@amerged/ohmyhost-mcp 0.1.19 → 0.1.21

package/src/apps/mcp/local-server.ts

@@ -9,9 +9,16 @@ import {
 } from "@modelcontextprotocol/server";
 import { z } from "zod";
 import {
+  ACCOUNT_SENSITIVE_PROBLEMS,
+  CredentialStoreUnavailableError,
+  isProfileUserId,
+  parseCurrentIdentity,
+  profileLimitAction,
+  ProfileSelectionError,
   resolveProductCliEnvironment,
   parseSafeProblem,
   type ProductCliEnvironment,
+  type ProfileRequestInput,
 } from "@ohmyhost/product-cli";
 import { createOhmyhostMcpServer } from "./index.js";
 
@@ -63,6 +70,12 @@ export interface LocalMcpProductClient {
     projectId: string;
     idempotencyKey: string;
   }): Promise<import("@ohmyhost/sdk-ts").DevAccessState>;
+  getPoweredByFlag(projectId: string): Promise<import("@ohmyhost/sdk-ts").PoweredByFlag>;
+  setPoweredByFlag(input: {
+    projectId: string;
+    enabled: boolean;
+    idempotencyKey: string;
+  }): Promise<import("@ohmyhost/sdk-ts").PoweredByFlag>;
   revokeDevShareLink(input: {
     projectId: string;
     idempotencyKey: string;
@@ -149,6 +162,9 @@ export interface LocalMcpProductClient {
   getOrganizationAccount(
     organizationId: string,
   ): Promise<import("@ohmyhost/sdk-ts").OrganizationAccount>;
+  getOrganizationReferral(
+    organizationId: string,
+  ): Promise<import("@ohmyhost/sdk-ts").OrganizationReferral>;
   getOrganizationCredits(
     organizationId: string,
   ): Promise<import("@ohmyhost/sdk-ts").OrganizationCredits>;
@@ -174,7 +190,9 @@ export interface LocalMcpProductClient {
     organizationId: string,
     signal: AbortSignal,
   ): Promise<WorkspaceSelectionReport>;
-  getCurrentIdentity(signal: AbortSignal): Promise<CurrentIdentity>;
+  getCurrentIdentity(signal: AbortSignal): Promise<IdentityReport>;
+  /** The account this client acts as, for errors whose meaning depends on it. */
+  actingAs?(): IdentityReport["context"];
   listProjects(input: { readonly cursor?: string; readonly limit?: number }): Promise<ProjectPage>;
   submitFeedback(input: {
     report: import("@ohmyhost/sdk-ts").FeedbackSubmission;
@@ -261,21 +279,53 @@ export interface PublicWorkspaceSummary {
   readonly name: string;
 }
 
-/** The workspaces of the signed-in user and the one this machine is currently scoped to. */
+/** One saved login as `profile_list` shows it; it never carries a credential. */
+export interface PublicProfileSummary {
+  readonly name: string;
+  readonly user_id: string;
+  readonly organization_id: string | null;
+  readonly organization_name: string | null;
+}
+
+/** The identity a call acted as, and which saved login or OHMYHOST_TOKEN supplied it. */
+export type IdentityReport = CurrentIdentity & {
+  readonly context: {
+    readonly credential: "profile" | "environment_token";
+    readonly profile: PublicProfileSummary | null;
+  };
+};
+
+/** The workspaces of the signed-in user and the one the chosen login is scoped to. */
 export interface WorkspaceReport {
   readonly organizations: readonly PublicWorkspaceSummary[];
   readonly selected: string | null;
+  readonly profile: PublicProfileSummary;
 }
 
 /** One workspace that was just created or selected, with the resulting scope. */
 export interface WorkspaceSelectionReport {
   readonly organization: PublicWorkspaceSummary;
   readonly selected: string;
+  readonly profile: PublicProfileSummary;
+  readonly next_action?: string;
+}
+
+/** The saved logins of this computer and how this MCP process chooses among them. */
+export interface ProfileListReport {
+  readonly profiles: readonly PublicProfileSummary[];
+  readonly bound: string | null;
+  readonly environment_token: boolean;
 }
 
