feat: add ECS Exec debug sessions browser (M3.11)

- Add ECS service layer: ListClusters, ListServices, ListTasks, DescribeTaskContainers
- Add ECSClientAPI interface and ECSClient field to AwsRepository
- Add BuildECSExecCommand wrapping `aws ecs execute-command --interactive`
- Add TUI drill-down: Cluster → Service → Task → Container
- Show exec readiness (exec:✓/✗) per container; surface actionable error if disabled
- Launch exec session via tea.ExecProcess, return cleanly to TUI on exit
- Add unit tests with mockECSClient (5 test cases)
- Update README features table and key bindings

Author: jjjjjjeonda86

README.md

@@ -128,6 +128,7 @@ contexts:
 | IAM | IAM User Browser (lightweight username pages, background filter expansion, detail drill-down) | ✅ Implemented |
 | IAM | Access Key Browser (list keys with status, age, last used) | ✅ Implemented |
 | IAM | Access Key Rotation (create → verify/apply → deactivate → delete) | ✅ Implemented |
+| ECS | ECS Exec Sessions (Clusters → Services → Tasks → Containers, exec session via `aws ecs execute-command`) | ✅ Implemented |
 
 ## TUI Key Bindings
 
@@ -202,6 +203,16 @@ contexts:
 | `n` | Load more (older events) | Viewer |
 | `PgUp`/`PgDn` | Page scroll | Viewer |
 
+### ECS Exec Sessions
+
+| Key | Action | Screen |
+|-----|--------|--------|
+| `/` | Filter clusters/services | Cluster / Service list |
+| `r` | Refresh list | Cluster / Service / Task list |
+| `Enter` | Drill down (Cluster → Service → Task → Container) | Any list |
+| `Enter` | Start exec session (`/bin/sh`) | Container list |
+| `Esc` | Go back one level | Any screen |
+
 ### Context Switcher
 
 | Key | Action |

go.mod

@@ -26,6 +26,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.68.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.20 // indirect

go.sum

@@ -24,6 +24,8 @@ github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.68.0 h1:+/lmB/+i2oqkzbmlQ
 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.68.0/go.mod h1:PobeppEnIjw4pcgjFryNDZCTH7AiqZw0yb5r98Gvf9c=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.296.0 h1:98Miqj16un1WLNyM1RjVDhXYumhqZrQfAeG8i4jPG6o=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.296.0/go.mod h1:T6ndRfdhnXLIY5oKBHjYZDVj706los2zGdpThppquvA=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0 h1:a5G/TgJNrpuCjZBTf8/PTN0C2B0do/ylaYVynxPSbUQ=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0/go.mod h1:QkWmubOYmjj3cHn7A4CoUU7BKJhVeo39Gp6NH7IyhZw=
 github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 h1:n9YLiWtX3+6pTLZWvRJmtq5JIB9NA/KFelyCg5fOlTU=
 github.com/aws/aws-sdk-go-v2/service/iam v1.53.7/go.mod h1:sP46Vo6MeJcM4s0ZXcG2PFmfiSyixhIuC/74W52yKuk=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=

internal/app/app.go

@@ -48,6 +48,10 @@ const (
 	screenCWLogGroupList
 	screenCWLogStreamList
 	screenCWLogViewer
+	screenECSClusterList
+	screenECSServiceList
+	screenECSTaskList
+	screenECSContainerList
 	screenContextPicker
 	screenContextAdd
 	screenLoading
@@ -176,6 +180,29 @@ type Model struct {
 	sgAddInput             string            // current field text input
 	sgAddSelectIdx         int               // index for select-type fields (direction, protocol)
 
+	// ECS browser state
+	ecsClusters            []awsservice.ECSCluster
+	filteredECSClusters    []awsservice.ECSCluster
+	ecsClusterIdx          int
+	ecsClusterFilter       string
+	ecsClusterFilterActive bool
+	selectedECSCluster     *awsservice.ECSCluster
+
+	ecsServices            []awsservice.ECSService
+	filteredECSServices    []awsservice.ECSService
+	ecsServiceIdx          int
+	ecsServiceFilter       string
+	ecsServiceFilterActive bool
+	selectedECSService     *awsservice.ECSService
+
+	ecsTasks            []awsservice.ECSTask
+	filteredECSTasks    []awsservice.ECSTask
+	ecsTaskIdx          int
+	selectedECSTask     *awsservice.ECSTask
+
+	ecsContainers    []awsservice.ECSContainer
+	ecsContainerIdx  int
+
 	// CloudWatch Logs browser state
 	cwLogGroups             []awsservice.LogGroup
 	filteredCWLogGroups     []awsservice.LogGroup
@@ -310,6 +337,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.handleIAMMsg,
 		m.handleSecretMsg,
 		m.handleCloudWatchLogsMsg,
+		m.handleECSMsg,
 		m.handleContextMsg,
 	} {
 		if newM, cmd, handled := h(msg); handled {
@@ -398,6 +426,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m.updateIAMKeyRotateConfirm(msg)
 		case screenIAMKeyRotateResult:
 			return m.updateIAMKeyRotateResult(msg)
+		case screenECSClusterList:
+			return m.updateECSClusterList(msg)
+		case screenECSServiceList:
+			return m.updateECSServiceList(msg)
+		case screenECSTaskList:
+			return m.updateECSTaskList(msg)
+		case screenECSContainerList:
+			return m.updateECSContainerList(msg)
 		case screenContextPicker:
 			return m.updateContextPicker(msg)
 		case screenContextAdd:
@@ -501,6 +537,9 @@ func (m Model) updateFeatureList(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 				m.iamRotationEnabled = true
 				m.screen = screenLoading
 				return m, m.loadIAMKeys()
+			case domain.FeatureECSExec:
+				m.screen = screenLoading
+				return m, m.loadECSClusters()
 			}
 		}
 	}
@@ -586,6 +625,14 @@ func (m Model) View() string {
 		v = m.viewIAMKeyRotateConfirm()
 	case screenIAMKeyRotateResult:
 		v = m.viewIAMKeyRotateResult()
+	case screenECSClusterList:
+		v = m.viewECSClusterList()
+	case screenECSServiceList:
+		v = m.viewECSServiceList()
+	case screenECSTaskList:
+		v = m.viewECSTaskList()
+	case screenECSContainerList:
+		v = m.viewECSContainerList()
 	case screenContextPicker:
 		v = m.viewContextPicker()
 	case screenContextAdd:

internal/app/messages.go

@@ -152,3 +152,23 @@ type iamKeyDeletedMsg struct {
 	keyID string
 	err   error
 }
+
+type ecsClustersLoadedMsg struct {
+	clusters []awsservice.ECSCluster
+}
+
+type ecsServicesLoadedMsg struct {
+	services []awsservice.ECSService
+}
+
+type ecsTasksLoadedMsg struct {
+	tasks []awsservice.ECSTask
+}
+
+type ecsContainersLoadedMsg struct {
+	containers []awsservice.ECSContainer
+}
+
+type ecsExecDoneMsg struct {
+	err error
+}