spinuptui 0.26.1 → 0.28.0

package/CHANGELOG.md

@@ -11,6 +11,27 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.28.0] - 2026-09-23
+
+### Added
+- **Multiple SpinupWP accounts.** Press `A` from anywhere to open **Accounts**: add another account (its token is checked with SpinupWP before it's saved), switch between accounts, rename them, or remove one. You work in one account at a time, never a merged fleet, so an action can't land on the wrong client's server, and the header always shows `Account: …`. Switching reloads the app on the new account, and it waits until running changes (PHP upgrades, DNS edits, clones, WordPress updates…) finish. Each account keeps its own token, DNS provider connections, local-copy links, sudo users and saved Keychain passwords, monitors, and cached probes. Machine-level settings (terminal app, local scan roots, the Uptime Kuma login) are shared by all of them. Your existing setup becomes the first account automatically; nothing moves on disk. Removing an account also deletes its Keychain passwords and caches, but never files in your local working copies. For commands, `SPINUPTUI_ACCOUNT=<id>` picks an account for one run, and `spinuptui where` lists the account ids.
+- **Vanity Site in Stacks.** Non-WP now has a **Vanity Site** row for each server's own-hostname site, the same rule the vanity features use, so these show up without an SSH probe instead of sitting under Unknown or unprobed. Their rows read `Vanity Site` in place of `Unknown`.
+
+### Notes
+- **Config migration.** The first time this version saves a setting, `config.json` is rewritten in the new accounts shape. A version before 0.28.0 can't read the token from it and would run first-time setup, so back up `~/.config/spinupwp-tui/config.json` if you might downgrade. Accounts are stored per machine; add them on each machine where you use SpinupTUI.
+
+## [0.27.0] - 2026-09-23
+
+### Added
+- **Update WordPress core from `u`.** `u` is now **Update**, a menu with two choices: PHP version, the flow you already know, and WordPress core. The WordPress option checks the site over SSH with wp-cli and lists the available versions, with minor (security) releases picked first. After you confirm, it runs `wp core update` and then the database upgrade. The update keeps running if you close the overlay, and a toast reports when it's done. Bedrock and Radicle sites are included; for those, the confirm screen names the version `composer.lock` pins, and warns that the next `composer install` will put that version back until you run `composer update`.
+- **Stacks groups WordPress sites by core version.** Under Standard WP, Bedrock and Radicle, one indented row per WordPress version, newest first, shows how many sites run it (for example `└ WP 7.0.2  51`). The newest version in the fleet is highlighted green. Select a row to list its sites, which makes it easy to find the ones still waiting for a security release. `D` on a version row re-probes just those sites. Sites with no known version are grouped under `no version`, and the left pane now scrolls when the list is taller than the terminal.
+- **Update WordPress on a whole version group.** In Stacks, `u` on a version row (`└ WP 7.0.2`) checks every site in that group live over SSH, then shows a plan you can edit. The default target is the newest release in each site's own line (the security hotfix), and `m` switches to the newest release overall. `space` leaves a site out, and Bedrock and Radicle sites are marked `⚙` because of the `composer.lock` caveat. After you confirm, a canary site updates alone first, and if it fails nothing else is touched. The rest follow up to 4 at a time, one per server, stopping after 3 failures; `x` stops starting new sites. It keeps running if you close the overlay, and a single toast reports the result.
+- **Update progress shows on the site's row.** While a WordPress core update runs, the Stacks row replaces the version with a spinner and the target version (`⠹ → WP 7.1.2`). Servers and Search show a compact `WP` marker. If the update fails, the row keeps a `⬆!` marker until you open the result, and the toast that reports the failure is red instead of green.
+
+### Fixed
+- **The WordPress version on a site's row now follows the Update check.** Stacks and Servers show the version from the last `d` probe, so it went stale as soon as core changed. Opening **Update → WordPress core** reads the live version over SSH, and that value, along with the result of any update, now replaces the stored one.
+- **SpinupWP API errors now say why.** A rejected write used to show only "SpinupWP API error (HTTP 400)." The message now includes the reason from the API's response, such as which field it rejected.
+
 ## [0.26.1] - 2026-09-18
 
