@amerged/ohmyhost-mcp 0.1.18 → 0.1.20

package/src/apps/product-cli/cli.ts

@@ -43,17 +43,28 @@ import {
   type StoredCredential,
 } from "./credential-store.js";
 import type { ProductApi } from "./product-api.js";
+import {
+  defaultProfileName,
+  isProfileUserId,
+  ProfileLimitError,
+  profileLimitAction,
+  ProfileNameConflictError,
+  publicProfile,
+  type LocalProfile,
+  type ProfileRegistry,
+} from "./profile-store.js";
 import type { ProjectLinkStore } from "./project-link-store.js";
 import { DeviceTokenExpiryError, resolveDeviceTokenExpiresAt } from "./device-token-expiry.js";
 import {
+  AccountVerificationError,
+  assertVerifiedLogin,
   chooseWorkspace,
   InteractiveSessionRequiredError,
+  ProfileOrganizationFixedError,
   publicWorkspace,
   selectWorkspace,
-  selectedWorkspaceId,
   workspaceOf,
   type WorkspaceSelection,
-  type WorkspaceSession,
 } from "./workspace.js";
 import {
   parseCloudflareDnsAuthorization,
@@ -63,6 +74,7 @@ import {
   parseDeploymentPlan,
   parseCurrentIdentity,
   parseOrganization,
+  type PublicAccount,
   type PublicWorkspace,
   parseOrganizationCredits,
   parseProjectCreditBudget,
@@ -198,7 +210,18 @@ export class PublicResponseTooLargeError extends Error {
 export interface ProductCliDependencies {
   readonly apiToken?: string;
   readonly commandPrefix: string;
-  readonly credentialStore: (kind: "native") => CredentialStore;
+  /** One credential store for a run without saved logins; a chosen saved login uses its own. */
+  readonly credentialStore?: (kind: "native") => CredentialStore;
+  /** Saved interactive logins; login, logout, profile list and workspace binding need them. */
+  readonly profiles?: ProfileRegistry;
+  /** The saved login this run acts as, chosen before the command started and never by another run. */
+  readonly profile?: LocalProfile;
+  /** The alias `login` gives the login it adds. */
+  readonly profileName?: string;
+  /** The OHMYHOST_PROFILE binding of this process, reported by `profile list`. */
+  readonly profileBinding?: string;
+  /** Read-only `GET /v1/me`, which verifies a fresh login before anything is stored. */
+  readonly currentIdentity?: (accessToken: () => Promise<string>) => Promise<unknown>;
   readonly deviceFlow: WorkosDeviceFlowClient;
   readonly deviceAuthorizationPresenter: DeviceAuthorizationPresenter;
   readonly productApi: (accessToken: () => Promise<string>) => ProductApi;
@@ -206,9 +229,7 @@ export interface ProductCliDependencies {
    * Reads the signed-in customer's workspaces through a separate read-only dependency,
    * keeping product mutation capabilities out of login.
    */
-  readonly accountProfile: (
-    accessToken: () => Promise<string>,
-  ) => Promise<readonly PublicWorkspace[]>;
+  readonly accountProfile: (accessToken: () => Promise<string>) => Promise<PublicAccount>;
   /** Optional onboarding guidance; production supplies only this one read-only SDK query. */
   readonly githubConnectionStatus?: (
     accessToken: () => Promise<string>,
@@ -256,6 +277,8 @@ interface CliErrorDocument {
     readonly retry_after_seconds?: number;
     readonly request_id?: string;
     readonly docs_url?: string;
+    /** The account the command ran as, for answers that depend on which account that is. */
+    readonly acting_as?: Readonly<Record<string, unknown>>;
   };
 }
 
