switch-profile 2.0.1 → 2.2.0

package/README.md

@@ -11,21 +11,23 @@ npx switch-profile
 ```
 
 ```
-┌   switch-profile  2.0.0
+┌   switch-profile  2.1.0
 │
 │  ● acme-prod · Admin · 111111111111 · ap-southeast-2 · PROD · SSO ✓ auto-refresh · logged in 3h ago
 │
 ◆  Switch to · type a name, account, role or client
-│  Search: dev▌
-│  ● acme-dev        Admin     222222222222  ap-southeast-2   (used 2d ago)
+│  Search: dev█  (3 matches)
+│  ● acme-dev        Admin     222222222222  ap-southeast-2  used 2d ago
 │  ○ globex-dev      ReadOnly  333333333333  us-east-1
 │  ○ initech-dev     Admin     444444444444  eu-west-1
-└
+│
+│  [Log in] [Add] [Remove] [Log out] [Settings]
+└  ↑↓ choose · enter switch · tab actions · esc quit
 ```
 
 ## Why it's great
 
-- **Seconds, not minutes.** Fuzzy search across profile name, account ID, account name, role, client and region, with your most-used accounts first. `sp acme prod` switches without even opening the picker.
+- **Seconds, not minutes.** Fuzzy search across profile name, account ID, account name, role, client and region, with your most-used accounts first, and every other action one Tab away. `sp acme prod` switches without even opening the home screen.
 - **Logged in when you need it.** If a session has expired, it logs you in on the spot, then never again until the session ends: credentials refresh on their own in the AWS CLI, SDKs and Terraform.
 - **Every terminal on its own account.** With the `sp` shortcut, each terminal keeps its own `AWS_PROFILE`, plus tab-completion of your profile names.
 - **Made for remote machines.** On a server reached over SSH, the login code lands in your laptop's clipboard, or scan a QR code with your phone.
@@ -51,6 +53,7 @@ npx switch-profile
 - [Why it's great](#why-its-great)
 - [Built on AWS best practices](#built-on-aws-best-practices)
 - [Quick start](#quick-start)
+- [The home screen](#the-home-screen)
 - [Commands](#commands)
 - [Working on remote machines (SSH)](#working-on-remote-machines-ssh)
 - [Importing a client's accounts](#importing-a-clients-accounts)
@@ -90,11 +93,20 @@ sp acme prod       # fuzzy match: switches if exactly one profile matches
 
 No profiles yet? `switch-profile` starts the **Add profiles** flow. To import every account of your company's or client's SSO portal, see [Importing a client's accounts](#importing-a-clients-accounts).
 
+## The home screen
+
+Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
+
+- **Type and press Enter** to switch. That's the whole path for everyday use.
+- **Tab** moves to the action bar below the list, which is always visible however many profiles you have: **Log in**, **Add**, **Remove**, **Log out**, **Settings**. Use ←→ to choose and Enter to open.
+- **Every action opens as a page and comes back** to the home screen when it's done. **Esc** goes back from a page, and quits from the home screen.
+- A switch ends the session, which is what lets `sp` set `AWS_PROFILE` in your terminal.
+
 ## Commands
 
 | Command | What it does |
 |---------|--------------|
-| `switch-profile [profile...]` | Opens the picker. With words: an exact name or a unique fuzzy match switches directly; otherwise the picker opens pre-filtered (or exits 3 when non-interactive). |
+| `switch-profile [profile...]` | Opens the home screen (search and switch, plus the action bar). With words: an exact name or a unique fuzzy match switches directly; otherwise the home screen opens pre-filtered (or exits 3 when non-interactive). |
 | `use <profile>` | Switches to a profile by its exact name (no fuzzy matching). |
 | `status [--json]` | Shows the default profile, its login state, and what this terminal uses. |
 | `login [profile] [--device\|--browser]` | Starts a fresh login now, even if the session is still valid. Defaults to this terminal's `AWS_PROFILE`, then the default profile. |
@@ -142,7 +154,7 @@ sp add          # then choose "Accounts from an SSO portal"
 1. Pick an existing `[sso-session]` or create one: start URL (e.g. `https://acme.awsapps.com/start`), SSO region (where Identity Center lives, not where you deploy), and a short name, usually the client.