 export interface LocalOhmyhostMcpDependencies {
   readonly environment?: ProductCliEnvironment;
-  authenticatedClient(signal: AbortSignal): Promise<LocalMcpProductClient>;
+  /** One client for one call; the request names the login and organization that call is about. */
+  authenticatedClient(
+    signal: AbortSignal,
+    request?: ProfileRequestInput,
+  ): Promise<LocalMcpProductClient>;
+  /** Saved logins, read without choosing one; absent where no local store exists. */
+  listProfiles?(signal: AbortSignal): Promise<ProfileListReport>;
 }
 
 interface ProjectCreateInput {
@@ -351,6 +401,14 @@ interface ProjectDeleteInput {
 }
 
 const identifier = z.string().min(1).max(256);
+/** Every product tool accepts the saved login to act as; it is an alias, never a credential. */
+const profileName = z
+  .string()
+  .regex(/^[a-z0-9][a-z0-9_-]{0,62}$/u)
+  .optional()
+  .describe(
+    "Saved login to act as (profile_list shows them). Needed only when several logins could run this call; OHMYHOST_PROFILE of this server must match it.",
+  );
 const idempotencyKey = z.string().min(1).max(256);
 const commitSha = z.string().regex(/^[a-f0-9]{40}$/u);
 const domainName = z
@@ -657,6 +715,14 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     z.object({ organization_id: identifier }),
     (client, input) => client.getOrganizationAccount(input.organization_id),
   );
+  registerProductTool(
+    server,
+    dependencies,
+    "referral_link_get",
+    "Read the workspace's referral link to share. A new user whose first workspace comes from it starts with a free Paid month and 1,000 credits; that workspace's first payment gives this workspace the same. Any member may read it.",
+    z.object({ organization_id: identifier }),
+    (client, input) => client.getOrganizationReferral(input.organization_id),
+  );
   registerProductTool(
     server,
     dependencies,
@@ -700,7 +766,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "organization_create",
-    `Create an organization owned by the signed-in user and select it for this machine. Signup is open. signup_source is optional attribution from a link's r parameter, never a secret; omit it when the customer arrived directly. The server decides any once-per-user bonus; do not promise credits for arbitrary sources. Repeat the same name/source/key after uncertainty. No second login is needed: selected names the workspace every later call uses, so continue with identity_get, github_status and github_connect if needed, then projects. An OHMYHOST_TOKEN process cannot do this; it needs ${commandPrefix} login --json.`,
+    `Create an organization owned by the signed-in user. Signup is open. signup_source is optional attribution from a link's r parameter, never a secret; omit it when the customer arrived directly. The server decides any once-per-user bonus; do not promise credits for arbitrary sources. Repeat the same name/source/key after uncertainty. A login that has no organization yet is bound to the new one, so selected names the workspace later calls use; a login already in another organization keeps it and next_action names the login for the new one. Continue with identity_get, github_status and github_connect if needed, then projects. An OHMYHOST_TOKEN process cannot do this; it needs ${commandPrefix} login --json.`,
     z.object({
       name: z.string().min(1).max(128),
       signup_source: z
@@ -724,7 +790,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "organization_list",
-    "List the workspaces the signed-in user belongs to and which one this machine currently uses. selected is null while none is chosen; every project and billing call then answers resource_not_found. Ask the customer which workspace to use instead of guessing, then call organization_use.",
+    "List the workspaces the chosen login's user belongs to and which one that login is scoped to. selected is null while none is chosen; every project and billing call then answers resource_not_found. Ask the customer which workspace to use instead of guessing, then call organization_use.",
     z.object({}),
     (client) => client.listOrganizations(),
   );
@@ -732,10 +798,32 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "organization_use",
-    `Select one workspace for this machine's stored login, so later calls act inside it. Read organization_list first, then github_status for the selected workspace and github_connect if needed; the identifier is the platform ULID, not the provider identifier. An OHMYHOST_TOKEN process cannot select anything and needs ${commandPrefix} login --json instead.`,
+    `Bind a saved login that has no organization yet to one workspace, so later calls act inside it. A login already in another organization keeps it (profile_organization_fixed): add a login for the other workspace as the same user with ${commandPrefix} login --organization ULID --user USER_ID --json. Read organization_list first, then github_status for the selected workspace and github_connect if needed; the identifier is the platform ULID, not the provider identifier. An OHMYHOST_TOKEN process cannot select anything and needs ${commandPrefix} login --json instead.`,
     z.object({ organization_id: identifier }),
     (client, input, signal) => client.selectOrganization(input.organization_id, signal),
     mutationAnnotations(),
+    (input) => ({
+      ...(input.profile_name === undefined ? {} : { name: input.profile_name }),
+      organizationId: input.organization_id,
+      bindOrganization: true,
+    }),
+  );
+
+  server.registerTool(
+    "profile_list",
+    {
+      description: `List the saved ohmyho.st logins on this computer: each has a name, a user and an organization, never a token. When the customer named a user or organization, pass the matching name as profile_name on later calls; with several logins and no profile_name a call answers profile_selection_required. With no match, the customer adds one with ${commandPrefix} login --organization ULID --user USER_ID --json, which saves nothing if the browser signs in as another account. bound is this server's OHMYHOST_PROFILE; environment_token means OHMYHOST_TOKEN replaces saved logins here.`,
+      inputSchema: z.object({}),
+      annotations: readAnnotations(),
+    },
+    (async (_input: unknown, context: { mcpReq: { signal: AbortSignal } }) => {
+      try {
+        if (dependencies.listProfiles === undefined) throw new CredentialStoreUnavailableError();
+        return toolResult(await dependencies.listProfiles(context.mcpReq.signal));
+      } catch (error) {
+        return toolError(error, dependencies);
+      }
+    }) as ToolCallback<z.ZodObject<Record<string, never>>>,
   );
 
