spinuptui 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -11,6 +11,15 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.28.0] - 2026-09-23
+
+### Added
+- **Multiple SpinupWP accounts.** Press `A` from anywhere to open **Accounts**: add another account (its token is checked with SpinupWP before it's saved), switch between accounts, rename them, or remove one. You work in one account at a time, never a merged fleet, so an action can't land on the wrong client's server, and the header always shows `Account: …`. Switching reloads the app on the new account, and it waits until running changes (PHP upgrades, DNS edits, clones, WordPress updates…) finish. Each account keeps its own token, DNS provider connections, local-copy links, sudo users and saved Keychain passwords, monitors, and cached probes. Machine-level settings (terminal app, local scan roots, the Uptime Kuma login) are shared by all of them. Your existing setup becomes the first account automatically; nothing moves on disk. Removing an account also deletes its Keychain passwords and caches, but never files in your local working copies. For commands, `SPINUPTUI_ACCOUNT=<id>` picks an account for one run, and `spinuptui where` lists the account ids.
+- **Vanity Site in Stacks.** Non-WP now has a **Vanity Site** row for each server's own-hostname site, the same rule the vanity features use, so these show up without an SSH probe instead of sitting under Unknown or unprobed. Their rows read `Vanity Site` in place of `Unknown`.
+
+### Notes
+- **Config migration.** The first time this version saves a setting, `config.json` is rewritten in the new accounts shape. A version before 0.28.0 can't read the token from it and would run first-time setup, so back up `~/.config/spinupwp-tui/config.json` if you might downgrade. Accounts are stored per machine; add them on each machine where you use SpinupTUI.
+
 ## [0.27.0] - 2026-09-23
 
 ### Added
@@ -1427,7 +1436,8 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.28.0...HEAD
+[0.28.0]: https://github.com/mwender/spinupwp-tui/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/mwender/spinupwp-tui/compare/v0.26.1...v0.27.0
 [0.26.1]: https://github.com/mwender/spinupwp-tui/compare/v0.26.0...v0.26.1
 [0.26.0]: https://github.com/mwender/spinupwp-tui/compare/v0.25.0...v0.26.0

package/README.md

@@ -38,6 +38,7 @@
   probe for precise identification. → [docs/stack-detection.md](docs/stack-detection.md)
 - **Global search** — fuzzy search across every server and site by name, domain,
   or IP, with inline actions on the result.
+- **Multiple SpinupWP accounts** (`A`) — keep several accounts (say, your agency's and a client's) and switch between them in-app; the header always names the one you're on. → [docs/multiple-accounts.md](docs/multiple-accounts.md)
 - **Events feed** — recent provisioning/operation activity with per-event detail.
 - **Live server health** (`h`) — real-time CPU/load/memory/disk over SSH.
   → [docs/server-health.md](docs/server-health.md)
@@ -262,13 +263,15 @@ The token is resolved in this order (first match wins):
 To reconfigure, delete the config file (the path is shown on the onboarding
 screen) and relaunch, or set the environment variable.
 
+More than one SpinupWP account? Add the others in-app with `A`. Each keeps its own token and account settings; see [docs/multiple-accounts.md](docs/multiple-accounts.md).
+
 ### Optional settings
 
 These can be set in `config.json` or via an environment variable:
 
 - **`accountSlug`** / `SPINUPWP_ACCOUNT_SLUG` — your SpinupWP account/team slug
-  (the first path segment in a SpinupWP URL, e.g. `wenmark-digital-solutions` in
-  `https://spinupwp.app/wenmark-digital-solutions/servers/35633`). The API
+  (the first path segment in a SpinupWP URL, e.g. `acme-agency` in
+  `https://spinupwp.app/acme-agency/servers/12345`). The API
   doesn't expose it, so set it to enable the `w` deep links into the web app.
   Without it, `w` opens the SpinupWP dashboard root.
 - **`sshUser`** / `SPINUPWP_SSH_USER` — override the SSH user for the health view
@@ -333,6 +336,7 @@ These can be set in `config.json` or via an environment variable:
 | `K` | Grant / revoke an SSH key on a site, or every site on the server (Servers / Search; needs sudo connected) |
 | `w` | Open the selected server/site in the SpinupWP web app |
 | `/` | Jump to global search |
+| `A` | Accounts — switch, add, rename, or remove SpinupWP accounts (from anywhere) |
 | `r` | Refresh data from the API |
 | `i` | Explain the current screen (what each pane and key does) |
 | `?` | Toggle the help overlay |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/config.ts