@@ -265,9 +288,14 @@ type CustomerCommandLabel = Exclude<CommandLabel, "unknown" | "help" | "version"
 const CLI_VERSION = cliPackage.version;
 const HELP_USAGE = Object.freeze({
   init: "ohmyhost init [--directory PATH] [--root PATH] [--project SLUG] [--region us|eu] [--dry-run] --json (pass the project's hosting region so storage.jurisdiction matches it; us when omitted)",
-  login: "ohmyhost login [--organization ULID] --json",
-  logout: "ohmyhost logout [--revoke] --json",
-  whoami: "ohmyhost whoami --json",
+  login:
+    "ohmyhost login [--organization ULID] [--user USER_ID] [--profile-name NAME] --json (adds one saved login; nothing is saved unless the browser signed in as that user and organization)",
+  logout:
+    "ohmyhost logout [--profile-name NAME] [--revoke] --json (removes only the selected saved login)",
+  whoami:
+    "ohmyhost whoami [--profile-name NAME] --json (the effective user, organization and saved login)",
+  "profile list":
+    "ohmyhost profile list --json (saved logins on this computer: name, user and organization, never a token; pass --profile-name NAME or set OHMYHOST_PROFILE to choose one)",
   "github connect":
     "ohmyhost github connect --organization ULID --idempotency-key KEY --json (connect once, then link covered repositories without another browser consent)",
   "github status": "ohmyhost github status --organization ULID --json",
@@ -291,10 +319,11 @@ const HELP_USAGE = Object.freeze({
   "budget set":
     "ohmyhost budget set --project ULID --credits NUMBER|none [--mode continue|stop] --idempotency-key KEY --json",
   "organization create":
-    "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; the new workspace is selected immediately)",
+    "ohmyhost organization create --name NAME --idempotency-key KEY [--source SOURCE] --json (SOURCE is optional attribution from a link's r value; a login without organization is bound to the new workspace, another login keeps its own)",
   "organization list":
-    "ohmyhost organization list --json (the workspaces you belong to and the selected one)",
-  "organization use": "ohmyhost organization use --organization ULID --json",
+    "ohmyhost organization list [--profile-name NAME] --json (the workspaces of the chosen login's user and the one that login is scoped to)",
+  "organization use":
+    "ohmyhost organization use --organization ULID [--profile-name NAME] --json (binds a login that has no organization yet; another organization needs its own login)",
   "operation get": "ohmyhost operation get OPERATION_ULID --json",
   "operation reconcile":
     "ohmyhost operation reconcile OPERATION_ULID --idempotency-key KEY --yes --json",
@@ -377,7 +406,7 @@ const HELP_USAGE = Object.freeze({
   "function runs":
     "ohmyhost function runs --project ULID --environment ENVIRONMENT_ULID [--limit 1-100] --json",
   "secret set":
-    "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY --stdin [--wait] --json",
+    "printf '%s' \"$SECRET_VALUE\" | ohmyhost secret set NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--profile-user USER_ID --profile-organization ULID | --token-user USER_ID --token-organization ULID] --stdin [--wait] --json (with --profile-user and --profile-organization the saved login that runs it must belong to that user and organization; with --token-user and --token-organization it runs only with an OHMYHOST_TOKEN of that user and organization, never with a saved login)",
   "secret delete":
     "ohmyhost secret delete NAME --project ULID --environment ENVIRONMENT_ULID --idempotency-key KEY [--wait] --json",
   "mail setup":
@@ -411,8 +440,9 @@ export const cliMetadataResult = (kind: "help" | "version", topic?: string): Cli
     ? success("help", {
         status: "succeeded",
         cli_version: CLI_VERSION,
-        usage: "ohmyhost <command> [options] --json",
-        environment: "OHMYHOST_ENVIRONMENT=development|production (default: production)",
+        usage: "ohmyhost <command> [options] [--profile-name NAME] --json",
+        environment:
+          "OHMYHOST_ENVIRONMENT=development|production (default: production); OHMYHOST_PROFILE=NAME binds this process to one saved login",
         commands: HELP_COMMANDS.filter((entry) => !topic || entry.command === topic),
       })
     : success("version", { status: "succeeded", cli_version: CLI_VERSION });
@@ -431,7 +461,12 @@ class ProductCliFailure extends Error {
 }
 