 ### Fixed
@@ -1415,7 +1436,9 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.28.0...HEAD
+[0.28.0]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...v0.28.0
+[0.27.0]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...v0.27.0
 [0.26.1]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...v0.26.1
 [0.26.0]: https://github.com/mwender/spinupwp-tui/compare/v0.25.0...v0.26.0
 [0.25.0]: https://github.com/mwender/spinupwp-tui/compare/v0.24.4...v0.25.0

package/README.md

@@ -38,6 +38,7 @@
   probe for precise identification. → [docs/stack-detection.md](docs/stack-detection.md)
 - **Global search** — fuzzy search across every server and site by name, domain,
   or IP, with inline actions on the result.
+- **Multiple SpinupWP accounts** (`A`) — keep several accounts (say, your agency's and a client's) and switch between them in-app; the header always names the one you're on. → [docs/multiple-accounts.md](docs/multiple-accounts.md)
 - **Events feed** — recent provisioning/operation activity with per-event detail.
 - **Live server health** (`h`) — real-time CPU/load/memory/disk over SSH.
   → [docs/server-health.md](docs/server-health.md)
@@ -53,8 +54,8 @@
   pull a production DB into a linked local copy. → [docs/database-backup-sync.md](docs/database-backup-sync.md)
 - **Production media fallback** (`m`, Servers / Search tabs) — serve missing-locally images
   from production after a DB pull. → [docs/production-media-fallback.md](docs/production-media-fallback.md)
-- **Upgrade a site's PHP version** (`u`) — pick a version, apply it, watch the
-  event complete. → [docs/php-upgrade.md](docs/php-upgrade.md)
+- **Update a site** (`u`) — change its PHP version, or update WordPress core over
+  SSH (Standard WP, Bedrock and Radicle). → [docs/php-upgrade.md](docs/php-upgrade.md)
 - **Enable / disable HTTPS** (`H`) — toggle a site's certificate.
 - **Purge cache** (`P`) — clear page + object cache together.
 - **Server actions** (`a`) — reboot or restart a service, with the real reason a
@@ -262,13 +263,15 @@ The token is resolved in this order (first match wins):
 To reconfigure, delete the config file (the path is shown on the onboarding
 screen) and relaunch, or set the environment variable.
 
+More than one SpinupWP account? Add the others in-app with `A`. Each keeps its own token and account settings; see [docs/multiple-accounts.md](docs/multiple-accounts.md).
+
 ### Optional settings
 
 These can be set in `config.json` or via an environment variable:
 
 - **`accountSlug`** / `SPINUPWP_ACCOUNT_SLUG` — your SpinupWP account/team slug
-  (the first path segment in a SpinupWP URL, e.g. `wenmark-digital-solutions` in
-  `https://spinupwp.app/wenmark-digital-solutions/servers/35633`). The API
+  (the first path segment in a SpinupWP URL, e.g. `acme-agency` in
+  `https://spinupwp.app/acme-agency/servers/12345`). The API
   doesn't expose it, so set it to enable the `w` deep links into the web app.
   Without it, `w` opens the SpinupWP dashboard root.
 - **`sshUser`** / `SPINUPWP_SSH_USER` — override the SSH user for the health view
@@ -320,7 +323,7 @@ These can be set in `config.json` or via an environment variable:
 | `D` | Identify every site in the selected stack (Stacks tab) |
 | `S` | Auto-discover & batch-link local copies (Stacks tab) |
 | `f` | Report sites with no usable local copy (Stacks tab only — `f` identifies a site's stack in Servers/Search, above) |
-| `u` | Upgrade a site's PHP version (Servers / Stacks / Search; needs a Read/Write token) |
+| `u` | Update a site: PHP version (needs a Read/Write token) or WordPress core (over SSH) (Servers / Stacks / Search) |
 | `H` | Enable / disable HTTPS on a site (Servers / Stacks / Search; needs a Read/Write token) |
 | `P` | Purge a site's page cache + object cache (Servers / Stacks / Search; needs a Read/Write token) |
 | `M` | Site/server monitoring — a two-pane browser of this site's Uptime Kuma monitors (capital, since lowercase `m` is media fallback in Servers/Search). Inside: `↑`/`↓` selects a monitor, `a` registers/recalibrates/repairs it (Front page and Cache bypass open a check-window picker), `x` removes Front page or Cache bypass, `o` opens the selected monitor in Kuma, `d` runs the site doctor, `n` shows/edits alert wiring, and vanity sites add `R`/`r` for page refresh/secret rotation (Servers / Stacks / Search) |
@@ -333,6 +336,7 @@ These can be set in `config.json` or via an environment variable:
 | `K` | Grant / revoke an SSH key on a site, or every site on the server (Servers / Search; needs sudo connected) |
 | `w` | Open the selected server/site in the SpinupWP web app |
 | `/` | Jump to global search |
+| `A` | Accounts — switch, add, rename, or remove SpinupWP accounts (from anywhere) |
 | `r` | Refresh data from the API |
 | `i` | Explain the current screen (what each pane and key does) |
 | `?` | Toggle the help overlay |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/api/client.ts