@@ -6,6 +6,16 @@
 //
 // This lets the original author keep a project-local .env while letting other
 // users configure the tool globally after a `bun install -g`.
+//
+// Accounts (profiles): config.json can hold several SpinupWP accounts under
+// `profiles`, one of them active. Everything that belongs to an account — its
+// token, DNS connections, local-copy links, sudo users, jobs… (PROFILE_KEYS) —
+// lives inside its profile; machine-level settings (terminal app, local scan
+// roots, the Uptime Kuma login, last-seen version) stay at the top level and are
+// shared. Callers never see the split: readStoredConfig() returns the active
+// profile flattened over the globals, and saveConfig() routes each key back to
+// where it belongs. A pre-profiles file is read as a single profile, "default",
+// and rewritten in the new shape on its next save.
 
 import { homedir } from "node:os"
 import { join } from "node:path"
@@ -17,13 +27,16 @@ import { ALL_PROVIDERS, type Connection, type ConnProvider } from "./lib/provide
 export const DEFAULT_BASE_URL = "https://api.spinupwp.app/v1"
 
 export interface AppConfig {
+  // The active account's profile id and human label (see "Accounts" above).
+  profileId: string
+  profileLabel: string
   token: string
   baseUrl: string
   tokenSource: "env" | "file" | "none"
   // Optional override for the SSH user used by the server health view. When unset,
   // the health view derives the user from a site on the server (its `site_user`).
   sshUser: string | null
-  // SpinupWP account/team slug (e.g. "wenmark-digital-solutions"), used to build
+  // SpinupWP account/team slug (e.g. "acme-agency"), used to build
   // deep links into the SpinupWP web app. The API doesn't expose it, so it's
   // configured. When unset, deep links fall back to the dashboard root.
   accountSlug: string | null
@@ -191,6 +204,64 @@ export interface StoredConfig {
   lastSeenVersion?: string
 }
 
+// ---- Accounts (profiles) -------------------------------------------------------
+
+// The keys that belong to one SpinupWP account. Server and site ids are assigned
+// per account (two accounts can both have a server #42), so anything keyed by
+// them MUST be here, as must DNS provider credentials (each client's own).
+// Everything else in StoredConfig is machine-level and shared by every profile.
+// `kumaMonitors` is per account, the Kuma login (`uptimeKuma`) is shared: one
+// agency's Kuma watches every account's sites.
+const PROFILE_KEYS = [
+  "token",
+  "baseUrl",
+  "accountSlug",
+  "sshUser",
+  "localSites",
+  "localSync",
+  "providers",
+  "serverProviders",
+  "jobs",
+  "sudoUsers",
+  "preferredGrantKeys",
+  "grantedKeys",
+  "zoneAccessNotes",
+  "vanityHealthKeys",
+  "kumaMonitors",
+] as const satisfies readonly (keyof StoredConfig)[]
+type ProfileKey = (typeof PROFILE_KEYS)[number]
+const isProfileKey = (k: string): k is ProfileKey => (PROFILE_KEYS as readonly string[]).includes(k)
+
+export type StoredProfile = Pick<StoredConfig, ProfileKey> & { label?: string }
+
+// The on-disk shape: globals at the top, accounts under `profiles`.
+interface StoredFile extends Omit<StoredConfig, ProfileKey> {
+  activeProfile?: string
+  profiles?: Record<string, StoredProfile>
+}
+
+// The profile a pre-profiles config migrates into. Its Keychain entries and cache
+// files keep their original (un-namespaced) names, so migrating moves nothing.
+export const DEFAULT_PROFILE = "default"
+
+export interface ProfileSummary {
+  id: string
+  label: string
+  accountSlug: string | null
+  active: boolean
+  // How many sudo passwords this account has saved in the Keychain — what a
+  // removal will scrub.
+  keychainServers: number[]
+}
+
+// Picks a profile for this process only (no write) — the SPINUPTUI_ACCOUNT env
+// var, so a CLI command can target an account without switching the app's.
+let processProfile: string | null = process.env.SPINUPTUI_ACCOUNT?.trim() || null
+
+export function profileLabel(p: StoredProfile | undefined, id: string): string {
+  return p?.label?.trim() || p?.accountSlug?.trim() || id
+}
+
 export function configDir(): string {
   const xdg = process.env.XDG_CONFIG_HOME
   return xdg ? join(xdg, "spinupwp-tui") : join(homedir(), ".config", "spinupwp-tui")
@@ -206,19 +277,142 @@ export function keysDir(): string {
   return join(configDir(), "keys")
 }
 