   registerProductTool(
@@ -940,7 +1028,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "identity_get",
-    "Get the current ohmyho.st customer/agent identity. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.",
+    "Get the ohmyho.st customer/agent identity this call acts as: user, organization and, in context, the saved login or OHMYHOST_TOKEN that supplied it. Compare it with the user and organization the customer named before any change. This does not authenticate the hosted application's end users or provision a customer AuthKit tenant; application authentication is the customer's chosen integration.",
     z.object({}),
     (client, _input, signal) => client.getCurrentIdentity(signal),
   );
@@ -1092,6 +1180,28 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
       }),
     destructiveAnnotations(),
   );
+  registerProductTool(
+    server,
+    dependencies,
+    "powered_by_flag_get",
+    'Read whether the production site shows the opt-in "Powered by ohmyho.st" flag.',
+    z.object({ project_id: identifier }),
+    (client, input) => client.getPoweredByFlag(input.project_id),
+  );
+  registerProductTool(
+    server,
+    dependencies,
+    "powered_by_flag_set",
+    'Owner only, ask the human first: show or hide a small "Powered by ohmyho.st" flag on the right edge of the production site. While it is on, a Free workspace may connect its own domain to this project free of the domain fee, and each Paid period adds 250 credits. Hiding it is refused while a Free workspace\'s domain depends on it. Replay the same key and value after uncertainty to get the first answer without switching again; every new switch needs a new key.',
+    z.object({ project_id: identifier, enabled: z.boolean(), idempotency_key: idempotencyKey }),
+    (client, input) =>
+      client.setPoweredByFlag({
+        projectId: input.project_id,
+        enabled: input.enabled,
+        idempotencyKey: input.idempotency_key,
+      }),
+    mutationAnnotations(),
+  );
   registerProductTool(
     server,
     dependencies,
@@ -1144,7 +1254,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "github_status",
-    "Read this workspace's GitHub connection. If not_connected or revoked, an Owner or Admin must run github_connect. A connected installation covers only repositories selected in its settings.",
+    "Read this workspace's GitHub connection. If not_connected or revoked, an Owner or Admin must run github_connect. A connected installation covers only repositories selected in its settings. Each workspace has its own connection, so the same repository can be connected and linked in the workspaces of separate accounts.",
     z.object({ organization_id: identifier }),
     (client, input) => client.getGithubConnection(input.organization_id),
   );
@@ -1152,7 +1262,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "source_link",
-    "Link a repository covered by the workspace GitHub connection. Call github_status first and github_connect once if needed. This returns an operation without another browser consent and never starts a build. Wait for that operation before planning a deploy. If repository access is missing, update the installation using the returned settings action, then retry the same project and key. Never ask for an installation ID or provider token.",
+    "Link a repository covered by the workspace GitHub connection. Call github_status first and github_connect once if needed. This returns an operation without another browser consent and never starts a build. Wait for that operation before planning a deploy. If repository access is missing, update the installation using the returned settings action, then retry the same project and key. Never ask for an installation ID or provider token. Errors name the account the call ran as (acting_as): resource_not_found means that account cannot see the project (use the login of the account that owns it), github_connection_required means that workspace has no GitHub connection yet, and repository_not_installed means its GitHub App installation does not cover the repository.",
     z.object({
       project_id: identifier,
       repository_owner: identifier,
@@ -1237,7 +1347,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "deployment_logs",
-    "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. Read it after build_failed before changing source; scheduled runs are in function_runs_list, not here.",
+    "List the newest normalized diagnostics of one deployment (build, control, runtime and function failures with catalog codes). A failed operation_get names the deployment as deployment_id. A BUILD_FAILED item carries excerpt: the sanitized tail of the customer's own install/build output, newest lines last, with excerpt_truncated when earlier output was omitted. A HEALTH_CHECK_FAILED item carries the probed route and status_code and, only for a project owner, excerpt: the head (at most 4096 characters, control characters removed, never a header) of what the app answered. The probe is a cookieless GET that follows no redirect, 5 s per try and up to four tries, so a 3xx or an empty 503 is unhealthy too. Read the item before changing source; scheduled runs are in function_runs_list, not here.",
     z.object({
       project_id: identifier,
       deployment_id: identifier,
@@ -1254,7 +1364,7 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     server,
     dependencies,
     "operation_get",
-    "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it.",
+    "Get durable operation status and current deployment progress/reconciliation guidance. Follow progress.phase and progress.suggested_action. waiting_for_mail requires mail_domain_status now for the current verification issue and DNS records; publishing means the build completed but runtime preparation/publication is unfinished. Poll this operation after progress.next_poll_after_seconds. A queued/running operation with reconciliation.state=required needs one confirmed operation_reconcile using the same operation; pending means poll this operation after 60 seconds. Never infer deployment success from a completed reconciliation attempt or start another build to recover it. A deploy, promotion or rollback names its deployment_id in every state; when state is failed, read that deployment with deployment_logs and follow error.suggested_action before changing source.",
     z.object({ operation_id: identifier }),
     (client, input) => client.getOperation(input.operation_id),
   );
@@ -1543,21 +1653,22 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
     destructiveAnnotations(),
   );
 