@@ -31,6 +31,42 @@ export class ApiError extends Error {
   }
 }
 
+// Pull the human-readable reason out of a SpinupWP error body. The API answers
+// validation failures Laravel-style — {"message": "...", "errors": {field: [..]}}
+// — and a bare "HTTP 400" hides exactly the part the user needs (which field,
+// and why). Returns "" when the body has nothing usable, so callers can fall
+// back to the status-only message.
+export function apiErrorDetail(body: string | undefined): string {
+  const text = (body ?? "").trim()
+  if (!text) return ""
+  let json: unknown
+  try {
+    json = JSON.parse(text)
+  } catch {
+    // Not JSON (an HTML error page, say) — a short plain-text body is still worth
+    // showing; anything long is noise.
+    return text.length <= 200 && !text.startsWith("<") ? text : ""
+  }
+  if (!json || typeof json !== "object") return ""
+  const j = json as { message?: unknown; error?: unknown; errors?: unknown }
+  const parts: string[] = []
+  const message = typeof j.message === "string" ? j.message : typeof j.error === "string" ? j.error : ""
+  if (j.errors && typeof j.errors === "object") {
+    for (const v of Object.values(j.errors as Record<string, unknown>)) {
+      for (const m of Array.isArray(v) ? v : [v]) if (typeof m === "string" && !parts.includes(m)) parts.push(m)
+    }
+  }
+  // Laravel's top-level message usually just repeats the first field error
+  // ("The php version is invalid. (and 1 more error)") — prefer the field list.
+  if (parts.length) return parts.join(" ")
+  return message
+}
+
+function httpErrorMessage(status: number, body: string): string {
+  const detail = apiErrorDetail(body)
+  return detail ? `SpinupWP API error (HTTP ${status}): ${detail}` : `SpinupWP API error (HTTP ${status}).`
+}
+
 export interface ClientOptions {
   token: string
   baseUrl: string
@@ -152,7 +188,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
     }
     if (!res.ok) {
       const body = await res.text().catch(() => "")
-      throw new ApiError(`SpinupWP API error (HTTP ${res.status}).`, res.status, body)
+      throw new ApiError(httpErrorMessage(res.status, body), res.status, body)
     }
 
     return (await res.json()) as T
@@ -189,7 +225,7 @@ export class SpinupWPClient implements SpinupWPClientLike {
     }
     if (!res.ok) {
       const errBody = await res.text().catch(() => "")
-      throw new ApiError(`SpinupWP API error (HTTP ${res.status}).`, res.status, errBody)
+      throw new ApiError(httpErrorMessage(res.status, errBody), res.status, errBody)
     }
 
     // Some write endpoints (e.g. PHP upgrade) return a bare body, others 204.