-function readStoredConfig(): StoredConfig {
+function readRawFile(): Record<string, unknown> {
   try {
     const path = configPath()
     if (!existsSync(path)) return {}
-    return JSON.parse(readFileSync(path, "utf8")) as StoredConfig
+    return JSON.parse(readFileSync(path, "utf8")) as Record<string, unknown>
   } catch {
     return {}
   }
 }
 
+// Read config.json in the profiles shape, migrating a flat (pre-profiles) file
+// in memory: its account keys become the "default" profile.
+function readStoredFile(): StoredFile {
+  const raw = readRawFile()
+  if (raw.profiles && typeof raw.profiles === "object") return raw as StoredFile
+  const file: Record<string, unknown> = {}
+  const profile: Record<string, unknown> = {}
+  for (const [k, v] of Object.entries(raw)) (isProfileKey(k) ? profile : file)[k] = v
+  // Nothing account-shaped yet (fresh install): no profile until one is saved.
+  if (Object.keys(profile).length === 0) return file as StoredFile
+  return { ...(file as StoredFile), activeProfile: DEFAULT_PROFILE, profiles: { [DEFAULT_PROFILE]: profile as StoredProfile } }
+}
+
+// The id of the profile this process reads and writes. Falls back to the first
+// profile when the stored pointer is missing or dangling.
+function resolveActive(file: StoredFile): string {
+  const ids = Object.keys(file.profiles ?? {})
+  for (const want of [processProfile, file.activeProfile]) if (want && ids.includes(want)) return want
+  return ids[0] ?? DEFAULT_PROFILE
+}
+
+export function activeProfileId(): string {
+  return resolveActive(readStoredFile())
+}
+
+// The active profile flattened over the machine-level settings — the shape every
+// caller has always read.
+function readStoredConfig(): StoredConfig {
+  const file = readStoredFile()
+  const { profiles, activeProfile: _active, ...globals } = file
+  const profile = profiles?.[resolveActive(file)] ?? {}
+  const { label: _label, ...fields } = profile
+  return { ...globals, ...fields }
+}
+
+// Where an account's disk caches (probe results, DNS, verified zones) live. The
+// default profile keeps the original top-level paths, so migrating moves no
+// files; any other account gets its own directory, since those caches are keyed
+// by per-account site ids and zones.
+export function profileDataDir(id = activeProfileId()): string {
+  return id === DEFAULT_PROFILE ? configDir() : join(configDir(), "profiles", id)
+}
+
+// The per-account cache files, by name, inside profileDataDir() — listed so
+// removing an account can delete exactly these (the default profile's sit
+// beside machine-level files in the config dir itself).
+export const PROFILE_CACHE_FILES = ["stack-cache.json", "dns-cache.json", "providers-cache.json"]
+
+export function listProfiles(): ProfileSummary[] {
+  const file = readStoredFile()
+  const active = resolveActive(file)
+  return Object.entries(file.profiles ?? {}).map(([id, p]) => ({
+    id,
+    label: profileLabel(p, id),
+    accountSlug: p.accountSlug?.trim() || null,
+    active: id === active,
+    keychainServers: Object.entries(p.sudoUsers ?? {})
+      .filter(([, u]) => u.keychain)
+      .map(([sid]) => Number(sid)),
+  }))
+}
+
+// A lowercase, dash-separated id from a label, unique among existing profiles.
+function profileIdFor(label: string, taken: string[]): string {
+  const base = label.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "account"
+  let id = base
+  for (let n = 2; taken.includes(id); n++) id = `${base}-${n}`
+  return id
+}
+
+// Add an account (token already validated by the caller). Does not switch to it.
