feat: add ECS Exec debug sessions browser (M3.11)

.gitignore

@@ -1,3 +1,5 @@
 /dist/
 /unic
 .claude/reports/
+# SSM session-manager-plugin temp files (ecs exec session state)
+cs.json

README.md

@@ -169,6 +169,7 @@ Behavior:
 | IAM | IAM User Browser (lightweight username pages, background filter expansion, detail drill-down) | ✅ Implemented |
 | IAM | Access Key Browser (list keys with status, age, last used) | ✅ Implemented |
 | IAM | Access Key Rotation (create → verify/apply → deactivate → delete) | ✅ Implemented |
+| ECS | ECS Exec Sessions (Clusters → Services → Tasks → Containers, exec session via `aws ecs execute-command`) | ✅ Implemented |
 
 ## TUI Key Bindings
 
@@ -243,6 +244,16 @@ Behavior:
 | `n` | Load more (older events) | Viewer |
 | `PgUp`/`PgDn` | Page scroll | Viewer |
 
+### ECS Exec Sessions
+
+| Key | Action | Screen |
+|-----|--------|--------|
+| `/` | Filter clusters/services | Cluster / Service list |
+| `r` | Refresh list | Cluster / Service / Task list |
+| `Enter` | Drill down (Cluster → Service → Task → Container) | Any list |
+| `Enter` | Start exec session (`/bin/sh`) | Container list |
+| `Esc` | Go back one level | Any screen |
+
 ### Context Switcher
 
 | Key | Action |

go.mod

@@ -27,6 +27,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
 	github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.68.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect

go.sum

@@ -26,6 +26,8 @@ github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.68.0 h1:+/lmB/+i2oqkzbmlQ
 github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.68.0/go.mod h1:PobeppEnIjw4pcgjFryNDZCTH7AiqZw0yb5r98Gvf9c=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.296.0 h1:98Miqj16un1WLNyM1RjVDhXYumhqZrQfAeG8i4jPG6o=
 github.com/aws/aws-sdk-go-v2/service/ec2 v1.296.0/go.mod h1:T6ndRfdhnXLIY5oKBHjYZDVj706los2zGdpThppquvA=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0 h1:a5G/TgJNrpuCjZBTf8/PTN0C2B0do/ylaYVynxPSbUQ=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.76.0/go.mod h1:QkWmubOYmjj3cHn7A4CoUU7BKJhVeo39Gp6NH7IyhZw=
 github.com/aws/aws-sdk-go-v2/service/iam v1.53.7 h1:n9YLiWtX3+6pTLZWvRJmtq5JIB9NA/KFelyCg5fOlTU=
 github.com/aws/aws-sdk-go-v2/service/iam v1.53.7/go.mod h1:sP46Vo6MeJcM4s0ZXcG2PFmfiSyixhIuC/74W52yKuk=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=

internal/app/app.go

@@ -48,6 +48,10 @@ const (
 	screenCWLogGroupList
 	screenCWLogStreamList
 	screenCWLogViewer
+	screenECSClusterList
+	screenECSServiceList
+	screenECSTaskList
+	screenECSContainerList
 	screenS3BucketList
 	screenS3ObjectList
 	screenS3ObjectDetail
@@ -179,6 +183,28 @@ type Model struct {
 	sgAddInput             string            // current field text input
 	sgAddSelectIdx         int               // index for select-type fields (direction, protocol)
 
+	// ECS browser state
+	ecsClusters            []awsservice.ECSCluster
+	filteredECSClusters    []awsservice.ECSCluster
+	ecsClusterIdx          int
+	ecsClusterFilter       string
+	ecsClusterFilterActive bool
+	selectedECSCluster     *awsservice.ECSCluster
+
+	ecsServices            []awsservice.ECSService
+	filteredECSServices    []awsservice.ECSService
+	ecsServiceIdx          int
+	ecsServiceFilter       string
+	ecsServiceFilterActive bool
+	selectedECSService     *awsservice.ECSService
+
+	ecsTasks    []awsservice.ECSTask
+	ecsTaskIdx  int
+	selectedECSTask *awsservice.ECSTask
+
+	ecsContainers    []awsservice.ECSContainer
+	ecsContainerIdx  int
+
 	// CloudWatch Logs browser state
 	cwLogGroups             []awsservice.LogGroup
 	filteredCWLogGroups     []awsservice.LogGroup
@@ -329,6 +355,7 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 		m.handleIAMMsg,
 		m.handleSecretMsg,
 		m.handleCloudWatchLogsMsg,
+		m.handleECSMsg,
 		m.handleS3Msg,
 		m.handleContextMsg,
 	} {
@@ -424,6 +451,14 @@ func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m.updateIAMKeyRotateConfirm(msg)
 		case screenIAMKeyRotateResult:
 			return m.updateIAMKeyRotateResult(msg)
+		case screenECSClusterList:
+			return m.updateECSClusterList(msg)
+		case screenECSServiceList:
+			return m.updateECSServiceList(msg)
+		case screenECSTaskList:
+			return m.updateECSTaskList(msg)
+		case screenECSContainerList:
+			return m.updateECSContainerList(msg)
 		case screenContextPicker:
 			return m.updateContextPicker(msg)
 		case screenContextAdd:
@@ -530,6 +565,9 @@ func (m Model) updateFeatureList(msg tea.KeyMsg) (tea.Model, tea.Cmd) {
 				m.iamRotationEnabled = true
 				m.screen = screenLoading
 				return m, m.loadIAMKeys()
+			case domain.FeatureECSExec:
+				m.screen = screenLoading
+				return m, m.loadECSClusters()
 			}
 		}
 	}
@@ -621,6 +659,14 @@ func (m Model) View() string {
 		v = m.viewIAMKeyRotateConfirm()
 	case screenIAMKeyRotateResult:
 		v = m.viewIAMKeyRotateResult()
+	case screenECSClusterList:
+		v = m.viewECSClusterList()
+	case screenECSServiceList:
+		v = m.viewECSServiceList()
+	case screenECSTaskList:
+		v = m.viewECSTaskList()
+	case screenECSContainerList:
+		v = m.viewECSContainerList()
 	case screenContextPicker:
 		v = m.viewContextPicker()
 	case screenContextAdd:

internal/app/messages.go

@@ -166,3 +166,23 @@ type iamKeyDeletedMsg struct {
 	keyID string
 	err   error
 }
+
+type ecsClustersLoadedMsg struct {
+	clusters []awsservice.ECSCluster
+}
+
+type ecsServicesLoadedMsg struct {
+	services []awsservice.ECSService
+}
+
+type ecsTasksLoadedMsg struct {
+	tasks []awsservice.ECSTask
+}
+
+type ecsContainersLoadedMsg struct {
+	containers []awsservice.ECSContainer
+}
+
+type ecsExecDoneMsg struct {
+	err error
+}