 export class ProductCli {
-  public constructor(private readonly dependencies: ProductCliDependencies) {}
+  /** The saved login of this run; binding a login without organization replaces it. */
+  #profile: LocalProfile | undefined;
+
+  public constructor(private readonly dependencies: ProductCliDependencies) {
+    this.#profile = dependencies.profile;
+  }
 
   public async run(
     argv: readonly string[],
@@ -479,8 +514,9 @@ export class ProductCli {
         // A user API token is bound to one workspace and cannot read the account profile.
         throw new InteractiveSessionRequiredError();
       }
+      if (command.kind === "profile-list") return await this.listProfiles();
       if (command.kind === "login")
-        return await this.login(command.credentialStore, command.organizationId, signal);
+        return await this.login(command.organizationId, command.userId, signal);
       if (command.kind === "logout") {
         return await this.logout(command.credentialStore, command.revoke, signal);
       }
@@ -628,12 +664,9 @@ export class ProductCli {
             idempotencyKey: command.idempotencyKey,
           }),
         );
-        // A created workspace is only usable once it is in the access token, so select it now.
-        const selection = await this.chooseAndStoreWorkspace(
-          await api.getAccountProfile(),
+        const selection = chooseWorkspace(
+          (await api.getAccountProfile()).organizations,
           organization.id,
-          command.credentialStore,
-          signal,
         );
         if (selection.outcome !== "selected")
           throw new ProductCliFailure(
@@ -642,10 +675,28 @@ export class ProductCli {
             true,
             `The new workspace is not yet readable for this account. Run '${this.dependencies.commandPrefix} organization use --organization ${organization.id} --json' again.`,
           );
+        const current = this.#profile;
+        // A login in another organization keeps it: the new workspace gets its own login, so no
+        // other agent that uses this login is moved into the new workspace.
+        if (
+          current !== undefined &&
+          current.organizationId !== null &&
+          current.organizationId !== organization.id
+        )
+          return success("organization create", {
+            status: "succeeded",
+            organization,
+            selected: current.organizationId,
+            profile: publicProfile(current),
+            next_action: `Run '${this.dependencies.commandPrefix} login --organization ${organization.id} --user ${current.userId} --json' to add a login for the new workspace as the same user; profile ${current.name} stays in organization ${current.organizationId}.`,
+          });
+        // A created workspace is only usable once it is in the access token, so bind it now.
+        const profile = await this.bindOrganization(selection.organization, signal);
         return success("organization create", {
           status: "succeeded",
           organization,
           selected: organization.id,
+          profile: publicProfile(profile),
           next_action: `Run '${this.dependencies.commandPrefix} whoami --json' to confirm the selected workspace, then create a project.`,
           ...(await this.githubNextAction(
             await this.authenticatedApi(command.credentialStore, signal),
@@ -655,26 +706,26 @@ export class ProductCli {
       }
       if (command.kind === "organization-list") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
-        const organizations = await api.getAccountProfile();
+        const account = await api.getAccountProfile();
         return success("organization list", {
           status: "listed",
-          organizations: organizations.map(publicWorkspace),
-          selected: await selectedWorkspaceId(this.workspaceSession(command.credentialStore)),
+          organizations: account.organizations.map(publicWorkspace),
+          selected: this.#profile?.organizationId ?? null,
         });
       }
       if (command.kind === "organization-use") {
         const api = await this.authenticatedApi(command.credentialStore, signal);
-        const selection = await this.chooseAndStoreWorkspace(
-          await api.getAccountProfile(),
+        const selection = chooseWorkspace(
+          (await api.getAccountProfile()).organizations,
           command.organizationId,
-          command.credentialStore,
-          signal,
         );
         if (selection.outcome !== "selected") throw this.unknownWorkspace(selection);
+        const profile = await this.bindOrganization(selection.organization, signal);
         return success("organization use", {
           status: "selected",
           organization: publicWorkspace(selection.organization),
           selected: selection.organization.id,
+          profile: publicProfile(profile),
           ...(await this.githubNextAction(
             await this.authenticatedApi(command.credentialStore, signal),
             selection.organization.id,
@@ -887,8 +938,16 @@ export class ProductCli {
           false,
           `A user API token cannot create, list or select a workspace. Run '${this.dependencies.commandPrefix} login --json' in a process without OHMYHOST_TOKEN.`,
         );
+      if (error instanceof ProfileLimitError)
+        return failure(
+          name,
+          2,
+          "profile_limit_reached",
+          false,
+          profileLimitAction(this.dependencies.commandPrefix),
+        );
       this.recordDiagnostic(diagnosticDescriptor(error, signal));
-      return classifyFailure(name, error, signal);
+      return classifyFailure(name, error, signal, this.context());
     }
   }
 