+export async function addProfile(p: { label: string; token: string; baseUrl?: string; accountSlug?: string }): Promise<string> {
+  const file = readStoredFile()
+  const profiles = { ...(file.profiles ?? {}) }
+  const id = profileIdFor(p.label, Object.keys(profiles))
+  profiles[id] = {
+    label: p.label.trim(),
+    token: p.token.trim(),
+    baseUrl: p.baseUrl ?? DEFAULT_BASE_URL,
+    ...(p.accountSlug?.trim() ? { accountSlug: p.accountSlug.trim() } : {}),
+  }
+  await writeStoredFile({ ...file, activeProfile: resolveActive(file), profiles })
+  return id
+}
+
+export async function renameProfile(id: string, label: string): Promise<void> {
+  const file = readStoredFile()
+  const p = file.profiles?.[id]
+  if (!p || !label.trim()) return
+  await writeStoredFile({ ...file, activeProfile: resolveActive(file), profiles: { ...file.profiles, [id]: { ...p, label: label.trim() } } })
+}
+
+// Drop an account's profile. The caller scrubs its Keychain entries and cache
+// directory (see removeAccount in the Accounts overlay). The active account
+// can't be removed — switch away first.
+export async function removeProfile(id: string): Promise<void> {
+  const file = readStoredFile()
+  const active = resolveActive(file)
+  if (id === active || !file.profiles?.[id]) return
+  const { [id]: _gone, ...rest } = file.profiles
+  await writeStoredFile({ ...file, activeProfile: active, profiles: rest })
+}
+
+// Lock this process to the account active right now. The TUI calls it at
+// launch: without it, a second instance on the same machine
+// switching accounts would rewrite `activeProfile` in the shared file, and this
+// process's call-time reads — Keychain names, cache dirs, jobs, local links —
+// would quietly follow it while its screens still show the old account.
+export function pinActiveProfile(): string {
+  processProfile = resolveActive(readStoredFile())
+  return processProfile
+}
+
+// Make `id` the active account, for this process and future launches.
+export async function setActiveProfile(id: string): Promise<void> {
+  const file = readStoredFile()
+  if (!file.profiles?.[id]) return
+  processProfile = id
+  await writeStoredFile({ ...file, activeProfile: id })
+}
+
 // Resolve the active config from env + stored file. Never throws.
 export function loadConfig(): AppConfig {
   const stored = readStoredConfig()
+  const file = readStoredFile()
+  const profileId = resolveActive(file)
   const envToken = process.env.SPINUPWP_ACCESS_TOKEN?.trim()
   const fileToken = stored.token?.trim()
 
@@ -257,11 +451,16 @@ export function loadConfig(): AppConfig {
   }
 
   return {
+    profileId,
+    profileLabel: profileLabel(file.profiles?.[profileId], profileId),
     token,
     baseUrl: (stored.baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, ""),
     tokenSource,
     sshUser: process.env.SPINUPWP_SSH_USER?.trim() || stored.sshUser?.trim() || null,
-    accountSlug: process.env.SPINUPWP_ACCOUNT_SLUG?.trim() || stored.accountSlug?.trim() || null,
+    // The env slug describes the env token's account (or the one account a
+    // pre-profiles setup had) — never another profile the user switched to.
+    accountSlug:
+      ((tokenSource === "env" || profileId === DEFAULT_PROFILE) && process.env.SPINUPWP_ACCOUNT_SLUG?.trim()) || stored.accountSlug?.trim() || null,
     terminalApp: process.env.SPINUPWP_TERMINAL_APP?.trim() || stored.terminalApp?.trim() || null,
     localSync: ((): boolean => {
       // Env overrides the file when present; otherwise the stored flag (default off).
@@ -295,12 +494,37 @@ export function hasToken(): boolean {
   return loadConfig().token.length > 0
 }
 
