haru-cli 0.1.2__tar.gz → 0.1.3__tar.gz

{haru_cli-0.1.2 → haru_cli-0.1.3}/CHANGELOG.md

@@ -9,6 +9,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- Browser-only login: `haru login` now discovers your accessible AWS
+  accounts and permission-set roles from Identity Center after sign-in
+  (auto-selected when unambiguous, prompted otherwise) and remembers the
+  choice — no IAM role name or account id env var needed upfront.
+  `auth.sso.account_id`/`role_name` remain available as optional pins.
+
+### Changed
+
+- `haru config init` no longer asks for an IAM role name; the
+  `HARU_AWS_ACCOUNT_ID` step is gone from the quickstart.
+
+### Added
+
 - Sampling controls (`temperature`, `top_p`, `top_k`, `seed`) across three
   surfaces: model entries, per-agent `sampling:` blocks, and CLI/REPL
   overrides (`--temperature/--top-p/--top-k/--seed`, `/sampling`).

{haru_cli-0.1.2 → haru_cli-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: haru-cli
-Version: 0.1.2
+Version: 0.1.3
 Summary: Secure, scriptable CLI for Amazon Bedrock Claude models via the AWS Strands Agents SDK.
 Author: haru-cli maintainers
 License-Expression: Apache-2.0
@@ -84,12 +84,17 @@ Inside `haru chat`, slash commands switch targets mid-session:
 
 ```bash
 haru config init      # writes ~/.config/haru (asks for your SSO start URL)
-export HARU_AWS_ACCOUNT_ID=<your AWS account id>
-haru login
+haru login            # browser sign-in; account and role discovered for you
 haru run "Summarise the Converse API in two sentences."
 haru chat --agent supervisor --session-id demo
 ```
 
+`haru login` is browser-only: after Identity Center sign-in, your accessible
+AWS accounts and permission-set roles are discovered automatically (like
+`aws configure sso`), auto-selected when there is exactly one, prompted
+otherwise, and remembered for later sessions. Pin `auth.sso.account_id` /
+`role_name` in configuration only if you want to skip the discovery.
+
 Authentication uses the same PKCE authorization-code flow as `aws sso login`,
 caching tokens in the botocore-compatible schema under `~/.aws/sso/cache`
 (0600) so standard AWS tooling can consume and refresh the same cache. Access

{haru_cli-0.1.2 → haru_cli-0.1.3}/README.md

@@ -56,12 +56,17 @@ Inside `haru chat`, slash commands switch targets mid-session:
 
 ```bash
 haru config init      # writes ~/.config/haru (asks for your SSO start URL)
-export HARU_AWS_ACCOUNT_ID=<your AWS account id>
-haru login
+haru login            # browser sign-in; account and role discovered for you
 haru run "Summarise the Converse API in two sentences."
 haru chat --agent supervisor --session-id demo
 ```
 
+`haru login` is browser-only: after Identity Center sign-in, your accessible
+AWS accounts and permission-set roles are discovered automatically (like
+`aws configure sso`), auto-selected when there is exactly one, prompted
+otherwise, and remembered for later sessions. Pin `auth.sso.account_id` /
+`role_name` in configuration only if you want to skip the discovery.
+
 Authentication uses the same PKCE authorization-code flow as `aws sso login`,
 caching tokens in the botocore-compatible schema under `~/.aws/sso/cache`
 (0600) so standard AWS tooling can consume and refresh the same cache. Access

{haru_cli-0.1.2 → haru_cli-0.1.3}/config/haru.yaml

@@ -8,8 +8,10 @@ auth:
     registration_scopes:
       - sso:account:access
     client_name: haru-cli
-    account_id_env: HARU_AWS_ACCOUNT_ID
-    role_name: HaruBedrockInvoke
+    # Optional pins. When unset, your AWS account and role are discovered
+    # during 'haru login' (browser sign-in) and remembered.
+    # account_id: "123456789012"
+    # role_name: HaruBedrockInvoke
     callback_port: 0            # 0 selects an ephemeral loopback port
     browser: true
   bedrock_region: us-east-1

