haru-cli 0.1.2__tar.gz → 0.1.4__tar.gz

{haru_cli-0.1.2 → haru_cli-0.1.4}/CHANGELOG.md

@@ -9,6 +9,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- The login callback now serves a proper local result page (dark themed,
+  approval/denial card): "Request approved" on success, "Request denied"
+  with the reason on error, missing parameters, or a state mismatch —
+  rendered server-side with no JavaScript.
+
+### Security
+
+- Login result pages ship strict browser security headers: CSP
+  (`default-src 'none'`, inline styles only, `frame-ancestors 'none'`),
+  `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`,
+  `Referrer-Policy: no-referrer`, and `Cache-Control: no-store`; error
+  descriptions are HTML-escaped, and the `state` parameter is now also
+  validated in the callback handler before the browser is answered.
+
+### Added
+
+- Browser-only login: `haru login` now discovers your accessible AWS
+  accounts and permission-set roles from Identity Center after sign-in
+  (auto-selected when unambiguous, prompted otherwise) and remembers the
+  choice — no IAM role name or account id env var needed upfront.
+  `auth.sso.account_id`/`role_name` remain available as optional pins.
+
+### Changed
+
+- `haru config init` no longer asks for an IAM role name; the
+  `HARU_AWS_ACCOUNT_ID` step is gone from the quickstart.
+
+### Added
+
 - Sampling controls (`temperature`, `top_p`, `top_k`, `seed`) across three
   surfaces: model entries, per-agent `sampling:` blocks, and CLI/REPL
   overrides (`--temperature/--top-p/--top-k/--seed`, `/sampling`).

{haru_cli-0.1.2 → haru_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: haru-cli
-Version: 0.1.2
+Version: 0.1.4
 Summary: Secure, scriptable CLI for Amazon Bedrock Claude models via the AWS Strands Agents SDK.
 Author: haru-cli maintainers
 License-Expression: Apache-2.0
@@ -84,12 +84,17 @@ Inside `haru chat`, slash commands switch targets mid-session:
 
 ```bash
 haru config init      # writes ~/.config/haru (asks for your SSO start URL)
-export HARU_AWS_ACCOUNT_ID=<your AWS account id>
-haru login
+haru login            # browser sign-in; account and role discovered for you
 haru run "Summarise the Converse API in two sentences."
 haru chat --agent supervisor --session-id demo
 ```
 
+`haru login` is browser-only: after Identity Center sign-in, your accessible
+AWS accounts and permission-set roles are discovered automatically (like
+`aws configure sso`), auto-selected when there is exactly one, prompted
+otherwise, and remembered for later sessions. Pin `auth.sso.account_id` /
+`role_name` in configuration only if you want to skip the discovery.
+
 Authentication uses the same PKCE authorization-code flow as `aws sso login`,
 caching tokens in the botocore-compatible schema under `~/.aws/sso/cache`
 (0600) so standard AWS tooling can consume and refresh the same cache. Access

{haru_cli-0.1.2 → haru_cli-0.1.4}/README.md

@@ -56,12 +56,17 @@ Inside `haru chat`, slash commands switch targets mid-session:
 
 ```bash
 haru config init      # writes ~/.config/haru (asks for your SSO start URL)
-export HARU_AWS_ACCOUNT_ID=<your AWS account id>
-haru login
+haru login            # browser sign-in; account and role discovered for you
 haru run "Summarise the Converse API in two sentences."
 haru chat --agent supervisor --session-id demo
 ```
 
+`haru login` is browser-only: after Identity Center sign-in, your accessible
+AWS accounts and permission-set roles are discovered automatically (like
+`aws configure sso`), auto-selected when there is exactly one, prompted
+otherwise, and remembered for later sessions. Pin `auth.sso.account_id` /
+`role_name` in configuration only if you want to skip the discovery.
+
 Authentication uses the same PKCE authorization-code flow as `aws sso login`,
 caching tokens in the botocore-compatible schema under `~/.aws/sso/cache`
 (0600) so standard AWS tooling can consume and refresh the same cache. Access

{haru_cli-0.1.2 → haru_cli-0.1.4}/config/haru.yaml

@@ -8,8 +8,10 @@ auth:
     registration_scopes:
       - sso:account:access
     client_name: haru-cli
-    account_id_env: HARU_AWS_ACCOUNT_ID
-    role_name: HaruBedrockInvoke
+    # Optional pins. When unset, your AWS account and role are discovered
+    # during 'haru login' (browser sign-in) and remembered.
+    # account_id: "123456789012"
+    # role_name: HaruBedrockInvoke
     callback_port: 0            # 0 selects an ephemeral loopback port
     browser: true
   bedrock_region: us-east-1

