switch-profile 2.0.0 → 2.1.0

package/README.md

@@ -1,32 +1,59 @@
 # switch-profile
 
-Switch between AWS profiles from your terminal. Type a few letters, press enter, and every AWS tool uses that account. SSO logins work on remote machines too (device code, clipboard over SSH, QR code), and each terminal can stay on its own account.
+<p align="center"><img src="docs/images/hero.webp" width="100%" alt="switch-profile illustration: a girl rides a rope lift up a tower of lit workshops"></p>
 
+**Jump between AWS accounts from your terminal in seconds, the way AWS recommends.**
+
+If you work across many AWS accounts (clients, environments, organizations), you switch accounts dozens of times a day. `switch-profile` turns that into a few keystrokes: type part of a name, account ID or client, press Enter, and every AWS tool in that terminal is on the right account, logged in and verified. It works the same on your laptop and on a remote machine over SSH, and it never asks you to manage access keys.
+
+```shell
+npx switch-profile
 ```
-┌   switch-profile  2.0.0
+
+```
+┌   switch-profile  2.1.0
 │
 │  ● acme-prod · Admin · 111111111111 · ap-southeast-2 · PROD · SSO ✓ auto-refresh · logged in 3h ago
 │
 ◆  Switch to · type a name, account, role or client
-│  Search: dev▌
-│  ● acme-dev        Admin     222222222222  ap-southeast-2   (used 2d ago)
+│  Search: dev█  (3 matches)
+│  ● acme-dev        Admin     222222222222  ap-southeast-2  used 2d ago
 │  ○ globex-dev      ReadOnly  333333333333  us-east-1
 │  ○ initech-dev     Admin     444444444444  eu-west-1
-└
+│
+│  [Log in] [Add] [Remove] [Log out] [Settings]
+└  ↑↓ choose · enter switch · tab actions · esc quit
 ```
 
-- **Fast picker.** Fuzzy search across profile name, account id, account name, role, SSO session (client) and region. The profiles you use most come first.
-- **One identity check per switch.** `switch-profile` calls `aws sts get-caller-identity` once, logs in if needed, then makes the profile the default.
-- **Auto-refresh.** It writes the profile's *settings* into `[default]`, never temporary credentials, so the AWS CLI, SDKs and Terraform refresh credentials on their own.
-- **Per-terminal.** With the `sp` shortcut, the current terminal also gets `AWS_PROFILE`, so different terminals can use different accounts. `sp` also adds tab-completion.
-- **Remote-friendly.** Over SSH, logins use a device code: the code is copied to your laptop's clipboard and the URL can be shown as a QR code.
-- **Import a whole portal.** `sp add` creates one profile per account and role of an IAM Identity Center portal.
-- **Script and agent friendly.** Never prompts when there is no terminal, `--json` output, stable exit codes.
+## Why it's great
+
+- **Seconds, not minutes.** Fuzzy search across profile name, account ID, account name, role, client and region, with your most-used accounts first, and every other action one Tab away. `sp acme prod` switches without even opening the home screen.
+- **Logged in when you need it.** If a session has expired, it logs you in on the spot, then never again until the session ends: credentials refresh on their own in the AWS CLI, SDKs and Terraform.
+- **Every terminal on its own account.** With the `sp` shortcut, each terminal keeps its own `AWS_PROFILE`, plus tab-completion of your profile names.
+- **Made for remote machines.** On a server reached over SSH, the login code lands in your laptop's clipboard, or scan a QR code with your phone.
+- **A whole client in one step.** `sp add` creates a profile for every account and role in an IAM Identity Center portal, and re-syncs it later.
+- **Scripts and AI agents welcome.** It never prompts without a terminal, offers `--json` output and stable exit codes.
+
+## Built on AWS best practices
+
+`switch-profile` does not invent its own security model. It follows what AWS recommends, lets the official AWS CLI do the sensitive work, and adds the guardrails that make switching accounts all day safe.
+
+- **Temporary credentials, not access keys.** AWS recommends that people sign in through an identity provider, such as IAM Identity Center (AWS SSO), and use short-lived credentials instead of long-lived access keys ([IAM best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)). `switch-profile` is built around SSO and console sign-in (`aws login`). Access keys still work, but it warns you before creating new ones.