package/src/config.ts

@@ -6,6 +6,16 @@
 //
 // This lets the original author keep a project-local .env while letting other
 // users configure the tool globally after a `bun install -g`.
+//
+// Accounts (profiles): config.json can hold several SpinupWP accounts under
+// `profiles`, one of them active. Everything that belongs to an account — its
+// token, DNS connections, local-copy links, sudo users, jobs… (PROFILE_KEYS) —
+// lives inside its profile; machine-level settings (terminal app, local scan
+// roots, the Uptime Kuma login, last-seen version) stay at the top level and are
+// shared. Callers never see the split: readStoredConfig() returns the active
+// profile flattened over the globals, and saveConfig() routes each key back to
+// where it belongs. A pre-profiles file is read as a single profile, "default",
+// and rewritten in the new shape on its next save.
 
 import { homedir } from "node:os"
 import { join } from "node:path"
@@ -17,13 +27,16 @@ import { ALL_PROVIDERS, type Connection, type ConnProvider } from "./lib/provide
 export const DEFAULT_BASE_URL = "https://api.spinupwp.app/v1"
 
 export interface AppConfig {
+  // The active account's profile id and human label (see "Accounts" above).
+  profileId: string
+  profileLabel: string
   token: string
   baseUrl: string
   tokenSource: "env" | "file" | "none"
   // Optional override for the SSH user used by the server health view. When unset,
   // the health view derives the user from a site on the server (its `site_user`).
   sshUser: string | null
-  // SpinupWP account/team slug (e.g. "wenmark-digital-solutions"), used to build
+  // SpinupWP account/team slug (e.g. "acme-agency"), used to build
   // deep links into the SpinupWP web app. The API doesn't expose it, so it's
   // configured. When unset, deep links fall back to the dashboard root.
   accountSlug: string | null
@@ -191,6 +204,64 @@ export interface StoredConfig {
   lastSeenVersion?: string
 }
 
+// ---- Accounts (profiles) -------------------------------------------------------
+
+// The keys that belong to one SpinupWP account. Server and site ids are assigned
+// per account (two accounts can both have a server #42), so anything keyed by
+// them MUST be here, as must DNS provider credentials (each client's own).
+// Everything else in StoredConfig is machine-level and shared by every profile.
+// `kumaMonitors` is per account, the Kuma login (`uptimeKuma`) is shared: one
+// agency's Kuma watches every account's sites.
+const PROFILE_KEYS = [
+  "token",
+  "baseUrl",
+  "accountSlug",
+  "sshUser",
+  "localSites",
+  "localSync",
+  "providers",
+  "serverProviders",
+  "jobs",
+  "sudoUsers",
+  "preferredGrantKeys",
+  "grantedKeys",
+  "zoneAccessNotes",
+  "vanityHealthKeys",
+  "kumaMonitors",
+] as const satisfies readonly (keyof StoredConfig)[]
+type ProfileKey = (typeof PROFILE_KEYS)[number]
+const isProfileKey = (k: string): k is ProfileKey => (PROFILE_KEYS as readonly string[]).includes(k)
+
+export type StoredProfile = Pick<StoredConfig, ProfileKey> & { label?: string }
+
+// The on-disk shape: globals at the top, accounts under `profiles`.
+interface StoredFile extends Omit<StoredConfig, ProfileKey> {
+  activeProfile?: string
+  profiles?: Record<string, StoredProfile>
+}
+
+// The profile a pre-profiles config migrates into. Its Keychain entries and cache
+// files keep their original (un-namespaced) names, so migrating moves nothing.
+export const DEFAULT_PROFILE = "default"
+
+export interface ProfileSummary {
+  id: string
+  label: string
+  accountSlug: string | null
+  active: boolean
+  // How many sudo passwords this account has saved in the Keychain — what a
+  // removal will scrub.
+  keychainServers: number[]
+}
+
+// Picks a profile for this process only (no write) — the SPINUPTUI_ACCOUNT env
+// var, so a CLI command can target an account without switching the app's.
+let processProfile: string | null = process.env.SPINUPTUI_ACCOUNT?.trim() || null
+
+export function profileLabel(p: StoredProfile | undefined, id: string): string {
+  return p?.label?.trim() || p?.accountSlug?.trim() || id
+}
+
 export function configDir(): string {
   const xdg = process.env.XDG_CONFIG_HOME
   return xdg ? join(xdg, "spinupwp-tui") : join(homedir(), ".config", "spinupwp-tui")
@@ -206,19 +277,142 @@ export function keysDir(): string {
   return join(configDir(), "keys")
 }
 