{haru_cli-0.1.2 → haru_cli-0.1.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "haru-cli"
-version = "0.1.2"
+version = "0.1.4"
 description = "Secure, scriptable CLI for Amazon Bedrock Claude models via the AWS Strands Agents SDK."
 readme = "README.md"
 license = "Apache-2.0"

haru_cli-0.1.4/src/haru/auth/identity.py

@@ -0,0 +1,169 @@
+"""Discover and persist the AWS account and role behind an SSO sign-in.
+
+Kiro-style browser sign-in needs no upfront AWS knowledge: after the token
+exchange, the accessible accounts and permission-set roles are listed from
+IAM Identity Center (as ``aws configure sso`` does), auto-selected when there
+is exactly one, and persisted next to the token cache for later sessions.
+"""
+
+import json
+import os
+from collections.abc import Callable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+import boto3
+from botocore.exceptions import ClientError
+
+from haru.auth.cache import cache_path
+from haru.auth.sso import SsoToken
+from haru.config.schema import SsoConfig
+from haru.errors import AuthError
+
+Chooser = Callable[[str, list[str]], int]
+"""Callback picking one option: (question, labels) -> chosen index."""
+
+
+@dataclass(frozen=True)
+class SelectedIdentity:
+    """The AWS account and role selected for Bedrock access."""
+
+    account_id: str
+    role_name: str
+    account_name: str | None = None
+
+
+def identity_path(start_url: str, cache_dir: Path | None = None) -> Path:
+    """Return the persisted-identity path for ``start_url``."""
+    token_path = cache_path(start_url, cache_dir)
+    return token_path.with_name(f"{token_path.stem}-haru-identity.json")
+
+
+def write_identity(
+    identity: SelectedIdentity, start_url: str, cache_dir: Path | None = None
+) -> Path:
+    """Persist the selected identity next to the token cache."""
+    path = identity_path(start_url, cache_dir)
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    payload = {
+        "accountId": identity.account_id,
+        "roleName": identity.role_name,
+        "accountName": identity.account_name,
+    }
+    path.write_text(json.dumps(payload), encoding="utf-8")
+    path.chmod(0o600)
+    return path
+
+
+def read_identity(start_url: str, cache_dir: Path | None = None) -> SelectedIdentity | None:
+    """Read the persisted identity; None when absent or unreadable."""
+    path = identity_path(start_url, cache_dir)
+    if not path.is_file():
+        return None
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+        return SelectedIdentity(
+            account_id=payload["accountId"],
+            role_name=payload["roleName"],
+            account_name=payload.get("accountName"),
+        )
+    except (json.JSONDecodeError, KeyError):
+        return None
+
+
+def select_identity(
+    sso_cfg: SsoConfig,
+    token: SsoToken,
+    *,
+    sso_client: Any | None = None,
+    cache_dir: Path | None = None,
+    chooser: Chooser | None = None,
+) -> SelectedIdentity:
+    """Resolve the account and role for this sign-in and persist the choice.
+
+    Configuration pins win (``account_id``/``role_name``, or the account id
+    from ``account_id_env``); anything unpinned is discovered from Identity
+    Center. With multiple choices and no ``chooser``, raises AuthError.
+    """
+    if sso_client is None:
+        sso_client = boto3.Session().client("sso", region_name=sso_cfg.sso_region)
+
+    account_id = _pinned_account(sso_cfg)
+    account_name: str | None = None
+    if account_id is None:
+        accounts = _list_accounts(sso_client, token.access_token)
+        chosen = _choose(
+            "Choose the AWS account to use",
+            accounts,
+            lambda account: f"{account['accountId']}  {account.get('accountName', '')}".strip(),
+            chooser,
+        )
+        account_id = chosen["accountId"]
+        account_name = chosen.get("accountName")
+
+    role_name = sso_cfg.role_name
+    if role_name is None:
+        roles = _list_roles(sso_client, token.access_token, account_id)
+        role_name = _choose(f"Choose the role for account {account_id}", roles, str, chooser)
+
+    identity = SelectedIdentity(
+        account_id=account_id, role_name=role_name, account_name=account_name
+    )
+    write_identity(identity, sso_cfg.start_url, cache_dir)
+    return identity
+
+
+def _pinned_account(sso_cfg: SsoConfig) -> str | None:
+    if sso_cfg.account_id is not None:
+        return sso_cfg.account_id
+    if sso_cfg.account_id_env is not None:
+        return os.environ.get(sso_cfg.account_id_env)
+    return None
+
+
+def _list_accounts(sso_client: Any, access_token: str) -> list[dict[str, Any]]:
+    try:
+        paginator = sso_client.get_paginator("list_accounts")
+        accounts = [
+            account
+            for page in paginator.paginate(accessToken=access_token)
+            for account in page.get("accountList", [])
+        ]
+    except ClientError as exc:
+        raise AuthError(f"Listing accessible AWS accounts failed: {exc}") from exc
+    if not accounts:
+        raise AuthError("This sign-in grants access to no AWS accounts; contact your admin")
+    return sorted(accounts, key=lambda account: str(account["accountId"]))
+
+
+def _list_roles(sso_client: Any, access_token: str, account_id: str) -> list[str]:
+    try:
+        paginator = sso_client.get_paginator("list_account_roles")
+        roles = [
+            role["roleName"]
+            for page in paginator.paginate(accessToken=access_token, accountId=account_id)
+            for role in page.get("roleList", [])
+        ]
+    except ClientError as exc:
+        raise AuthError(f"Listing roles for account {account_id} failed: {exc}") from exc
+    if not roles:
+        raise AuthError(f"No roles are available in account {account_id}; contact your admin")
+    return sorted(roles)
+
+
+def _choose[Item](
+    question: str,
+    options: list[Item],
+    label: Callable[[Item], str],
+    chooser: Chooser | None,
+) -> Item:
+    if len(options) == 1:
+        return options[0]
+    if chooser is None:
+        raise AuthError(
+            f"{question}: multiple options available; re-run 'haru login' interactively"
+            " or pin the choice in configuration"
+        )
+    index = chooser(question, [label(option) for option in options])
+    return options[index]

