switch-profile 2.1.0 → 2.3.0

package/README.md

@@ -64,6 +64,8 @@ npx switch-profile
 - [Requirements](#requirements)
 - [Troubleshooting](#troubleshooting)
   - [`invalid_grant` during an SSO login](#invalid_grant-during-an-sso-login)
+  - [`Invalid start url provided` when adding an SSO profile](#invalid-start-url-provided-when-adding-an-sso-profile)
+  - [Something failed and the message is not enough](#something-failed-and-the-message-is-not-enough)
   - [`Error loading SSO Token` or "session has expired"](#error-loading-sso-token-or-session-has-expired)
   - [SSO login hangs on a remote machine](#sso-login-hangs-on-a-remote-machine)
   - [The code is not in my clipboard over SSH](#the-code-is-not-in-my-clipboard-over-ssh)
@@ -116,7 +118,7 @@ Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
 | `remove [profiles...] [--yes]` | Removes profiles (alias `rm`). The current default cannot be removed. |
 | `settings` | Per-terminal switching, SSO login mode, legacy SSO upgrade. |
 
-Global options: `--json`, `--no-input` (never prompt), `--debug` (show stack traces), `-v, --version`. In examples, `sp` and `switch-profile` are interchangeable; only `sp` changes the current terminal.
+Global options: `--json`, `--no-input` (never prompt), `--debug` (show stack traces), `-v, --version`. Every run, AWS CLI call and error is logged to `~/.switch-profile/switch-profile.log` (secrets redacted). In examples, `sp` and `switch-profile` are interchangeable; only `sp` changes the current terminal.
 
 See [CLI Interface](docs/cli-interface.md) for every screen.
 
@@ -154,7 +156,7 @@ sp add          # then choose "Accounts from an SSO portal"
 1. Pick an existing `[sso-session]` or create one: start URL (e.g. `https://acme.awsapps.com/start`), SSO region (where Identity Center lives, not where you deploy), and a short name, usually the client.
 2. Log in if needed.
 3. `switch-profile` lists every account and role you can access, then asks for a default region and a name prefix. Profiles are named `<prefix>-<account-name>-<role>`, for example `acme-prod-workloads-admin`.
-4. A preview shows the new profiles, the ones already set up, and the ones that no longer exist. Confirm to write them.
+4. A preview shows the new profiles, the ones already set up, and the ones that no longer exist. Then pick the new profiles to add: all are selected, so press Enter to add everything, or untick the ones you don't want (type to search by name, account or role).
 
 Run it again later to pick up new accounts. Account/role pairs that already have a profile are never duplicated, whatever its name. Generated profiles that no longer exist can be pruned (after a backup); profiles you wrote by hand are never pruned.
 
@@ -235,6 +237,14 @@ The published package has no runtime dependencies: everything is bundled into on
 
 The SSO region is wrong. It must be the region of your IAM Identity Center instance, not the region you deploy to. Fix `sso_region` in the `[sso-session]` section of `~/.aws/config` (or remove the portal and add it again).
 
+### `Invalid start url provided` when adding an SSO profile
+
+The start URL is usually fine: AWS sends this error when the **SSO region** is wrong. Use the region where IAM Identity Center lives (Identity Center console › Settings), not where you deploy. If the portal is already set up, type its existing session name instead (`sp add` lists them with their regions).
+
+### Something failed and the message is not enough
+
+Open `~/.switch-profile/switch-profile.log`. It has every run, every AWS CLI call with its exit code and output, and every error with its full chain. Secrets are redacted, so you can share it.
+
 ### `Error loading SSO Token` or "session has expired"
 
 The SSO login is missing or expired. Run `sp login` (or just switch to the profile again: `switch-profile` logs in when needed). There is no need to recreate the profile.
@@ -271,7 +281,7 @@ The completion registers only if `compinit` ran before the `switch-profile` bloc
 - [Architecture](docs/architecture.md) — Module map, data flow and bundling of the switch-profile CLI.
 - [AWS Profile Management](docs/aws-profile-management.md) — Profile kinds, switching, SSO logins, SSO import, migrations and the sp shell function.
 - [CLI Interface](docs/cli-interface.md) — Walkthrough of every command and screen of the CLI.
-- [Configuration Files](docs/configuration-files.md) — Exact formats of the AWS files, the settings file and the shell block written by switch-profile.
+- [Configuration Files](docs/configuration-files.md) — Exact formats of the AWS files, the settings and log files and the shell block written by switch-profile.
 - [Development Guide](docs/development-guide.md) — Build, lint, tests, manual testing and releases.
 - [Gotchas](docs/gotchas.md) — Non-obvious pitfalls for users and maintainers.
 <!-- END doc-index -->

package/dist/cli.js

@@ -5235,10 +5235,77 @@ ${i2}
   }
 });
 