-function readStoredConfig(): StoredConfig {
+function readRawFile(): Record<string, unknown> {
   try {
     const path = configPath()
     if (!existsSync(path)) return {}
-    return JSON.parse(readFileSync(path, "utf8")) as StoredConfig
+    return JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>
   } catch {
     return {}
   }
 }
 
+// Read config.json in the profiles shape, migrating a flat (pre-profiles) file
+// in memory: its account keys become the "default" profile.
+function readStoredFile(): StoredFile {
+  const raw = readRawFile()
+  if (raw.profiles && typeof raw.profiles === "object") return raw as StoredFile
+  const file: Record<string, unknown> = {}
+  const profile: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(raw)) (isProfileKey(k) ? profile : file)[k] = v
+  // Nothing account-shaped yet (fresh install): no profile until one is saved.
+  if (Object.keys(profile).length === 0) return file as StoredFile
+  return { ...(file as StoredFile), activeProfile: DEFAULT_PROFILE, profiles: { [DEFAULT_PROFILE]: profile as StoredProfile } }
+}
+
+// The id of the profile this process reads and writes. Falls back to the first
+// profile when the stored pointer is missing or dangling.
+function resolveActive(file: StoredFile): string {
+  const ids = Object.keys(file.profiles ?? {})
+  for (const want of [processProfile, file.activeProfile]) if (want && ids.includes(want)) return want
+  return ids[0] ?? DEFAULT_PROFILE
+}
+
+export function activeProfileId(): string {
+  return resolveActive(readStoredFile())
+}
+
+// The active profile flattened over the machine-level settings — the shape every
+// caller has always read.
+function readStoredConfig(): StoredConfig {
+  const file = readStoredFile()
+  const { profiles, activeProfile: _active, ...globals } = file
+  const profile = profiles?.[resolveActive(file)] ?? {}
+  const { label: _label, ...fields } = profile
+  return { ...globals, ...fields }
+}
+
+// Where an account's disk caches (probe results, DNS, verified zones) live. The
+// default profile keeps the original top-level paths, so migrating moves no
+// files; any other account gets its own directory, since those caches are keyed
+// by per-account site ids and zones.
+export function profileDataDir(id = activeProfileId()): string {
+  return id === DEFAULT_PROFILE ? configDir() : join(configDir(), "profiles", id)
+}
+
+// The per-account cache files, by name, inside profileDataDir() — listed so
+// removing an account can delete exactly these (the default profile's sit
+// beside machine-level files in the config dir itself).
+export const PROFILE_CACHE_FILES = ["stack-cache.json", "dns-cache.json", "providers-cache.json"]
+
+export function listProfiles(): ProfileSummary[] {
+  const file = readStoredFile()
+  const active = resolveActive(file)
+  return Object.entries(file.profiles ?? {}).map(([id, p]) => ({
+    id,
+    label: profileLabel(p, id),
+    accountSlug: p.accountSlug?.trim() || null,
+    active: id === active,
+    keychainServers: Object.entries(p.sudoUsers ?? {})