+- **It never copies credentials.** Switching writes only a profile's *settings* into `[default]`. The AWS CLI and SDKs fetch short-lived credentials themselves and refresh them through `[sso-session]` ([AWS CLI SSO guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html)). There are no secrets in anything `switch-profile` writes, so nothing to leak and nothing to go stale.
+- **The AWS CLI does the logging in.** Logins run through `aws sso login` and `aws login`: browser sign-in on your machine, device code where there is no browser. `switch-profile` stores no tokens and has no telemetry. Its only network calls are the AWS CLI's own and npx fetching the package.
+- **Device codes, handled carefully.** Device-code approvals are a known phishing route, so they are used only where there is no browser, and the login screen tells you to approve only the exact code it shows.
+- **You always know which account you are in.** Every switch confirms the real identity with `aws sts get-caller-identity`. Production accounts are flagged in red. Environment variables that would silently override your choice (such as `AWS_ACCESS_KEY_ID`) are flagged, and `sp` clears them.
+- **One account per terminal.** `AWS_PROFILE` is scoped to a terminal, so switching in one window cannot move a deploy running in another.
+- **Careful with your files.** Edits to `~/.aws` are atomic, upgrades back up your files first, and the shell setup lives in one clearly marked block that you can remove from Settings at any time.
+- **Always the latest version.** Run through `npx`, every run uses the newest release: nothing to install, nothing to update.
 
 ## Table of Contents
 
 <!-- BEGIN toc -->
+- [Why it's great](#why-its-great)
+- [Built on AWS best practices](#built-on-aws-best-practices)
 - [Quick start](#quick-start)
+- [The home screen](#the-home-screen)
 - [Commands](#commands)
 - [Working on remote machines (SSH)](#working-on-remote-machines-ssh)
 - [Importing a client's accounts](#importing-a-clients-accounts)
@@ -62,19 +89,24 @@ sp acme-prod       # switch straight to a profile
 sp acme prod       # fuzzy match: switches if exactly one profile matches
 ```
 
-For speed, install it globally. `npx` checks the npm registry on every run, which adds a noticeable delay; `sp` uses the global command when it exists and falls back to `npx` otherwise.
-
-```shell
-npm install -g switch-profile
-```
+**Why npx?** It always runs the latest release, so you never have to update anything. `sp` uses `npx switch-profile@latest` under the hood. The cost is a second or two while npm checks for a newer version, and the tool needs a connection to AWS anyway. A global install (`npm install -g switch-profile`) also works, but then updating is up to you, and `sp` keeps using npx regardless.
 
 No profiles yet? `switch-profile` starts the **Add profiles** flow. To import every account of your company's or client's SSO portal, see [Importing a client's accounts](#importing-a-clients-accounts).
 
+## The home screen
+
+Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
+
+- **Type and press Enter** to switch. That's the whole path for everyday use.
+- **Tab** moves to the action bar below the list, which is always visible however many profiles you have: **Log in**, **Add**, **Remove**, **Log out**, **Settings**. Use ←→ to choose and Enter to open.
+- **Every action opens as a page and comes back** to the home screen when it's done. **Esc** goes back from a page, and quits from the home screen.
+- A switch ends the session, which is what lets `sp` set `AWS_PROFILE` in your terminal.
+
 ## Commands
 
 | Command | What it does |
 |---------|--------------|
-| `switch-profile [profile...]` | Opens the picker. With words: an exact name or a unique fuzzy match switches directly; otherwise the picker opens pre-filtered (or exits 3 when non-interactive). |
+| `switch-profile [profile...]` | Opens the home screen (search and switch, plus the action bar). With words: an exact name or a unique fuzzy match switches directly; otherwise the home screen opens pre-filtered (or exits 3 when non-interactive). |
 | `use <profile>` | Switches to a profile by its exact name (no fuzzy matching). |
 | `status [--json]` | Shows the default profile, its login state, and what this terminal uses. |
 | `login [profile] [--device\|--browser]` | Starts a fresh login now, even if the session is still valid. Defaults to this terminal's `AWS_PROFILE`, then the default profile. |
@@ -156,6 +188,8 @@ AWS_PROFILE=acme-dev terraform plan
 
 ## Settings
 
+Open **Settings** from the home screen's action bar (Tab, then → to Settings), or run it directly:
+
 ```shell
 sp settings
 ```
@@ -223,7 +257,7 @@ The completion registers only if `compinit` ran before the `switch-profile` bloc
 
 ### Commands still use the wrong account
 
-`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` in the environment override every profile, and `AWS_REGION` overrides the profile's region. The picker warns about them; switching with `sp` clears the credential variables (not the region).