-// Persist a token (and optional base URL) to the config file. Used by onboarding.
-export async function saveConfig(partial: StoredConfig): Promise<void> {
+// Merge settings into the config file: account keys into the active profile
+// (created as "default" if there is none yet — first-run onboarding), the rest
+// at the top level. `profileId` pins the account keys to a specific profile —
+// the app passes the one it was started for, so a write that lands after an
+// account switch can't leak into the newly active account (and one for an
+// account removed meanwhile is dropped).
+export async function saveConfig(partial: StoredConfig, profileId?: string): Promise<void> {
+  const file = readStoredFile()
+  const active = resolveActive(file)
+  if (profileId && profileId !== active && !file.profiles?.[profileId]) {
+    partial = Object.fromEntries(Object.entries(partial).filter(([k]) => !isProfileKey(k)))
+    if (Object.keys(partial).length === 0) return
+  }
+  const target = profileId && file.profiles?.[profileId] ? profileId : active
+  const profile: StoredProfile = { ...(file.profiles?.[target] ?? {}) }
+  const next: StoredFile = { ...file }
+  for (const [k, v] of Object.entries(partial)) {
+    if (isProfileKey(k)) (profile as Record<string, unknown>)[k] = v
+    else (next as Record<string, unknown>)[k] = v
+  }
+  const hasProfile = file.profiles?.[target] || PROFILE_KEYS.some((k) => k in partial)
+  if (hasProfile) {
+    next.profiles = { ...(file.profiles ?? {}), [target]: profile }
+    next.activeProfile = active
+  }
+  await writeStoredFile(next)
+}
+
+async function writeStoredFile(next: StoredFile): Promise<void> {
   const dir = configDir()
   await mkdir(dir, { recursive: true })
-  const current = readStoredConfig()
-  const next: StoredConfig = { ...current, ...partial }
   const path = configPath()
   await Bun.write(path, JSON.stringify(next, null, 2) + "\n")
   // The file holds an API token — restrict it to the owner.

package/src/index.tsx

@@ -6,13 +6,15 @@
 // First, before any config read or spawn: keep a site checkout's .env from
 // leaking into child processes (see the module).
 import "./lib/cwdDotenv.ts"
-import { useState } from "react"
+import { useCallback, useMemo, useState } from "react"
 import { createCliRenderer } from "@opentui/core"
 import { createRoot } from "@opentui/react"
 import pkg from "../package.json" with { type: "json" }
-import { hasToken, configPath, loadConfig } from "./config.ts"
+import { hasToken, configPath, loadConfig, pinActiveProfile, setActiveProfile, listProfiles } from "./config.ts"
 import { StoreProvider } from "./ui/store.tsx"
 import { App } from "./ui/App.tsx"
+import { AccountsContext, type AccountsApi } from "./ui/accounts.tsx"
+import { resetWpCoreJobs } from "./ui/wpCoreJobs.tsx"
 import { Onboarding } from "./ui/Onboarding.tsx"
 import { isDevMode } from "./dev/devMode.ts"
 import { SpinupWPClient } from "./api/client.ts"
@@ -94,7 +96,12 @@ Token resolution: SPINUPWP_ACCESS_TOKEN (env / .env) first, then the config
 file. Run \`spinuptui login\` once to save a token so \`spinuptui\` works from
 anywhere.
 