+// src/log.js
+var require_log = __commonJS({
+  "src/log.js"(exports2, module2) {
+    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2 } = require("path"), logFile = () => process.env.SWITCH_PROFILE_LOG_FILE || join2(homedir(), ".switch-profile", "switch-profile.log"), MAX_BYTES = 1024 * 1024, MAX_OUTPUT = 4e3, SECRET_FLAGS = ["--access-token", "--client-secret", "--otp"], SECRET_PATTERNS = [
+      /((?:aws_secret_access_key|aws_session_token|aws_security_token)\s*[=:]\s*)\S+/gi,
+      /("?(?:accessToken|refreshToken|clientSecret|secretAccessKey|sessionToken)"?\s*[=:]\s*"?)[^\s",}]+/gi,
+      /(--(?:access-token|client-secret|otp)[=\s]+)\S+/gi
+    ], redact = (text2) => SECRET_PATTERNS.reduce((s, re) => s.replace(re, "$1***"), String(text2 ?? "")), redactArgs = (args) => (args || []).map((a2, i2) => SECRET_FLAGS.includes(args[i2 - 1]) ? "***" : redact(a2)), truncate = (text2, max = MAX_OUTPUT) => {
+      let s = String(text2 ?? "").trim();
+      return s.length > max ? `\u2026${s.slice(-max)}` : s;
+    }, indent = (text2) => String(text2).split(`
+`).map((l2) => `    ${l2}`).join(`
+`), describeError = (err, depth = 0) => {
+      if (depth > 8)
+        return "  (cause chain truncated)";
+      if (!(err instanceof Error))
+        return `  ${redact(typeof err == "string" ? err : JSON.stringify(err))}`;
+      let lines = [`  ${err.name || "Error"}: ${redact(err.message)}`];
+      err.hint && lines.push(`  hint: ${redact(err.hint)}`), err.exitCode != null && lines.push(`  exit code: ${err.exitCode}`), err.command && lines.push(`  command: ${redact(err.command)}`), err.code != null && err.exitCode == null && lines.push(`  code: ${err.code}`), err.output && lines.push("  output:", indent(redact(truncate(err.output)))), err.stack && lines.push(indent(redact(err.stack.split(`
+`).slice(1).join(`
+`).replace(/^\s+/gm, ""))));
+      for (let e of err.errors || [])
+        lines.push("  wrapped:", describeError(e, depth + 1));
+      return err.cause && lines.push("  caused by:", describeError(err.cause, depth + 1)), lines.join(`
+`);
+    }, rotated = !1, write = (level, message, details) => {
+      try {
+        let file = logFile();
+        if (fs.existsSync(dirname2(file)) || fs.mkdirSync(dirname2(file), { recursive: !0, mode: 448 }), !rotated) {
+          rotated = !0;
+          let stat = fs.statSync(file, { throwIfNoEntry: !1 });
+          stat && stat.size > MAX_BYTES && fs.renameSync(file, `${file}.1`);
+        }
+        let line = `${(/* @__PURE__ */ new Date()).toISOString()} [${process.pid}] ${level.padEnd(5)} ${redact(message)}${details ? `
+${details}` : ""}
+`;
+        fs.appendFileSync(file, line, { mode: 384 });
+      } catch {
+      }
+    }, info = (message, details) => write("INFO", message, details && redact(details)), warn = (message, details) => write("WARN", message, details && redact(details)), error = (context, err) => write("ERROR", context, describeError(err)), tolerated = (context, fallback) => (err) => (write("WARN", `${context} failed (ignored)`, describeError(err)), fallback), command = ({ cmd, args, code, ms, output, inherit }) => {
+      let line = `${cmd} ${redactArgs(args).join(" ")}`.trim(), status = code === 0 ? "ok" : `exit ${code}`, details = code !== 0 && output ? indent(redact(truncate(output))) : null;
+      write(code === 0 ? "INFO" : "WARN", `exec ${line} \u2192 ${status} in ${ms}ms${inherit ? " (interactive)" : ""}`, details);
+    }, start = ({ version, argv }) => write("INFO", `run switch-profile ${version} ${redactArgs((argv || []).slice(2)).join(" ")}`.trim(), indent([
+      `node ${process.version} \xB7 ${process.platform} ${process.arch} \xB7 ${process.stdout.isTTY ? "tty" : "no tty"}${process.env.SSH_CONNECTION ? " \xB7 ssh" : ""}`,
+      `shell ${process.env.SWITCH_PROFILE_SHELL || process.env.SHELL || "?"}${process.env.SWITCH_PROFILE_ENV_FILE ? " (via sp)" : ""}`
+    ].join(`
+`))), displayPath = () => {
+      let file = logFile(), home = homedir();
+      return file.startsWith(home + "/") || file.startsWith(home + "\\") ? `~${file.slice(home.length)}` : file;
+    };
+    module2.exports = {
+      logFile,
+      MAX_BYTES,
+      redact,
+      redactArgs,
+      describeError,
+      displayPath,
+      start,
+      info,
+      warn,
+      error,
+      tolerated,
+      command
+    };
+  }
+});
+
 // src/ui.js
 var require_ui = __commonJS({
   "src/ui.js"(exports2, module2) {
-    var { styleText: styleText3 } = require("node:util"), env = process.env, colorEnabled = () => env.FORCE_COLOR && env.FORCE_COLOR !== "0" ? !0 : env.NO_COLOR || env.TERM == "dumb" ? !1 : !!process.stdout.isTTY, style = (format, text2) => colorEnabled() ? styleText3(format, String(text2)) : String(text2), unicode2 = process.platform !== "win32" || !!env.WT_SESSION || env.TERM_PROGRAM == "vscode" || !!env.TERMINAL_EMULATOR, sym = {
+    var { styleText: styleText3 } = require("node:util"), log3 = require_log(), env = process.env, colorEnabled = () => env.FORCE_COLOR && env.FORCE_COLOR !== "0" ? !0 : env.NO_COLOR || env.TERM == "dumb" ? !1 : !!process.stdout.isTTY, style = (format, text2) => colorEnabled() ? styleText3(format, String(text2)) : String(text2), unicode2 = process.platform !== "win32" || !!env.WT_SESSION || env.TERM_PROGRAM == "vscode" || !!env.TERMINAL_EMULATOR, sym = {
       ok: unicode2 ? "\u2713" : "v",
       err: unicode2 ? "\u2717" : "x",
       warn: unicode2 ? "\u25B2" : "!",
@@ -5265,13 +5332,13 @@ var require_ui = __commonJS({
       fit: (text2, width) => (text2 = String(text2 || ""), text2.length > width ? width > 1 ? text2.slice(0, width - 1) + (unicode2 ? "\u2026" : "~") : text2.slice(0, width) : text2 + " ".repeat(width - text2.length)),
       columns: () => process.stdout.columns || 100
     }, isInteractive = (options) => options && options.input === !1 || env.CI && env.CI !== "false" ? !1 : !!(process.stdin.isTTY && process.stdout.isTTY), CliError = class extends Error {
-      constructor(message, { hint, code, cause } = {}) {
-        super(message), this.hint = hint, this.exitCode = code || 1, this.cause = cause;
+      constructor(message, { hint, code, cause, errors } = {}) {
+        super(message), this.name = "CliError", this.hint = hint, this.exitCode = code || 1, this.cause = cause, this.errors = errors;
       }
-    }, debugEnabled = () => !!(env.SWITCH_PROFILE_DEBUG || env.DEBUG && /switch-profile|\*/.test(env.DEBUG)), errorsMessage = (errors) => (errors || []).map((e) => e && e.message || String(e)).filter(Boolean).join(`
+    }, cliErrorFrom = (errors, options) => new CliError(errorsMessage(errors), { ...options, errors }), debugEnabled = () => !!(env.SWITCH_PROFILE_DEBUG || env.DEBUG && /switch-profile|\*/.test(env.DEBUG)), errorsMessage = (errors) => (errors || []).map((e) => e && e.message || String(e)).filter(Boolean).join(`
 `), printError = (err) => {
       let lines = [`${ui2.bad(sym.err)} ${err.message || String(err)}`];
-      err.hint && lines.push(`  ${ui2.dim(err.hint)}`), debugEnabled() && err.stack ? lines.push(ui2.dim(err.stack)) : err instanceof CliError || lines.push(`  ${ui2.dim("Run with --debug for details.")}`), console.error(lines.join(`
+      err.hint && lines.push(`  ${ui2.dim(err.hint)}`), debugEnabled() && err.stack && lines.push(ui2.dim(err.stack)), (!(err instanceof CliError) || err.exitCode == 1) && lines.push(`  ${ui2.dim(`Details: ${log3.displayPath()}`)}`), console.error(lines.join(`