 2. Log in if needed.
 3. `switch-profile` lists every account and role you can access, then asks for a default region and a name prefix. Profiles are named `<prefix>-<account-name>-<role>`, for example `acme-prod-workloads-admin`.
-4. A preview shows the new profiles, the ones already set up, and the ones that no longer exist. Confirm to write them.
+4. A preview shows the new profiles, the ones already set up, and the ones that no longer exist. Then pick the new profiles to add: all are selected, so press Enter to add everything, or untick the ones you don't want (type to search by name, account or role).
 
 Run it again later to pick up new accounts. Account/role pairs that already have a profile are never duplicated, whatever its name. Generated profiles that no longer exist can be pruned (after a backup); profiles you wrote by hand are never pruned.
 
@@ -176,6 +188,8 @@ AWS_PROFILE=acme-dev terraform plan
 
 ## Settings
 
+Open **Settings** from the home screen's action bar (Tab, then → to Settings), or run it directly:
+
 ```shell
 sp settings
 ```
@@ -243,7 +257,7 @@ The completion registers only if `compinit` ran before the `switch-profile` bloc
 
 ### Commands still use the wrong account
 
-`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` in the environment override every profile, and `AWS_REGION` overrides the profile's region. The picker warns about them; switching with `sp` clears the credential variables (not the region).
+`AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` in the environment override every profile, and `AWS_REGION` overrides the profile's region. The home screen warns about them; switching with `sp` clears the credential variables (not the region).
 
 ### AWS CLI not found
 

package/dist/cli.js

@@ -2836,6 +2836,30 @@ var require_src = __commonJS({
 });
 
 // node_modules/@clack/core/dist/index.mjs
+var dist_exports = {};
+__export(dist_exports, {
+  AutocompletePrompt: () => T$1,
+  CANCEL_SYMBOL: () => CANCEL_SYMBOL,
+  ConfirmPrompt: () => r,
+  DatePrompt: () => U,
+  GroupMultiSelectPrompt: () => u$2,
+  MultiLinePrompt: () => h,
+  MultiSelectPrompt: () => a,
+  PasswordPrompt: () => u$1,
+  Prompt: () => y,
+  SelectKeyPrompt: () => u3,
+  SelectPrompt: () => n$1,
+  TextPrompt: () => n2,
+  block: () => block,
+  getColumns: () => getColumns,
+  getRows: () => getRows,
+  isAccessible: () => isAccessible,
+  isCancel: () => isCancel,
+  runValidation: () => runValidation,
+  settings: () => settings,
+  updateSettings: () => updateSettings,
+  wrapTextWithPrefix: () => wrapTextWithPrefix
+});
 function findCursor(s, o2, l2) {
   if (!l2.some((r2) => !r2.disabled))
     return s;
@@ -3805,8 +3829,8 @@ ${i2}` : `${s}${(0, import_node_util.styleText)("inverse", r2)}${i2}`;
 });
 
 // node_modules/@clack/prompts/dist/index.mjs
-var dist_exports = {};
-__export(dist_exports, {
+var dist_exports2 = {};
+__export(dist_exports2, {
   CANCEL_SYMBOL: () => CANCEL_SYMBOL,
   MULTISELECT_INSTRUCTIONS: () => MULTISELECT_INSTRUCTIONS,
   SELECT_INSTRUCTIONS: () => SELECT_INSTRUCTIONS,
@@ -5261,7 +5285,7 @@ var require_ui = __commonJS({
       let h2 = Math.floor(m3 / 60);
       return h2 < 48 ? `${h2}h ago` : `${Math.floor(h2 / 24)}d ago`;
     }, spinner2 = (options) => {
-      let p4 = (init_dist4(), __toCommonJS(dist_exports));
+      let p4 = (init_dist4(), __toCommonJS(dist_exports2));
       if (process.stdout.isTTY && !env.ACCESSIBLE)
         return p4.spinner(options);
       let accessible = process.stdout.isTTY;
@@ -5277,7 +5301,7 @@ var require_ui = __commonJS({