@@ -929,33 +988,59 @@ export class ProductCli {
       return success("whoami", {
         status: "authenticated",
         identity,
+        context: this.context(),
         ...(identity.organization_ids.length === 1 && identity.organization_ids[0] !== undefined
           ? await this.githubNextAction(api, identity.organization_ids[0])
           : {}),
       });
-    const selection = await this.chooseAndStoreWorkspace(
-      await api.getAccountProfile(),
-      undefined,
-      command.credentialStore,
-      signal,
-    );
-    if (selection.outcome === "selected")
+    const selection = chooseWorkspace((await api.getAccountProfile()).organizations, undefined);
+    if (selection.outcome === "selected") {
+      await this.bindOrganization(selection.organization, signal);
       return success("whoami", {
         status: "authenticated",
         identity: parseCurrentIdentity(await api.getCurrentIdentity()),
         organization: publicWorkspace(selection.organization),
         selected: selection.organization.id,
+        context: this.context(),
         ...(await this.githubNextAction(api, selection.organization.id)),
       });
+    }
     return success("whoami", {
       status: "authenticated",
       identity,
+      context: this.context(),
       organizations:
         selection.outcome === "choice_required" ? selection.organizations.map(publicWorkspace) : [],
-      next_action:
-        selection.outcome === "choice_required"
-          ? `Ask the customer which workspace to use, then run '${this.dependencies.commandPrefix} organization use --organization ULID --json'.`
-          : `Run '${this.dependencies.commandPrefix} organization create --name NAME --idempotency-key KEY --json' to create the first workspace.`,
+      next_action: this.workspaceAction(selection),
+    });
+  }
+
+  /** Which account this run acts as, without any credential. */
+  private context(): Readonly<Record<string, unknown>> {
+    if (this.dependencies.apiToken !== undefined) return { credential: "environment_token" };
+    return {
+      credential: "profile",
+      profile: this.#profile === undefined ? null : publicProfile(this.#profile),
+    };
+  }
+
+  /** The next step for a login that has no organization yet. */
+  private workspaceAction(selection: WorkspaceSelection): string {
+    const prefix = this.dependencies.commandPrefix;
+    const named = this.#profile === undefined ? "" : ` --profile-name ${this.#profile.name}`;
+    return selection.outcome === "choice_required"
+      ? `Ask the customer which workspace to use, then run '${prefix} organization use --organization ULID${named} --json'.`
+      : `Run '${prefix} organization create --name NAME --idempotency-key KEY${named} --json' to create the first workspace.`;
+  }
+
+  private async listProfiles(): Promise<CliResult> {
+    const profiles = this.dependencies.profiles;
+    if (profiles === undefined) throw new ProviderCapabilityBlockedError();
+    return success("profile list", {
+      status: "listed",
+      profiles: (await profiles.list()).map(publicProfile),
+      bound: this.dependencies.profileBinding ?? null,
+      environment_token: this.dependencies.apiToken !== undefined,
     });
   }
 