 `));
     }, ago = (date2) => {
       let ms = Date.now() - new Date(date2).getTime();
@@ -5341,6 +5408,7 @@ var require_ui = __commonJS({
       debugEnabled,
       errorsMessage,
       printError,
+      cliErrorFrom,
       ago
     };
   }
@@ -5351,7 +5419,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.1.0",
+      version: "2.3.0",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -5396,7 +5464,7 @@ var require_package = __commonJS({
         eslint: "^10.0.0",
         fuzzysort: "^3.1.0",
         globals: "^17.13.0",
-        mocha: "^8.2.1",
+        mocha: "^11.8.0",
         uqr: "^0.1.3"
       },
       files: [
@@ -5451,23 +5519,40 @@ var require_settings = __commonJS({
 // src/core.js
 var require_core = __commonJS({
   "src/core.js"(exports2, module2) {
-    var { exec: exec2, spawn } = require("child_process"), WrappedError = class extends Error {
+    var { exec: exec2, spawn } = require("child_process"), log3 = require_log(), WrappedError = class extends Error {
       constructor(message, errors) {
         super(message), this.errors = errors || [];
       }
     }, wrapErrors = (message, errors) => new WrappedError(message, errors), flattenErrors = (err) => err instanceof WrappedError ? [new Error(err.message), ...err.errors.flatMap(flattenErrors)] : [err instanceof Error ? err : new Error(String(err))], catchErrors = (promise) => Promise.resolve(promise).then((value) => [null, value], (err) => [flattenErrors(err)]), IS_WINDOWS = process.platform == "win32", _exec = (cmd) => new Promise((next, fail) => {
+      let started = Date.now();
       exec2(cmd, (error, stdout2, stderr) => {
-        error || stderr ? fail(error || stderr) : next(stdout2);
+        log3.command({ cmd, args: [], code: error ? error.code ?? 1 : stderr ? "stderr" : 0, ms: Date.now() - started, output: stderr || error && error.message }), error || stderr ? fail(error || stderr) : next(stdout2);
       });
-    }), run2 = (cmd, args, options) => new Promise((next, fail) => {
-      let { inherit } = options || {}, child = spawn(cmd, args || [], {
-        stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"],
+    }), commandError = (message, { command, exitCode, output }) => Object.assign(new Error(message), { command, code: exitCode, output }), run2 = (cmd, args, options) => new Promise((next, fail) => {
+      let { inherit, tee } = options || {}, started = Date.now(), command = `${cmd} ${log3.redactArgs(args).join(" ")}`.trim(), child = spawn(cmd, args || [], {
+        stdio: tee ? ["inherit", "inherit", "pipe"] : inherit ? "inherit" : ["ignore", "pipe", "pipe"],
         ...IS_WINDOWS ? { shell: !0 } : {}
       }), stdout2 = "", stderr = "";
-      inherit || (child.stdout.on("data", (d) => stdout2 += d), child.stderr.on("data", (d) => stderr += d)), child.on("error", fail), child.on("close", (code) => {
-        code === 0 ? next(stdout2) : fail(new Error((stderr || stdout2 || "").trim() || `'${cmd} ${(args || []).join(" ")}' exited with code ${code}`));
+      tee ? child.stderr.on("data", (d) => {
+        stderr += d, process.stderr.write(d);
+      }) : inherit || (child.stdout.on("data", (d) => stdout2 += d), child.stderr.on("data", (d) => stderr += d)), child.on("error", (err) => {
+        log3.command({ cmd, args, code: err.code || "spawn error", ms: Date.now() - started, output: err.message, inherit: inherit || tee }), fail(Object.assign(err, { command }));
+      }), child.on("close", (code) => {
+        let output = (stderr || stdout2 || "").trim();
+        log3.command({ cmd, args, code, ms: Date.now() - started, output, inherit: inherit || tee }), code === 0 ? next(stdout2) : fail(commandError(lastErrorLine(output) || `'${command}' exited with code ${code}`, { command, exitCode: code, output }));
       });
-    }), _commandExistsResult = {}, isCommandExist = (cmd, errorMsg) => () => catchErrors((async () => {
+    }), lastErrorLine = (output) => {
+      let text2 = (output || "").trim();
+      if (!text2)
+        return "";
+      let lines = text2.split(`
+`).map((l2) => l2.trim()).filter(Boolean);
+      if (lines.length <= 3)
+        return text2;
+      let telling = lines.filter((l2) => /error|exception|denied|invalid|expired|unable|not found|failed/i.test(l2));
+      return telling.length ? telling.slice(-2).join(`
+`) : text2;
+    }, _commandExistsResult = {}, isCommandExist = (cmd, errorMsg) => () => catchErrors((async () => {
       if (!cmd)
         return !1;
       if (_commandExistsResult[cmd] !== void 0)
@@ -5481,6 +5566,7 @@ var require_core = __commonJS({
       wrapErrors,
       exec: _exec,
       run: run2,
+      lastErrorLine,
       isCommandExist
     };
   }
@@ -5640,14 +5726,16 @@ var require_transforms = __commonJS({
         login_session: params.login_session || null
       };
       return p4.isSso = !!p4.sso_start_url, p4.isLegacySso = p4.isSso && !p4.sso_session, p4.kind = p4.isSso ? "sso" : p4.login_session ? "login" : p4.role_arn ? "role" : params.credential_process ? "process" : "keys", !p4.sso_account_id && p4.role_arn && (p4.sso_account_id = (p4.role_arn.match(/^arn:aws[^:]*:iam::(\d{12}):/) || [])[1] || null), p4;
-    }), slug = (text2) => String(text2 || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""), generatedProfileName = (prefix, accountName, accountId, roleName) => [slug(prefix), slug(accountName) || accountId, slug(roleName)].filter(Boolean).join("-"), populateSsoProfiles = (configStr, { ssoSession, entries, region, prefix, prune, version }) => {
-      let config = configStr, profiles = listProfiles(config), session = ini.getSection(config, `sso-session ${ssoSession}`) || {}, samePortal = (p4) => p4.sso_session == ssoSession || p4.sso_start_url && p4.sso_start_url == session.sso_start_url, key = (accountId, roleName) => `${accountId}/${roleName}`, byKey = new Map(profiles.filter((p4) => p4.isSso && samePortal(p4)).map((p4) => [key(p4.sso_account_id, p4.sso_role_name), p4])), taken = new Set(profiles.map((p4) => p4.name)), wanted = new Set(entries.map((e) => key(e.accountId, e.roleName))), added = [], existing = [];
+    }), slug = (text2) => String(text2 || "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, ""), generatedProfileName = (prefix, accountName, accountId, roleName) => [slug(prefix), slug(accountName) || accountId, slug(roleName)].filter(Boolean).join("-"), ssoEntryKey = (accountId, roleName) => `${accountId}/${roleName}`, populateSsoProfiles = (configStr, { ssoSession, entries, region, prefix, prune, include, version }) => {
+      let config = configStr, profiles = listProfiles(config), session = ini.getSection(config, `sso-session ${ssoSession}`) || {}, samePortal = (p4) => p4.sso_session == ssoSession || p4.sso_start_url && p4.sso_start_url == session.sso_start_url, key = ssoEntryKey, included = include ? new Set(include) : null, byKey = new Map(profiles.filter((p4) => p4.isSso && samePortal(p4)).map((p4) => [key(p4.sso_account_id, p4.sso_role_name), p4])), taken = new Set(profiles.map((p4) => p4.name)), wanted = new Set(entries.map((e) => key(e.accountId, e.roleName))), added = [], addedEntries = [], existing = [];
       for (let e of entries) {
         let found = byKey.get(key(e.accountId, e.roleName));
         if (found) {