         isCancelled: !1
       };
     }, timerSpinner = () => {
-      let p4 = (init_dist4(), __toCommonJS(dist_exports));
+      let p4 = (init_dist4(), __toCommonJS(dist_exports2));
       if (!process.stdout.isTTY || env.ACCESSIBLE)
         return spinner2();
       let frames = unicode2 ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["-", "\\", "|", "/"], timer = null, message = "", started = 0, i2 = 0, clear = () => process.stdout.write("\r\x1B[2K"), render = () => {
@@ -5327,7 +5351,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.0.1",
+      version: "2.2.0",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -5363,6 +5387,7 @@ var require_package = __commonJS({
       author: "Nicolas Dao",
       license: "BSD-3-Clause",
       devDependencies: {
+        "@clack/core": "^1.5.1",
         "@clack/prompts": "^1.8.1",
         "@eslint/js": "^10.0.1",
         chai: "^4.1.2",
@@ -5371,7 +5396,7 @@ var require_package = __commonJS({
         eslint: "^10.0.0",
         fuzzysort: "^3.1.0",
         globals: "^17.13.0",
-        mocha: "^8.2.1",
+        mocha: "^11.8.0",
         uqr: "^0.1.3"
       },
       files: [
@@ -5615,14 +5640,16 @@ var require_transforms = __commonJS({
         login_session: params.login_session || null
       };
       return p4.isSso = !!p4.sso_start_url, p4.isLegacySso = p4.isSso && !p4.sso_session, p4.kind = p4.isSso ? "sso" : p4.login_session ? "login" : p4.role_arn ? "role" : params.credential_process ? "process" : "keys", !p4.sso_account_id && p4.role_arn && (p4.sso_account_id = (p4.role_arn.match(/^arn:aws[^:]*:iam::(\d{12}):/) || [])[1] || null), p4;
-    }), slug = (text2) => String(text2 || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""), generatedProfileName = (prefix, accountName, accountId, roleName) => [slug(prefix), slug(accountName) || accountId, slug(roleName)].filter(Boolean).join("-"), populateSsoProfiles = (configStr, { ssoSession, entries, region, prefix, prune, version }) => {
-      let config = configStr, profiles = listProfiles(config), session = ini.getSection(config, `sso-session ${ssoSession}`) || {}, samePortal = (p4) => p4.sso_session == ssoSession || p4.sso_start_url && p4.sso_start_url == session.sso_start_url, key = (accountId, roleName) => `${accountId}/${roleName}`, byKey = new Map(profiles.filter((p4) => p4.isSso && samePortal(p4)).map((p4) => [key(p4.sso_account_id, p4.sso_role_name), p4])), taken = new Set(profiles.map((p4) => p4.name)), wanted = new Set(entries.map((e) => key(e.accountId, e.roleName))), added = [], existing = [];
+    }), slug = (text2) => String(text2 || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""), generatedProfileName = (prefix, accountName, accountId, roleName) => [slug(prefix), slug(accountName) || accountId, slug(roleName)].filter(Boolean).join("-"), ssoEntryKey = (accountId, roleName) => `${accountId}/${roleName}`, populateSsoProfiles = (configStr, { ssoSession, entries, region, prefix, prune, include, version }) => {
+      let config = configStr, profiles = listProfiles(config), session = ini.getSection(config, `sso-session ${ssoSession}`) || {}, samePortal = (p4) => p4.sso_session == ssoSession || p4.sso_start_url && p4.sso_start_url == session.sso_start_url, key = ssoEntryKey, included = include ? new Set(include) : null, byKey = new Map(profiles.filter((p4) => p4.isSso && samePortal(p4)).map((p4) => [key(p4.sso_account_id, p4.sso_role_name), p4])), taken = new Set(profiles.map((p4) => p4.name)), wanted = new Set(entries.map((e) => key(e.accountId, e.roleName))), added = [], addedEntries = [], existing = [];