@@ -974,10 +1059,14 @@ export class ProductCli {
 
   // The reviewed boundary proof parses this signature, so keep its parameters brace-free.
   private async login(
-    credentialStore: "native",
     organizationId: string | undefined,
+    expectedUserId: string | undefined,
     signal: AbortSignal,
   ): Promise<CliResult> {
+    const profiles = this.dependencies.profiles;
+    const readIdentity = this.dependencies.currentIdentity;
+    if (profiles === undefined || readIdentity === undefined)
+      throw new ProviderCapabilityBlockedError();
     // A device code lives five minutes and the provider offers no way to lengthen it, so the
     // sign-in outlives the code instead: while this window lasts, a lapsed code is replaced.
     const signInDeadline = this.dependencies.now().getTime() + SIGN_IN_WINDOW_MS;
@@ -1046,78 +1135,169 @@ export class ProductCli {
           "Run login again; the authorization response was incomplete.",
         );
       }
-      await this.dependencies.credentialStore(credentialStore).replace({
+      // Nothing is stored before the browser's account is verified, so a wrong, refused or
+      // cancelled sign-in leaves every saved login, and every command using one, as it was.
+      const signedIn: CurrentCredential = {
         accessToken: result.tokens.accessToken,
         refreshToken: result.tokens.refreshToken,
         expiresAt,
-      });
-      // The workspace lives in the access token, so signing in is only half of a usable login.
-      const profile = await this.dependencies.accountProfile(() =>
-        this.authenticatedToken(credentialStore, signal),
-      );
-      const selection = await this.chooseAndStoreWorkspace(
-        profile,
-        organizationId,
-        credentialStore,
-        signal,
-      );
+      };
+      const account = await this.dependencies.accountProfile(async () => signedIn.accessToken);
+      if (!isProfileUserId(account.userId)) throw this.unverifiedLogin();
+      if (expectedUserId !== undefined && account.userId !== expectedUserId)
+        throw new ProductCliFailure(
+          4,
+          "login_account_mismatch",
+          false,
+          `The browser signed in as user ${account.userId}, not ${expectedUserId}. Nothing was saved and every saved login is unchanged. Sign out of ohmyho.st in that browser or use the browser profile of ${expectedUserId}, then run '${this.dependencies.commandPrefix} login${organizationId === undefined ? "" : ` --organization ${organizationId}`} --user ${expectedUserId} --json' again.`,
+        );
+      const selection = chooseWorkspace(account.organizations, organizationId);
+      if (selection.outcome === "not_a_member") throw this.unknownWorkspace(selection);
+      // The workspace lives in the access token, so a chosen one is requested before storing.
+      const credential =
+        selection.outcome === "selected"
+          ? await runBounded(
+              (bounded) =>
+                this.dependencies.tokenRefresher.refresh(
+                  signedIn.refreshToken,
+                  bounded,
+                  selection.organization.workos_id,
+                ),
+              signal,
+              this.dependencies.lifecycleTimeoutMs,
+            )
+          : signedIn;
+      const identity = await readIdentity(async () => credential.accessToken);
+      const scopedId =
+        selection.outcome === "selected"
+          ? selection.organization.id
+          : (parseCurrentIdentity(identity).organization_ids[0] ?? null);
+      const organization =
+        scopedId === null
+          ? null
+          : account.organizations.find((candidate) => candidate.id === scopedId);
+      if (organization === undefined) throw this.unverifiedLogin();
+      try {
+        assertVerifiedLogin(identity, account.userId, scopedId);
+      } catch (error) {
+        if (error instanceof AccountVerificationError) throw this.unverifiedLogin();
+        throw error;
+      }
+      const login = {
+        userId: account.userId,
+        organizationId: scopedId,
+        organizationName: organization?.name ?? null,
+      };
+      const profile: LocalProfile = {
+        name: this.dependencies.profileName ?? defaultProfileName(await profiles.list(), login),
+        ...login,
+      };
+      try {
+        await profiles.save(
+          profile,
+          organization === null
+            ? credential
+            : {
+                ...credential,
+                workosOrganizationId: organization.workos_id,
+                organizationId: organization.id,
+              },
+        );
+      } catch (error) {
+        if (!(error instanceof ProfileNameConflictError)) throw error;
+        throw new ProductCliFailure(
+          2,
+          "profile_name_conflict",
+          false,
+          `The name ${profile.name} already belongs to the saved login of user ${error.profile.userId} in organization ${String(error.profile.organizationId ?? "none")}. Nothing was saved. Choose another --profile-name, or remove that login with '${this.dependencies.commandPrefix} logout --profile-name ${profile.name} --json' first.`,
+        );
+      }
+      this.#profile = profile;
       const readGithubConnection = this.dependencies.githubConnectionStatus;
-      if (selection.outcome === "selected")
+      if (organization !== null)
         return success("login", {
           status: "authenticated",
-          organization: publicWorkspace(selection.organization),
+          organization: publicWorkspace(organization),
+          profile: publicProfile(profile),
           ...(readGithubConnection === undefined
             ? {}
             : await this.githubNextAction(
                 {
                   getGithubConnection: (selectedOrganizationId) =>
                     readGithubConnection(
-                      () => this.authenticatedToken(credentialStore, signal),
+                      async () => credential.accessToken,
                       selectedOrganizationId,
                     ),
                 },
-                selection.organization.id,
+                organization.id,
               )),
         });
-      if (selection.outcome === "not_a_member") throw this.unknownWorkspace(selection);
       return success("login", {
         status: "authenticated",
         organization: null,
+        profile: publicProfile(profile),
         organizations:
           selection.outcome === "choice_required"
             ? selection.organizations.map(publicWorkspace)
             : [],
-        next_action:
-          selection.outcome === "choice_required"
-            ? `Ask the customer which workspace to use, then run '${this.dependencies.commandPrefix} organization use --organization ULID --json'.`
-            : `Run '${this.dependencies.commandPrefix} organization create --name NAME --idempotency-key KEY --json' to create the first workspace.`,
+        next_action: this.workspaceAction(selection),
       });
     }
   }
 
