switch-profile 2.2.0 → 2.3.0

package/README.md

@@ -64,6 +64,8 @@ npx switch-profile
 - [Requirements](#requirements)
 - [Troubleshooting](#troubleshooting)
   - [`invalid_grant` during an SSO login](#invalid_grant-during-an-sso-login)
+  - [`Invalid start url provided` when adding an SSO profile](#invalid-start-url-provided-when-adding-an-sso-profile)
+  - [Something failed and the message is not enough](#something-failed-and-the-message-is-not-enough)
   - [`Error loading SSO Token` or "session has expired"](#error-loading-sso-token-or-session-has-expired)
   - [SSO login hangs on a remote machine](#sso-login-hangs-on-a-remote-machine)
   - [The code is not in my clipboard over SSH](#the-code-is-not-in-my-clipboard-over-ssh)
@@ -116,7 +118,7 @@ Running `sp` (or `npx switch-profile`) with no arguments opens the home screen:
 | `remove [profiles...] [--yes]` | Removes profiles (alias `rm`). The current default cannot be removed. |
 | `settings` | Per-terminal switching, SSO login mode, legacy SSO upgrade. |
 
-Global options: `--json`, `--no-input` (never prompt), `--debug` (show stack traces), `-v, --version`. In examples, `sp` and `switch-profile` are interchangeable; only `sp` changes the current terminal.
+Global options: `--json`, `--no-input` (never prompt), `--debug` (show stack traces), `-v, --version`. Every run, AWS CLI call and error is logged to `~/.switch-profile/switch-profile.log` (secrets redacted). In examples, `sp` and `switch-profile` are interchangeable; only `sp` changes the current terminal.
 
 See [CLI Interface](docs/cli-interface.md) for every screen.
 
@@ -235,6 +237,14 @@ The published package has no runtime dependencies: everything is bundled into on
 
 The SSO region is wrong. It must be the region of your IAM Identity Center instance, not the region you deploy to. Fix `sso_region` in the `[sso-session]` section of `~/.aws/config` (or remove the portal and add it again).
 
+### `Invalid start url provided` when adding an SSO profile
+
+The start URL is usually fine: AWS sends this error when the **SSO region** is wrong. Use the region where IAM Identity Center lives (Identity Center console › Settings), not where you deploy. If the portal is already set up, type its existing session name instead (`sp add` lists them with their regions).
+
+### Something failed and the message is not enough
+
+Open `~/.switch-profile/switch-profile.log`. It has every run, every AWS CLI call with its exit code and output, and every error with its full chain. Secrets are redacted, so you can share it.
+
 ### `Error loading SSO Token` or "session has expired"
 
 The SSO login is missing or expired. Run `sp login` (or just switch to the profile again: `switch-profile` logs in when needed). There is no need to recreate the profile.
@@ -271,7 +281,7 @@ The completion registers only if `compinit` ran before the `switch-profile` bloc
 - [Architecture](docs/architecture.md) — Module map, data flow and bundling of the switch-profile CLI.
 - [AWS Profile Management](docs/aws-profile-management.md) — Profile kinds, switching, SSO logins, SSO import, migrations and the sp shell function.
 - [CLI Interface](docs/cli-interface.md) — Walkthrough of every command and screen of the CLI.
-- [Configuration Files](docs/configuration-files.md) — Exact formats of the AWS files, the settings file and the shell block written by switch-profile.
+- [Configuration Files](docs/configuration-files.md) — Exact formats of the AWS files, the settings and log files and the shell block written by switch-profile.
 - [Development Guide](docs/development-guide.md) — Build, lint, tests, manual testing and releases.
 - [Gotchas](docs/gotchas.md) — Non-obvious pitfalls for users and maintainers.