       for (let e of entries) {
         let found = byKey.get(key(e.accountId, e.roleName));
         if (found) {
           existing.push(found.name);
           continue;
         }
+        if (included && !included.has(key(e.accountId, e.roleName)))
+          continue;
         let base = generatedProfileName(prefix || ssoSession, e.accountName, e.accountId, e.roleName), name = base;
         for (let i2 = 2; taken.has(name); i2++)
           name = `${base}-${i2}`;
@@ -5635,13 +5662,13 @@ var require_transforms = __commonJS({
           ...e.accountName ? [[ACCOUNT_NAME_KEY, e.accountName]] : [],
           [GENERATED_KEY, ssoSession],
           [VERSION_KEY, version]
-        ]), added.push(name);
+        ]), added.push(name), addedEntries.push({ name, accountId: e.accountId, accountName: e.accountName, roleName: e.roleName });
       }
       let stale = profiles.filter((p4) => p4.generated == ssoSession && !wanted.has(key(p4.sso_account_id, p4.sso_role_name))).map((p4) => p4.name), removed = [];
       if (prune)
         for (let name of stale)
           config = ini.removeSection(config, configSectionName(config, name)), removed.push(name);
-      return { config, added, existing, stale, removed };
+      return { config, added, addedEntries, existing, stale, removed };
     }, listSsoSessions = (configStr) => ini.listSections(configStr).filter((s) => s.startsWith("sso-session ")).map((s) => ({ name: s.replace(/^sso-session\s+/, ""), ...ini.getSection(configStr, s) })), addSsoSession = (configStr, { name, startUrl, region, version }) => ini.getSection(configStr, `sso-session ${name}`) ? configStr : ini.setSection(configStr, `sso-session ${name}`, [
       ["sso_start_url", startUrl],
       ["sso_region", region],
@@ -5653,6 +5680,7 @@ var require_transforms = __commonJS({
       ACCOUNT_NAME_KEY,
       generatedProfileName,
       populateSsoProfiles,
+      ssoEntryKey,
       listSsoSessions,
       addSsoSession,
       NAME_KEY,
@@ -6288,7 +6316,7 @@ var require_migrate = __commonJS({
 // src/commands/common.js
 var require_common = __commonJS({
   "src/commands/common.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
     }, ask = async (promise) => {
       let value = await promise;
       if (p4.isCancel(value))
@@ -7364,7 +7392,7 @@ var require_clipboard = __commonJS({
 // src/commands/login-flow.js
 var require_login_flow = __commonJS({
   "src/commands/login-flow.js"(exports2, module2) {
-    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
+    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
       let current = await settings2.read(), args = await aws.ssoLoginArgs(target, loginMode || settings2.getLoginMode(current)), legacyCli = !atLeast(await aws.getAwsCliVersion(), [2, 22, 0]), device = args.includes("--use-device-code") || legacyCli, remote = isRemoteSession(process.env, process.platform);
       if (!interactive)
         return plainLogin(args, label);
@@ -7445,10 +7473,74 @@ ${detail}` : ""}`, {
   }
 });
 
+// src/home.js
+var require_home = __commonJS({
+  "src/home.js"(exports2, module2) {
+    var { AutocompletePrompt } = (init_dist3(), __toCommonJS(dist_exports)), { S_BAR: S_BAR2, S_BAR_END: S_BAR_END2, S_RADIO_ACTIVE: S_RADIO_ACTIVE2, S_RADIO_INACTIVE: S_RADIO_INACTIVE2, symbol: symbol2, limitOptions: limitOptions2 } = (init_dist4(), __toCommonJS(dist_exports2)), ui2 = require_ui(), ACTION_PREFIX = "__action__:", nextFocus = (state, { name, char }) => {
+      let { area, index, count, hasRows } = state;
