switch-profile 2.0.0 → 2.0.1

package/README.md

@@ -1,6 +1,14 @@
 # switch-profile
 
-Switch between AWS profiles from your terminal. Type a few letters, press enter, and every AWS tool uses that account. SSO logins work on remote machines too (device code, clipboard over SSH, QR code), and each terminal can stay on its own account.
+<p align="center"><img src="docs/images/hero.webp" width="100%" alt="switch-profile illustration: a girl rides a rope lift up a tower of lit workshops"></p>
+
+**Jump between AWS accounts from your terminal in seconds, the way AWS recommends.**
+
+If you work across many AWS accounts (clients, environments, organizations), you switch accounts dozens of times a day. `switch-profile` turns that into a few keystrokes: type part of a name, account ID or client, press Enter, and every AWS tool in that terminal is on the right account, logged in and verified. It works the same on your laptop and on a remote machine over SSH, and it never asks you to manage access keys.
+
+```shell
+npx switch-profile
+```
 
 ```
 ┌   switch-profile  2.0.0
@@ -15,17 +23,33 @@ Switch between AWS profiles from your terminal. Type a few letters, press enter,
 └
 ```
 
-- **Fast picker.** Fuzzy search across profile name, account id, account name, role, SSO session (client) and region. The profiles you use most come first.
-- **One identity check per switch.** `switch-profile` calls `aws sts get-caller-identity` once, logs in if needed, then makes the profile the default.
-- **Auto-refresh.** It writes the profile's *settings* into `[default]`, never temporary credentials, so the AWS CLI, SDKs and Terraform refresh credentials on their own.
-- **Per-terminal.** With the `sp` shortcut, the current terminal also gets `AWS_PROFILE`, so different terminals can use different accounts. `sp` also adds tab-completion.
-- **Remote-friendly.** Over SSH, logins use a device code: the code is copied to your laptop's clipboard and the URL can be shown as a QR code.
-- **Import a whole portal.** `sp add` creates one profile per account and role of an IAM Identity Center portal.
-- **Script and agent friendly.** Never prompts when there is no terminal, `--json` output, stable exit codes.
+## Why it's great
+
+- **Seconds, not minutes.** Fuzzy search across profile name, account ID, account name, role, client and region, with your most-used accounts first. `sp acme prod` switches without even opening the picker.
+- **Logged in when you need it.** If a session has expired, it logs you in on the spot, then never again until the session ends: credentials refresh on their own in the AWS CLI, SDKs and Terraform.
+- **Every terminal on its own account.** With the `sp` shortcut, each terminal keeps its own `AWS_PROFILE`, plus tab-completion of your profile names.
+- **Made for remote machines.** On a server reached over SSH, the login code lands in your laptop's clipboard, or scan a QR code with your phone.
+- **A whole client in one step.** `sp add` creates a profile for every account and role in an IAM Identity Center portal, and re-syncs it later.
+- **Scripts and AI agents welcome.** It never prompts without a terminal, offers `--json` output and stable exit codes.
+
+## Built on AWS best practices
+
+`switch-profile` does not invent its own security model. It follows what AWS recommends, lets the official AWS CLI do the sensitive work, and adds the guardrails that make switching accounts all day safe.
+
+- **Temporary credentials, not access keys.** AWS recommends that people sign in through an identity provider, such as IAM Identity Center (AWS SSO), and use short-lived credentials instead of long-lived access keys ([IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)). `switch-profile` is built around SSO and console sign-in (`aws login`). Access keys still work, but it warns you before creating new ones.
+- **It never copies credentials.** Switching writes only a profile's *settings* into `[default]`. The AWS CLI and SDKs fetch short-lived credentials themselves and refresh them through `[sso-session]` ([AWS CLI SSO guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html)). There are no secrets in anything `switch-profile` writes, so nothing to leak and nothing to go stale.
+- **The AWS CLI does the logging in.** Logins run through `aws sso login` and `aws login`: browser sign-in on your machine, device code where there is no browser. `switch-profile` stores no tokens and has no telemetry. Its only network calls are the AWS CLI's own and npx fetching the package.
+- **Device codes, handled carefully.** Device-code approvals are a known phishing route, so they are used only where there is no browser, and the login screen tells you to approve only the exact code it shows.
+- **You always know which account you are in.** Every switch confirms the real identity with `aws sts get-caller-identity`. Production accounts are flagged in red. Environment variables that would silently override your choice (such as `AWS_ACCESS_KEY_ID`) are flagged, and `sp` clears them.
+- **One account per terminal.** `AWS_PROFILE` is scoped to a terminal, so switching in one window cannot move a deploy running in another.
+- **Careful with your files.** Edits to `~/.aws` are atomic, upgrades back up your files first, and the shell setup lives in one clearly marked block that you can remove from Settings at any time.
+- **Always the latest version.** Run through `npx`, every run uses the newest release: nothing to install, nothing to update.
 