{haru_cli-0.1.2 → haru_cli-0.1.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "haru-cli"
-version = "0.1.2"
+version = "0.1.3"
 description = "Secure, scriptable CLI for Amazon Bedrock Claude models via the AWS Strands Agents SDK."
 readme = "README.md"
 license = "Apache-2.0"

haru_cli-0.1.3/src/haru/auth/identity.py

@@ -0,0 +1,169 @@
+"""Discover and persist the AWS account and role behind an SSO sign-in.
+
+Kiro-style browser sign-in needs no upfront AWS knowledge: after the token
+exchange, the accessible accounts and permission-set roles are listed from
+IAM Identity Center (as ``aws configure sso`` does), auto-selected when there
+is exactly one, and persisted next to the token cache for later sessions.
+"""
+
+import json
+import os
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import boto3
+from botocore.exceptions import ClientError
+
+from haru.auth.cache import cache_path
+from haru.auth.sso import SsoToken
+from haru.config.schema import SsoConfig
+from haru.errors import AuthError
+
+Chooser = Callable[[str, list[str]], int]
+"""Callback picking one option: (question, labels) -> chosen index."""
+
+
+@dataclass(frozen=True)
+class SelectedIdentity:
+    """The AWS account and role selected for Bedrock access."""
+
+    account_id: str
+    role_name: str
+    account_name: str | None = None
+
+
+def identity_path(start_url: str, cache_dir: Path | None = None) -> Path:
+    """Return the persisted-identity path for ``start_url``."""
+    token_path = cache_path(start_url, cache_dir)
+    return token_path.with_name(f"{token_path.stem}-haru-identity.json")
+
+
+def write_identity(
+    identity: SelectedIdentity, start_url: str, cache_dir: Path | None = None
+) -> Path:
+    """Persist the selected identity next to the token cache."""
+    path = identity_path(start_url, cache_dir)
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    payload = {
+        "accountId": identity.account_id,
+        "roleName": identity.role_name,
+        "accountName": identity.account_name,
+    }
+    path.write_text(json.dumps(payload), encoding="utf-8")
+    path.chmod(0o600)
+    return path
+
+
+def read_identity(start_url: str, cache_dir: Path | None = None) -> SelectedIdentity | None:
+    """Read the persisted identity; None when absent or unreadable."""
+    path = identity_path(start_url, cache_dir)
+    if not path.is_file():
+        return None
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        return SelectedIdentity(
+            account_id=payload["accountId"],
+            role_name=payload["roleName"],
+            account_name=payload.get("accountName"),
+        )
+    except (json.JSONDecodeError, KeyError):
+        return None
+
+
+def select_identity(
+    sso_cfg: SsoConfig,
+    token: SsoToken,
+    *,
+    sso_client: Any | None = None,
+    cache_dir: Path | None = None,
+    chooser: Chooser | None = None,
+) -> SelectedIdentity:
+    """Resolve the account and role for this sign-in and persist the choice.
+
+    Configuration pins win (``account_id``/``role_name``, or the account id
+    from ``account_id_env``); anything unpinned is discovered from Identity
+    Center. With multiple choices and no ``chooser``, raises AuthError.
+    """
+    if sso_client is None:
+        sso_client = boto3.Session().client("sso", region_name=sso_cfg.sso_region)
+
+    account_id = _pinned_account(sso_cfg)
+    account_name: str | None = None
+    if account_id is None:
+        accounts = _list_accounts(sso_client, token.access_token)
+        chosen = _choose(
+            "Choose the AWS account to use",
+            accounts,
+            lambda account: f"{account['accountId']}  {account.get('accountName', '')}".strip(),
+            chooser,
+        )
+        account_id = chosen["accountId"]
+        account_name = chosen.get("accountName")
+
+    role_name = sso_cfg.role_name
+    if role_name is None:
+        roles = _list_roles(sso_client, token.access_token, account_id)
+        role_name = _choose(f"Choose the role for account {account_id}", roles, str, chooser)
+
+    identity = SelectedIdentity(
+        account_id=account_id, role_name=role_name, account_name=account_name
+    )
+    write_identity(identity, sso_cfg.start_url, cache_dir)
+    return identity
+
+
+def _pinned_account(sso_cfg: SsoConfig) -> str | None:
+    if sso_cfg.account_id is not None:
+        return sso_cfg.account_id
+    if sso_cfg.account_id_env is not None:
+        return os.environ.get(sso_cfg.account_id_env)
+    return None
+
+
+def _list_accounts(sso_client: Any, access_token: str) -> list[dict[str, Any]]:
+    try:
+        paginator = sso_client.get_paginator("list_accounts")
+        accounts = [
+            account
+            for page in paginator.paginate(accessToken=access_token)
+            for account in page.get("accountList", [])
+        ]
+    except ClientError as exc:
+        raise AuthError(f"Listing accessible AWS accounts failed: {exc}") from exc
+    if not accounts:
+        raise AuthError("This sign-in grants access to no AWS accounts; contact your admin")
+    return sorted(accounts, key=lambda account: str(account["accountId"]))
+
+
+def _list_roles(sso_client: Any, access_token: str, account_id: str) -> list[str]:
+    try:
+        paginator = sso_client.get_paginator("list_account_roles")
+        roles = [
+            role["roleName"]
+            for page in paginator.paginate(accessToken=access_token, accountId=account_id)
+            for role in page.get("roleList", [])
+        ]
+    except ClientError as exc:
+        raise AuthError(f"Listing roles for account {account_id} failed: {exc}") from exc
+    if not roles:
+        raise AuthError(f"No roles are available in account {account_id}; contact your admin")
+    return sorted(roles)
+
+
+def _choose[Item](
+    question: str,
+    options: list[Item],
+    label: Callable[[Item], str],
+    chooser: Chooser | None,
+) -> Item:
+    if len(options) == 1:
+        return options[0]
+    if chooser is None:
+        raise AuthError(
+            f"{question}: multiple options available; re-run 'haru login' interactively"
+            " or pin the choice in configuration"
+        )
+    index = chooser(question, [label(option) for option in options])
+    return options[index]