 <!-- END doc-index -->

package/dist/cli.js

@@ -5235,10 +5235,77 @@ ${i2}
   }
 });
 
+// src/log.js
+var require_log = __commonJS({
+  "src/log.js"(exports2, module2) {
+    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2 } = require("path"), logFile = () => process.env.SWITCH_PROFILE_LOG_FILE || join2(homedir(), ".switch-profile", "switch-profile.log"), MAX_BYTES = 1024 * 1024, MAX_OUTPUT = 4e3, SECRET_FLAGS = ["--access-token", "--client-secret", "--otp"], SECRET_PATTERNS = [
+      /((?:aws_secret_access_key|aws_session_token|aws_security_token)\s*[=:]\s*)\S+/gi,
+      /("?(?:accessToken|refreshToken|clientSecret|secretAccessKey|sessionToken)"?\s*[=:]\s*"?)[^\s",}]+/gi,
+      /(--(?:access-token|client-secret|otp)[=\s]+)\S+/gi
+    ], redact = (text2) => SECRET_PATTERNS.reduce((s, re) => s.replace(re, "$1***"), String(text2 ?? "")), redactArgs = (args) => (args || []).map((a2, i2) => SECRET_FLAGS.includes(args[i2 - 1]) ? "***" : redact(a2)), truncate = (text2, max = MAX_OUTPUT) => {
+      let s = String(text2 ?? "").trim();
+      return s.length > max ? `\u2026${s.slice(-max)}` : s;
+    }, indent = (text2) => String(text2).split(`
+`).map((l2) => `    ${l2}`).join(`
+`), describeError = (err, depth = 0) => {
+      if (depth > 8)
+        return "  (cause chain truncated)";
+      if (!(err instanceof Error))
+        return `  ${redact(typeof err == "string" ? err : JSON.stringify(err))}`;
+      let lines = [`  ${err.name || "Error"}: ${redact(err.message)}`];
+      err.hint && lines.push(`  hint: ${redact(err.hint)}`), err.exitCode != null && lines.push(`  exit code: ${err.exitCode}`), err.command && lines.push(`  command: ${redact(err.command)}`), err.code != null && err.exitCode == null && lines.push(`  code: ${err.code}`), err.output && lines.push("  output:", indent(redact(truncate(err.output)))), err.stack && lines.push(indent(redact(err.stack.split(`
+`).slice(1).join(`
+`).replace(/^\s+/gm, ""))));
+      for (let e of err.errors || [])
+        lines.push("  wrapped:", describeError(e, depth + 1));
+      return err.cause && lines.push("  caused by:", describeError(err.cause, depth + 1)), lines.join(`
+`);
+    }, rotated = !1, write = (level, message, details) => {
+      try {
+        let file = logFile();
+        if (fs.existsSync(dirname2(file)) || fs.mkdirSync(dirname2(file), { recursive: !0, mode: 448 }), !rotated) {
+          rotated = !0;
+          let stat = fs.statSync(file, { throwIfNoEntry: !1 });
+          stat && stat.size > MAX_BYTES && fs.renameSync(file, `${file}.1`);
+        }
+        let line = `${(/* @__PURE__ */ new Date()).toISOString()} [${process.pid}] ${level.padEnd(5)} ${redact(message)}${details ? `
+${details}` : ""}
+`;
+        fs.appendFileSync(file, line, { mode: 384 });
+      } catch {
+      }
+    }, info = (message, details) => write("INFO", message, details && redact(details)), warn = (message, details) => write("WARN", message, details && redact(details)), error = (context, err) => write("ERROR", context, describeError(err)), tolerated = (context, fallback) => (err) => (write("WARN", `${context} failed (ignored)`, describeError(err)), fallback), command = ({ cmd, args, code, ms, output, inherit }) => {
+      let line = `${cmd} ${redactArgs(args).join(" ")}`.trim(), status = code === 0 ? "ok" : `exit ${code}`, details = code !== 0 && output ? indent(redact(truncate(output))) : null;
+      write(code === 0 ? "INFO" : "WARN", `exec ${line} \u2192 ${status} in ${ms}ms${inherit ? " (interactive)" : ""}`, details);
+    }, start = ({ version, argv }) => write("INFO", `run switch-profile ${version} ${redactArgs((argv || []).slice(2)).join(" ")}`.trim(), indent([