-  private workspaceSession(credentialStore: "native"): WorkspaceSession {
-    return {
-      store: this.dependencies.credentialStore(credentialStore),
-      refresher: this.dependencies.tokenRefresher,
-    };
+  /** The provider answered with another account than the one this login requested. */
+  private unverifiedLogin(): ProductCliFailure {
+    return new ProductCliFailure(
+      4,
+      "login_verification_failed",
+      true,
+      `The signed-in account could not be verified; nothing was saved. Run '${this.dependencies.commandPrefix} login --json' again.`,
+    );
   }
 
-  /** Decide the workspace and, when the answer cannot be wrong, put it into the credential. */
-  private async chooseAndStoreWorkspace(
-    organizations: readonly PublicWorkspace[],
-    requested: string | undefined,
-    credentialStore: "native",
+  /**
+   * Bind the login of this run, which has no organization yet, to one of its user's organizations.
+   * A login that already has one keeps it; another organization is its own login.
+   */
+  private async bindOrganization(
+    organization: PublicWorkspace,
     signal: AbortSignal,
-  ): Promise<WorkspaceSelection> {
-    const selection = chooseWorkspace(organizations, requested);
-    if (selection.outcome === "selected")
-      await runBounded(
+  ): Promise<LocalProfile> {
+    const profiles = this.dependencies.profiles;
+    const profile = this.#profile;
+    if (profiles === undefined || profile === undefined)
+      throw new InteractiveSessionRequiredError();
+    let bound: LocalProfile;
+    try {
+      bound = await runBounded(
         (bounded) =>
-          selectWorkspace(this.workspaceSession(credentialStore), selection.organization, bounded),
+          selectWorkspace(
+            {
+              store: profiles.credential(profile),
+              refresher: this.dependencies.tokenRefresher,
+              profiles,
+              profile,
+            },
+            organization,
+            bounded,
+            (accessToken) =>
+              this.dependencies.productApi(async () => accessToken).getCurrentIdentity(),
+          ),
         signal,
         this.dependencies.lifecycleTimeoutMs,
       );
-    return selection;
+    } catch (error) {
+      if (error instanceof AccountVerificationError) throw this.unverifiedLogin();
+      if (!(error instanceof ProfileOrganizationFixedError)) throw error;
+      throw new ProductCliFailure(
+        2,
+        "profile_organization_fixed",
+        false,
+        `Profile ${profile.name} stays signed in to organization ${String(profile.organizationId)}. Run '${this.dependencies.commandPrefix} login --organization ${organization.id} --user ${profile.userId} --json' to add a separate login for ${organization.id} as the same user; a saved login never switches organizations.`,
+      );
+    }
+    this.#profile = bound;
+    return bound;
   }
 
