seg.indexOf("\\") !== -1) {
+      throw new Error(`Invalid path segment: ${seg}`);
+    }
+  }
+  const joined = path.join(base, ...segments);
+  const normalBase = path.normalize(base) + path.sep;
+  const normalJoined = path.normalize(joined);
+  const compare = process.platform === "win32"
+    ? (a, b) => a.toLowerCase().startsWith(b.toLowerCase())
+    : (a, b) => a.startsWith(b);
+  if (!compare(normalJoined, normalBase)) {
+    const exactBase = process.platform === "win32"
+      ? path.normalize(base).toLowerCase()
+      : path.normalize(base);
+    const exactJoined = process.platform === "win32"
+      ? normalJoined.toLowerCase()
+      : normalJoined;
+    if (exactJoined !== exactBase) {
+      throw new Error(`Path traversal detected: ${joined} is outside ${base}`);
+    }
+  }
+  return normalJoined;
+}
+
 function getPlatform() {
   const osMap = { darwin: "darwin", linux: "linux", win32: "windows" };
   const archMap = { x64: "amd64", arm64: "arm64" };
@@ -58,18 +96,93 @@ async function getLatestVersion() {
   return release.tag_name.replace(/^v/, "");
 }
 
+function pickArchive(platform, checksumsText) {
+  const tarArchive = `juggernaut_${platform}.tar.gz`;
+  if (checksumsText.includes(tarArchive)) return { name: tarArchive, kind: "tar.gz" };
+  const zipArchive = `juggernaut_${platform}.zip`;
+  if (process.platform === "win32" && checksumsText.includes(zipArchive)) {
+    return { name: zipArchive, kind: "zip" };
+  }
+  throw new Error(`No supported archive found in release checksums for ${platform}`);
+}
+
+function extractTarGz(archiveBuf) {
+  const tmpDir = fs.mkdtempSync(TMP_PREFIX);
+  const archivePath = joinUnder(tmpDir, ARCHIVE_TAR);
+  const prevCwd = process.cwd();
+  try {
+    process.chdir(tmpDir);
+    fs.writeFileSync(ARCHIVE_TAR, archiveBuf);
+    process.chdir(PACKAGE_DIR);
+    fs.mkdirSync("bin", { recursive: true });
+    try {
+      execFileSync("tar", ["-xzf", archivePath, "-C", BIN_DIR], { stdio: "pipe" });
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        throw new Error(
+          "tar not found on PATH. On Windows, use Windows 10 version 1803 or later (includes tar.exe)."
+        );
+      }
+      const detail = err.stderr ? err.stderr.toString().trim() : err.message;
+      throw new Error(`tar extraction failed: ${detail}`);
+    }
+    if (process.platform !== "win32") {
+      process.chdir(BIN_DIR);
+      if (fs.existsSync(BIN_NAME)) {
+        fs.chmodSync(BIN_NAME, 0o700);
+      }
+    }
+  } finally {
+    process.chdir(prevCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
+async function extractZip(archiveBuf) {
+  const tmpDir = fs.mkdtempSync(TMP_PREFIX);
+  const archivePath = joinUnder(tmpDir, ARCHIVE_ZIP);
+  const prevCwd = process.cwd();
+  try {
+    process.chdir(tmpDir);
+    fs.writeFileSync(ARCHIVE_ZIP, archiveBuf);
+    process.chdir(PACKAGE_DIR);
+    fs.mkdirSync("bin", { recursive: true });
+    const script = [
+      "$ErrorActionPreference = 'Stop'",
+      `Expand-Archive -LiteralPath '${archivePath.replace(/'/g, "''")}' -DestinationPath '${BIN_DIR.replace(/'/g, "''")}' -Force`
+    ].join("; ");
+    try {
+      await execFileAsync(
+        "powershell",
+        ["-NoProfile", "-NonInteractive", "-Command", script],
+        { stdio: "pipe" }
+      );
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        throw new Error(
+          "PowerShell not found. PowerShell 5.0+ is required to extract archives on Windows."
+        );
+      }
+      const detail = err.stderr ? err.stderr.toString().trim() : err.message;
+      throw new Error(`ZIP extraction failed: ${detail}`);
+    }
+  } finally {
+    process.chdir(prevCwd);
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  }
+}
+
 async function main() {
-  const { platform, os: osName } = getPlatform();
+  const { platform } = getPlatform();
   const version = await getLatestVersion();
-  const ext = osName === "windows" ? "zip" : "tar.gz";
-  const archive = `juggernaut_${platform}.${ext}`;
   const baseUrl = `https://github.com/${REPO}/releases/download/v${version}`;
+  const checksumsBuf = await httpsGetBuffer(`${baseUrl}/checksums.txt`);
+  const checksums = checksumsBuf.toString("utf8");
+  const { name: archive, kind } = pickArchive(platform, checksums);
 
   console.log(`Downloading Juggernaut v${version} (${platform})...`);
   const archiveBuf = await httpsGetBuffer(`${baseUrl}/${archive}`);
-  const checksumsBuf = await httpsGetBuffer(`${baseUrl}/checksums.txt`);
 
-  const checksums = checksumsBuf.toString("utf8");
   const line = checksums.split("\n").find((l) => l.includes(archive));
   if (!line) throw new Error(`Checksum not found for ${archive}`);
   const expected = line.trim().split(/\s+/)[0].toLowerCase();
@@ -78,14 +191,8 @@ async function main() {
     throw new Error(`Checksum mismatch for ${archive}\n  expected: ${expected}\n  got:      ${actual}`);
   }
 
-  if (ext === "zip") {
-    const AdmZip = require("adm-zip");
-    const zip = new AdmZip(archiveBuf);
-    zip.extractEntryTo("juggernaut.exe", BIN_DIR, false, true);
-  } else {
-    const tar = require("tar");
-    await tar.x({ cwd: BIN_DIR, mode: 0o700, strict: true }, Readable.from(archiveBuf));
-  }
+  if (kind === "zip") await extractZip(archiveBuf);
+  else extractTarGz(archiveBuf);
 
   console.log(`Juggernaut v${version} installed successfully.`);
   console.log(`Run: juggernaut apply`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "juggernaut-bedrock",
-  "version": "4.0.3",
+  "version": "4.1.0",
   "description": "Route Claude Code through Amazon Bedrock in one command — IAM, SSO, or API key. Cross-platform CLI for GenAI developers.",
   "bin": {
     "juggernaut": "./bin/juggernaut"
@@ -8,12 +8,15 @@
   "scripts": {
     "postinstall": "node install.js"
   },
-  "dependencies": {
-    "tar": "7.5.16",
-    "adm-zip": "0.5.17"
-  },
-  "os": ["darwin", "linux", "win32"],
-  "cpu": ["x64", "arm64"],
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
   "keywords": [
     "claude",
     "claude-code",