+      return name == "tab" ? { ...state, area: area == "list" || !hasRows ? "actions" : "list" } : area != "actions" ? state : name == "left" ? { ...state, index: (index - 1 + count) % count } : name == "right" ? { ...state, index: (index + 1) % count } : name == "return" ? { ...state, submit: !0 } : (name == "up" || name == "down") && hasRows ? { ...state, area: "list" } : char && char.length == 1 && char >= " " && hasRows ? { ...state, area: "list" } : state;
+    }, HomePrompt = class extends AutocompletePrompt {
+      constructor(opts) {
+        super(opts), this.actions = opts.actions, this.area = this.options.length ? "list" : "actions", this.actionIndex = 0, this.on("key", (char, key) => {
+          let next = nextFocus(
+            { area: this.area, index: this.actionIndex, count: this.actions.length, hasRows: this.filteredOptions.length > 0 },
+            { name: key && key.name, char }
+          );
+          this.area = next.area, this.actionIndex = next.index, next.submit && (this.value = ACTION_PREFIX + this.actions[this.actionIndex].key);
+        });
+      }
+    }, actionBar = (actions, focused) => actions.map((a2, i2) => {
+      let label = ` ${a2.label} `;
+      return i2 === focused ? ui2.style(["inverse", "cyan"], label) : ui2.dim(`[${label.trim()}]`);
+    }).join(" "), home = ({ message, rows, actions, initialQuery, maxItems, input, output }) => new HomePrompt({
+      actions,
+      input,
+      output,
+      initialUserInput: initialQuery || void 0,
+      options() {
+        return rows(this.userInput || "");
+      },
+      validate: (value) => value === void 0 ? "Nothing matches: change the search, or press Tab for actions." : void 0,
+      render() {
+        let gray = (s) => ui2.style("gray", s), title = `${gray(S_BAR2)}
+${symbol2(this.state)}  ${message}`;
+        if (this.state == "submit") {
+          let v = String(this.value || "");
+          if (v.startsWith(ACTION_PREFIX)) {
+            let label = (actions.find((a2) => ACTION_PREFIX + a2.key == v) || {}).label || "";
+            return `${gray(S_BAR2)}
+${symbol2(this.state)}  ${ui2.dim("switch-profile \u203A")} ${ui2.strong(label)}`;
+          }
+          return `${title}
+${gray(S_BAR2)}  ${ui2.dim(v)}`;
+        }
+        if (this.state == "cancel")
+          return `${title}
+${gray(S_BAR2)}`;
+        let bar = ui2.style(this.state == "error" ? "yellow" : "cyan", S_BAR2), end = ui2.style(this.state == "error" ? "yellow" : "cyan", S_BAR_END2), onList = this.area == "list", count = this.filteredOptions.length, lines = [title];
+        return lines.push(`${bar}  ${ui2.dim("Search:")} ${this.userInputWithCursor}${this.userInput ? ui2.dim(`  (${count} match${count == 1 ? "" : "es"})`) : ""}`), count ? limitOptions2({
+          cursor: this.cursor,
+          options: this.filteredOptions,
+          maxItems,
+          output: this.output,
+          rowPadding: 8,
+          style: (option, active) => active && onList ? `${ui2.style("green", S_RADIO_ACTIVE2)} ${option.label}${option.hint ? ui2.dim(`  ${option.hint}`) : ""}` : `${ui2.dim(S_RADIO_INACTIVE2)} ${ui2.dim(option.label)}`
+        }).forEach((line) => lines.push(`${bar}  ${line}`)) : lines.push(`${bar}  ${ui2.warn(this.options.length ? "No matches" : "No profiles yet: Tab to Add")}`), lines.push(bar), lines.push(`${bar}  ${actionBar(actions, onList ? -1 : this.actionIndex)}`), this.state == "error" && lines.push(`${bar}  ${ui2.warn(this.error)}`), lines.push(`${end}  ${ui2.dim(onList ? "\u2191\u2193 choose \xB7 enter switch \xB7 tab actions \xB7 esc quit" : "\u2190\u2192 choose \xB7 enter open \xB7 tab back to the list \xB7 esc quit")}`), lines.join(`
