SanMar AWS MFA Notifier

Native VS Code request manager for validated AWS MFA requests created by Secrets Broker.

Security boundary

The extension:

reads only ~/.iac/pending-unlocks/awsmfa_*.json;
requires a trusted, non-virtual workspace;
validates request ownership, mode, size, schema, filename/ID binding, account, expiry, and canonical operator command;
displays only non-secret request metadata through native VS Code prompts;
never accepts an MFA code, password, passphrase, token, or credential;
never approves or denies requests, writes broker state, opens a webview/input box/external URL, manages SSH, or modifies the vault;
copies only the validated non-secret command when requested;
launches the fixed root-owned vault-cli.sh directly with array arguments in a dedicated terminal. It never receives terminal input or sends shell text.

Commands

Command	Purpose
`SanMar: Manage AWS MFA Requests`	Review, copy, or open a validated request
`SanMar: Refresh AWS MFA Requests`	Refresh the bounded request snapshot

Configuration

Setting	Scope	Default	Range
`sanmarInteractions.pollIntervalMs`	Machine	`5000` ms	`1000`-`60000` ms

The request directory and operator command are fixed by the release. Workspace settings cannot redirect either path.

Operator workflow

A single new validated request opens its native management modal automatically. Use SanMar: Manage AWS MFA Requests when several requests are pending.
Review requester, purpose, account, region, duration, device, and expiry.
Select Open MFA prompt to open the fixed command in a trusted terminal, or Copy command for manual terminal use.

/usr/local/lib/secrets-broker/current/vault-cli.sh aws-mfa awsmfa_ <review_digest>


4. Enter the MFA code only at the hidden terminal prompt. The extension never
receives it.
5. Never paste an MFA code or credential into VS Code, chat, MCP, arguments,
environment variables, or files.

## Build and test

```bash
npm --prefix /workspaces/secrets-broker ci
npm --prefix /workspaces/secrets-broker run build --workspace=packages/vscode-interaction-notifier
npm --prefix /workspaces/secrets-broker run test --workspace=packages/vscode-interaction-notifier
npm --prefix /workspaces/secrets-broker run package:extension

Tagged releases are built with pinned tooling, scanned by npm audit, emitted with an SBOM and SHA-256 manifest, attested with GitHub OIDC provenance, and published through the SanMarIaC Marketplace publisher. The devcontainer installer accepts only the approved publisher and exact version; it never installs a workspace VSIX.