-  server.registerTool(
+  registerProductTool(
+    server,
+    dependencies,
     "secret_set_command",
-    {
-      description:
-        "Return the stdin-only CLI command for setting a secret; the value never enters MCP.",
-      inputSchema: z.object({
-        project_id: identifier,
-        environment_id: identifier,
-        name: secretName,
-        idempotency_key: idempotencyKey,
-      }),
-      annotations: readAnnotations(),
-    },
-    (input) =>
-      toolResult({
+    "Return the stdin-only CLI command for setting a secret; the value never enters MCP. The call runs as the chosen login and first reads the project, so an account that cannot see it answers resource_not_found. The command names that login with --profile-name plus its user and organization (--profile-user, --profile-organization), so a login of the same name that belongs to anyone else is refused, for example on another computer; a server with OHMYHOST_TOKEN instead names its key's user and organization with --token-user and --token-organization, and the CLI then runs only with an OHMYHOST_TOKEN of that account. Either way the later write runs as exactly this account or not at all (acting_as shows which).",
+    z.object({
+      project_id: identifier,
+      environment_id: identifier,
+      name: secretName,
+      idempotency_key: idempotencyKey,
+    }),
+    async (client, input, signal) => {
+      // The project must be visible to the account this call runs as, and the command names it.
+      await client.getProject(input.project_id);
+      const account = await handoverAccount(client, signal);
+      return {
         command: [
           `${commandPrefix} secret set`,
           shellQuote(input.name),
@@ -1567,13 +1678,15 @@ export function createLocalOhmyhostMcpServer(dependencies: LocalOhmyhostMcpDepen
           shellQuote(input.environment_id),
           "--idempotency-key",
           shellQuote(input.idempotency_key),
+          ...account.flags,
           "--stdin",
           "--wait",
           "--json",
         ].join(" "),
-        instruction:
-          "Pass the secret value on stdin in a local terminal. Never place it in MCP arguments, prompts, command-line arguments, source, or logs.",
-      }),
+        acting_as: client.actingAs?.() ?? null,
+        instruction: `Pass the secret value on stdin in a local terminal; ${account.runs}. Never place the value or a key in MCP arguments, prompts, command-line arguments, source, or logs.`,
+      };
+    },
   );
 