{haru_cli-0.1.2 → haru_cli-0.1.4}/src/haru/auth/session.py

@@ -14,9 +14,10 @@ from botocore.exceptions import (
 )
 
 from haru.auth.cache import read_token_cache, write_token_cache
+from haru.auth.identity import read_identity
 from haru.auth.sso import SsoToken
-from haru.config.schema import AuthConfig
-from haru.errors import AuthExpiredError, ConfigError
+from haru.config.schema import AuthConfig, SsoConfig
+from haru.errors import AuthExpiredError
 
 _REFRESH_WINDOW = timedelta(minutes=15)
 _RELOGIN_HINT = "run 'haru login'"
@@ -42,16 +43,12 @@ def build_boto3_session(
     if token.expires_at <= datetime.now(UTC) + _REFRESH_WINDOW:
         token = _refresh_token(config, token, oidc=oidc, cache_dir=cache_dir)
 
-    account_id = os.environ.get(sso.account_id_env)
-    if account_id is None:
-        raise ConfigError(
-            f"Environment variable {sso.account_id_env!r} must hold the target AWS account id"
-        )
+    account_id, role_name = _resolve_identity(sso, cache_dir)
     if sso_client is None:
         sso_client = boto3.Session().client("sso", region_name=sso.sso_region)
     try:
         response = sso_client.get_role_credentials(
-            roleName=sso.role_name, accountId=account_id, accessToken=token.access_token
+            roleName=role_name, accountId=account_id, accessToken=token.access_token
         )
     except (ClientError, SSOTokenLoadError, UnauthorizedSSOTokenError, TokenRetrievalError) as exc:
         raise AuthExpiredError(f"SSO credentials rejected; {_RELOGIN_HINT}") from exc
@@ -65,6 +62,25 @@ def build_boto3_session(
     )
 
 
+def _resolve_identity(sso: SsoConfig, cache_dir: Path | None) -> tuple[str, str]:
+    """Resolve the account id and role: config pins, env var, then the login choice."""
+    stored = read_identity(sso.start_url, cache_dir)
+
+    account_id = sso.account_id
+    if account_id is None and sso.account_id_env is not None:
+        account_id = os.environ.get(sso.account_id_env)
+    if account_id is None and stored is not None:
+        account_id = stored.account_id
+
+    role_name = sso.role_name
+    if role_name is None and stored is not None:
+        role_name = stored.role_name
+
+    if account_id is None or role_name is None:
+        raise AuthExpiredError(f"No AWS account/role selected yet; {_RELOGIN_HINT}")
+    return account_id, role_name
+
+
 def _refresh_token(
     config: AuthConfig, token: SsoToken, *, oidc: Any | None, cache_dir: Path | None
 ) -> SsoToken:

{haru_cli-0.1.2 → haru_cli-0.1.4}/src/haru/auth/sso.py

@@ -6,6 +6,7 @@ endpoint, capture the code on a 127.0.0.1 loopback listener, and exchange it
 with ``CreateToken``. Only loopback redirect URIs are accepted.
 """
 
+import html
 import secrets
 import time
 import webbrowser
@@ -13,6 +14,7 @@ from collections.abc import Callable
 from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 from http.server import BaseHTTPRequestHandler, HTTPServer
+from string import Template
 from typing import Any, cast
 from urllib.parse import parse_qs, urlencode, urlsplit
 
@@ -26,9 +28,74 @@ from haru.errors import AuthError
 _LOOPBACK_HOST = "127.0.0.1"
 _CALLBACK_PATH = "/oauth/callback"
 _AUTHORIZE_SCOPES = "sso:account:access"
-_CALLBACK_RESPONSE = (
-    b"<html><body><p>Sign-in complete. You can close this window and return to haru.</p>"
-    b"</body></html>"
+
+# Self-contained result page: inline CSS and inline SVG only — no scripts and
+# no external resources. The outcome is rendered server-side (unlike client
+# scripting, this works under the strict CSP below) and the strict CSP
+# enforces the no-script, no-resource policy in the browser.
+_PAGE_TEMPLATE = Template("""<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>$title</title>
+<style>
+    html { height: 100%; }
+    body {
+        box-sizing: border-box; min-height: 100%; margin: 0; padding: 15px 30px;
+        display: flex; flex-direction: column; justify-content: center;
+        align-items: center; min-width: 400px;
+        font-family: Verdana, Geneva, Tahoma, sans-serif; font-size: 0.9rem;
+        background-color: #000000; color: #e0e0e0;
+    }
+    .logo { font-size: 2rem; font-weight: bold; letter-spacing: 0.04em;
+            margin-bottom: 50px; color: #ffffff; }
+    .logo span { color: #7b5cfa; }
+    .request {
+        border: 1px solid; border-radius: 6px; padding: 20px 24px;
+        display: flex; flex-direction: row; align-items: flex-start; gap: 10px;
+    }
+    .request h4 { margin: 0 0 4px 0; }
+    .request p { margin: 0; opacity: 0.85; }
+    .approval { background-color: rgba(46, 204, 113, 0.08); border-color: #2ecc71; }
+    .approval h4, .approval p { color: #2ecc71; }
+    .denial { background-color: rgba(231, 76, 60, 0.08); border-color: #e74c3c; }
+    .denial h4, .denial p { color: #e74c3c; }
+    .icon { flex-shrink: 0; margin-top: 2px; margin-right: 5px; }
+    .hint { color: #a0a0b8; text-align: center; margin-top: 24px; }
+</style>
+</head>
+<body>
+    <div class="logo">haru <span>CLI</span></div>
+    <div>
+        <div class="request $variant">
+            <svg class="icon" width="18" height="18" viewBox="0 0 24 24" fill="none"
+                 stroke="$stroke" stroke-width="2" stroke-linecap="round"
+                 stroke-linejoin="round">$icon</svg>
+            <div>
+                <h4>$heading</h4>
+                <p>$message</p>
+            </div>
+        </div>
+        <p class="hint">$footer</p>
+    </div>
+</body>
+</html>""")
+
+_CHECK_ICON = '<polyline points="20 6 9 17 4 12"></polyline>'
+_CROSS_ICON = (
+    '<line x1="18" y1="6" x2="6" y2="18"></line><line x1="6" y1="6" x2="18" y2="18"></line>'
+)
+
+_SECURITY_HEADERS = (
+    (
+        "Content-Security-Policy",
+        "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'",
+    ),
+    ("X-Content-Type-Options", "nosniff"),
+    ("X-Frame-Options", "DENY"),
+    ("Referrer-Policy", "no-referrer"),
+    ("Cache-Control", "no-store"),
 )
 