+      `node ${process.version} \xB7 ${process.platform} ${process.arch} \xB7 ${process.stdout.isTTY ? "tty" : "no tty"}${process.env.SSH_CONNECTION ? " \xB7 ssh" : ""}`,
+      `shell ${process.env.SWITCH_PROFILE_SHELL || process.env.SHELL || "?"}${process.env.SWITCH_PROFILE_ENV_FILE ? " (via sp)" : ""}`
+    ].join(`
+`))), displayPath = () => {
+      let file = logFile(), home = homedir();
+      return file.startsWith(home + "/") || file.startsWith(home + "\\") ? `~${file.slice(home.length)}` : file;
+    };
+    module2.exports = {
+      logFile,
+      MAX_BYTES,
+      redact,
+      redactArgs,
+      describeError,
+      displayPath,
+      start,
+      info,
+      warn,
+      error,
+      tolerated,
+      command
+    };
+  }
+});
+
 // src/ui.js
 var require_ui = __commonJS({
   "src/ui.js"(exports2, module2) {
-    var { styleText: styleText3 } = require("node:util"), env = process.env, colorEnabled = () => env.FORCE_COLOR && env.FORCE_COLOR !== "0" ? !0 : env.NO_COLOR || env.TERM == "dumb" ? !1 : !!process.stdout.isTTY, style = (format, text2) => colorEnabled() ? styleText3(format, String(text2)) : String(text2), unicode2 = process.platform !== "win32" || !!env.WT_SESSION || env.TERM_PROGRAM == "vscode" || !!env.TERMINAL_EMULATOR, sym = {
+    var { styleText: styleText3 } = require("node:util"), log3 = require_log(), env = process.env, colorEnabled = () => env.FORCE_COLOR && env.FORCE_COLOR !== "0" ? !0 : env.NO_COLOR || env.TERM == "dumb" ? !1 : !!process.stdout.isTTY, style = (format, text2) => colorEnabled() ? styleText3(format, String(text2)) : String(text2), unicode2 = process.platform !== "win32" || !!env.WT_SESSION || env.TERM_PROGRAM == "vscode" || !!env.TERMINAL_EMULATOR, sym = {
       ok: unicode2 ? "\u2713" : "v",
       err: unicode2 ? "\u2717" : "x",
       warn: unicode2 ? "\u25B2" : "!",
@@ -5265,13 +5332,13 @@ var require_ui = __commonJS({
       fit: (text2, width) => (text2 = String(text2 || ""), text2.length > width ? width > 1 ? text2.slice(0, width - 1) + (unicode2 ? "\u2026" : "~") : text2.slice(0, width) : text2 + " ".repeat(width - text2.length)),
       columns: () => process.stdout.columns || 100
     }, isInteractive = (options) => options && options.input === !1 || env.CI && env.CI !== "false" ? !1 : !!(process.stdin.isTTY && process.stdout.isTTY), CliError = class extends Error {
-      constructor(message, { hint, code, cause } = {}) {
-        super(message), this.hint = hint, this.exitCode = code || 1, this.cause = cause;
+      constructor(message, { hint, code, cause, errors } = {}) {
+        super(message), this.name = "CliError", this.hint = hint, this.exitCode = code || 1, this.cause = cause, this.errors = errors;
       }
-    }, debugEnabled = () => !!(env.SWITCH_PROFILE_DEBUG || env.DEBUG && /switch-profile|\*/.test(env.DEBUG)), errorsMessage = (errors) => (errors || []).map((e) => e && e.message || String(e)).filter(Boolean).join(`
+    }, cliErrorFrom = (errors, options) => new CliError(errorsMessage(errors), { ...options, errors }), debugEnabled = () => !!(env.SWITCH_PROFILE_DEBUG || env.DEBUG && /switch-profile|\*/.test(env.DEBUG)), errorsMessage = (errors) => (errors || []).map((e) => e && e.message || String(e)).filter(Boolean).join(`
 `), printError = (err) => {
       let lines = [`${ui2.bad(sym.err)} ${err.message || String(err)}`];
-      err.hint && lines.push(`  ${ui2.dim(err.hint)}`), debugEnabled() && err.stack ? lines.push(ui2.dim(err.stack)) : err instanceof CliError || lines.push(`  ${ui2.dim("Run with --debug for details.")}`), console.error(lines.join(`