+      .filter(([, u]) => u.keychain)
+      .map(([sid]) => Number(sid)),
+  }))
+}
+
+// A lowercase, dash-separated id from a label, unique among existing profiles.
+function profileIdFor(label: string, taken: string[]): string {
+  const base = label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "account"
+  let id = base
+  for (let n = 2; taken.includes(id); n++) id = `${base}-${n}`
+  return id
+}
+
+// Add an account (token already validated by the caller). Does not switch to it.
+export async function addProfile(p: { label: string; token: string; baseUrl?: string; accountSlug?: string }): Promise<string> {
+  const file = readStoredFile()
+  const profiles = { ...(file.profiles ?? {}) }
+  const id = profileIdFor(p.label, Object.keys(profiles))
+  profiles[id] = {
+    label: p.label.trim(),
+    token: p.token.trim(),
+    baseUrl: p.baseUrl ?? DEFAULT_BASE_URL,
+    ...(p.accountSlug?.trim() ? { accountSlug: p.accountSlug.trim() } : {}),
+  }
+  await writeStoredFile({ ...file, activeProfile: resolveActive(file), profiles })
+  return id
+}
+
+export async function renameProfile(id: string, label: string): Promise<void> {
+  const file = readStoredFile()
+  const p = file.profiles?.[id]
+  if (!p || !label.trim()) return
+  await writeStoredFile({ ...file, activeProfile: resolveActive(file), profiles: { ...file.profiles, [id]: { ...p, label: label.trim() } } })
+}
+
+// Drop an account's profile. The caller scrubs its Keychain entries and cache
+// directory (see removeAccount in the Accounts overlay). The active account
+// can't be removed — switch away first.
+export async function removeProfile(id: string): Promise<void> {
+  const file = readStoredFile()
+  const active = resolveActive(file)
+  if (id === active || !file.profiles?.[id]) return
+  const { [id]: _gone, ...rest } = file.profiles
+  await writeStoredFile({ ...file, activeProfile: active, profiles: rest })
+}
+
+// Lock this process to the account active right now. The TUI calls it at
+// launch: without it, a second instance on the same machine
+// switching accounts would rewrite `activeProfile` in the shared file, and this
+// process's call-time reads — Keychain names, cache dirs, jobs, local links —
+// would quietly follow it while its screens still show the old account.
+export function pinActiveProfile(): string {
+  processProfile = resolveActive(readStoredFile())
+  return processProfile
+}
+
+// Make `id` the active account, for this process and future launches.
+export async function setActiveProfile(id: string): Promise<void> {
+  const file = readStoredFile()
+  if (!file.profiles?.[id]) return
+  processProfile = id
+  await writeStoredFile({ ...file, activeProfile: id })
+}
+
 // Resolve the active config from env + stored file. Never throws.
 export function loadConfig(): AppConfig {
   const stored = readStoredConfig()
+  const file = readStoredFile()
+  const profileId = resolveActive(file)
   const envToken = process.env.SPINUPWP_ACCESS_TOKEN?.trim()
   const fileToken = stored.token?.trim()
 