{haru_cli-0.1.2 → haru_cli-0.1.3}/src/haru/auth/session.py

@@ -14,9 +14,10 @@ from botocore.exceptions import (
 )
 
 from haru.auth.cache import read_token_cache, write_token_cache
+from haru.auth.identity import read_identity
 from haru.auth.sso import SsoToken
-from haru.config.schema import AuthConfig
-from haru.errors import AuthExpiredError, ConfigError
+from haru.config.schema import AuthConfig, SsoConfig
+from haru.errors import AuthExpiredError
 
 _REFRESH_WINDOW = timedelta(minutes=15)
 _RELOGIN_HINT = "run 'haru login'"
@@ -42,16 +43,12 @@ def build_boto3_session(
     if token.expires_at <= datetime.now(UTC) + _REFRESH_WINDOW:
         token = _refresh_token(config, token, oidc=oidc, cache_dir=cache_dir)
 
-    account_id = os.environ.get(sso.account_id_env)
-    if account_id is None:
-        raise ConfigError(
-            f"Environment variable {sso.account_id_env!r} must hold the target AWS account id"
-        )
+    account_id, role_name = _resolve_identity(sso, cache_dir)
     if sso_client is None:
         sso_client = boto3.Session().client("sso", region_name=sso.sso_region)
     try:
         response = sso_client.get_role_credentials(
-            roleName=sso.role_name, accountId=account_id, accessToken=token.access_token
+            roleName=role_name, accountId=account_id, accessToken=token.access_token
         )
     except (ClientError, SSOTokenLoadError, UnauthorizedSSOTokenError, TokenRetrievalError) as exc:
         raise AuthExpiredError(f"SSO credentials rejected; {_RELOGIN_HINT}") from exc
@@ -65,6 +62,25 @@ def build_boto3_session(
     )
 
