juggernaut-bedrock 4.0.4 → 4.1.0

package/README.md

@@ -50,7 +50,7 @@ juggernaut apply --auth=iam
 That one command:
 
 1. **Writes** Bedrock config to `~/.claude/settings.json` (or project scope)
-2. **Sets** model IDs, region, effort level, and `CLAUDE_CODE_USE_BEDROCK=1` — only after credentials check out
+2. **Sets** model IDs, region, effort level, permission mode, and `CLAUDE_CODE_USE_BEDROCK=1` — only after credentials check out
 3. **Installs** a `claude` launcher shim that reads your token from the keychain and execs the real binary
 
 No `.bashrc` edits. No copying API keys into env vars. No "why isn't Bedrock routing?" at 2am.
@@ -87,14 +87,51 @@ No `.bashrc` edits. No copying API keys into env vars. No "why isn't Bedrock rou
 
 ## Default models
 
-| Tier | Model |
-|------|-------|
-| **Primary** | Claude Sonnet 4.6 |
-| **Opus** | Claude Opus 4.7 |
-| **Fast** | Claude Haiku 4.5 |
+| Tier | Model | Global inference profile |
+|------|-------|--------------------------|
+| **Primary** | Claude Sonnet 4.6 | `global.anthropic.claude-sonnet-4-6` |
+| **Opus** | Claude Opus 4.8 | `global.anthropic.claude-opus-4-8` |
+| **Fast** | Claude Haiku 4.5 | `global.anthropic.claude-haiku-4-5-20251001-v1:0` |
 
 Override any tier: `juggernaut apply --auth=iam --model=global.anthropic.claude-sonnet-4-6`
 
+## Effort levels
+
+Controls adaptive thinking depth. Valid values: `low | medium | high | xhigh | max`
+
+```bash
+juggernaut apply --auth=iam --effort=max
+```
+
+Default: `xhigh`. On Opus 4.8/4.7, effort level controls adaptive thinking depth — manual thinking mode is not supported.
+
+## Permission modes
+
+Controls how Claude Code handles tool-use approvals:
+
+| Mode | Behavior |
+|------|----------|
+| `default` | Prompts for each action |
+| `acceptEdits` | Auto-approves file edits |
+| `plan` | Propose only, no execution |
+| `auto` | Agentic safety classifier |
+| `bypassPermissions` | Skip all prompts (containers/VMs only) |
+
+```bash
+juggernaut apply --auth=iam --mode=auto
+```
+
+Auto mode on Bedrock requires `CLAUDE_CODE_ENABLE_AUTO_MODE=1` — Juggernaut sets this automatically.
+
+## Other options
+
+```bash
+--always-thinking       # enable extended thinking by default (alwaysThinkingEnabled)
+--service-tier=flex     # Bedrock service tier: default | flex | priority
+--opusplan              # route /plan to Opus 4.8, execution to Sonnet 4.6
+--scope=project         # write to ./.claude/settings.json instead of ~/.claude/
+```
+
 ## Troubleshooting
 
 Stuck? Start here:
@@ -115,4 +152,4 @@ Full docs, IAM policy, migration guide, and platform notes:
 
 MIT — see [LICENSE](https://github.com/jpvelasco/juggernaut/blob/main/LICENSE).
 
-Juggernaut is an independent tool, not affiliated with Anthropic or Amazon Web Services.
+Juggernaut is an independent tool, not affiliated with Anthropic or Amazon Web Services.

package/install.js

@@ -11,13 +11,47 @@ const { promisify } = require("util");
 const execFileAsync = promisify(execFile);
 
 const REPO = "jpvelasco/juggernaut";
-const BIN_DIR = path.join(__dirname, "bin");
+const PACKAGE_DIR = __dirname;
+const BIN_DIR = path.join(PACKAGE_DIR, "bin");
+const TMP_PREFIX = path.join(os.tmpdir(), "juggernaut-install-");
+const ARCHIVE_TAR = "archive.tar.gz";
+const ARCHIVE_ZIP = "archive.zip";
+const BIN_NAME = "juggernaut";
 const ALLOWED_HOSTS = new Set([
   "github.com",
   "api.github.com",
   "release-assets.githubusercontent.com"
 ]);
 
+function joinUnder(base, ...segments) {
+  if (base.indexOf("\0") !== -1) {
+    throw new Error("Invalid base path");
+  }
+  for (const seg of segments) {
+    if (seg.indexOf("..") !== -1 || seg.indexOf("/") !== -1 || seg.indexOf("\\") !== -1) {
+      throw new Error(`Invalid path segment: ${seg}`);
+    }
+  }
+  const joined = path.join(base, ...segments);
+  const normalBase = path.normalize(base) + path.sep;
+  const normalJoined = path.normalize(joined);
+  const compare = process.platform === "win32"
+    ? (a, b) => a.toLowerCase().startsWith(b.toLowerCase())
+    : (a, b) => a.startsWith(b);
+  if (!compare(normalJoined, normalBase)) {
+    const exactBase = process.platform === "win32"
+      ? path.normalize(base).toLowerCase()
+      : path.normalize(base);
+    const exactJoined = process.platform === "win32"
+      ? normalJoined.toLowerCase()
+      : normalJoined;
+    if (exactJoined !== exactBase) {
+      throw new Error(`Path traversal detected: ${joined} is outside ${base}`);
+    }
+  }
+  return normalJoined;
+}
+
 function getPlatform() {
   const osMap = { darwin: "darwin", linux: "linux", win32: "windows" };
   const archMap = { x64: "amd64", arm64: "arm64" };
@@ -64,9 +98,7 @@ async function getLatestVersion() {
 