           existing.push(found.name);
           continue;
         }
+        if (included && !included.has(key(e.accountId, e.roleName)))
+          continue;
         let base = generatedProfileName(prefix || ssoSession, e.accountName, e.accountId, e.roleName), name = base;
         for (let i2 = 2; taken.has(name); i2++)
           name = `${base}-${i2}`;
@@ -5660,13 +5748,13 @@ var require_transforms = __commonJS({
           ...e.accountName ? [[ACCOUNT_NAME_KEY, e.accountName]] : [],
           [GENERATED_KEY, ssoSession],
           [VERSION_KEY, version]
-        ]), added.push(name);
+        ]), added.push(name), addedEntries.push({ name, accountId: e.accountId, accountName: e.accountName, roleName: e.roleName });
       }
       let stale = profiles.filter((p4) => p4.generated == ssoSession && !wanted.has(key(p4.sso_account_id, p4.sso_role_name))).map((p4) => p4.name), removed = [];
       if (prune)
         for (let name of stale)
           config = ini.removeSection(config, configSectionName(config, name)), removed.push(name);
-      return { config, added, existing, stale, removed };
+      return { config, added, addedEntries, existing, stale, removed };
     }, listSsoSessions = (configStr) => ini.listSections(configStr).filter((s) => s.startsWith("sso-session ")).map((s) => ({ name: s.replace(/^sso-session\s+/, ""), ...ini.getSection(configStr, s) })), addSsoSession = (configStr, { name, startUrl, region, version }) => ini.getSection(configStr, `sso-session ${name}`) ? configStr : ini.setSection(configStr, `sso-session ${name}`, [
       ["sso_start_url", startUrl],
       ["sso_region", region],
@@ -5678,6 +5766,7 @@ var require_transforms = __commonJS({
       ACCOUNT_NAME_KEY,
       generatedProfileName,
       populateSsoProfiles,
+      ssoEntryKey,
       listSsoSessions,
       addSsoSession,
       NAME_KEY,
@@ -5710,8 +5799,13 @@ var require_login = __commonJS({
       text2 = text2 || "";
       let urls = text2.match(URL_REGEX) || [], code = (text2.match(CODE_REGEX) || [])[1] || null, completeUrl = urls.find((u5) => /user_code=/.test(u5)) || null;
       return { url: urls.find((u5) => u5 !== completeUrl) || completeUrl || null, code, completeUrl };
+    }, WRONG_REGION = /Invalid start url|invalid_request|InvalidRequestException/i, configureSsoFailure = (output, sessions) => {
+      let lines = (output || "").split(`
+`).map((l2) => l2.trim()).filter(Boolean), detail = (lines.filter((l2) => /error/i.test(l2)).slice(-1)[0] || lines.slice(-1)[0] || "").replace(/^aws:\s*\[ERROR\]:\s*/i, ""), description = ((output || "").match(/error_description:\s*(.+)/) || [])[1], known = (sessions || []).filter((s) => s.sso_region).map((s) => `${s.name} (${s.sso_region}, ${s.sso_start_url})`), reuse = known.length ? ` Portals already set up here: ${known.join(", ")}. Type one of these names as the session name to reuse it.` : "", message = `aws configure sso failed${description || detail ? `: ${(description || detail).trim()}` : "."}`;
+      return WRONG_REGION.test(output || "") ? { message, hint: `The SSO region is most likely wrong: it must be the region where IAM Identity Center lives (Identity Center console \u203A Settings), not where you deploy. AWS reports a wrong region as an invalid start URL.${reuse}` } : { message, hint: `Run sp add to try again.${reuse}` };
     };
     module2.exports = {
+      configureSsoFailure,
       isRemoteSession,
       resolveLoginMode,
       loginFlags,
@@ -5832,12 +5926,12 @@ var require_regions = __commonJS({
 // src/aws/index.js
 var require_aws = __commonJS({
   "src/aws/index.js"(exports2, module2) {
-    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast } = require_login(), regions = require_regions(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
+    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast } = require_login(), regions = require_regions(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
 ` : EOL, AWS_CONFIG_FILE = join2(homedir(), ".aws", "config"), AWS_CREDS_FILE = join2(homedir(), ".aws", "credentials"), AWS_SSO_FOLDER = join2(homedir(), ".aws", "sso", "cache"), awsExists = isCommandExist("aws"), _awsCliVersion = null, whichAws = () => exec2(`${process.platform == "win32" ? "where" : "which"} aws`).then((out) => (out || "").split(/\r?\n/)[0].trim(), () => null), getAwsCliVersion = async () => {
       if (_awsCliVersion)
         return _awsCliVersion;
-      let path2 = await whichAws(), stat = path2 ? await fs.promises.stat(fs.realpathSync(path2)).catch(() => null) : null, cached = (await settings2.read().catch(() => ({}))).awsCli;
-      return stat && cached && cached.path == path2 && cached.mtimeMs == stat.mtimeMs && cached.version ? _awsCliVersion = cached.version : (_awsCliVersion = ((await exec2("aws --version") || "").match(/aws-cli\/(\S+)/) || [])[1] || null, stat && _awsCliVersion && await settings2.update({ awsCli: { path: path2, mtimeMs: stat.mtimeMs, version: _awsCliVersion } }).catch(() => null), _awsCliVersion);
+      let path2 = await whichAws(), stat = path2 ? await fs.promises.stat(fs.realpathSync(path2)).catch(() => null) : null, cached = (await settings2.read().catch(log3.tolerated("reading the settings", {}))).awsCli;
+      return stat && cached && cached.path == path2 && cached.mtimeMs == stat.mtimeMs && cached.version ? _awsCliVersion = cached.version : (_awsCliVersion = ((await exec2("aws --version") || "").match(/aws-cli\/(\S+)/) || [])[1] || null, stat && _awsCliVersion && await settings2.update({ awsCli: { path: path2, mtimeMs: stat.mtimeMs, version: _awsCliVersion } }).catch(log3.tolerated("caching the AWS CLI version", null)), _awsCliVersion);
     }, awsCliV2Exists = (noFailIfMissing) => catchErrors((async () => {
       let [awsCliErrors] = await awsExists();
       if (awsCliErrors) {
@@ -5929,9 +6023,9 @@ var require_aws = __commonJS({
       if (!atLeast(version, [2, 32, 0]))
         throw new Error(`'aws login' needs AWS CLI 2.32 or later (you have ${version}). Update the AWS CLI and try again.`);
       let remote = isRemoteSession(process.env, process.platform) ? ["--remote"] : [];
-      await run2("aws", ["login", "--profile", profile, ...remote], { inherit: !0 });
+      await run2("aws", ["login", "--profile", profile, ...remote], { tee: !0 });
     }, logoutAll = async () => {
-      await run2("aws", ["sso", "logout"]), atLeast(await getAwsCliVersion(), [2, 32, 0]) && await run2("aws", ["logout", "--all"]).catch(() => null);
+      await run2("aws", ["sso", "logout"]), atLeast(await getAwsCliVersion(), [2, 32, 0]) && await run2("aws", ["logout", "--all"]).catch(log3.tolerated("aws logout --all", null));
     }, readSsoToken = async ({ ssoSession, startUrl }) => {
       let key = crypto.createHash("sha1").update(ssoSession || startUrl).digest("hex"), token = await fs.promises.readFile(join2(AWS_SSO_FOLDER, `${key}.json`), "utf8").then(JSON.parse).catch(() => null);
       return !token || !token.accessToken || new Date(token.expiresAt).getTime() < Date.now() + 60 * 1e3 ? null : token;
@@ -6013,9 +6107,9 @@ var require_aws = __commonJS({
     })()), createSsoProfile = (name) => catchErrors((async () => {
       await awsCliV2Exists();
       try {
-        await run2("aws", ["configure", "sso", "--profile", name], { inherit: !0 });
+        await run2("aws", ["configure", "sso", "--profile", name], { tee: !0 });