+`);
+      }
+    }).prompt();
+    module2.exports = {
+      ACTION_PREFIX,
+      nextFocus,
+      home
+    };
+  }
+});
+
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState } = require_common(), { ssoLogin } = require_login_flow(), ACTION = "__action__:", header = async (state) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7463,7 +7555,7 @@ var require_switch = __commonJS({
         lines.push(ui2.dim("No default profile yet. Pick one below."));
       let terminal = process.env.AWS_PROFILE;
       terminal && terminal != state.defaultName && lines.push(`${ui2.dim("This terminal uses")} ${ui2.accent(terminal)} ${ui2.dim("(AWS_PROFILE)")}`), p4.log.message(lines.join(`
-`)), warnEnv();
+`)), warnings && warnEnv();
     }, warnEnv = () => {
       let set = shell.CLEARED_VARS.filter((v) => process.env[v]);
       if (!set.length)
@@ -7472,11 +7564,11 @@ var require_switch = __commonJS({
       p4.log.warn(`${set.join(", ")} ${set.length > 1 ? "are" : "is"} set in this terminal and override${set.length > 1 ? "" : "s"} profiles.
 ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${set.length > 1 ? "them" : "it"}, or switch with ${shell.FUNCTION_NAME} to clear ${set.length > 1 ? "them" : "it"} automatically.`)}`);
     }, ACTIONS = [
-      { key: "add", icon: "+", label: "Add profiles", hint: "import accounts from an SSO portal, or create one" },
-      { key: "login", icon: "\u21BB", label: "Log in again", hint: "start a fresh SSO session for the current profile" },
-      { key: "remove", icon: "\u2212", label: "Remove profiles" },
-      { key: "logout", icon: "\u23FB", label: "Log out", hint: "end every SSO session on this machine" },
-      { key: "settings", icon: "\u2699", label: "Settings" }
+      { key: "login", label: "Log in" },
+      { key: "add", label: "Add" },
+      { key: "remove", label: "Remove" },
+      { key: "logout", label: "Log out" },
+      { key: "settings", label: "Settings" }
     ], buildRows = (profiles, state) => {
       let cols = ui2.columns(), showRole = cols >= 80, showRegion = cols >= 100, roleOf = (x2) => x2.sso_role_name || (x2.kind == "keys" ? "access keys" : x2.kind == "login" ? "console sign-in" : x2.kind), all = state.profiles, nameWidth = Math.min(Math.max(...all.map((x2) => x2.name.length), 8), 32), roleWidth = Math.min(Math.max(0, ...all.map((x2) => roleOf(x2).length)), 22), usage = state.settings.usage || {};
       return profiles.map((x2) => {
@@ -7489,20 +7581,13 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
         ].filter((v) => v !== null).join("  ").trimEnd(), hint = x2.name == state.defaultName ? "current default" : [x2.accountName, usage[x2.name] ? `used ${ui2.ago(usage[x2.name].last)}` : null].filter(Boolean).join(" \xB7 ");
         return { value: x2.name, label, hint: hint || void 0 };
       });
-    }, pick = async (state, initialQuery) => {
-      let actions = ACTIONS.map((a2) => ({ value: ACTION + a2.key, label: `${ui2.accent(ui2.unicode ? a2.icon : ">")} ${a2.label}`, hint: a2.hint, text: a2.label.toLowerCase() })), maxItems = Math.max(5, Math.min(14, (process.stdout.rows || 24) - 10));
-      return ask(p4.autocomplete({
-        message: `Switch to ${ui2.dim("\xB7 type a name, account, role or client")}`,
-        maxItems,
-        initialUserInput: initialQuery || void 0,
-        // Rows are already filtered and ranked below; clack would otherwise re-filter them by substring.