+Accounts: add and switch SpinupWP accounts in the app with A. Commands use the
+active one; SPINUPTUI_ACCOUNT=<id> picks another for a single run (ids are
+listed by \`spinuptui where\`).
+
 Config file: ${configPath()}
+Account: ${cfg.profileLabel} (${cfg.profileId})
 Token source: ${cfg.tokenSource}`)
   process.exit(0)
 }
@@ -107,7 +114,10 @@ if (args.includes("-v") || args.includes("--version") || command === "version")
 if (command === "where") {
   const cfg = loadConfig()
   console.log(`config: ${configPath()}`)
+  console.log(`account: ${cfg.profileLabel} (${cfg.profileId})`)
   console.log(`token source: ${cfg.tokenSource}`)
+  const others = listProfiles().filter((p) => !p.active)
+  if (others.length) console.log(`other accounts: ${others.map((p) => `${p.label} (${p.id})`).join(", ")}`)
   process.exit(0)
 }
 
@@ -240,13 +250,23 @@ const forceLogin = command === "login"
 
 function Root() {
   const [configured, setConfigured] = useState(isDevMode() ? true : forceLogin ? false : hasToken())
+  // The store is keyed by account: switching remounts it (see ui/accounts.tsx).
+  const [account, setAccount] = useState(() => pinActiveProfile())
+  const switchAccount = useCallback(async (id: string) => {
+    await setActiveProfile(id)
+    resetWpCoreJobs()
+    setAccount(id)
+  }, [])
+  const accounts = useMemo<AccountsApi>(() => ({ switchAccount }), [switchAccount])
   if (!configured) {
     return <Onboarding onComplete={() => setConfigured(true)} />
   }
   return (
-    <StoreProvider>
-      <App />
-    </StoreProvider>
+    <AccountsContext.Provider value={accounts}>
+      <StoreProvider key={account}>
+        <App />
+      </StoreProvider>
+    </AccountsContext.Provider>
   )
 }
 

package/src/lib/dnsCache.ts

@@ -13,7 +13,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { ZoneHost } from "./dns.ts"
 
 const CACHE_VERSION = 1
@@ -29,11 +29,14 @@ interface CacheFile {
   entries: Record<string, CachedDns> // key: normalized domain
 }
 
-export function dnsCachePath(): string {
-  return join(configDir(), "dns-cache.json")
+export function dnsCachePath(dir = profileDataDir()): string {
+  return join(dir, "dns-cache.json")
 }
 
 export class DnsCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<string, CachedDns>()
   // Serializes writes so concurrent batch lookups can't tear the file.
   private writeChain: Promise<void> = Promise.resolve()
@@ -42,7 +45,7 @@ export class DnsCache {
   // an empty cache.
   load(): void {
     try {
-      const path = dnsCachePath()
+      const path = dnsCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -80,10 +83,10 @@ export class DnsCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [k, entry] of this.entries) file.entries[k] = entry
-    const path = dnsCachePath()
+    const path = dnsCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/keychain.ts

@@ -8,6 +8,7 @@
 // the write — acceptable for an opt-in convenience on a personal box; documented here.
 
 import { spawn } from "./spawn.ts"
+import { activeProfileId, DEFAULT_PROFILE } from "../config.ts"
 
 const SERVICE = "spinup-sudo"
 
@@ -15,8 +16,12 @@ export function keychainAvailable(): boolean {
   return process.platform === "darwin"
 }
 
-function account(serverId: number): string {
-  return `server-${serverId}`
+// Server ids are per SpinupWP account — two accounts can both have server #42 —
+// so each account's entries are namespaced by its profile id. The default
+// profile keeps the original un-namespaced name, so entries saved before
+// accounts existed are still found.
+function account(serverId: number, profileId = activeProfileId()): string {
+  return profileId === DEFAULT_PROFILE ? `server-${serverId}` : `${profileId}:server-${serverId}`
 }
 
 async function security(args: string[]): Promise<{ ok: boolean; stdout: string; stderr: string }> {
@@ -53,8 +58,9 @@ export async function getSudoPassword(serverId: number): Promise<string | null>
   return r.ok ? r.stdout.replace(/\n+$/, "") : null
 }
 