@@ -257,11 +451,16 @@ export function loadConfig(): AppConfig {
   }
 
   return {
+    profileId,
+    profileLabel: profileLabel(file.profiles?.[profileId], profileId),
     token,
     baseUrl: (stored.baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, ""),
     tokenSource,
     sshUser: process.env.SPINUPWP_SSH_USER?.trim() || stored.sshUser?.trim() || null,
-    accountSlug: process.env.SPINUPWP_ACCOUNT_SLUG?.trim() || stored.accountSlug?.trim() || null,
+    // The env slug describes the env token's account (or the one account a
+    // pre-profiles setup had) — never another profile the user switched to.
+    accountSlug:
+      ((tokenSource === "env" || profileId === DEFAULT_PROFILE) && process.env.SPINUPWP_ACCOUNT_SLUG?.trim()) || stored.accountSlug?.trim() || null,
     terminalApp: process.env.SPINUPWP_TERMINAL_APP?.trim() || stored.terminalApp?.trim() || null,
     localSync: ((): boolean => {
       // Env overrides the file when present; otherwise the stored flag (default off).
@@ -295,12 +494,37 @@ export function hasToken(): boolean {
   return loadConfig().token.length > 0
 }
 
-// Persist a token (and optional base URL) to the config file. Used by onboarding.
-export async function saveConfig(partial: StoredConfig): Promise<void> {
+// Merge settings into the config file: account keys into the active profile
+// (created as "default" if there is none yet — first-run onboarding), the rest
+// at the top level. `profileId` pins the account keys to a specific profile —
+// the app passes the one it was started for, so a write that lands after an
+// account switch can't leak into the newly active account (and one for an
+// account removed meanwhile is dropped).
+export async function saveConfig(partial: StoredConfig, profileId?: string): Promise<void> {
+  const file = readStoredFile()
+  const active = resolveActive(file)
+  if (profileId && profileId !== active && !file.profiles?.[profileId]) {
+    partial = Object.fromEntries(Object.entries(partial).filter(([k]) => !isProfileKey(k)))
+    if (Object.keys(partial).length === 0) return
+  }
+  const target = profileId && file.profiles?.[profileId] ? profileId : active
+  const profile: StoredProfile = { ...(file.profiles?.[target] ?? {}) }
+  const next: StoredFile = { ...file }
+  for (const [k, v] of Object.entries(partial)) {
+    if (isProfileKey(k)) (profile as Record<string, unknown>)[k] = v
+    else (next as Record<string, unknown>)[k] = v
+  }
+  const hasProfile = file.profiles?.[target] || PROFILE_KEYS.some((k) => k in partial)
+  if (hasProfile) {
+    next.profiles = { ...(file.profiles ?? {}), [target]: profile }
+    next.activeProfile = active
+  }
+  await writeStoredFile(next)
+}
+
+async function writeStoredFile(next: StoredFile): Promise<void> {
   const dir = configDir()
   await mkdir(dir, { recursive: true })
-  const current = readStoredConfig()
-  const next: StoredConfig = { ...current, ...partial }
   const path = configPath()
   await Bun.write(path, JSON.stringify(next, null, 2) + "\n")
   // The file holds an API token — restrict it to the owner.

package/src/index.tsx

@@ -6,13 +6,15 @@
 // First, before any config read or spawn: keep a site checkout's .env from
 // leaking into child processes (see the module).
 import "./lib/cwdDotenv.ts"
-import { useState } from "react"
+import { useCallback, useMemo, useState } from "react"
 import { createCliRenderer } from "@opentui/core"
 import { createRoot } from "@opentui/react"
 import pkg from "../package.json" with { type: "json" }
-import { hasToken, configPath, loadConfig } from "./config.ts"
+import { hasToken, configPath, loadConfig, pinActiveProfile, setActiveProfile, listProfiles } from "./config.ts"
 import { StoreProvider } from "./ui/store.tsx"
 import { App } from "./ui/App.tsx"
+import { AccountsContext, type AccountsApi } from "./ui/accounts.tsx"
+import { resetWpCoreJobs } from "./ui/wpCoreJobs.tsx"
 import { Onboarding } from "./ui/Onboarding.tsx"
 import { isDevMode } from "./dev/devMode.ts"
 import { SpinupWPClient } from "./api/client.ts"
@@ -94,7 +96,12 @@ Token resolution: SPINUPWP_ACCESS_TOKEN (env / .env) first, then the config
 file. Run \`spinuptui login\` once to save a token so \`spinuptui\` works from
 anywhere.
 
+Accounts: add and switch SpinupWP accounts in the app with A. Commands use the
+active one; SPINUPTUI_ACCOUNT=<id> picks another for a single run (ids are
+listed by \`spinuptui where\`).
+
 Config file: ${configPath()}
+Account: ${cfg.profileLabel} (${cfg.profileId})
 Token source: ${cfg.tokenSource}`)
   process.exit(0)
 }
@@ -107,7 +114,10 @@ if (args.includes("-v") || args.includes("--version") || command === "version")
 if (command === "where") {
   const cfg = loadConfig()
   console.log(`config: ${configPath()}`)
+  console.log(`account: ${cfg.profileLabel} (${cfg.profileId})`)
   console.log(`token source: ${cfg.tokenSource}`)
+  const others = listProfiles().filter((p) => !p.active)
+  if (others.length) console.log(`other accounts: ${others.map((p) => `${p.label} (${p.id})`).join(", ")}`)
   process.exit(0)
 }
 