-        filter: () => !0,
-        options() {
-          let query = this.userInput || "", ranked = rank.rankProfiles(state.profiles, { query, usage: state.settings.usage, current: state.defaultName }), q = query.trim().toLowerCase(), matchingActions = actions.filter((a2) => !q || a2.text.includes(q)).map((a2) => ({ value: a2.value, label: a2.label, hint: a2.hint }));
-          return [...buildRows(ranked, state), ...matchingActions];
-        }
-      }));
-    }, connect = async (profile, state, { interactive, quiet, force }) => {
+    }, pick = (state, initialQuery) => home({
+      message: `Switch to ${ui2.dim("\xB7 type a name, account, role or client")}`,
+      maxItems: Math.max(5, Math.min(14, (process.stdout.rows || 24) - 14)),
+      initialQuery,
+      actions: ACTIONS,
+      rows: (query) => buildRows(rank.rankProfiles(state.profiles, { query, usage: state.settings.usage, current: state.defaultName }), state)
+    }), connect = async (profile, state, { interactive, quiet, force }) => {
       let spin = quiet ? null : ui2.spinner(), tryIdentity = async () => {
         spin && spin.start(`Connecting to ${profile.name}`);
         try {
@@ -7523,7 +7608,7 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
         throw new ui2.CliError(`Logged in, but ${profile.name} still has no access.`, { hint: firstLine(result.message) });
       return result;
     }, firstLine = (text2) => String(text2 || "").trim().split(`
-`).filter(Boolean).slice(-1)[0], switchTo = async (profile, state, opts) => {
+`).filter(Boolean).slice(-1)[0], switchTo = async (profile, state, opts) => (await doSwitch(profile, state, opts), { switched: !0 }), doSwitch = async (profile, state, opts) => {
       let { interactive, json } = opts, identity = await connect(profile, state, { interactive, quiet: json, force: opts.force }), [defaultErrors] = await aws.setDefaultProfile(profile.name);
       if (defaultErrors)
         throw new ui2.CliError(ui2.errorsMessage(defaultErrors));
@@ -7578,6 +7663,35 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
     }, runAction = async (key, state, opts) => {
       let commands2 = require_commands();
       return key == "login" ? commands2.login(state.defaultName, { ...opts, fromPicker: !0 }) : commands2[key](opts.args || [], { ...opts, fromPicker: !0 });
+    }, routeChoice = (choice) => {
+      if (p4.isCancel(choice))
+        return { type: "quit" };
+      let value = String(choice);
+      return value.startsWith(ACTION_PREFIX) ? { type: "page", key: value.slice(ACTION_PREFIX.length) } : { type: "switch", name: value };
+    }, afterPage = (result, err) => err ? err instanceof CancelError2 ? "back" : err instanceof ui2.CliError ? "error" : "throw" : result && result.switched ? "exit" : "home", homeLoop = async (state, opts, initialQuery) => {
+      let first = !0;
+      for (; ; ) {
+        await header(state, { warnings: first });
+        let route = routeChoice(await pick(state, first ? initialQuery : void 0));
+        if (first = !1, route.type == "quit") {
+          p4.outro(ui2.dim(`Bye ${ui2.unicode ? "\u{1F44B}" : ""}`));
+          return;
+        }
+        if (route.type == "switch")
+          return switchTo(state.profiles.find((x2) => x2.name == route.name), state, opts);
+        let result, error;
+        try {
+          result = await runAction(route.key, state, opts);
+        } catch (err) {
+          error = err;
+        }
+        let next = afterPage(result, error);
+        if (next == "exit")
+          return result;
+        if (next == "throw")
+          throw error;
+        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && ui2.printError(error), state = await loadState();
+      }
     }, switchCommand = async (query, opts) => {
       let interactive = ui2.isInteractive(opts);
       await preflight({ interactive, quiet: opts.json });
@@ -7598,11 +7712,11 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
           });
       } else if (!interactive)
         throw new ui2.CliError("Which profile? Pass its name.", { code: 3, hint: `e.g. switch-profile ${state.profiles[0].name}` });