 ## Table of Contents
 
 <!-- BEGIN toc -->
+- [Why it's great](#why-its-great)
+- [Built on AWS best practices](#built-on-aws-best-practices)
 - [Quick start](#quick-start)
 - [Commands](#commands)
 - [Working on remote machines (SSH)](#working-on-remote-machines-ssh)
@@ -62,11 +86,7 @@ sp acme-prod       # switch straight to a profile
 sp acme prod       # fuzzy match: switches if exactly one profile matches
 ```
 
-For speed, install it globally. `npx` checks the npm registry on every run, which adds a noticeable delay; `sp` uses the global command when it exists and falls back to `npx` otherwise.
-
-```shell
-npm install -g switch-profile
-```
+**Why npx?** It always runs the latest release, so you never have to update anything. `sp` uses `npx switch-profile@latest` under the hood. The cost is a second or two while npm checks for a newer version, and the tool needs a connection to AWS anyway. A global install (`npm install -g switch-profile`) also works, but then updating is up to you, and `sp` keeps using npx regardless.
 
 No profiles yet? `switch-profile` starts the **Add profiles** flow. To import every account of your company's or client's SSO portal, see [Importing a client's accounts](#importing-a-clients-accounts).
 

package/dist/cli.js

@@ -5327,7 +5327,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.0.0",
+      version: "2.0.1",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -6034,10 +6034,10 @@ var require_shell = __commonJS({
     var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
 	local __sp_file __sp_status
 	__sp_file="$(mktemp "\${TMPDIR:-/tmp}/switch-profile.XXXXXX")" || return 1
-	if command -v switch-profile >/dev/null 2>&1; then
-		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" switch-profile "$@"
+	if [ -n "\${SWITCH_PROFILE_DEV_BIN:-}" ]; then
+		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" "$SWITCH_PROFILE_DEV_BIN" "$@"
 	else
-		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" npx --yes switch-profile "$@"
+		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" npx --yes switch-profile@latest "$@"
 	fi
 	__sp_status=$?
 	if [ -s "$__sp_file" ]; then
@@ -6071,10 +6071,10 @@ fi`, BASH_COMPLETION = `_switch_profile_complete() {
 }
 complete -F _switch_profile_complete ${FUNCTION_NAME} switch-profile`, FISH_FUNCTION = `function ${FUNCTION_NAME}
 	set -l __sp_file (mktemp)
-	if type -q switch-profile
-		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file switch-profile $argv
+	if set -q SWITCH_PROFILE_DEV_BIN
+		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file $SWITCH_PROFILE_DEV_BIN $argv
 	else
-		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file npx --yes switch-profile $argv
+		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file npx --yes switch-profile@latest $argv
 	end
 	set -l __sp_status $status
 	if test -s $__sp_file
@@ -6099,7 +6099,7 @@ end`, POWERSHELL_FUNCTION = `function ${FUNCTION_NAME} {
 	$env:SWITCH_PROFILE_SHELL = 'powershell'
 	$env:SWITCH_PROFILE_ENV_FILE = $spFile
 	try {
-		if (Get-Command switch-profile -ErrorAction SilentlyContinue) { switch-profile @Rest } else { npx --yes switch-profile @Rest }
+		if ($env:SWITCH_PROFILE_DEV_BIN) { & $env:SWITCH_PROFILE_DEV_BIN @Rest } else { npx --yes switch-profile@latest @Rest }
 	} finally {
 		Remove-Item Env:\\SWITCH_PROFILE_SHELL -ErrorAction SilentlyContinue
 		Remove-Item Env:\\SWITCH_PROFILE_ENV_FILE -ErrorAction SilentlyContinue
@@ -7448,7 +7448,7 @@ ${detail}` : ""}`, {
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { exec: exec2 } = require_core(), { ask, preflight, loadState, loginKey, describe, loginState } = require_common(), { ssoLogin } = require_login_flow(), ACTION = "__action__:", header = async (state) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState } = require_common(), { ssoLogin } = require_login_flow(), ACTION = "__action__:", header = async (state) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7574,7 +7574,7 @@ ${ui2.dim("Tip: enable per-terminal switching in Settings.")}` : ""}`);
     }, enableShortcut = async () => {
       let installed = await shell.install(settings2.CLI_VERSION);
       p4.log.success(`Added ${ui2.accent(shell.FUNCTION_NAME)} to ${installed.files.map(shell.tilde).join(", ")}
-${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name == "powershell" && p4.log.message(ui2.dim("If PowerShell refuses to load your profile: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned")), await exec2(`${process.platform == "win32" ? "where" : "which"} switch-profile`).then(() => !0, () => !1) || p4.log.message(ui2.dim(`Tip: npm install -g switch-profile makes ${shell.FUNCTION_NAME} start instantly (npx checks the registry on every run).`));
+${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name == "powershell" && p4.log.message(ui2.dim("If PowerShell refuses to load your profile: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned"));
     }, runAction = async (key, state, opts) => {
       let commands2 = require_commands();
       return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"