       } catch (err) {
-        throw new Error(`'aws configure sso' failed (${err.message}). The SSO profile may not have been created correctly.`, { cause: err });
+        throw Object.assign(new Error(`'aws configure sso' failed: ${err.message}`, { cause: err }), { output: err.output || "" });
       }
       let [configStrErrors, configStr] = await getConfigFile();
       if (configStrErrors)
@@ -6056,7 +6150,7 @@ var require_aws = __commonJS({
 // src/shell.js
 var require_shell = __commonJS({
   "src/shell.js"(exports2, module2) {
-    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
+    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
 	local __sp_file __sp_status
 	__sp_file="$(mktemp "\${TMPDIR:-/tmp}/switch-profile.XXXXXX")" || return 1
 	if [ -n "\${SWITCH_PROFILE_DEV_BIN:-}" ]; then
@@ -6190,7 +6284,7 @@ Register-ArgumentCompleter -CommandName ${FUNCTION_NAME} -ParameterName Rest -Sc
       if (IS_WINDOWS && !shellPath) {
         let files = [];
         for (let exe of ["pwsh", "powershell"]) {
-          let file = await run2(exe, ["-NoProfile", "-NonInteractive", "-Command", "$PROFILE.CurrentUserAllHosts"]).then((out) => (out || "").trim()).catch(() => "");
+          let file = await run2(exe, ["-NoProfile", "-NonInteractive", "-Command", "$PROFILE.CurrentUserAllHosts"]).then((out) => (out || "").trim()).catch(log3.tolerated("reading the PowerShell profile path", ""));
           file && !files.includes(file) && files.push(file);
         }
         if (files.length)
@@ -6313,7 +6407,7 @@ var require_migrate = __commonJS({
 // src/commands/common.js
 var require_common = __commonJS({
   "src/commands/common.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
     }, ask = async (promise) => {
       let value = await promise;
       if (p4.isCancel(value))
@@ -6326,14 +6420,14 @@ var require_common = __commonJS({
     }, preflight = async ({ interactive, quiet }) => {
       let [cliErrors, cliExists] = await aws.awsCliV2Exists(!0);
       if (cliErrors)
-        throw new ui2.CliError(ui2.errorsMessage(cliErrors), { hint: "switch-profile needs AWS CLI v2." });
+        throw ui2.cliErrorFrom(cliErrors, { hint: "switch-profile needs AWS CLI v2." });
       if (!cliExists)
         throw new ui2.CliError("The AWS CLI is not installed.", { hint: INSTALL_HINTS[process.platform] || INSTALL_HINTS.linux });
       let result;
       try {
         result = await migrate.runMigrations();
       } catch (err) {
-        throw err instanceof migrate.NewerFormatError ? new ui2.CliError(err.message) : err;
+        throw err instanceof migrate.NewerFormatError ? new ui2.CliError(err.message, { cause: err }) : err;
       }
       if (result.migrated && !quiet && p4.log.info([
         `Upgraded your AWS setup for switch-profile ${settings2.CLI_VERSION} ${ui2.unicode ? "\u{1F389}" : ""}`,
@@ -6344,7 +6438,7 @@ var require_common = __commonJS({
         let legacy = await migrate.findLegacySsoProfiles();
         legacy.length && (p4.log.warn(`${legacy.length > 1 ? `${legacy.length} profiles use` : "1 profile uses"} the old SSO format, which never auto-refreshes: ${legacy.join(", ")}`), await ask(p4.confirm({ message: "Upgrade them now? You'll log in once per SSO portal." })) ? await upgradeLegacySso(legacy) : (await settings2.update({ ssoUpgradeDeclined: !0 }), p4.log.message(ui2.dim("No problem. You can upgrade later from Settings."))));
       }
-      let status = await shell.getStatus(settings2.CLI_VERSION).catch(() => null);
+      let status = await shell.getStatus(settings2.CLI_VERSION).catch(log3.tolerated("reading the sp shortcut status", null));
       status && status.installed && status.outdated && await shell.install(settings2.CLI_VERSION).then(() => !0, () => !1) && !quiet && p4.log.info(`Updated the ${ui2.accent(shell.FUNCTION_NAME)} shortcut in ${status.shell.files.map(shell.tilde).join(", ")} ${ui2.dim("(new terminals pick it up)")}`);
     }, upgradeLegacySso = async (names) => {
       let { sessions, backups } = await migrate.upgradeLegacySsoProfiles(names);
@@ -6357,10 +6451,10 @@ var require_common = __commonJS({
     }, loadState = async () => {
       let [listErrors, profiles] = await aws.listProfiles();
       if (listErrors)
-        throw new ui2.CliError(ui2.errorsMessage(listErrors));
+        throw ui2.cliErrorFrom(listErrors);
       let [defaultErrors, info] = await aws.getDefaultProfile();
       if (defaultErrors)
-        throw new ui2.CliError(ui2.errorsMessage(defaultErrors));
+        throw ui2.cliErrorFrom(defaultErrors);
       let defaultProfile = profiles.find((x2) => x2.name == info.profile) || null;
       return { profiles, defaultName: defaultProfile ? defaultProfile.name : null, defaultProfile, settings: await settings2.read() };
     }, loginKey = (profile) => profile.sso_session || profile.sso_start_url || profile.name, describe = (profile, identity) => ui2.join([
@@ -7389,11 +7483,11 @@ var require_clipboard = __commonJS({
 // src/commands/login-flow.js
 var require_login_flow = __commonJS({
   "src/commands/login-flow.js"(exports2, module2) {
-    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
+    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
       let current = await settings2.read(), args = await aws.ssoLoginArgs(target, loginMode || settings2.getLoginMode(current)), legacyCli = !atLeast(await aws.getAwsCliVersion(), [2, 22, 0]), device = args.includes("--use-device-code") || legacyCli, remote = isRemoteSession(process.env, process.platform);
       if (!interactive)
         return plainLogin(args, label);
-      let child = spawn("aws", args, { stdio: ["ignore", "pipe", "pipe"], ...IS_WINDOWS ? { shell: !0 } : {} }), output = "", shown = !1, rawMode = !1, spin = null, parsed = {}, stdin2 = process.stdin, onKey = async (key) => {
+      let started = Date.now(), child = spawn("aws", args, { stdio: ["ignore", "pipe", "pipe"], ...IS_WINDOWS ? { shell: !0 } : {} }), output = "", shown = !1, rawMode = !1, spin = null, parsed = {}, stdin2 = process.stdin, onKey = async (key) => {
         if (key === "") {
           child.kill();
           return;
@@ -7438,7 +7532,7 @@ ${ui2.dim(`If nothing opens, visit: ${parsed.url}`)}`);
       }, RAW_OUTPUT_AFTER_MS), code = await new Promise((resolve) => {
         child.on("error", () => resolve(-1)), child.on("close", resolve);
       });
-      if (clearTimeout(fallback), cleanup(), code === 0) {
+      if (clearTimeout(fallback), cleanup(), log3.command({ cmd: "aws", args, code: child.killed ? "killed (cancelled)" : code, ms: Date.now() - started, output }), code === 0) {
         spin ? spin.stop(`${ui2.unicode ? "\u{1F513} " : ""}Logged in`) : p4.log.success("Logged in"), await rememberLogin(loginKey);
         return;
       }
@@ -7450,12 +7544,15 @@ ${ui2.dim(`If nothing opens, visit: ${parsed.url}`)}`);
 `) || lines.slice(-1)[0] || "";
       throw new ui2.CliError(`SSO login for ${label} failed.${detail ? `
 ${detail}` : ""}`, {
-        hint: /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : "Try again, or run with --debug."
+        cause: Object.assign(new Error(`aws ${args.join(" ")} exited with code ${code}`), { output }),
+        hint: /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : `Try again. Details: ${log3.displayPath()}`
       });
     }, plainLogin = async (args, label) => {