+`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` in the environment override every profile, and `AWS_REGION` overrides the profile's region. The home screen warns about them; switching with `sp` clears the credential variables (not the region).
 
 ### AWS CLI not found
 

package/dist/cli.js

@@ -2836,6 +2836,30 @@ var require_src = __commonJS({
 });
 
 // node_modules/@clack/core/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  AutocompletePrompt: () => T$1,
+  CANCEL_SYMBOL: () => CANCEL_SYMBOL,
+  ConfirmPrompt: () => r,
+  DatePrompt: () => U,
+  GroupMultiSelectPrompt: () => u$2,
+  MultiLinePrompt: () => h,
+  MultiSelectPrompt: () => a,
+  PasswordPrompt: () => u$1,
+  Prompt: () => y,
+  SelectKeyPrompt: () => u3,
+  SelectPrompt: () => n$1,
+  TextPrompt: () => n2,
+  block: () => block,
+  getColumns: () => getColumns,
+  getRows: () => getRows,
+  isAccessible: () => isAccessible,
+  isCancel: () => isCancel,
+  runValidation: () => runValidation,
+  settings: () => settings,
+  updateSettings: () => updateSettings,
+  wrapTextWithPrefix: () => wrapTextWithPrefix
+});
 function findCursor(s, o2, l2) {
   if (!l2.some((r2) => !r2.disabled))
     return s;
@@ -3805,8 +3829,8 @@ ${i2}` : `${s}${(0, import_node_util.styleText)("inverse", r2)}${i2}`;
 });
 
 // node_modules/@clack/prompts/dist/index.mjs
-var dist_exports = {};
-__export(dist_exports, {
+var dist_exports2 = {};
+__export(dist_exports2, {
   CANCEL_SYMBOL: () => CANCEL_SYMBOL,
   MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
   SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
@@ -5261,7 +5285,7 @@ var require_ui = __commonJS({
       let h2 = Math.floor(m3 / 60);
       return h2 < 48 ? `${h2}h ago` : `${Math.floor(h2 / 24)}d ago`;
     }, spinner2 = (options) => {
-      let p4 = (init_dist4(), __toCommonJS(dist_exports));
+      let p4 = (init_dist4(), __toCommonJS(dist_exports2));
       if (process.stdout.isTTY && !env.ACCESSIBLE)
         return p4.spinner(options);
       let accessible = process.stdout.isTTY;
@@ -5277,7 +5301,7 @@ var require_ui = __commonJS({
         isCancelled: !1
       };
     }, timerSpinner = () => {
-      let p4 = (init_dist4(), __toCommonJS(dist_exports));
+      let p4 = (init_dist4(), __toCommonJS(dist_exports2));
       if (!process.stdout.isTTY || env.ACCESSIBLE)
         return spinner2();
       let frames = unicode2 ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["-", "\\", "|", "/"], timer = null, message = "", started = 0, i2 = 0, clear = () => process.stdout.write("\r\x1B[2K"), render = () => {
@@ -5327,7 +5351,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.0.0",
+      version: "2.1.0",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -5363,6 +5387,7 @@ var require_package = __commonJS({
       author: "Nicolas Dao",
       license: "BSD-3-Clause",
       devDependencies: {
+        "@clack/core": "^1.5.1",
         "@clack/prompts": "^1.8.1",
         "@eslint/js": "^10.0.1",
         chai: "^4.1.2",
@@ -6034,10 +6059,10 @@ var require_shell = __commonJS({
     var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
 	local __sp_file __sp_status
 	__sp_file="$(mktemp "\${TMPDIR:-/tmp}/switch-profile.XXXXXX")" || return 1
-	if command -v switch-profile >/dev/null 2>&1; then
-		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" switch-profile "$@"
+	if [ -n "\${SWITCH_PROFILE_DEV_BIN:-}" ]; then
+		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" "$SWITCH_PROFILE_DEV_BIN" "$@"
 	else
-		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" npx --yes switch-profile "$@"
+		SWITCH_PROFILE_SHELL=${shell} SWITCH_PROFILE_ENV_FILE="$__sp_file" npx --yes switch-profile@latest "$@"