 
@@ -142,6 +209,7 @@ def run_login(
         registration = register_client(oidc, sso.client_name, sso.start_url, redirect_uri)
         verifier, challenge = generate_pkce_pair()
         state = secrets.token_urlsafe(32)
+        server.expected_state = state
         open_url(
             build_authorize_url(
                 sso.sso_region, registration.client_id, redirect_uri, state, challenge
@@ -159,6 +227,7 @@ class _CallbackServer(HTTPServer):
     """Loopback HTTP server that records the OAuth callback query parameters."""
 
     callback_params: dict[str, list[str]] | None = None
+    expected_state: str | None = None
 
 
 class _CallbackHandler(BaseHTTPRequestHandler):
@@ -166,20 +235,71 @@ class _CallbackHandler(BaseHTTPRequestHandler):
 
     def do_GET(self) -> None:
         parsed = urlsplit(self.path)
+        if parsed.path == "/favicon.ico":
+            self.send_response(204)
+            self.end_headers()
+            return
         if parsed.path != _CALLBACK_PATH:
             self.send_error(404)
             return
         server = cast(_CallbackServer, self.server)
-        server.callback_params = parse_qs(parsed.query)
+        params = parse_qs(parsed.query)
+        server.callback_params = params
+        self._respond(_render_outcome(params, server.expected_state))
+
+    def _respond(self, page: bytes) -> None:
         self.send_response(200)
-        self.send_header("Content-Type", "text/html")
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(page)))
+        for header, value in _SECURITY_HEADERS:
+            self.send_header(header, value)
         self.end_headers()
-        self.wfile.write(_CALLBACK_RESPONSE)
+        self.wfile.write(page)
 
     def log_message(self, format: str, *args: object) -> None:
         """Silence default request logging; callback URLs must never be logged."""
 
 
+def _render_outcome(params: dict[str, list[str]], expected_state: str | None) -> bytes:
+    """Render the approval or denial page for the callback the browser sent."""
+    error = params.get("error", [""])[0]
+    if error:
+        description = params.get("error_description", [""])[0]
+        reason = f"{error}: {description}" if description else error
+        return _failure_page(html.escape(reason))
+    codes = params.get("code")
+    states = params.get("state")
+    if not codes or not states:
+        return _failure_page("The sign-in response was missing required parameters")
+    if expected_state is not None and not secrets.compare_digest(states[0], expected_state):
+        return _failure_page("The sign-in response failed a security check (state mismatch)")
+    return _success_page()
+
+
+def _success_page() -> bytes:
+    return _PAGE_TEMPLATE.substitute(
+        title="haru CLI authentication",
+        variant="approval",
+        stroke="#2ecc71",
+        icon=_CHECK_ICON,
+        heading="Request approved",
+        message="haru CLI has been given the requested permissions",
+        footer="You can close this window and start using haru CLI",
+    ).encode("utf-8")
+
+
+def _failure_page(reason: str) -> bytes:
+    return _PAGE_TEMPLATE.substitute(
+        title="haru CLI authentication",
+        variant="denial",
+        stroke="#e74c3c",
+        icon=_CROSS_ICON,
+        heading="Request denied",
+        message=reason,
+        footer="You can close this window and re-run haru login",
+    ).encode("utf-8")
+
+
 def _start_loopback_server(port: int) -> _CallbackServer:
     """Bind the loopback callback server (port 0 selects an ephemeral port)."""
     try:

{haru_cli-0.1.2 → haru_cli-0.1.4}/src/haru/commands/config.py

@@ -65,7 +65,6 @@ def config() -> None:
     "--sso-region", default="us-east-1", prompt="Identity Center region", show_default=True
 )
 @click.option("--bedrock-region", default="us-east-1", prompt="Bedrock region", show_default=True)
-@click.option("--role-name", default="HaruBedrockInvoke", prompt="IAM role name", show_default=True)
 @click.option(
     "--guardrail-id",
     default="",
@@ -78,7 +77,6 @@ def init(  # noqa: PLR0913, PLR0917 - one option per prompted setting; Click pas
     start_url: str,
     sso_region: str,
     bedrock_region: str,
-    role_name: str,
     guardrail_id: str,
     force: bool,
 ) -> None:
@@ -92,7 +90,6 @@ def init(  # noqa: PLR0913, PLR0917 - one option per prompted setting; Click pas
         "__START_URL__": start_url,
         "__SSO_REGION__": sso_region,
         "__BEDROCK_REGION__": bedrock_region,
-        "__ROLE_NAME__": role_name,
     }
     templates = resources.files("haru.config.templates")
     (target / "prompts").mkdir(parents=True, exist_ok=True)
@@ -113,9 +110,8 @@ def init(  # noqa: PLR0913, PLR0917 - one option per prompted setting; Click pas
 
     click.echo(f"Configuration written to {target}.")
     click.echo("Next steps:")
-    click.echo("  1. export HARU_AWS_ACCOUNT_ID=<your AWS account id>")
-    click.echo("  2. haru login")
-    click.echo("  3. haru chat")
+    click.echo("  1. haru login   (browser sign-in; your account and role are discovered)")
+    click.echo("  2. haru chat")
 
