Public/Status.ps1

# What this shell will actually do if you type `claude` right now.

function Get-CcsStatus {
    <#
    .SYNOPSIS
        Resolved backend, model pins and credential state for the active profile.
    .DESCRIPTION
        Reads the profile's settings.json rather than guessing from env vars,
        because a settings 'env' block wins over shell environment variables in
        Claude Code — the single most common source of "I switched but nothing
        changed".
    #>

    [CmdletBinding()]
    param([string]$Name)

    $config = Get-CcsConfig
    if (-not $Name) { $Name = Get-CcsActiveProfileName -Config $config }

    if (-not $Name) {
        return [pscustomobject]@{
            Profile      = $null
            ConfigDir    = $env:CLAUDE_CONFIG_DIR
            Backend      = 'unknown'
            Warning      = "CLAUDE_CONFIG_DIR points at a directory no profile claims"
        }
    }

    $resolved = Resolve-CcsProfile -Name $Name -Config $config
    $envMap = $resolved.Env

    $aws = $null
    if ($resolved.Backend -eq 'bedrock') {
        $aws = [pscustomobject]@{
            Profile           = $envMap['AWS_PROFILE']
            Region            = $envMap['AWS_REGION']
            ProfileConfigured = ($envMap['AWS_PROFILE'] -in (Get-CcsAwsProfileNames))
            CredentialProcess = Test-Path -LiteralPath (Join-Path (Get-CcwbHome) 'credential-process.exe')
        }
    }

    [pscustomobject]@{
        Profile     = $resolved.Name
        ConfigDir   = $resolved.Dir
        Backend     = $resolved.Backend
        Model       = $resolved.Settings.model
        OpusPin     = $envMap['ANTHROPIC_DEFAULT_OPUS_MODEL']
        SonnetPin   = $envMap['ANTHROPIC_DEFAULT_SONNET_MODEL']
        HaikuPin    = $envMap['ANTHROPIC_DEFAULT_HAIKU_MODEL']
        Telemetry   = $envMap['OTEL_EXPORTER_OTLP_ENDPOINT']
        Aws         = $aws
        LoggedIn    = Test-Path -LiteralPath (Join-Path $resolved.Dir '.credentials.json')
    }
}

function Get-CcsAwsIdentity {
    <#
    .SYNOPSIS
        Call `aws sts get-caller-identity` for a Bedrock profile's AWS profile.
    .DESCRIPTION
        This triggers the company credential process, which may open a browser to
        authenticate. Kept out of `status` and `doctor` so neither ever surprises
        you with a login prompt; call it explicitly when you want to prove the
        federation still works.
    #>

    [CmdletBinding()]
    param([string]$Name)

    $status = Get-CcsStatus -Name $Name
    if ($status.Backend -ne 'bedrock') { throw "Profile '$($status.Profile)' does not use Bedrock" }
    if (-not $status.Aws.Profile) { throw "Profile '$($status.Profile)' has no AWS_PROFILE in its settings" }

    $awsCmd = Get-Command aws -ErrorAction SilentlyContinue
    if (-not $awsCmd) { throw 'aws CLI was not found on PATH' }

    $previous = $env:AWS_PROFILE
    try {
        $env:AWS_PROFILE = $status.Aws.Profile
        $raw = & $awsCmd.Source sts get-caller-identity --output json 2>&1
        if ($LASTEXITCODE -ne 0) { throw "aws sts get-caller-identity failed: $raw" }
        $raw | ConvertFrom-Json
    } finally {
        if ($null -eq $previous) { Remove-Item env:AWS_PROFILE -ErrorAction SilentlyContinue }
        else { $env:AWS_PROFILE = $previous }
    }
}