 	fi
 	__sp_status=$?
 	if [ -s "$__sp_file" ]; then
@@ -6071,10 +6096,10 @@ fi`, BASH_COMPLETION = `_switch_profile_complete() {
 }
 complete -F _switch_profile_complete ${FUNCTION_NAME} switch-profile`, FISH_FUNCTION = `function ${FUNCTION_NAME}
 	set -l __sp_file (mktemp)
-	if type -q switch-profile
-		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file switch-profile $argv
+	if set -q SWITCH_PROFILE_DEV_BIN
+		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file $SWITCH_PROFILE_DEV_BIN $argv
 	else
-		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file npx --yes switch-profile $argv
+		env SWITCH_PROFILE_SHELL=fish SWITCH_PROFILE_ENV_FILE=$__sp_file npx --yes switch-profile@latest $argv
 	end
 	set -l __sp_status $status
 	if test -s $__sp_file
@@ -6099,7 +6124,7 @@ end`, POWERSHELL_FUNCTION = `function ${FUNCTION_NAME} {
 	$env:SWITCH_PROFILE_SHELL = 'powershell'
 	$env:SWITCH_PROFILE_ENV_FILE = $spFile
 	try {
-		if (Get-Command switch-profile -ErrorAction SilentlyContinue) { switch-profile @Rest } else { npx --yes switch-profile @Rest }
+		if ($env:SWITCH_PROFILE_DEV_BIN) { & $env:SWITCH_PROFILE_DEV_BIN @Rest } else { npx --yes switch-profile@latest @Rest }
 	} finally {
 		Remove-Item Env:\\SWITCH_PROFILE_SHELL -ErrorAction SilentlyContinue
 		Remove-Item Env:\\SWITCH_PROFILE_ENV_FILE -ErrorAction SilentlyContinue
@@ -6288,7 +6313,7 @@ var require_migrate = __commonJS({
 // src/commands/common.js
 var require_common = __commonJS({
   "src/commands/common.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
     }, ask = async (promise) => {
       let value = await promise;
       if (p4.isCancel(value))
@@ -7364,7 +7389,7 @@ var require_clipboard = __commonJS({
 // src/commands/login-flow.js
 var require_login_flow = __commonJS({
   "src/commands/login-flow.js"(exports2, module2) {
-    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
+    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
       let current = await settings2.read(), args = await aws.ssoLoginArgs(target, loginMode || settings2.getLoginMode(current)), legacyCli = !atLeast(await aws.getAwsCliVersion(), [2, 22, 0]), device = args.includes("--use-device-code") || legacyCli, remote = isRemoteSession(process.env, process.platform);
       if (!interactive)
         return plainLogin(args, label);
@@ -7445,10 +7470,74 @@ ${detail}` : ""}`, {
   }
 });
 
+// src/home.js
+var require_home = __commonJS({
+  "src/home.js"(exports2, module2) {
+    var { AutocompletePrompt } = (init_dist3(), __toCommonJS(dist_exports)), { S_BAR: S_BAR2, S_BAR_END: S_BAR_END2, S_RADIO_ACTIVE: S_RADIO_ACTIVE2, S_RADIO_INACTIVE: S_RADIO_INACTIVE2, symbol: symbol2, limitOptions: limitOptions2 } = (init_dist4(), __toCommonJS(dist_exports2)), ui2 = require_ui(), ACTION_PREFIX = "__action__:", nextFocus = (state, { name, char }) => {
+      let { area, index, count, hasRows } = state;
+      return name == "tab" ? { ...state, area: area == "list" || !hasRows ? "actions" : "list" } : area != "actions" ? state : name == "left" ? { ...state, index: (index - 1 + count) % count } : name == "right" ? { ...state, index: (index + 1) % count } : name == "return" ? { ...state, submit: !0 } : (name == "up" || name == "down") && hasRows ? { ...state, area: "list" } : char && char.length == 1 && char >= " " && hasRows ? { ...state, area: "list" } : state;
+    }, HomePrompt = class extends AutocompletePrompt {
+      constructor(opts) {
+        super(opts), this.actions = opts.actions, this.area = this.options.length ? "list" : "actions", this.actionIndex = 0, this.on("key", (char, key) => {
+          let next = nextFocus(
+            { area: this.area, index: this.actionIndex, count: this.actions.length, hasRows: this.filteredOptions.length > 0 },
+            { name: key && key.name, char }
+          );