   registerProductTool(
@@ -1647,24 +1760,33 @@ function registerProductTool<Schema extends z.ZodObject<z.ZodRawShape>, Result>(
   dependencies: LocalOhmyhostMcpDependencies,
   name: string,
   description: string,
-  inputSchema: Schema,
+  schema: Schema,
   execute: (
     client: LocalMcpProductClient,
     input: z.output<Schema>,
     signal: AbortSignal,
   ) => Promise<Result>,
   annotations = readAnnotations(),
+  selection: (
+    input: z.output<Schema> & { readonly profile_name?: string | undefined },
+  ) => ProfileRequestInput = (input) => {
+    // A call about one organization runs as a login of that organization.
+    const organizationId = (input as Record<string, unknown>)["organization_id"];
+    return {
+      ...(input.profile_name === undefined ? {} : { name: input.profile_name }),
+      ...(typeof organizationId === "string" ? { organizationId } : {}),
+    };
+  },
 ) {
+  const inputSchema = schema.extend({ profile_name: profileName });
   const callback = (async (input: unknown, context: { mcpReq: { signal: AbortSignal } }) => {
-    const parsed = inputSchema.parse(input) as z.output<Schema>;
+    const parsed = inputSchema.parse(input) as z.output<Schema> & {
+      readonly profile_name?: string | undefined;
+    };
+    let client: LocalMcpProductClient | undefined;
     try {
-      const result = toolResult(
-        await execute(
-          await dependencies.authenticatedClient(context.mcpReq.signal),
-          parsed,
-          context.mcpReq.signal,
-        ),
-      );
+      client = await dependencies.authenticatedClient(context.mcpReq.signal, selection(parsed));
+      const result = toolResult(await execute(client, parsed, context.mcpReq.signal));
       const scope = parsed as Record<string, unknown>;
       if (
         typeof scope["project_id"] === "string" &&
@@ -1680,69 +1802,180 @@ function registerProductTool<Schema extends z.ZodObject<z.ZodRawShape>, Result>(
         });
       return result;
     } catch (error) {
-      let safe: {
-        code: string;
-        retryable: boolean;
-        suggestedAction: string;
-        retryAfterSeconds?: number;
-        requestId?: string;
-      };
-      try {
-        safe =
-          error instanceof Error && error.name === "InteractiveSessionRequiredError"
+      return toolError(error, dependencies, client?.actingAs?.());
+    }
+  }) as ToolCallback<typeof inputSchema>;
+  server.registerTool(name, { description, inputSchema, annotations }, callback);
+}
+
+/**
+ * The account a command handed to a terminal must run as: a saved login by its name, user and
+ * organization, which the CLI compares with the login of that name wherever it runs, or this
+ * server's OHMYHOST_TOKEN by its key's verified user and organization, which the CLI then demands
+ * of the terminal's own OHMYHOST_TOKEN. No key or token value ever enters the command.
+ */
+async function handoverAccount(
+  client: LocalMcpProductClient,
+  signal: AbortSignal,
+): Promise<{ readonly flags: readonly string[]; readonly runs: string }> {
+  const profile = client.actingAs?.()?.profile ?? null;
+  if (profile !== null) {
+    if (profile.organization_id === null)
+      throw new ProfileSelectionError(
+        "profile_context_mismatch",
+        2,
+        `The saved login ${profile.name} has no organization, so no command can be tied to its account. Nothing was sent.`,
+      );
+    return {
+      flags: [
+        "--profile-name",
+        shellQuote(profile.name),
+        "--profile-user",
+        shellQuote(profile.user_id),
+        "--profile-organization",
+        shellQuote(profile.organization_id),
+      ],
+      runs: `the command runs only as the saved login it names and only while that login belongs to user ${profile.user_id} in organization ${profile.organization_id}, so a login of the same name that belongs to anyone else, for example on another computer, is refused before anything is read or sent`,
+    };
+  }
+  const report = await client.getCurrentIdentity(signal);
+  const identity = parseCurrentIdentity({
+    actor_id: report.actor_id,
+    organization_ids: report.organization_ids,
+  });
+  const userId = identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : "";
+  const [organizationId, ...others] = identity.organization_ids;
+  if (!isProfileUserId(userId) || organizationId === undefined || others.length > 0)
+    throw new ProfileSelectionError(
+      "environment_token_context_mismatch",
+      2,
+      "This server's OHMYHOST_TOKEN does not belong to one user in one organization, so no command can be tied to its account. Nothing was sent.",
+    );
+  return {
+    flags: ["--token-user", shellQuote(userId), "--token-organization", shellQuote(organizationId)],
+    runs: `run it only where OHMYHOST_TOKEN holds a key of user ${userId} in organization ${organizationId}, loaded from its private env file; it refuses a saved login and any other account's key before anything is sent`,
+  };
+}
+
+/** How to add a login for another workspace as the same user; another browser account saves nothing. */
+function fixedOrganizationAction(
+  error: {
+    readonly profile: { readonly userId: string };
+    readonly organization: { readonly id: string };
+  },
+  commandPrefix: string,
+): string {
+  return `This saved login stays in its organization. Add a login for the other workspace with ${commandPrefix} login --organization ${error.organization.id} --user ${error.profile.userId} --json, then pass its profile_name.`;
+}
+
+/** The stable, credential-free error of one tool call. */
+function toolError(
+  error: unknown,
+  dependencies: LocalOhmyhostMcpDependencies,
+  actingAs?: IdentityReport["context"],
+): CallToolResult {
+  let safe: {
+    code: string;
+    retryable: boolean;
+    suggestedAction: string;
+    retryAfterSeconds?: number;
+    requestId?: string;
+  };
+  try {
+    safe =
+      error instanceof Error && error.name === "ProfileSelectionError"
+        ? {
+            code: (error as Error & { code: string }).code,
+            retryable: false,
+            suggestedAction: (error as Error & { suggestedAction: string }).suggestedAction,
+          }
+        : error instanceof Error && error.name === "ProfileLimitError"
+          ? {
+              code: "profile_limit_reached",
+              retryable: false,
+              suggestedAction: profileLimitAction(
+                resolveProductCliEnvironment(dependencies.environment).commandPrefix,