 
 @config.command()

{haru_cli-0.1.2 → haru_cli-0.1.4}/src/haru/commands/login.py

@@ -1,4 +1,9 @@
-"""The ``haru login`` command: interactive IAM Identity Center sign-in."""
+"""The ``haru login`` command: interactive IAM Identity Center sign-in.
+
+Browser-only sign-in: no IAM role or account id needs to be known upfront.
+After the token exchange, the accessible accounts and roles are discovered
+from Identity Center, auto-selected when unambiguous, and remembered.
+"""
 
 import webbrowser
 from pathlib import Path
@@ -6,18 +11,28 @@ from pathlib import Path
 import click
 
 from haru.auth.cache import write_token_cache
+from haru.auth.identity import select_identity
 from haru.auth.sso import run_login
 from haru.config import load_config
 from haru.errors import HaruError
 
 
+def _prompt_choice(question: str, labels: list[str]) -> int:
+    """Interactive numbered chooser for accounts and roles."""
+    click.echo(f"{question}:")
+    for number, label in enumerate(labels, start=1):
+        click.echo(f"  {number}. {label}")
+    choice: int = click.prompt("Enter a number", type=click.IntRange(1, len(labels)))
+    return choice - 1
+
+
 @click.command()
 @click.option(
     "--config",
     "config_path",
     type=click.Path(exists=True, dir_okay=False, path_type=Path),
     default=None,
-    help="Path to haru.yaml (default: config/haru.yaml).",
+    help="Path to haru.yaml (default: ./config/haru.yaml, then ~/.config/haru/haru.yaml).",
 )
 def login(config_path: Path | None) -> None:
     """Sign in to AWS IAM Identity Center via the browser (PKCE)."""
@@ -33,6 +48,13 @@ def login(config_path: Path | None) -> None:
 
         token = run_login(auth, opener=_open)
         path = write_token_cache(token, auth.sso.start_url, auth.sso.sso_region)
+        identity = select_identity(auth.sso, token, chooser=_prompt_choice)
     except HaruError as exc:
         raise click.ClickException(str(exc)) from exc
     click.echo(f"Login successful. Token cached at {path}.")
+    account_label = (
+        f"{identity.account_id} ({identity.account_name})"
+        if identity.account_name
+        else identity.account_id
+    )
+    click.echo(f"Using account {account_label}, role {identity.role_name}.")

{haru_cli-0.1.2 → haru_cli-0.1.4}/src/haru/config/schema.py

@@ -24,14 +24,20 @@ class AppConfig(_FrozenModel):
 
 
 class SsoConfig(_FrozenModel):
-    """IAM Identity Center (SSO) login settings."""
+    """IAM Identity Center (SSO) login settings.
+
+    ``account_id`` and ``role_name`` are optional: when unset, the account
+    and permission-set role are discovered interactively during
+    ``haru login`` (browser-only sign-in, like the AWS CLI's SSO flow).
+    """
 
     start_url: str
     sso_region: str
     registration_scopes: tuple[str, ...] = ("sso:account:access",)
     client_name: str = "haru-cli"
-    account_id_env: str
-    role_name: str
+    account_id: str | None = None
+    account_id_env: str | None = None
+    role_name: str | None = None
     callback_port: int = Field(default=0, ge=0, le=65535)
     browser: bool = True
 

{haru_cli-0.1.2 → haru_cli-0.1.4}/src/haru/config/templates/haru.yaml

@@ -8,8 +8,10 @@ auth:
     registration_scopes:
       - sso:account:access
     client_name: haru-cli
-    account_id_env: HARU_AWS_ACCOUNT_ID
-    role_name: __ROLE_NAME__
+    # Optional pins. When unset, your AWS account and role are discovered
+    # during 'haru login' (browser sign-in) and remembered.
+    # account_id: "123456789012"
+    # role_name: BedrockAccess
     callback_port: 0            # 0 selects an ephemeral loopback port
     browser: true
   bedrock_region: __BEDROCK_REGION__