 
+def _resolve_identity(sso: SsoConfig, cache_dir: Path | None) -> tuple[str, str]:
+    """Resolve the account id and role: config pins, env var, then the login choice."""
+    stored = read_identity(sso.start_url, cache_dir)
+
+    account_id = sso.account_id
+    if account_id is None and sso.account_id_env is not None:
+        account_id = os.environ.get(sso.account_id_env)
+    if account_id is None and stored is not None:
+        account_id = stored.account_id
+
+    role_name = sso.role_name
+    if role_name is None and stored is not None:
+        role_name = stored.role_name
+
+    if account_id is None or role_name is None:
+        raise AuthExpiredError(f"No AWS account/role selected yet; {_RELOGIN_HINT}")
+    return account_id, role_name
+
+
 def _refresh_token(
     config: AuthConfig, token: SsoToken, *, oidc: Any | None, cache_dir: Path | None
 ) -> SsoToken:

{haru_cli-0.1.2 → haru_cli-0.1.3}/src/haru/commands/config.py

@@ -65,7 +65,6 @@ def config() -> None:
     "--sso-region", default="us-east-1", prompt="Identity Center region", show_default=True
 )
 @click.option("--bedrock-region", default="us-east-1", prompt="Bedrock region", show_default=True)
-@click.option("--role-name", default="HaruBedrockInvoke", prompt="IAM role name", show_default=True)
 @click.option(
     "--guardrail-id",
     default="",
@@ -78,7 +77,6 @@ def init(  # noqa: PLR0913, PLR0917 - one option per prompted setting; Click pas
     start_url: str,
     sso_region: str,
     bedrock_region: str,
-    role_name: str,
     guardrail_id: str,
     force: bool,
 ) -> None:
@@ -92,7 +90,6 @@ def init(  # noqa: PLR0913, PLR0917 - one option per prompted setting; Click pas
         "__START_URL__": start_url,
         "__SSO_REGION__": sso_region,
         "__BEDROCK_REGION__": bedrock_region,
-        "__ROLE_NAME__": role_name,
     }
     templates = resources.files("haru.config.templates")
     (target / "prompts").mkdir(parents=True, exist_ok=True)
@@ -113,9 +110,8 @@ def init(  # noqa: PLR0913, PLR0917 - one option per prompted setting; Click pas
 
     click.echo(f"Configuration written to {target}.")
     click.echo("Next steps:")
-    click.echo("  1. export HARU_AWS_ACCOUNT_ID=<your AWS account id>")
-    click.echo("  2. haru login")
-    click.echo("  3. haru chat")
+    click.echo("  1. haru login   (browser sign-in; your account and role are discovered)")
+    click.echo("  2. haru chat")
 
 
 @config.command()

{haru_cli-0.1.2 → haru_cli-0.1.3}/src/haru/commands/login.py

@@ -1,4 +1,9 @@
-"""The ``haru login`` command: interactive IAM Identity Center sign-in."""
+"""The ``haru login`` command: interactive IAM Identity Center sign-in.
+
+Browser-only sign-in: no IAM role or account id needs to be known upfront.
+After the token exchange, the accessible accounts and roles are discovered
+from Identity Center, auto-selected when unambiguous, and remembered.
+"""
 
 import webbrowser
 from pathlib import Path
@@ -6,18 +11,28 @@ from pathlib import Path
 import click
 
 from haru.auth.cache import write_token_cache
+from haru.auth.identity import select_identity
 from haru.auth.sso import run_login
 from haru.config import load_config
 from haru.errors import HaruError
 
