aws-cli-zsp 0.3.2

aws-cli-zsp 0.3.2

First tagged release. Build from source: bash scripts/build-app.sh (macOS, Apple Silicon or T2, Touch ID).

New in 0.3.2: client keys with read-only IAM users

• Sessions work as normal (GetSessionToken needs no IAM permission).
• Check in AWS simulates the user's IAM permissions and hides what it may not do: rotate, revoke, deactivate, delete, MFA steps.
• An AccessDenied is remembered and refused before Touch ID next time.
• aws-cli-zsp access --profile P read-only|full|auto, or ⋯ → Mark read-only.
• Nothing changes in the client's AWS account.

0.3.1: account pinning

• The first session pins each profile to its AWS account and IAM user, in the login Keychain.
• A key swapped for one to another account is refused (key.swapped); a session aws-cli-zsp did not issue is not served (session.swapped).
• aws-cli-zsp pin show|reset --profile P.

0.3.0: new UI, MFA from the menu

• Redesigned menu bar app: Overview, Keys, MFA & phone, Audit trail; onboarding and About.
• This Mac as a virtual MFA device, MFA enforced by AWS, phone approval (QR code for any authenticator app) for Claude Code Remote Control, with undo for each step.
• doctor, test, selftest-watcher, setup commands.

See the README for what it protects against and what it does not.