       console.error(`Logging in to ${label}. Approve the request using the URL and code below.`), await new Promise((resolve, reject) => {
-        let child = spawn("aws", args, { stdio: ["ignore", process.stderr, process.stderr], ...IS_WINDOWS ? { shell: !0 } : {} });
-        child.on("error", reject), child.on("close", (code) => code === 0 ? resolve() : reject(new ui2.CliError(`SSO login for ${label} failed.`, { code: 2 })));
+        let started = Date.now(), child = spawn("aws", args, { stdio: ["ignore", process.stderr, process.stderr], ...IS_WINDOWS ? { shell: !0 } : {} });
+        child.on("error", reject), child.on("close", (code) => {
+          log3.command({ cmd: "aws", args, code, ms: Date.now() - started, output: "(output passed through to stderr)" }), code === 0 ? resolve() : reject(new ui2.CliError(`SSO login for ${label} failed.`, { code: 2 }));
+        });
       });
     }, rememberLogin = async (key) => {
       if (!key)
@@ -7537,7 +7634,7 @@ ${gray(S_BAR2)}`;
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), log3 = require_log(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7598,20 +7695,20 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
         return result;
       let loginProfile = profile.kind == "role" && profile.source_profile ? state.profiles.find((x2) => x2.name == profile.source_profile) : profile;
       if (!(loginProfile && (loginProfile.kind == "sso" || loginProfile.kind == "login")))
-        throw new ui2.CliError(`Could not get credentials for ${profile.name}.`, { hint: firstLine(result.message) });
+        throw new ui2.CliError(`Could not get credentials for ${profile.name}.`, { hint: firstLine(result.message), cause: result });
       if (!interactive && !force)
         throw new ui2.CliError(`${profile.name} needs a login.`, { code: 2, hint: `Run: switch-profile login ${loginProfile.name}` });
       if (loginProfile.kind == "sso" ? await ssoLogin({ profile: loginProfile.name }, { label: loginProfile.sso_session || loginProfile.name, loginKey: loginKey(loginProfile), interactive }) : await aws.awsLogin(loginProfile.name), result = await tryIdentity(), result instanceof Error)
-        throw new ui2.CliError(`Logged in, but ${profile.name} still has no access.`, { hint: firstLine(result.message) });
+        throw new ui2.CliError(`Logged in, but ${profile.name} still has no access.`, { hint: firstLine(result.message), cause: result });
       return result;
     }, firstLine = (text2) => String(text2 || "").trim().split(`
 `).filter(Boolean).slice(-1)[0], switchTo = async (profile, state, opts) => (await doSwitch(profile, state, opts), { switched: !0 }), doSwitch = async (profile, state, opts) => {
       let { interactive, json } = opts, identity = await connect(profile, state, { interactive, quiet: json, force: opts.force }), [defaultErrors] = await aws.setDefaultProfile(profile.name);
       if (defaultErrors)
-        throw new ui2.CliError(ui2.errorsMessage(defaultErrors));
+        throw ui2.cliErrorFrom(defaultErrors);
       let current = await settings2.read();
       await settings2.update({ usage: rank.recordUsage(current.usage, profile.name) });
-      let terminal = await shell.exportProfile(profile.name).catch(() => !1);
+      let terminal = await shell.exportProfile(profile.name).catch(log3.tolerated("handing the profile to sp", !1));
       if (json) {
         process.stdout.write(JSON.stringify({ profile: profile.name, account: identity.account, arn: identity.arn, region: profile.region || null, default: !0, terminal }) + `
 `);
@@ -7631,7 +7728,7 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
 ${ui2.dim("set as the default profile")}`), await offerShortcut(profile);
     }, exportHint = (name) => process.platform == "win32" ? `$env:AWS_PROFILE = "${name}"   ${ui2.dim("(PowerShell)")}
    set AWS_PROFILE=${name}   ${ui2.dim("(CMD)")}` : `export AWS_PROFILE=${name}`, offerShortcut = async (profile) => {
-      let status = await shell.getStatus(settings2.CLI_VERSION).catch(() => null), hint = `${ui2.dim("To use it in this terminal only, run:")}
+      let status = await shell.getStatus(settings2.CLI_VERSION).catch(log3.tolerated("reading the sp shortcut status", null)), hint = `${ui2.dim("To use it in this terminal only, run:")}
    ${ui2.accent(exportHint(profile.name))}`;
       if (status && status.installed) {
         p4.outro(`${hint}
@@ -7687,7 +7784,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
           return result;
         if (next == "throw")
           throw error;
-        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && ui2.printError(error), state = await loadState();
+        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && (log3.error(`${route.key} failed (back to the home screen)`, error), ui2.printError(error)), state = await loadState();
       }
     }, switchCommand = async (query, opts) => {
       let interactive = ui2.isInteractive(opts);
@@ -7726,7 +7823,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
 // src/commands/index.js
 var require_commands = __commonJS({
   "src/commands/index.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession, configureSsoFailure } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
       !opts.fromPicker && !opts.json && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
     }, begin = async (opts, { needsInput } = {}) => {
       let interactive = ui2.isInteractive(opts);
@@ -7745,7 +7842,7 @@ var require_commands = __commonJS({
       return interactive && !opts.json && intro2(opts), switchTo(findProfile(state, name), state, { ...opts, interactive });
     }, status = async (args, opts) => {
       await begin(opts);
-      let state = await loadState(), terminal = process.env.AWS_PROFILE || null, shortcut = await shell.getStatus(settings2.CLI_VERSION).catch(() => null), d = state.defaultProfile, login2 = d ? await loginState(d, state) : { text: null, needsLogin: !1 };
+      let state = await loadState(), terminal = process.env.AWS_PROFILE || null, shortcut = await shell.getStatus(settings2.CLI_VERSION).catch(log3.tolerated("reading the sp shortcut status", null)), d = state.defaultProfile, login2 = d ? await loginState(d, state) : { text: null, needsLogin: !1 };
       if (opts.json) {
         let at = d ? (state.settings.logins || {})[loginKey(d)] : null;
         process.stdout.write(JSON.stringify({
@@ -7810,21 +7907,31 @@ var require_commands = __commonJS({
         return importFromSso(state, { ...opts, interactive });
       let taken = state.profiles.map((x2) => x2.name), name = await ask(p4.text({ message: "Profile name", placeholder: "e.g. acme-prod", validate: validateProfileName(taken) }));
       if (kind == "sso") {
+        let [configErrors, configStr] = await aws.getConfigFile();
+        if (configErrors)
+          throw ui2.cliErrorFrom(configErrors);
+        let sessions = transforms.listSsoSessions(configStr);
         p4.log.message([
           "Handing over to aws configure sso. You will be asked for:",
-          `${ui2.dim("1.")} a session name ${ui2.dim("(reuse the same one for every profile of a portal: one login covers them all)")}`,
+          `${ui2.dim("1.")} a session name ${ui2.dim("(a short name such as acme, not the URL; reuse the same one for every profile of a portal: one login covers them all)")}`,