 
+def _prompt_choice(question: str, labels: list[str]) -> int:
+    """Interactive numbered chooser for accounts and roles."""
+    click.echo(f"{question}:")
+    for number, label in enumerate(labels, start=1):
+        click.echo(f"  {number}. {label}")
+    choice: int = click.prompt("Enter a number", type=click.IntRange(1, len(labels)))
+    return choice - 1
+
+
 @click.command()
 @click.option(
     "--config",
     "config_path",
     type=click.Path(exists=True, dir_okay=False, path_type=Path),
     default=None,
-    help="Path to haru.yaml (default: config/haru.yaml).",
+    help="Path to haru.yaml (default: ./config/haru.yaml, then ~/.config/haru/haru.yaml).",
 )
 def login(config_path: Path | None) -> None:
     """Sign in to AWS IAM Identity Center via the browser (PKCE)."""
@@ -33,6 +48,13 @@ def login(config_path: Path | None) -> None:
 
         token = run_login(auth, opener=_open)
         path = write_token_cache(token, auth.sso.start_url, auth.sso.sso_region)
+        identity = select_identity(auth.sso, token, chooser=_prompt_choice)
     except HaruError as exc:
         raise click.ClickException(str(exc)) from exc
     click.echo(f"Login successful. Token cached at {path}.")
+    account_label = (
+        f"{identity.account_id} ({identity.account_name})"
+        if identity.account_name
+        else identity.account_id
+    )
+    click.echo(f"Using account {account_label}, role {identity.role_name}.")

{haru_cli-0.1.2 → haru_cli-0.1.3}/src/haru/config/schema.py

@@ -24,14 +24,20 @@ class AppConfig(_FrozenModel):
 
 
 class SsoConfig(_FrozenModel):
-    """IAM Identity Center (SSO) login settings."""
+    """IAM Identity Center (SSO) login settings.
+
+    ``account_id`` and ``role_name`` are optional: when unset, the account
+    and permission-set role are discovered interactively during
+    ``haru login`` (browser-only sign-in, like the AWS CLI's SSO flow).
+    """
 
     start_url: str
     sso_region: str
     registration_scopes: tuple[str, ...] = ("sso:account:access",)
     client_name: str = "haru-cli"
-    account_id_env: str
-    role_name: str
+    account_id: str | None = None
+    account_id_env: str | None = None
+    role_name: str | None = None
     callback_port: int = Field(default=0, ge=0, le=65535)
     browser: bool = True
 

{haru_cli-0.1.2 → haru_cli-0.1.3}/src/haru/config/templates/haru.yaml

@@ -8,8 +8,10 @@ auth:
     registration_scopes:
       - sso:account:access
     client_name: haru-cli
-    account_id_env: HARU_AWS_ACCOUNT_ID
-    role_name: __ROLE_NAME__
+    # Optional pins. When unset, your AWS account and role are discovered
+    # during 'haru login' (browser sign-in) and remembered.
+    # account_id: "123456789012"
+    # role_name: BedrockAccess
     callback_port: 0            # 0 selects an ephemeral loopback port
     browser: true
   bedrock_region: __BEDROCK_REGION__

{haru_cli-0.1.2 → haru_cli-0.1.3}/tests/unit/test_cli.py

@@ -10,6 +10,7 @@ from typing import Any
 from click.testing import CliRunner
 from rich.console import Console
 
+from haru.auth.identity import SelectedIdentity
 from haru.auth.sso import ClientRegistration, SsoToken
 from haru.cli import cli
 from haru.commands.chat import run_chat
@@ -81,15 +82,23 @@ def test_login_command(runner: CliRunner, tmp_path: Path, mocker: Any) -> None:
     write_cache = mocker.patch(
         "haru.commands.login.write_token_cache", return_value=tmp_path / "cache.json"
     )
+    select = mocker.patch(
+        "haru.commands.login.select_identity",
+        return_value=SelectedIdentity(
+            account_id="111122223333", role_name="BedrockAccess", account_name="Sandbox"
+        ),
+    )
 
     result = runner.invoke(cli, ["login", "--config", str(config_path)])
 