+      err.hint && lines.push(`  ${ui2.dim(err.hint)}`), debugEnabled() && err.stack && lines.push(ui2.dim(err.stack)), (!(err instanceof CliError) || err.exitCode == 1) && lines.push(`  ${ui2.dim(`Details: ${log3.displayPath()}`)}`), console.error(lines.join(`
 `));
     }, ago = (date2) => {
       let ms = Date.now() - new Date(date2).getTime();
@@ -5341,6 +5408,7 @@ var require_ui = __commonJS({
       debugEnabled,
       errorsMessage,
       printError,
+      cliErrorFrom,
       ago
     };
   }
@@ -5351,7 +5419,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "switch-profile",
-      version: "2.2.0",
+      version: "2.3.0",
       main: "index.js",
       bin: {
         "switch-profile": "index.js"
@@ -5451,23 +5519,40 @@ var require_settings = __commonJS({
 // src/core.js
 var require_core = __commonJS({
   "src/core.js"(exports2, module2) {
-    var { exec: exec2, spawn } = require("child_process"), WrappedError = class extends Error {
+    var { exec: exec2, spawn } = require("child_process"), log3 = require_log(), WrappedError = class extends Error {
       constructor(message, errors) {
         super(message), this.errors = errors || [];
       }
     }, wrapErrors = (message, errors) => new WrappedError(message, errors), flattenErrors = (err) => err instanceof WrappedError ? [new Error(err.message), ...err.errors.flatMap(flattenErrors)] : [err instanceof Error ? err : new Error(String(err))], catchErrors = (promise) => Promise.resolve(promise).then((value) => [null, value], (err) => [flattenErrors(err)]), IS_WINDOWS = process.platform == "win32", _exec = (cmd) => new Promise((next, fail) => {
+      let started = Date.now();
       exec2(cmd, (error, stdout2, stderr) => {
-        error || stderr ? fail(error || stderr) : next(stdout2);
+        log3.command({ cmd, args: [], code: error ? error.code ?? 1 : stderr ? "stderr" : 0, ms: Date.now() - started, output: stderr || error && error.message }), error || stderr ? fail(error || stderr) : next(stdout2);
       });
-    }), run2 = (cmd, args, options) => new Promise((next, fail) => {
-      let { inherit } = options || {}, child = spawn(cmd, args || [], {
-        stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"],
+    }), commandError = (message, { command, exitCode, output }) => Object.assign(new Error(message), { command, code: exitCode, output }), run2 = (cmd, args, options) => new Promise((next, fail) => {
+      let { inherit, tee } = options || {}, started = Date.now(), command = `${cmd} ${log3.redactArgs(args).join(" ")}`.trim(), child = spawn(cmd, args || [], {
+        stdio: tee ? ["inherit", "inherit", "pipe"] : inherit ? "inherit" : ["ignore", "pipe", "pipe"],
         ...IS_WINDOWS ? { shell: !0 } : {}
       }), stdout2 = "", stderr = "";
-      inherit || (child.stdout.on("data", (d) => stdout2 += d), child.stderr.on("data", (d) => stderr += d)), child.on("error", fail), child.on("close", (code) => {
-        code === 0 ? next(stdout2) : fail(new Error((stderr || stdout2 || "").trim() || `'${cmd} ${(args || []).join(" ")}' exited with code ${code}`));
+      tee ? child.stderr.on("data", (d) => {
+        stderr += d, process.stderr.write(d);
+      }) : inherit || (child.stdout.on("data", (d) => stdout2 += d), child.stderr.on("data", (d) => stderr += d)), child.on("error", (err) => {
+        log3.command({ cmd, args, code: err.code || "spawn error", ms: Date.now() - started, output: err.message, inherit: inherit || tee }), fail(Object.assign(err, { command }));
+      }), child.on("close", (code) => {
+        let output = (stderr || stdout2 || "").trim();
+        log3.command({ cmd, args, code, ms: Date.now() - started, output, inherit: inherit || tee }), code === 0 ? next(stdout2) : fail(commandError(lastErrorLine(output) || `'${command}' exited with code ${code}`, { command, exitCode: code, output }));