-      await header(state);
-      let choice = await pick(state, query);
-      return choice.startsWith(ACTION) ? runAction(choice.slice(ACTION.length), state, { ...opts, interactive }) : switchTo(state.profiles.find((x2) => x2.name == choice), state, { ...opts, interactive });
+      return homeLoop(state, { ...opts, interactive }, query);
     };
     module2.exports = {
+      routeChoice,
+      afterPage,
       switchCommand,
       switchTo,
       connect,
@@ -7615,7 +7729,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
 // src/commands/index.js
 var require_commands = __commonJS({
   "src/commands/index.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
       !opts.fromPicker && !opts.json && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
     }, begin = async (opts, { needsInput } = {}) => {
       let interactive = ui2.isInteractive(opts);
@@ -7791,14 +7905,25 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       ].filter(Boolean).join(`
 `);
       opts.json || p4.log.message(summary);
-      let prune = !!opts.prune;
+      let prune = !!opts.prune, include;
       if (interactive && !opts.yes) {
-        if (preview.added.length && !await ask(p4.confirm({ message: `Add ${preview.added.length} profile${preview.added.length == 1 ? "" : "s"}?` })))
-          return p4.outro(ui2.dim("Nothing changed."));
+        if (preview.added.length) {
+          let all = preview.addedEntries.map((e) => transforms.ssoEntryKey(e.accountId, e.roleName)), picked = await ask(p4.autocompleteMultiselect({
+            message: `Add which profiles? ${ui2.dim("(all selected: space to untick, type to search, enter to confirm)")}`,
+            maxItems: 12,
+            initialValues: all,
+            options: preview.addedEntries.map((e, i2) => ({ value: all[i2], label: e.name, hint: [e.accountName, e.accountId, e.roleName].filter(Boolean).join(" \xB7 ") }))
+          }));
+          if (!picked.length && !preview.stale.length)
+            return p4.outro(ui2.dim("Nothing changed."));
+          picked.length < all.length && (include = picked);
+        }
         preview.stale.length && (prune = await ask(p4.confirm({ message: `Remove the ${preview.stale.length} profile${preview.stale.length == 1 ? "" : "s"} that no longer exist${preview.stale.length == 1 ? "s" : ""}?`, initialValue: !1 })));
       }
+      if (include && !include.length && !prune)
+        return p4.outro(ui2.dim("Nothing changed."));
       prune && await aws.backupAwsFiles();
-      let result = transforms.populateSsoProfiles(configStr, { ssoSession: sessionName, entries, region, prefix, prune, version: settings2.CLI_VERSION });
+      let result = transforms.populateSsoProfiles(configStr, { ssoSession: sessionName, entries, region, prefix, prune, include, version: settings2.CLI_VERSION });
       if (await aws.writeAwsFile(aws.AWS_CONFIG_FILE, result.config), await settings2.update({}), opts.json) {
         process.stdout.write(JSON.stringify({ added: result.added, existing: result.existing, removed: result.removed, stale: prune ? [] : result.stale }) + `
 `);
@@ -7887,7 +8012,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
 });
 
 // src/cli.js
-var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports)), ui = require_ui(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
+var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports2)), ui = require_ui(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
 process.env.AWS_CLI_AGENT_TOOLKIT_HINT_DISABLED = "true";
 var EXAMPLES = `
 Examples:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.0.1",
+  "version": "2.2.0",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"
@@ -36,6 +36,7 @@
   "author": "Nicolas Dao",
   "license": "BSD-3-Clause",
   "devDependencies": {
+    "@clack/core": "^1.5.1",
     "@clack/prompts": "^1.8.1",
     "@eslint/js": "^10.0.1",
     "chai": "^4.1.2",
@@ -44,7 +45,7 @@
     "eslint": "^10.0.0",
     "fuzzysort": "^3.1.0",
     "globals": "^17.13.0",
-    "mocha": "^8.2.1",
+    "mocha": "^11.8.0",
     "uqr": "^0.1.3"
   },
   "files": [