-    assert result.exit_code == 0
+    assert result.exit_code == 0, result.output
     assert "Login successful" in result.output
     assert "access-abc" not in result.output
+    assert "Using account 111122223333 (Sandbox), role BedrockAccess." in result.output
     auth = run_login.call_args.args[0]
     assert auth.sso.start_url == "https://example.awsapps.com/start"
     write_cache.assert_called_once_with(token, auth.sso.start_url, "us-east-1")
+    assert select.call_args.args[0] == auth.sso
 
 
 def make_config(tmp_path: Path) -> Path:
@@ -429,6 +438,10 @@ def test_login_opener_echoes_url_and_opens_browser(
     config_path.write_text(BASE_CONFIG, encoding="utf-8")
     browser_open = mocker.patch("haru.commands.login.webbrowser.open")
     mocker.patch("haru.commands.login.write_token_cache", return_value=tmp_path / "cache.json")
+    mocker.patch(
+        "haru.commands.login.select_identity",
+        return_value=SelectedIdentity(account_id="111122223333", role_name="BedrockAccess"),
+    )
 
     def fake_run_login(auth: Any, *, opener: Any) -> Any:
         opener("https://oidc.us-east-1.amazonaws.com/authorize?x=1")

{haru_cli-0.1.2 → haru_cli-0.1.3}/tests/unit/test_config_command.py

@@ -17,8 +17,6 @@ INIT_ARGS = [
     "us-east-1",
     "--bedrock-region",
     "eu-west-1",
-    "--role-name",
-    "HaruBedrockInvoke",
 ]
 
 