       });
-    }), _commandExistsResult = {}, isCommandExist = (cmd, errorMsg) => () => catchErrors((async () => {
+    }), lastErrorLine = (output) => {
+      let text2 = (output || "").trim();
+      if (!text2)
+        return "";
+      let lines = text2.split(`
+`).map((l2) => l2.trim()).filter(Boolean);
+      if (lines.length <= 3)
+        return text2;
+      let telling = lines.filter((l2) => /error|exception|denied|invalid|expired|unable|not found|failed/i.test(l2));
+      return telling.length ? telling.slice(-2).join(`
+`) : text2;
+    }, _commandExistsResult = {}, isCommandExist = (cmd, errorMsg) => () => catchErrors((async () => {
       if (!cmd)
         return !1;
       if (_commandExistsResult[cmd] !== void 0)
@@ -5481,6 +5566,7 @@ var require_core = __commonJS({
       wrapErrors,
       exec: _exec,
       run: run2,
+      lastErrorLine,
       isCommandExist
     };
   }
@@ -5713,8 +5799,13 @@ var require_login = __commonJS({
       text2 = text2 || "";
       let urls = text2.match(URL_REGEX) || [], code = (text2.match(CODE_REGEX) || [])[1] || null, completeUrl = urls.find((u5) => /user_code=/.test(u5)) || null;
       return { url: urls.find((u5) => u5 !== completeUrl) || completeUrl || null, code, completeUrl };
+    }, WRONG_REGION = /Invalid start url|invalid_request|InvalidRequestException/i, configureSsoFailure = (output, sessions) => {
+      let lines = (output || "").split(`
+`).map((l2) => l2.trim()).filter(Boolean), detail = (lines.filter((l2) => /error/i.test(l2)).slice(-1)[0] || lines.slice(-1)[0] || "").replace(/^aws:\s*\[ERROR\]:\s*/i, ""), description = ((output || "").match(/error_description:\s*(.+)/) || [])[1], known = (sessions || []).filter((s) => s.sso_region).map((s) => `${s.name} (${s.sso_region}, ${s.sso_start_url})`), reuse = known.length ? ` Portals already set up here: ${known.join(", ")}. Type one of these names as the session name to reuse it.` : "", message = `aws configure sso failed${description || detail ? `: ${(description || detail).trim()}` : "."}`;
+      return WRONG_REGION.test(output || "") ? { message, hint: `The SSO region is most likely wrong: it must be the region where IAM Identity Center lives (Identity Center console \u203A Settings), not where you deploy. AWS reports a wrong region as an invalid start URL.${reuse}` } : { message, hint: `Run sp add to try again.${reuse}` };
     };
     module2.exports = {
+      configureSsoFailure,
       isRemoteSession,
       resolveLoginMode,
       loginFlags,
@@ -5835,12 +5926,12 @@ var require_regions = __commonJS({
 // src/aws/index.js
 var require_aws = __commonJS({
   "src/aws/index.js"(exports2, module2) {
-    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast } = require_login(), regions = require_regions(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
+    var fs = require("fs"), crypto = require("crypto"), { homedir, EOL } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { exec: exec2, run: run2, isCommandExist, catchErrors, wrapErrors } = require_core(), settings2 = require_settings(), { CLI_VERSION: CLI_VERSION2 } = settings2, transforms = require_transforms(), { loginFlags, isRemoteSession, atLeast } = require_login(), regions = require_regions(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", NL = IS_WINDOWS ? `
 ` : EOL, AWS_CONFIG_FILE = join2(homedir(), ".aws", "config"), AWS_CREDS_FILE = join2(homedir(), ".aws", "credentials"), AWS_SSO_FOLDER = join2(homedir(), ".aws", "sso", "cache"), awsExists = isCommandExist("aws"), _awsCliVersion = null, whichAws = () => exec2(`${process.platform == "win32" ? "where" : "which"} aws`).then((out) => (out || "").split(/\r?\n/)[0].trim(), () => null), getAwsCliVersion = async () => {