   private unknownWorkspace(selection: WorkspaceSelection): ProductCliFailure {
@@ -1134,10 +1314,11 @@ export class ProductCli {
     revoke: boolean,
     signal: AbortSignal,
   ): Promise<CliResult> {
-    const store = this.dependencies.credentialStore(credentialStore);
+    const store = this.store(credentialStore);
+    const removed = this.#profile === undefined ? {} : { profile: publicProfile(this.#profile) };
     if (!revoke) {
-      await store.clear();
-      return success("logout", { status: "logged_out" });
+      await this.forgetLogin(store);
+      return success("logout", { status: "logged_out", ...removed });
     }
     const credential = await store.read();
     let revocationError: unknown;
@@ -1152,7 +1333,7 @@ export class ProductCli {
     } catch (error) {
       revocationError = error;
     } finally {
-      await store.clear();
+      await this.forgetLogin(store);
     }
     if (revocationError !== undefined) {
       if (isCancellation(revocationError) && signal.aborted) throw revocationError;
@@ -1182,7 +1363,34 @@ export class ProductCli {
       }
       throw revocationError;
     }
-    return success("logout", { status: "logged_out" });
+    return success("logout", { status: "logged_out", ...removed });
+  }
+
+  /** The credential store of this run's saved login; it follows a binding made during the run. */
+  private store(kind: "native"): CredentialStore {
+    const profiles = this.dependencies.profiles;
+    if (profiles !== undefined && this.#profile !== undefined)
+      return profiles.credential(this.#profile);
+    if (this.dependencies.credentialStore === undefined)
+      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
+    return this.dependencies.credentialStore(kind);
+  }
+
+  /** Removes only this run's saved login; every other saved login stays untouched. */
+  private async forgetLogin(store: CredentialStore): Promise<void> {
+    const profiles = this.dependencies.profiles;
+    if (profiles !== undefined && this.#profile !== undefined) await profiles.remove(this.#profile);
+    else await store.clear();
+  }
+
+  /** How to sign this run's login in again, naming its organization and alias when known. */
+  private loginAction(): string {
+    const profile = this.#profile;
+    return `Run '${this.dependencies.commandPrefix} login${
+      profile?.organizationId === undefined || profile.organizationId === null
+        ? ""
+        : ` --organization ${profile.organizationId}`
+    }${profile === undefined ? "" : ` --profile-name ${profile.name}`} --json'.`;
   }
 
   private async getOperation(
@@ -1271,7 +1479,7 @@ export class ProductCli {
   ): Promise<CliResult> {
     const api = await this.authenticatedApi(command.credentialStore, signal);
     const project = parseProjectStatus(await api.getProjectStatus(command.projectId));
-    return success("project status", { status: "succeeded", project });
+    return success("project status", { status: "succeeded", project, context: this.context() });
   }
 
   private async createDevAccessTicket(
@@ -1476,14 +1684,21 @@ export class ProductCli {
         `${command.repositoryOwner}/${command.repositoryName}`.toLowerCase()
     )
       throw new ResponseContractError();
+    // The link names the organization the server authorized, so this checkout can be linked once
+    // per organization and another account's link is never used by mistake.
+    const [organizationId, ...others] = parseCurrentIdentity(
+      await api.getCurrentIdentity(),
+    ).organization_ids;
+    if (organizationId === undefined || others.length > 0) throw new ResponseContractError();
     await this.dependencies.projectLinkStore.save({
-      version: 1,
+      version: 2,
       api_origin: this.dependencies.productApiOrigin,
+      organization_id: organizationId,
       project_id: command.projectId,
       installation_id: source.installation_id,
       repository_full_name: source.repository_full_name,
     });
-    return success("link", { status: "completed", operation });
+    return success("link", { status: "completed", operation, organization_id: organizationId });
   }
 