 function pickArchive(platform, checksumsText) {
   const tarArchive = `juggernaut_${platform}.tar.gz`;
-  if (checksumsText.includes(tarArchive)) {
-    return { name: tarArchive, kind: "tar.gz" };
-  }
+  if (checksumsText.includes(tarArchive)) return { name: tarArchive, kind: "tar.gz" };
   const zipArchive = `juggernaut_${platform}.zip`;
   if (process.platform === "win32" && checksumsText.includes(zipArchive)) {
     return { name: zipArchive, kind: "zip" };
@@ -75,11 +107,14 @@ function pickArchive(platform, checksumsText) {
 }
 
 function extractTarGz(archiveBuf) {
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "juggernaut-install-"));
-  const archivePath = path.join(tmpDir, "archive.tar.gz");
+  const tmpDir = fs.mkdtempSync(TMP_PREFIX);
+  const archivePath = joinUnder(tmpDir, ARCHIVE_TAR);
+  const prevCwd = process.cwd();
   try {
-    fs.writeFileSync(archivePath, archiveBuf);
-    fs.mkdirSync(BIN_DIR, { recursive: true });
+    process.chdir(tmpDir);
+    fs.writeFileSync(ARCHIVE_TAR, archiveBuf);
+    process.chdir(PACKAGE_DIR);
+    fs.mkdirSync("bin", { recursive: true });
     try {
       execFileSync("tar", ["-xzf", archivePath, "-C", BIN_DIR], { stdio: "pipe" });
     } catch (err) {
@@ -92,32 +127,47 @@ function extractTarGz(archiveBuf) {
       throw new Error(`tar extraction failed: ${detail}`);
     }
     if (process.platform !== "win32") {
-      const binPath = path.join(BIN_DIR, "juggernaut");
-      if (fs.existsSync(binPath)) {
-        fs.chmodSync(binPath, 0o700);
+      process.chdir(BIN_DIR);
+      if (fs.existsSync(BIN_NAME)) {
+        fs.chmodSync(BIN_NAME, 0o700);
       }
     }
   } finally {
+    process.chdir(prevCwd);
     fs.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
 
 async function extractZip(archiveBuf) {
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "juggernaut-install-"));
-  const archivePath = path.join(tmpDir, "archive.zip");
+  const tmpDir = fs.mkdtempSync(TMP_PREFIX);
+  const archivePath = joinUnder(tmpDir, ARCHIVE_ZIP);
+  const prevCwd = process.cwd();
   try {
-    fs.writeFileSync(archivePath, archiveBuf);
-    fs.mkdirSync(BIN_DIR, { recursive: true });
+    process.chdir(tmpDir);
+    fs.writeFileSync(ARCHIVE_ZIP, archiveBuf);
+    process.chdir(PACKAGE_DIR);
+    fs.mkdirSync("bin", { recursive: true });
     const script = [
       "$ErrorActionPreference = 'Stop'",
       `Expand-Archive -LiteralPath '${archivePath.replace(/'/g, "''")}' -DestinationPath '${BIN_DIR.replace(/'/g, "''")}' -Force`
     ].join("; ");
-    await execFileAsync(
-      "powershell",
-      ["-NoProfile", "-NonInteractive", "-Command", script],
-      { stdio: "pipe" }
-    );
+    try {
+      await execFileAsync(
+        "powershell",
+        ["-NoProfile", "-NonInteractive", "-Command", script],
+        { stdio: "pipe" }
+      );
+    } catch (err) {
+      if (err.code === "ENOENT") {
+        throw new Error(
+          "PowerShell not found. PowerShell 5.0+ is required to extract archives on Windows."
+        );
+      }
+      const detail = err.stderr ? err.stderr.toString().trim() : err.message;
+      throw new Error(`ZIP extraction failed: ${detail}`);
+    }
   } finally {
+    process.chdir(prevCwd);
     fs.rmSync(tmpDir, { recursive: true, force: true });
   }
 }
@@ -141,11 +191,8 @@ async function main() {
     throw new Error(`Checksum mismatch for ${archive}\n  expected: ${expected}\n  got:      ${actual}`);
   }
 
-  if (kind === "zip") {
-    await extractZip(archiveBuf);
-  } else {
-    extractTarGz(archiveBuf);
-  }
+  if (kind === "zip") await extractZip(archiveBuf);
+  else extractTarGz(archiveBuf);
 
   console.log(`Juggernaut v${version} installed successfully.`);
   console.log(`Run: juggernaut apply`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "juggernaut-bedrock",
-  "version": "4.0.4",
+  "version": "4.1.0",
   "description": "Route Claude Code through Amazon Bedrock in one command — IAM, SSO, or API key. Cross-platform CLI for GenAI developers.",
   "bin": {
     "juggernaut": "./bin/juggernaut"
@@ -8,8 +8,15 @@
   "scripts": {
     "postinstall": "node install.js"
   },
-  "os": ["darwin", "linux", "win32"],
-  "cpu": ["x64", "arm64"],
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
   "keywords": [
     "claude",
     "claude-code",
@@ -35,4 +42,4 @@
     "url": "https://github.com/jpvelasco/juggernaut/issues"
   },
   "homepage": "https://github.com/jpvelasco/juggernaut#readme"
-}
+}