+          this.area = next.area, this.actionIndex = next.index, next.submit && (this.value = ACTION_PREFIX + this.actions[this.actionIndex].key);
+        });
+      }
+    }, actionBar = (actions, focused) => actions.map((a2, i2) => {
+      let label = ` ${a2.label} `;
+      return i2 === focused ? ui2.style(["inverse", "cyan"], label) : ui2.dim(`[${label.trim()}]`);
+    }).join(" "), home = ({ message, rows, actions, initialQuery, maxItems, input, output }) => new HomePrompt({
+      actions,
+      input,
+      output,
+      initialUserInput: initialQuery || void 0,
+      options() {
+        return rows(this.userInput || "");
+      },
+      validate: (value) => value === void 0 ? "Nothing matches: change the search, or press Tab for actions." : void 0,
+      render() {
+        let gray = (s) => ui2.style("gray", s), title = `${gray(S_BAR2)}
+${symbol2(this.state)}  ${message}`;
+        if (this.state == "submit") {
+          let v = String(this.value || "");
+          if (v.startsWith(ACTION_PREFIX)) {
+            let label = (actions.find((a2) => ACTION_PREFIX + a2.key == v) || {}).label || "";
+            return `${gray(S_BAR2)}
+${symbol2(this.state)}  ${ui2.dim("switch-profile \u203A")} ${ui2.strong(label)}`;
+          }
+          return `${title}
+${gray(S_BAR2)}  ${ui2.dim(v)}`;
+        }
+        if (this.state == "cancel")
+          return `${title}
+${gray(S_BAR2)}`;
+        let bar = ui2.style(this.state == "error" ? "yellow" : "cyan", S_BAR2), end = ui2.style(this.state == "error" ? "yellow" : "cyan", S_BAR_END2), onList = this.area == "list", count = this.filteredOptions.length, lines = [title];
+        return lines.push(`${bar}  ${ui2.dim("Search:")} ${this.userInputWithCursor}${this.userInput ? ui2.dim(`  (${count} match${count == 1 ? "" : "es"})`) : ""}`), count ? limitOptions2({
+          cursor: this.cursor,
+          options: this.filteredOptions,
+          maxItems,
+          output: this.output,
+          rowPadding: 8,
+          style: (option, active) => active && onList ? `${ui2.style("green", S_RADIO_ACTIVE2)} ${option.label}${option.hint ? ui2.dim(`  ${option.hint}`) : ""}` : `${ui2.dim(S_RADIO_INACTIVE2)} ${ui2.dim(option.label)}`
+        }).forEach((line) => lines.push(`${bar}  ${line}`)) : lines.push(`${bar}  ${ui2.warn(this.options.length ? "No matches" : "No profiles yet: Tab to Add")}`), lines.push(bar), lines.push(`${bar}  ${actionBar(actions, onList ? -1 : this.actionIndex)}`), this.state == "error" && lines.push(`${bar}  ${ui2.warn(this.error)}`), lines.push(`${end}  ${ui2.dim(onList ? "\u2191\u2193 choose \xB7 enter switch \xB7 tab actions \xB7 esc quit" : "\u2190\u2192 choose \xB7 enter open \xB7 tab back to the list \xB7 esc quit")}`), lines.join(`
+`);
+      }
+    }).prompt();
+    module2.exports = {
+      ACTION_PREFIX,
+      nextFocus,
+      home
+    };
+  }
+});
+
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { exec: exec2 } = require_core(), { ask, preflight, loadState, loginKey, describe, loginState } = require_common(), { ssoLogin } = require_login_flow(), ACTION = "__action__:", header = async (state) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7463,7 +7552,7 @@ var require_switch = __commonJS({
         lines.push(ui2.dim("No default profile yet. Pick one below."));
       let terminal = process.env.AWS_PROFILE;
       terminal && terminal != state.defaultName && lines.push(`${ui2.dim("This terminal uses")} ${ui2.accent(terminal)} ${ui2.dim("(AWS_PROFILE)")}`), p4.log.message(lines.join(`
-`)), warnEnv();
+`)), warnings && warnEnv();
     }, warnEnv = () => {
       let set = shell.CLEARED_VARS.filter((v) => process.env[v]);
       if (!set.length)
@@ -7472,11 +7561,11 @@ var require_switch = __commonJS({
       p4.log.warn(`${set.join(", ")} ${set.length > 1 ? "are" : "is"} set in this terminal and override${set.length > 1 ? "" : "s"} profiles.
 ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${set.length > 1 ? "them" : "it"}, or switch with ${shell.FUNCTION_NAME} to clear ${set.length > 1 ? "them" : "it"} automatically.`)}`);
     }, ACTIONS = [
-      { key: "add", icon: "+", label: "Add profiles", hint: "import accounts from an SSO portal, or create one" },
-      { key: "login", icon: "\u21BB", label: "Log in again", hint: "start a fresh SSO session for the current profile" },
-      { key: "remove", icon: "\u2212", label: "Remove profiles" },
-      { key: "logout", icon: "\u23FB", label: "Log out", hint: "end every SSO session on this machine" },
-      { key: "settings", icon: "\u2699", label: "Settings" }
+      { key: "login", label: "Log in" },
+      { key: "add", label: "Add" },
+      { key: "remove", label: "Remove" },
+      { key: "logout", label: "Log out" },
+      { key: "settings", label: "Settings" }
     ], buildRows = (profiles, state) => {
       let cols = ui2.columns(), showRole = cols >= 80, showRegion = cols >= 100, roleOf = (x2) => x2.sso_role_name || (x2.kind == "keys" ? "access keys" : x2.kind == "login" ? "console sign-in" : x2.kind), all = state.profiles, nameWidth = Math.min(Math.max(...all.map((x2) => x2.name.length), 8), 32), roleWidth = Math.min(Math.max(0, ...all.map((x2) => roleOf(x2).length)), 22), usage = state.settings.usage || {};
       return profiles.map((x2) => {
@@ -7489,20 +7578,13 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
         ].filter((v) => v !== null).join("  ").trimEnd(), hint = x2.name == state.defaultName ? "current default" : [x2.accountName, usage[x2.name] ? `used ${ui2.ago(usage[x2.name].last)}` : null].filter(Boolean).join(" \xB7 ");
         return { value: x2.name, label, hint: hint || void 0 };
       });
-    }, pick = async (state, initialQuery) => {
-      let actions = ACTIONS.map((a2) => ({ value: ACTION + a2.key, label: `${ui2.accent(ui2.unicode ? a2.icon : ">")} ${a2.label}`, hint: a2.hint, text: a2.label.toLowerCase() })), maxItems = Math.max(5, Math.min(14, (process.stdout.rows || 24) - 10));
-      return ask(p4.autocomplete({
-        message: `Switch to ${ui2.dim("\xB7 type a name, account, role or client")}`,
-        maxItems,
-        initialUserInput: initialQuery || void 0,
-        // Rows are already filtered and ranked below; clack would otherwise re-filter them by substring.
-        filter: () => !0,
-        options() {
-          let query = this.userInput || "", ranked = rank.rankProfiles(state.profiles, { query, usage: state.settings.usage, current: state.defaultName }), q = query.trim().toLowerCase(), matchingActions = actions.filter((a2) => !q || a2.text.includes(q)).map((a2) => ({ value: a2.value, label: a2.label, hint: a2.hint }));
-          return [...buildRows(ranked, state), ...matchingActions];
-        }
-      }));
-    }, connect = async (profile, state, { interactive, quiet, force }) => {
+    }, pick = (state, initialQuery) => home({
+      message: `Switch to ${ui2.dim("\xB7 type a name, account, role or client")}`,
+      maxItems: Math.max(5, Math.min(14, (process.stdout.rows || 24) - 14)),
+      initialQuery,
+      actions: ACTIONS,
+      rows: (query) => buildRows(rank.rankProfiles(state.profiles, { query, usage: state.settings.usage, current: state.defaultName }), state)
+    }), connect = async (profile, state, { interactive, quiet, force }) => {
       let spin = quiet ? null : ui2.spinner(), tryIdentity = async () => {
         spin && spin.start(`Connecting to ${profile.name}`);
         try {
@@ -7523,7 +7605,7 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
         throw new ui2.CliError(`Logged in, but ${profile.name} still has no access.`, { hint: firstLine(result.message) });
       return result;
     }, firstLine = (text2) => String(text2 || "").trim().split(`
-`).filter(Boolean).slice(-1)[0], switchTo = async (profile, state, opts) => {
+`).filter(Boolean).slice(-1)[0], switchTo = async (profile, state, opts) => (await doSwitch(profile, state, opts), { switched: !0 }), doSwitch = async (profile, state, opts) => {
       let { interactive, json } = opts, identity = await connect(profile, state, { interactive, quiet: json, force: opts.force }), [defaultErrors] = await aws.setDefaultProfile(profile.name);
       if (defaultErrors)
         throw new ui2.CliError(ui2.errorsMessage(defaultErrors));
@@ -7574,10 +7656,39 @@ ${ui2.dim("Tip: enable per-terminal switching in Settings.")}` : ""}`);