       if (_awsCliVersion)
         return _awsCliVersion;
-      let path2 = await whichAws(), stat = path2 ? await fs.promises.stat(fs.realpathSync(path2)).catch(() => null) : null, cached = (await settings2.read().catch(() => ({}))).awsCli;
-      return stat && cached && cached.path == path2 && cached.mtimeMs == stat.mtimeMs && cached.version ? _awsCliVersion = cached.version : (_awsCliVersion = ((await exec2("aws --version") || "").match(/aws-cli\/(\S+)/) || [])[1] || null, stat && _awsCliVersion && await settings2.update({ awsCli: { path: path2, mtimeMs: stat.mtimeMs, version: _awsCliVersion } }).catch(() => null), _awsCliVersion);
+      let path2 = await whichAws(), stat = path2 ? await fs.promises.stat(fs.realpathSync(path2)).catch(() => null) : null, cached = (await settings2.read().catch(log3.tolerated("reading the settings", {}))).awsCli;
+      return stat && cached && cached.path == path2 && cached.mtimeMs == stat.mtimeMs && cached.version ? _awsCliVersion = cached.version : (_awsCliVersion = ((await exec2("aws --version") || "").match(/aws-cli\/(\S+)/) || [])[1] || null, stat && _awsCliVersion && await settings2.update({ awsCli: { path: path2, mtimeMs: stat.mtimeMs, version: _awsCliVersion } }).catch(log3.tolerated("caching the AWS CLI version", null)), _awsCliVersion);
     }, awsCliV2Exists = (noFailIfMissing) => catchErrors((async () => {
       let [awsCliErrors] = await awsExists();
       if (awsCliErrors) {
@@ -5932,9 +6023,9 @@ var require_aws = __commonJS({
       if (!atLeast(version, [2, 32, 0]))
         throw new Error(`'aws login' needs AWS CLI 2.32 or later (you have ${version}). Update the AWS CLI and try again.`);
       let remote = isRemoteSession(process.env, process.platform) ? ["--remote"] : [];
-      await run2("aws", ["login", "--profile", profile, ...remote], { inherit: !0 });
+      await run2("aws", ["login", "--profile", profile, ...remote], { tee: !0 });
     }, logoutAll = async () => {
-      await run2("aws", ["sso", "logout"]), atLeast(await getAwsCliVersion(), [2, 32, 0]) && await run2("aws", ["logout", "--all"]).catch(() => null);
+      await run2("aws", ["sso", "logout"]), atLeast(await getAwsCliVersion(), [2, 32, 0]) && await run2("aws", ["logout", "--all"]).catch(log3.tolerated("aws logout --all", null));
     }, readSsoToken = async ({ ssoSession, startUrl }) => {
       let key = crypto.createHash("sha1").update(ssoSession || startUrl).digest("hex"), token = await fs.promises.readFile(join2(AWS_SSO_FOLDER, `${key}.json`), "utf8").then(JSON.parse).catch(() => null);
       return !token || !token.accessToken || new Date(token.expiresAt).getTime() < Date.now() + 60 * 1e3 ? null : token;
@@ -6016,9 +6107,9 @@ var require_aws = __commonJS({
     })()), createSsoProfile = (name) => catchErrors((async () => {
       await awsCliV2Exists();
       try {
-        await run2("aws", ["configure", "sso", "--profile", name], { inherit: !0 });
+        await run2("aws", ["configure", "sso", "--profile", name], { tee: !0 });
       } catch (err) {
-        throw new Error(`'aws configure sso' failed (${err.message}). The SSO profile may not have been created correctly.`, { cause: err });
+        throw Object.assign(new Error(`'aws configure sso' failed: ${err.message}`, { cause: err }), { output: err.output || "" });
       }
       let [configStrErrors, configStr] = await getConfigFile();
       if (configStrErrors)
@@ -6059,7 +6150,7 @@ var require_aws = __commonJS({
 // src/shell.js
 var require_shell = __commonJS({