@@ -240,13 +250,23 @@ const forceLogin = command === "login"
 
 function Root() {
   const [configured, setConfigured] = useState(isDevMode() ? true : forceLogin ? false : hasToken())
+  // The store is keyed by account: switching remounts it (see ui/accounts.tsx).
+  const [account, setAccount] = useState(() => pinActiveProfile())
+  const switchAccount = useCallback(async (id: string) => {
+    await setActiveProfile(id)
+    resetWpCoreJobs()
+    setAccount(id)
+  }, [])
+  const accounts = useMemo<AccountsApi>(() => ({ switchAccount }), [switchAccount])
   if (!configured) {
     return <Onboarding onComplete={() => setConfigured(true)} />
   }
   return (
-    <StoreProvider>
-      <App />
-    </StoreProvider>
+    <AccountsContext.Provider value={accounts}>
+      <StoreProvider key={account}>
+        <App />
+      </StoreProvider>
+    </AccountsContext.Provider>
   )
 }
 

package/src/lib/dnsCache.ts

@@ -13,7 +13,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { ZoneHost } from "./dns.ts"
 
 const CACHE_VERSION = 1
@@ -29,11 +29,14 @@ interface CacheFile {
   entries: Record<string, CachedDns> // key: normalized domain
 }
 
-export function dnsCachePath(): string {
-  return join(configDir(), "dns-cache.json")
+export function dnsCachePath(dir = profileDataDir()): string {
+  return join(dir, "dns-cache.json")
 }
 
 export class DnsCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<string, CachedDns>()
   // Serializes writes so concurrent batch lookups can't tear the file.
   private writeChain: Promise<void> = Promise.resolve()
@@ -42,7 +45,7 @@ export class DnsCache {
   // an empty cache.
   load(): void {
     try {
-      const path = dnsCachePath()
+      const path = dnsCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -80,10 +83,10 @@ export class DnsCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [k, entry] of this.entries) file.entries[k] = entry
-    const path = dnsCachePath()
+    const path = dnsCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/keychain.ts

@@ -8,6 +8,7 @@
 // the write — acceptable for an opt-in convenience on a personal box; documented here.
 
 import { spawn } from "./spawn.ts"
+import { activeProfileId, DEFAULT_PROFILE } from "../config.ts"
 
 const SERVICE = "spinup-sudo"
 
@@ -15,8 +16,12 @@ export function keychainAvailable(): boolean {
   return process.platform === "darwin"
 }
 
-function account(serverId: number): string {
-  return `server-${serverId}`
+// Server ids are per SpinupWP account — two accounts can both have server #42 —
+// so each account's entries are namespaced by its profile id. The default
+// profile keeps the original un-namespaced name, so entries saved before
+// accounts existed are still found.
+function account(serverId: number, profileId = activeProfileId()): string {
+  return profileId === DEFAULT_PROFILE ? `server-${serverId}` : `${profileId}:server-${serverId}`
 }
 
 async function security(args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
@@ -53,8 +58,9 @@ export async function getSudoPassword(serverId: number): Promise<string | null>
   return r.ok ? r.stdout.replace(/\n+$/, "") : null
 }
 
-// Remove a server's stored sudo password (best-effort).
-export async function deleteSudoPassword(serverId: number): Promise<void> {
+// Remove a server's stored sudo password (best-effort) — the active account's,
+// or another account's when removing that account.
+export async function deleteSudoPassword(serverId: number, profileId?: string): Promise<void> {
   if (!keychainAvailable()) return
-  await security(["delete-generic-password", "-s", SERVICE, "-a", account(serverId)])
+  await security(["delete-generic-password", "-s", SERVICE, "-a", account(serverId, profileId)])
 }

package/src/lib/probe.ts

@@ -167,6 +167,22 @@ function parseSections(out: string): Record<string, string> {
   return flat
 }
 
+// The same probe result with a newly learned WordPress core version, relabeled the
+// way classify() labels it. Returns null for kinds that don't carry a WP version
+// (a WHMCS/Laravel/static site's cached identity must never be rewritten).
+export function withWpVersion(r: ProbeResult, version: string): ProbeResult | null {
+  switch (r.kind) {
+    case "wordpress":
+      return { ...r, version, label: `WordPress ${version}` }
+    case "bedrock":
+      return { ...r, version, label: `Bedrock · WP ${version}` }
+    case "radicle":
+      return { ...r, version, label: `Radicle · WP ${version}` }
+    default:
+      return null
+  }
+}
+
 // Turn raw signals into a named stack. Order matters: name the distinctive apps
 // (WHMCS, Bedrock, Laravel) before falling back to a generic WordPress version.
 export function classify(sig: Record<string, string>): ProbeResult {