haru_cli-0.1.3/tests/unit/test_identity.py

@@ -0,0 +1,172 @@
+"""Tests for account/role discovery and persistence after SSO sign-in."""
+
+from datetime import UTC, datetime, timedelta
+from pathlib import Path
+from typing import Any
+
+import pytest
+from botocore.exceptions import ClientError
+
+from haru.auth.identity import (
+    SelectedIdentity,
+    read_identity,
+    select_identity,
+    write_identity,
+)
+from haru.auth.sso import ClientRegistration, SsoToken
+from haru.config.schema import SsoConfig
+from haru.errors import AuthError
+
+START_URL = "https://example.awsapps.com/start"
+
+
+def make_sso_config(**overrides: Any) -> SsoConfig:
+    """Build an SsoConfig for tests."""
+    return SsoConfig.model_validate(
+        {"start_url": START_URL, "sso_region": "us-east-1", **overrides}
+    )
+
+
+def make_token() -> SsoToken:
+    """Build a valid SsoToken for tests."""
+    now = datetime.now(UTC)
+    return SsoToken(
+        access_token="access-abc",
+        refresh_token=None,
+        expires_at=now + timedelta(hours=1),
+        registration=ClientRegistration(
+            client_id="client-123", client_secret="client-secret", expires_at=now
+        ),
+    )
+
+
+class FakeSso:
+    """Minimal sso client stand-in with paginators."""
+
+    def __init__(self, accounts: list[dict[str, Any]], roles: dict[str, list[str]]) -> None:
+        self._accounts = accounts
+        self._roles = roles
+        self.role_calls: list[str] = []
+
+    def get_paginator(self, operation: str) -> Any:
+        fake = self
+
+        class _Paginator:
+            def paginate(self, **kwargs: Any) -> list[dict[str, Any]]:
+                if operation == "list_accounts":
+                    return [{"accountList": fake._accounts}]
+                fake.role_calls.append(kwargs["accountId"])
+                roles = fake._roles.get(kwargs["accountId"], [])
+                return [{"roleList": [{"roleName": name} for name in roles]}]
+
+        return _Paginator()
+
+
+def test_identity_roundtrip(tmp_path: Path) -> None:
+    """A written identity reads back identically, with 0600 permissions."""
+    identity = SelectedIdentity(account_id="111122223333", role_name="Dev", account_name="Sandbox")
+    path = write_identity(identity, START_URL, tmp_path)
+    assert path.stat().st_mode & 0o777 == 0o600
+    assert read_identity(START_URL, tmp_path) == identity
+
+
+def test_read_missing_identity(tmp_path: Path) -> None:
+    """A missing identity file reads as None."""
+    assert read_identity(START_URL, tmp_path) is None
+
+
+def test_single_account_and_role_auto_selected(tmp_path: Path) -> None:
+    """One account with one role needs no interaction and is persisted."""
+    sso = FakeSso(
+        [{"accountId": "111122223333", "accountName": "Sandbox"}],
+        {"111122223333": ["BedrockAccess"]},
+    )
+
+    identity = select_identity(make_sso_config(), make_token(), sso_client=sso, cache_dir=tmp_path)
+
+    assert identity == SelectedIdentity(
+        account_id="111122223333", role_name="BedrockAccess", account_name="Sandbox"
+    )
+    assert read_identity(START_URL, tmp_path) == identity
+
+
+def test_multiple_accounts_use_chooser(tmp_path: Path) -> None:
+    """The chooser picks among multiple accounts and roles."""
+    sso = FakeSso(
+        [
+            {"accountId": "111122223333", "accountName": "Sandbox"},
+            {"accountId": "444455556666", "accountName": "Prod"},
+        ],
+        {"444455556666": ["Admin", "ReadOnly"]},
+    )
+    questions: list[tuple[str, list[str]]] = []
+
+    def choose_last(question: str, labels: list[str]) -> int:
+        questions.append((question, labels))
+        return len(labels) - 1
+
+    identity = select_identity(
+        make_sso_config(), make_token(), sso_client=sso, cache_dir=tmp_path, chooser=choose_last
+    )
+
+    assert identity.account_id == "444455556666"
+    assert identity.role_name == "ReadOnly"
+    assert len(questions) == 2
+    assert "444455556666" in questions[0][1][1]
+
+
+def test_multiple_accounts_without_chooser_raises(tmp_path: Path) -> None:
+    """Multiple options with no chooser fail with guidance."""
+    sso = FakeSso(
+        [{"accountId": "111122223333"}, {"accountId": "444455556666"}],
+        {},
+    )
+    with pytest.raises(AuthError, match="multiple options"):
+        select_identity(make_sso_config(), make_token(), sso_client=sso, cache_dir=tmp_path)
+
+
+def test_pinned_account_skips_account_listing(tmp_path: Path) -> None:
+    """A configured account_id goes straight to role discovery."""
+    sso = FakeSso([], {"999900001111": ["BedrockAccess"]})
+
+    identity = select_identity(
+        make_sso_config(account_id="999900001111"),
+        make_token(),
+        sso_client=sso,
+        cache_dir=tmp_path,
+    )
+
+    assert identity.account_id == "999900001111"
+    assert sso.role_calls == ["999900001111"]
+
+
+def test_env_pinned_account(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    """account_id_env still pins the account when set."""
+    monkeypatch.setenv("HARU_AWS_ACCOUNT_ID", "999900001111")
+    sso = FakeSso([], {"999900001111": ["BedrockAccess"]})
+
+    identity = select_identity(
+        make_sso_config(account_id_env="HARU_AWS_ACCOUNT_ID"),
+        make_token(),
+        sso_client=sso,
+        cache_dir=tmp_path,
+    )
+
+    assert identity.account_id == "999900001111"
+
+
+def test_no_accounts_raises(tmp_path: Path) -> None:
+    """A sign-in granting no accounts fails with a clear message."""
+    sso = FakeSso([], {})
+    with pytest.raises(AuthError, match="no AWS accounts"):
+        select_identity(make_sso_config(), make_token(), sso_client=sso, cache_dir=tmp_path)
+
+
+def test_listing_failure_wrapped(tmp_path: Path, mocker: Any) -> None:
+    """botocore errors surface as AuthError."""
+    sso = mocker.Mock()
+    sso.get_paginator.return_value.paginate.side_effect = ClientError(
+        {"Error": {"Code": "UnauthorizedException", "Message": "no"}}, "ListAccounts"
+    )
+    with pytest.raises(AuthError, match="Listing accessible AWS accounts failed"):
+        select_identity(make_sso_config(), make_token(), sso_client=sso, cache_dir=tmp_path)