   private async configureAutoDeploy(
@@ -1925,18 +2140,19 @@ export class ProductCli {
     signal: AbortSignal,
   ): Promise<string> {
     if (this.dependencies.apiToken !== undefined) return this.dependencies.apiToken;
-    const store = this.dependencies.credentialStore(credentialStore);
+    const store = this.store(credentialStore);
     const stored = await store.read();
     if (stored === undefined) {
-      throw new ProductCliFailure(5, "authentication_required", false, "Run 'ohmyhost login'.");
+      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
     }
     let refresh: { readonly credential: CurrentCredential; readonly refreshed: boolean };
     try {
       refresh = await this.refreshIfExpired(stored, signal);
     } catch (error) {
       if (!(error instanceof TokenRefreshRejectedError)) throw error;
-      await store.clear();
-      throw new ProductCliFailure(5, "authentication_required", false, "Run 'ohmyhost login'.");
+      // The provider ended this login; only this saved login is removed.
+      await this.forgetLogin(store);
+      throw new ProductCliFailure(5, "authentication_required", false, this.loginAction());
     }
     if (refresh.refreshed) await store.replace(refresh.credential);
     return refresh.credential.accessToken;
@@ -2049,7 +2265,32 @@ const redactVerificationUri = (value: string): string => {
   return url.toString();
 };
 
-const classifyFailure = (command: CommandLabel, error: unknown, signal: AbortSignal): CliResult => {
+/**
+ * Answers that mean "this account cannot see or use that": they name the account that ran, so a
+ * wrong saved login is told apart from a missing organization or GitHub authorization.
+ */
+export const ACCOUNT_SENSITIVE_PROBLEMS: ReadonlySet<string> = new Set([
+  "resource_not_found",
+  "forbidden",
+  "organization_required",
+  "github_connection_required",
+  "github_connection_revoked",
+  "repository_not_installed",
+]);
+
+/** The stable CLI answer for a failure outside a command run, such as choosing the account. */
+export const classifyCliFailure = (
+  command: RecognizedCommandLabel,
+  error: unknown,
+  signal: AbortSignal,
+): CliResult => classifyFailure(command, error, signal);
+
+const classifyFailure = (
+  command: CommandLabel,
+  error: unknown,
+  signal: AbortSignal,
+  actingAs?: Readonly<Record<string, unknown>>,
+): CliResult => {
   if (signal.aborted || isCancellation(error)) {
     return failure(command, 130, "command_cancelled", true, "Run the command again.");
   }
@@ -2124,6 +2365,7 @@ const classifyFailure = (command: CommandLabel, error: unknown, signal: AbortSig
         problem.retryAfterSeconds,
         problem.requestId,
         problem.docsUrl,
+        ACCOUNT_SENSITIVE_PROBLEMS.has(problem.code) ? actingAs : undefined,
       );
     } catch {
       return failure(
@@ -2175,6 +2417,7 @@ const failure = (
   retryAfterSeconds?: number,
   requestId?: string,
   docsUrl?: string,
+  actingAs?: Readonly<Record<string, unknown>>,
 ): CliResult => {
   const document: CliErrorDocument = {
     version: 1,
@@ -2189,6 +2432,7 @@ const failure = (
       ...(requestId === undefined ? {} : { request_id: requestId }),
       ...(docsUrl === undefined ? {} : { docs_url: docsUrl }),
       ...(operation?.error === undefined ? {} : { message: operation.error.message }),
+      ...(actingAs === undefined ? {} : { acting_as: actingAs }),
     },
   };
   return { exitCode, stdout: `${JSON.stringify(document)}\n`, stderr: "" };
@@ -2258,6 +2502,7 @@ const parsedCommandName = (command: ProductCliCommand): CommandLabel => {
   if (command.kind === "secret-set") return "secret set";
   if (command.kind === "secret-delete") return "secret delete";
   if (command.kind === "managed-mail") return command.label;
+  if (command.kind === "profile-list") return "profile list";
   return command.kind;
 };