     }, enableShortcut = async () => {
       let installed = await shell.install(settings2.CLI_VERSION);
       p4.log.success(`Added ${ui2.accent(shell.FUNCTION_NAME)} to ${installed.files.map(shell.tilde).join(", ")}
-${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name == "powershell" && p4.log.message(ui2.dim("If PowerShell refuses to load your profile: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned")), await exec2(`${process.platform == "win32" ? "where" : "which"} switch-profile`).then(() => !0, () => !1) || p4.log.message(ui2.dim(`Tip: npm install -g switch-profile makes ${shell.FUNCTION_NAME} start instantly (npx checks the registry on every run).`));
+${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name == "powershell" && p4.log.message(ui2.dim("If PowerShell refuses to load your profile: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned"));
     }, runAction = async (key, state, opts) => {
       let commands2 = require_commands();
       return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });
+    }, routeChoice = (choice) => {
+      if (p4.isCancel(choice))
+        return { type: "quit" };
+      let value = String(choice);
+      return value.startsWith(ACTION_PREFIX) ? { type: "page", key: value.slice(ACTION_PREFIX.length) } : { type: "switch", name: value };
+    }, afterPage = (result, err) => err ? err instanceof CancelError2 ? "back" : err instanceof ui2.CliError ? "error" : "throw" : result && result.switched ? "exit" : "home", homeLoop = async (state, opts, initialQuery) => {
+      let first = !0;
+      for (; ; ) {
+        await header(state, { warnings: first });
+        let route = routeChoice(await pick(state, first ? initialQuery : void 0));
+        if (first = !1, route.type == "quit") {
+          p4.outro(ui2.dim(`Bye ${ui2.unicode ? "\u{1F44B}" : ""}`));
+          return;
+        }
+        if (route.type == "switch")
+          return switchTo(state.profiles.find((x2) => x2.name == route.name), state, opts);
+        let result, error;
+        try {
+          result = await runAction(route.key, state, opts);
+        } catch (err) {
+          error = err;
+        }
+        let next = afterPage(result, error);
+        if (next == "exit")
+          return result;
+        if (next == "throw")
+          throw error;
+        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && ui2.printError(error), state = await loadState();
+      }
     }, switchCommand = async (query, opts) => {
       let interactive = ui2.isInteractive(opts);
       await preflight({ interactive, quiet: opts.json });
@@ -7598,11 +7709,11 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
           });
       } else if (!interactive)
         throw new ui2.CliError("Which profile? Pass its name.", { code: 3, hint: `e.g. switch-profile ${state.profiles[0].name}` });
-      await header(state);
-      let choice = await pick(state, query);
-      return choice.startsWith(ACTION) ? runAction(choice.slice(ACTION.length), state, { ...opts, interactive }) : switchTo(state.profiles.find((x2) => x2.name == choice), state, { ...opts, interactive });
+      return homeLoop(state, { ...opts, interactive }, query);
     };
     module2.exports = {
+      routeChoice,
+      afterPage,
       switchCommand,
       switchTo,
       connect,
@@ -7615,7 +7726,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
 // src/commands/index.js
 var require_commands = __commonJS({
   "src/commands/index.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
       !opts.fromPicker && !opts.json && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
     }, begin = async (opts, { needsInput } = {}) => {
       let interactive = ui2.isInteractive(opts);
@@ -7887,7 +7998,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
 });
 
 // src/cli.js
-var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports)), ui = require_ui(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
+var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports2)), ui = require_ui(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
 process.env.AWS_CLI_AGENT_TOOLKIT_HINT_DISABLED = "true";
 var EXAMPLES = `
 Examples:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"
@@ -36,6 +36,7 @@
   "author": "Nicolas Dao",
   "license": "BSD-3-Clause",
   "devDependencies": {
+    "@clack/core": "^1.5.1",
     "@clack/prompts": "^1.8.1",
     "@eslint/js": "^10.0.1",
     "chai": "^4.1.2",