+              ),
+            }
+          : error instanceof Error && error.name === "ProfileOrganizationFixedError"
             ? {
-                code: "interactive_login_required",
+                code: "profile_organization_fixed",
                 retryable: false,
-                suggestedAction: `A user API token cannot create, list or select a workspace. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json in a process without OHMYHOST_TOKEN, then retry.`,
+                suggestedAction: fixedOrganizationAction(
+                  error as Error & {
+                    readonly profile: { readonly userId: string };
+                    readonly organization: { readonly id: string };
+                  },
+                  resolveProductCliEnvironment(dependencies.environment).commandPrefix,
+                ),
               }
-            : error instanceof Error && error.message.startsWith("ORGANIZATION_NOT_FOUND:")
+            : error instanceof Error && error.name === "AccountVerificationError"
               ? {
-                  code: "organization_not_found",
-                  retryable: false,
-                  suggestedAction:
-                    "Call organization_list and choose one of the returned workspace identifiers. Do not create another workspace to recover.",
+                  code: "login_verification_failed",
+                  retryable: true,
+                  suggestedAction: `The signed-in account could not be verified; nothing was saved. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json again.`,
                 }
-              : error instanceof OperationEventsUnavailableError
+              : error instanceof Error && error.name === "CredentialStoreUnavailableError"
                 ? {
-                    code: "operation_events_unavailable",
+                    code: "credential_store_unavailable",
                     retryable: true,
                     suggestedAction:
-                      "Read operation_get for current status, then retry operation_logs for this same operation. Do not submit another deployment to recover logs.",
+                      "Unlock or repair this computer's credential store and retry. Saved logins were not changed.",
                   }
-                : error instanceof Error &&
-                    error.message.startsWith("EXPORT_PASSWORD_FILE_INVALID:")
+                : error instanceof Error && error.name === "InteractiveSessionRequiredError"
                   ? {
-                      code: "export_password_file_invalid",
+                      code: "interactive_login_required",
                       retryable: false,
-                      suggestedAction:
-                        "Choose an existing private UTF-8 password file of 1–1024 bytes. The user retains the file and password. Do not paste the password into MCP arguments.",
+                      suggestedAction: `A user API token cannot create, list or select a workspace. Run ${resolveProductCliEnvironment(dependencies.environment).commandPrefix} login --json in a process without OHMYHOST_TOKEN, then retry.`,
                     }
-                  : parseSafeProblem(error);
-      } catch {
-        safe = {
-          code: "client_request_failed",
-          retryable: false,
-          suggestedAction:
-            "Check the connection and run 'ohmyhost login' if authentication expired. Inspect the existing operation before resubmitting any mutation.",
-        };
-      }
-      return {
-        ...toolResult({
-          error: {
-            code: safe.code,
-            retryable: safe.retryable,
-            suggested_action: safe.suggestedAction,
-            ...(safe.requestId === undefined ? {} : { request_id: safe.requestId }),
-            ...(safe.retryAfterSeconds === undefined
-              ? {}
-              : { retry_after_seconds: safe.retryAfterSeconds }),
-          },
-        }),
-        isError: true,
-      };
-    }
-  }) as ToolCallback<Schema>;
-  server.registerTool(name, { description, inputSchema, annotations }, callback);
+                  : error instanceof Error && error.message.startsWith("ORGANIZATION_NOT_FOUND:")
+                    ? {
+                        code: "organization_not_found",
+                        retryable: false,
+                        suggestedAction:
+                          "Call organization_list and choose one of the returned workspace identifiers. Do not create another workspace to recover.",
+                      }
+                    : error instanceof OperationEventsUnavailableError
+                      ? {
+                          code: "operation_events_unavailable",
+                          retryable: true,
+                          suggestedAction:
+                            "Read operation_get for current status, then retry operation_logs for this same operation. Do not submit another deployment to recover logs.",
+                        }
+                      : error instanceof Error &&
+                          error.message.startsWith("EXPORT_PASSWORD_FILE_INVALID:")
+                        ? {
+                            code: "export_password_file_invalid",
+                            retryable: false,
+                            suggestedAction:
+                              "Choose an existing private UTF-8 password file of 1–1024 bytes. The user retains the file and password. Do not paste the password into MCP arguments.",
+                          }
+                        : parseSafeProblem(error);
+  } catch {
+    safe = {
+      code: "client_request_failed",
+      retryable: false,
+      suggestedAction:
+        "Check the connection and run 'ohmyhost login' if authentication expired. Inspect the existing operation before resubmitting any mutation.",
+    };
+  }
+  return {
+    ...toolResult({
+      error: {
+        code: safe.code,
+        retryable: safe.retryable,
+        suggested_action: safe.suggestedAction,
+        ...(safe.requestId === undefined ? {} : { request_id: safe.requestId }),
+        ...(safe.retryAfterSeconds === undefined
+          ? {}
+          : { retry_after_seconds: safe.retryAfterSeconds }),
+        ...(actingAs !== undefined && ACCOUNT_SENSITIVE_PROBLEMS.has(safe.code)
+          ? { acting_as: actingAs }
+          : {}),
+      },
+    }),
+    isError: true,
+  };
 }
 