           `${ui2.dim("2.")} the start URL ${ui2.dim("(e.g. https://acme.awsapps.com/start)")}`,
-          `${ui2.dim("3.")} the SSO region ${ui2.dim("(where IAM Identity Center lives, not where you deploy)")}`
+          `${ui2.dim("3.")} the SSO region ${ui2.dim("(where IAM Identity Center lives, not where you deploy)")}`,
+          ...sessions.length ? [ui2.dim(`Portals already set up: ${sessions.map((x2) => `${x2.name} (${x2.sso_region || "?"})`).join(", ")}. Type one of these names to reuse it.`)] : []
         ].join(`
 `));
         let [errors, upgraded] = await aws.createSsoProfile(name);
-        if (errors)
-          throw new ui2.CliError(ui2.errorsMessage(errors));
+        if (errors) {
+          let failed = errors.find((e) => e.output != null);
+          if (!failed)
+            throw ui2.cliErrorFrom(errors);
+          let { message, hint } = configureSsoFailure(failed.output, sessions);
+          throw new ui2.CliError(message, { hint, errors });
+        }
         upgraded && p4.log.info(`No session name was given, so ${name} now uses an [sso-session] for auto-refresh. You'll log in once more.`);
       } else if (kind == "login") {
         let region = await chooseRegion("Default region", "us-east-1"), [configErrors, configStr] = await aws.getConfigFile();
         if (configErrors)
-          throw new ui2.CliError(ui2.errorsMessage(configErrors));
+          throw ui2.cliErrorFrom(configErrors);
         let ini = require_ini();
         await aws.writeAwsFile(aws.AWS_CONFIG_FILE, ini.setSection(configStr, `profile ${name}`, [["region", region], [transforms.VERSION_KEY, settings2.CLI_VERSION]])), p4.log.step("Signing in with aws login\u2026"), await aws.awsLogin(name);
       } else {
@@ -7833,7 +7940,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
           return p4.outro(ui2.dim("Nothing changed."));
         let aws_access_key_id = await ask(p4.text({ message: "Access key ID", validate: (v) => v ? void 0 : "Required." })), aws_secret_access_key = await ask(p4.password({ message: "Secret access key", validate: (v) => v ? void 0 : "Required." })), region = await chooseRegion("Default region", "us-east-1"), [errors] = await aws.createProfile({ name, aws_access_key_id, aws_secret_access_key, region });
         if (errors)
-          throw new ui2.CliError(ui2.errorsMessage(errors));
+          throw ui2.cliErrorFrom(errors);
       }
       p4.log.success(`Profile ${ui2.accent(name)} created`);
       let next = await loadState();
@@ -7851,7 +7958,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
     }, importFromSso = async (state, opts) => {
       let { interactive } = opts, [configErrors, configStr] = await aws.getConfigFile();
       if (configErrors)
-        throw new ui2.CliError(ui2.errorsMessage(configErrors));
+        throw ui2.cliErrorFrom(configErrors);
       let sessions = transforms.listSsoSessions(configStr), sessionName = opts.fromSso && opts.fromSso !== !0 ? opts.fromSso : null;
       if (sessionName && !sessions.some((s) => s.name == sessionName))
         throw new ui2.CliError(`There is no [sso-session ${sessionName}] in ~/.aws/config.`, { code: 3, hint: sessions.length ? `Known sessions: ${sessions.map((s) => s.name).join(", ")}` : "Run switch-profile add in a terminal to add a portal." });
@@ -7889,7 +7996,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
         entries = accounts.flatMap((a2, i2) => roles[i2].map((roleName) => ({ ...a2, roleName }))), spin && spin.stop(`Found ${accounts.length} account${accounts.length == 1 ? "" : "s"} and ${entries.length} role${entries.length == 1 ? "" : "s"}`);
       } catch (err) {
         throw spin && spin.error("Could not read the accounts"), new ui2.CliError(`Could not list the accounts of ${sessionName}.`, { hint: String(err.message).trim().split(`
-`).slice(-1)[0] });
+`).slice(-1)[0], cause: err });
       }
       let sessionRegions = state.profiles.filter((x2) => x2.sso_session == sessionName && x2.region).map((x2) => x2.region), region = opts.region || (interactive ? await chooseRegion("Default region for these profiles", sessionRegions[0] || session.sso_region) : session.sso_region), prefix = opts.prefix || (interactive ? await ask(p4.text({ message: `Name prefix ${ui2.dim("(profiles become <prefix>-<account>-<role>)")}`, initialValue: sessionName, validate: (v) => /^[a-z0-9_-]*$/.test(v || "") ? void 0 : "Lowercase letters, numbers, - and _ only." })) : sessionName), preview = transforms.populateSsoProfiles(configStr, { ssoSession: sessionName, entries, region, prefix, prune: !1, version: settings2.CLI_VERSION });
       if (!preview.added.length && !preview.stale.length)
@@ -7902,14 +8009,25 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       ].filter(Boolean).join(`
 `);
       opts.json || p4.log.message(summary);
-      let prune = !!opts.prune;
+      let prune = !!opts.prune, include;
       if (interactive && !opts.yes) {
-        if (preview.added.length && !await ask(p4.confirm({ message: `Add ${preview.added.length} profile${preview.added.length == 1 ? "" : "s"}?` })))
-          return p4.outro(ui2.dim("Nothing changed."));
+        if (preview.added.length) {
+          let all = preview.addedEntries.map((e) => transforms.ssoEntryKey(e.accountId, e.roleName)), picked = await ask(p4.autocompleteMultiselect({
+            message: `Add which profiles? ${ui2.dim("(all selected: space to untick, type to search, enter to confirm)")}`,
+            maxItems: 12,
+            initialValues: all,
+            options: preview.addedEntries.map((e, i2) => ({ value: all[i2], label: e.name, hint: [e.accountName, e.accountId, e.roleName].filter(Boolean).join(" \xB7 ") }))
+          }));
+          if (!picked.length && !preview.stale.length)
+            return p4.outro(ui2.dim("Nothing changed."));
+          picked.length < all.length && (include = picked);
+        }
         preview.stale.length && (prune = await ask(p4.confirm({ message: `Remove the ${preview.stale.length} profile${preview.stale.length == 1 ? "" : "s"} that no longer exist${preview.stale.length == 1 ? "s" : ""}?`, initialValue: !1 })));
       }
+      if (include && !include.length && !prune)
+        return p4.outro(ui2.dim("Nothing changed."));
       prune && await aws.backupAwsFiles();
-      let result = transforms.populateSsoProfiles(configStr, { ssoSession: sessionName, entries, region, prefix, prune, version: settings2.CLI_VERSION });
+      let result = transforms.populateSsoProfiles(configStr, { ssoSession: sessionName, entries, region, prefix, prune, include, version: settings2.CLI_VERSION });
       if (await aws.writeAwsFile(aws.AWS_CONFIG_FILE, result.config), await settings2.update({}), opts.json) {
         process.stdout.write(JSON.stringify({ added: result.added, existing: result.existing, removed: result.removed, stale: prune ? [] : result.stale }) + `
 `);
@@ -7939,7 +8057,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       }
       let [errors] = await aws.deleteProfiles(names);
       if (errors)
-        throw new ui2.CliError(ui2.errorsMessage(errors));
+        throw ui2.cliErrorFrom(errors);
       p4.outro(`${ui2.ok(ui2.sym.ok)} Removed ${names.join(", ")}`);
     }, LOGIN_MODE_LABELS = {
       auto: "Auto: device code over SSH, browser otherwise",
@@ -7998,7 +8116,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
 });
 