-// Remove a server's stored sudo password (best-effort).
-export async function deleteSudoPassword(serverId: number): Promise<void> {
+// Remove a server's stored sudo password (best-effort) — the active account's,
+// or another account's when removing that account.
+export async function deleteSudoPassword(serverId: number, profileId?: string): Promise<void> {
   if (!keychainAvailable()) return
-  await security(["delete-generic-password", "-s", SERVICE, "-a", account(serverId)])
+  await security(["delete-generic-password", "-s", SERVICE, "-a", account(serverId, profileId)])
 }

package/src/lib/providersCache.ts

@@ -13,7 +13,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { VerifiedZone } from "./providers.ts"
 
 // v2: VerifiedZone gained `nameservers` + `account` (was accountId/accountName).
@@ -42,17 +42,20 @@ interface CacheFile {
   entries: Record<string, VerifiedConn> // key: connection id
 }
 
-export function providersCachePath(): string {
-  return join(configDir(), "providers-cache.json")
+export function providersCachePath(dir = profileDataDir()): string {
+  return join(dir, "providers-cache.json")
 }
 
 export class ProvidersCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<string, VerifiedConn>()
   private writeChain: Promise<void> = Promise.resolve()
 
   load(): void {
     try {
-      const path = providersCachePath()
+      const path = providersCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -91,10 +94,10 @@ export class ProvidersCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [k, entry] of this.entries) file.entries[k] = entry
-    const path = providersCachePath()
+    const path = providersCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/stackCache.ts

@@ -12,7 +12,7 @@
 import { join } from "node:path"
 import { existsSync, readFileSync } from "node:fs"
 import { chmod, mkdir } from "node:fs/promises"
-import { configDir } from "../config.ts"
+import { profileDataDir } from "../config.ts"
 import type { ProbeResult } from "./probe.ts"
 
 const CACHE_VERSION = 1
@@ -28,8 +28,8 @@ interface CacheFile {
   entries: Record<string, CachedProbe> // key: String(site.id)
 }
 
-export function stackCachePath(): string {
-  return join(configDir(), "stack-cache.json")
+export function stackCachePath(dir = profileDataDir()): string {
+  return join(dir, "stack-cache.json")
 }
 
 // A cached probe is considered stale when the site's relevant shape changes.
@@ -40,6 +40,9 @@ export function siteSignature(site: { is_wordpress: boolean; public_folder: stri
 }
 
 export class StackCache {
+  // Pinned to the account active when the cache was created, so a write that
+  // lands after an account switch still goes to its own account\'s file.
+  private readonly dir = profileDataDir()
   private entries = new Map<number, CachedProbe>()
   // Serializes disk writes so concurrent probes (batch mode) can't tear the
   // file or drop each other's updates. Each persist() runs after the previous.
@@ -49,7 +52,7 @@ export class StackCache {
   // simply yields an empty cache.
   load(): void {
     try {
-      const path = stackCachePath()
+      const path = stackCachePath(this.dir)
       if (!existsSync(path)) return
       const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
       if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
@@ -99,10 +102,10 @@ export class StackCache {
   }
 
   private async writeFile(): Promise<void> {
-    await mkdir(configDir(), { recursive: true })
+    await mkdir(this.dir, { recursive: true })
     const file: CacheFile = { version: CACHE_VERSION, entries: {} }
     for (const [id, entry] of this.entries) file.entries[String(id)] = entry
-    const path = stackCachePath()
+    const path = stackCachePath(this.dir)
     await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
     try {
       await chmod(path, 0o600)

package/src/lib/wpCli.ts

@@ -5,9 +5,9 @@
 // individual site's configured version, and can be missing extensions that
 // version's CLI SAPI never got configured with.
 //
-// Verified live 2026-07-09 on web4.wenmarkdigital.com: the system default had
+// Verified live 2026-07-09 on a production server: the system default had
 // drifted to 8.4, whose CLI lacked `mysqli` (its FPM pool likely never needed
-// it — no site there runs 8.4), while lp.anchoredconstructiontn.com's actual
+// it — no site there runs 8.4), while a site's actual
 // configured version (8.1) has a fully working php8.1-cli. Bare `wp` silently
 // ran under 8.4 and failed on anything touching $wpdb (post/user/plugin list,
 // option get) — while `wp core version`, and `wp db export/import/check/size`