{haru_cli-0.1.2 → haru_cli-0.1.3}/tests/unit/test_session.py

@@ -8,10 +8,11 @@ import pytest
 from botocore.exceptions import ClientError
 
 from haru.auth.cache import read_token_cache, write_token_cache
+from haru.auth.identity import SelectedIdentity, write_identity
 from haru.auth.session import build_boto3_session
 from haru.auth.sso import ClientRegistration, SsoToken
 from haru.config.schema import AuthConfig
-from haru.errors import AuthExpiredError, ConfigError
+from haru.errors import AuthExpiredError
 
 START_URL = "https://example.awsapps.com/start"
 
@@ -168,9 +169,64 @@ def test_unauthorized_role_credentials_raises(tmp_path: Path, mocker: Any) -> No
         build_boto3_session(make_config(), sso_client=sso_client, cache_dir=tmp_path)
 
 
-def test_missing_account_env_raises(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    """A missing account id environment variable is a configuration error."""
+def test_no_identity_anywhere_requires_login(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """No pin, no env var, no stored identity: re-login is required."""
     monkeypatch.delenv("HARU_AWS_ACCOUNT_ID", raising=False)
     seed_cache(tmp_path)
-    with pytest.raises(ConfigError, match="HARU_AWS_ACCOUNT_ID"):
+    with pytest.raises(AuthExpiredError, match="haru login"):
         build_boto3_session(make_config(), cache_dir=tmp_path)
+
+
+def test_stored_identity_used_when_unpinned(tmp_path: Path, mocker: Any) -> None:
+    """The identity chosen at login backs the session when config pins nothing."""
+    seed_cache(tmp_path)
+    write_identity(
+        SelectedIdentity(account_id="777788889999", role_name="StoredRole"),
+        START_URL,
+        tmp_path,
+    )
+    sso_client = mocker.Mock()
+    sso_client.get_role_credentials.return_value = ROLE_CREDENTIALS
+    config = AuthConfig.model_validate(
+        {
+            "sso": {"start_url": START_URL, "sso_region": "us-east-1"},
+            "bedrock_region": "eu-west-1",
+        }
+    )
+
+    build_boto3_session(config, sso_client=sso_client, cache_dir=tmp_path)
+
+    sso_client.get_role_credentials.assert_called_once_with(
+        roleName="StoredRole", accountId="777788889999", accessToken="access-abc"
+    )
+
+
+def test_config_pins_beat_stored_identity(tmp_path: Path, mocker: Any) -> None:
+    """Explicit config account/role win over the stored login choice."""
+    seed_cache(tmp_path)
+    write_identity(
+        SelectedIdentity(account_id="777788889999", role_name="StoredRole"),
+        START_URL,
+        tmp_path,
+    )
+    sso_client = mocker.Mock()
+    sso_client.get_role_credentials.return_value = ROLE_CREDENTIALS
+    config = AuthConfig.model_validate(
+        {
+            "sso": {
+                "start_url": START_URL,
+                "sso_region": "us-east-1",
+                "account_id": "123456789012",
+                "role_name": "PinnedRole",
+            },
+            "bedrock_region": "eu-west-1",
+        }
+    )
+
+    build_boto3_session(config, sso_client=sso_client, cache_dir=tmp_path)
+
+    sso_client.get_role_credentials.assert_called_once_with(
+        roleName="PinnedRole", accountId="123456789012", accessToken="access-abc"
+    )

{haru_cli-0.1.2 → haru_cli-0.1.3}/uv.lock

@@ -633,7 +633,7 @@ wheels = [
 
 [[package]]
 name = "haru-cli"
-version = "0.1.2"
+version = "0.1.3"
 source = { editable = "." }
 dependencies = [
     { name = "boto3" },