 // src/cli.js
-var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports2)), ui = require_ui(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
+var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports2)), ui = require_ui(), log2 = require_log(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
 process.env.AWS_CLI_AGENT_TOOLKIT_HINT_DISABLED = "true";
 var EXAMPLES = `
 Examples:
@@ -8013,19 +8131,28 @@ Examples:
 sets AWS_PROFILE in the current terminal. Without it, use 'npx switch-profile'.
 
 Exit codes: 0 ok \xB7 1 error \xB7 2 login required \xB7 3 bad input \xB7 130 cancelled`, run = (action) => async (...args) => {
-  let opts = args[args.length - 1].optsWithGlobals();
+  let cmd = args[args.length - 1], opts = cmd.optsWithGlobals();
   opts.debug && (process.env.SWITCH_PROFILE_DEBUG = "1");
   try {
     await action(...args.slice(0, -2), opts);
   } catch (err) {
     if (err instanceof CancelError) {
-      p3.cancel(`Cancelled ${ui.unicode ? "\u{1F44B}" : ""}`), process.exitCode = 130;
+      log2.info("cancelled by the user"), p3.cancel(`Cancelled ${ui.unicode ? "\u{1F44B}" : ""}`), process.exitCode = 130;
       return;
     }
-    opts.json && err instanceof ui.CliError ? process.stderr.write(JSON.stringify({ error: err.message, hint: err.hint || null, code: err.exitCode }) + `
+    log2.error(`${cmd.name()} failed`, err), opts.json && err instanceof ui.CliError ? process.stderr.write(JSON.stringify({ error: err.message, hint: err.hint || null, code: err.exitCode }) + `
 `) : ui.printError(err), process.exitCode = err.exitCode || 1;
   }
+}, crashed = (err) => {
+  log2.error("unexpected crash", err);
+  try {
+    ui.printError(err instanceof Error ? err : new Error(String(err)));
+  } catch {
+    console.error(err);
+  }
+  process.exit(1);
 }, main = (argv) => {
+  log2.start({ version: CLI_VERSION, argv }), process.on("uncaughtException", crashed), process.on("unhandledRejection", crashed), process.on("exit", (code) => log2.info(`exit ${code}`));
   let program = new Command();
   return program.name("switch-profile").description("Switch between AWS profiles, log in with SSO, and keep every terminal on the right account.").version(CLI_VERSION, "-v, --version").argument("[profile...]", "profile name or search text").option("--json", "machine-readable output").option("--no-input", "never prompt (fails with a hint instead)").option("--debug", "show error details").addHelpText("after", EXAMPLES).showSuggestionAfterError().action(run((words, opts) => commands.switch((words || []).join(" "), opts))), program.command("use").argument("<profile>").description("switch to a profile by its exact name").action(run(commands.use)), program.command("status").description("show the current profile and login state").action(run((opts) => commands.status([], opts))), program.command("login").argument("[profile]", "defaults to this terminal's profile, then the default profile").description("log in again now, even if the session is still valid").option("--device", "use a device code (approve from any device)").option("--browser", "use the browser on this machine").action(run(commands.login)), program.command("logout").description("end every SSO session on this machine").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.logout([], opts))), program.command("add").description("add profiles: import an SSO portal, or create one").option("--from-sso [session]", "import (or re-sync) every account and role of an [sso-session]").option("--region <region>", "default region of imported profiles").option("--prefix <prefix>", "name prefix of imported profiles").option("--prune", "remove imported profiles that no longer exist").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.add([], opts))), program.command("remove").alias("rm").argument("[profiles...]").description("remove profiles").option("-y, --yes", "do not ask for confirmation").action(run(commands.remove)), program.command("settings").description("per-terminal switching, login mode and more").action(run((opts) => commands.settings([], opts))), program.command("switch", { hidden: !0 }).action(run((opts) => commands.switch("", opts))), program.parseAsync(argv);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"
@@ -45,7 +45,7 @@
     "eslint": "^10.0.0",
     "fuzzysort": "^3.1.0",
     "globals": "^17.13.0",
-    "mocha": "^8.2.1",
+    "mocha": "^11.8.0",
     "uqr": "^0.1.3"
   },
   "files": [