 function toolResult<Result>(result: Result): CallToolResult {

package/src/apps/mcp/stdio-main.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
-import { resolveProductCliEnvironment } from "@ohmyhost/product-cli";
+import { listSavedProfiles, resolveProductCliEnvironment } from "@ohmyhost/product-cli";
 
 import { createAuthenticatedLocalMcpClient } from "./local-client.js";
 import { createLocalOhmyhostMcpServer } from "./local-server.js";
@@ -13,6 +13,9 @@ const environment = {
   ...(process.env["OHMYHOST_TOKEN"] === undefined
     ? {}
     : { OHMYHOST_TOKEN: process.env["OHMYHOST_TOKEN"] }),
+  ...(process.env["OHMYHOST_PROFILE"] === undefined
+    ? {}
+    : { OHMYHOST_PROFILE: process.env["OHMYHOST_PROFILE"] }),
 };
 resolveProductCliEnvironment(environment);
 
@@ -20,7 +23,13 @@ serveStdio(
   () =>
     createLocalOhmyhostMcpServer({
       environment,
-      authenticatedClient: (signal) => createAuthenticatedLocalMcpClient(signal, { environment }),
+      // Every tool call chooses its own saved login; nothing this process remembers can retarget it.
+      authenticatedClient: (signal, request) =>
+        createAuthenticatedLocalMcpClient(signal, {
+          environment,
+          ...(request === undefined ? {} : { request }),
+        }),
+      listProfiles: (signal) => listSavedProfiles(signal, { environment }),
     }),
   { onerror: (error) => process.stderr.write(`${error.message}\n`) },
 );