   "src/shell.js"(exports2, module2) {
-    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
+    var fs = require("fs"), { homedir } = require("os"), { join: join2, dirname: dirname2, basename } = require("path"), { run: run2 } = require_core(), log3 = require_log(), IS_WINDOWS = process.platform === "win32", IS_MAC = process.platform === "darwin", FUNCTION_NAME = "sp", BLOCK_START_PREFIX = "# >>> switch-profile", BLOCK_END = "# <<< switch-profile <<<", BLOCK_REGEX = /(^|\r?\n)# >>> switch-profile[^\n]*\r?\n[\s\S]*?# <<< switch-profile <<<[^\n]*(\r?\n)?/, blockStart = (version) => `${BLOCK_START_PREFIX} v${version} (managed by switch-profile, do not edit) >>>`, CLEARED_VARS = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_DEFAULT_PROFILE"], SUBCOMMANDS = ["status", "login", "logout", "add", "remove", "settings", "use"], PROFILES_SED = "sed -n 's/^\\[profile \\(.*\\)\\]$/\\1/p'", POSIX_FUNCTION = (shell) => `${FUNCTION_NAME}() {
 	local __sp_file __sp_status
 	__sp_file="$(mktemp "\${TMPDIR:-/tmp}/switch-profile.XXXXXX")" || return 1
 	if [ -n "\${SWITCH_PROFILE_DEV_BIN:-}" ]; then
@@ -6193,7 +6284,7 @@ Register-ArgumentCompleter -CommandName ${FUNCTION_NAME} -ParameterName Rest -Sc
       if (IS_WINDOWS && !shellPath) {
         let files = [];
         for (let exe of ["pwsh", "powershell"]) {
-          let file = await run2(exe, ["-NoProfile", "-NonInteractive", "-Command", "$PROFILE.CurrentUserAllHosts"]).then((out) => (out || "").trim()).catch(() => "");
+          let file = await run2(exe, ["-NoProfile", "-NonInteractive", "-Command", "$PROFILE.CurrentUserAllHosts"]).then((out) => (out || "").trim()).catch(log3.tolerated("reading the PowerShell profile path", ""));
           file && !files.includes(file) && files.push(file);
         }
         if (files.length)
@@ -6316,7 +6407,7 @@ var require_migrate = __commonJS({
 // src/commands/common.js
 var require_common = __commonJS({
   "src/commands/common.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), ui2 = require_ui(), CancelError2 = class extends Error {
     }, ask = async (promise) => {
       let value = await promise;
       if (p4.isCancel(value))
@@ -6329,14 +6420,14 @@ var require_common = __commonJS({
     }, preflight = async ({ interactive, quiet }) => {
       let [cliErrors, cliExists] = await aws.awsCliV2Exists(!0);
       if (cliErrors)
-        throw new ui2.CliError(ui2.errorsMessage(cliErrors), { hint: "switch-profile needs AWS CLI v2." });
+        throw ui2.cliErrorFrom(cliErrors, { hint: "switch-profile needs AWS CLI v2." });
       if (!cliExists)
         throw new ui2.CliError("The AWS CLI is not installed.", { hint: INSTALL_HINTS[process.platform] || INSTALL_HINTS.linux });
       let result;
       try {
         result = await migrate.runMigrations();
       } catch (err) {
-        throw err instanceof migrate.NewerFormatError ? new ui2.CliError(err.message) : err;
+        throw err instanceof migrate.NewerFormatError ? new ui2.CliError(err.message, { cause: err }) : err;
       }
       if (result.migrated && !quiet && p4.log.info([
         `Upgraded your AWS setup for switch-profile ${settings2.CLI_VERSION} ${ui2.unicode ? "\u{1F389}" : ""}`,
@@ -6347,7 +6438,7 @@ var require_common = __commonJS({
         let legacy = await migrate.findLegacySsoProfiles();
         legacy.length && (p4.log.warn(`${legacy.length > 1 ? `${legacy.length} profiles use` : "1 profile uses"} the old SSO format, which never auto-refreshes: ${legacy.join(", ")}`), await ask(p4.confirm({ message: "Upgrade them now? You'll log in once per SSO portal." })) ? await upgradeLegacySso(legacy) : (await settings2.update({ ssoUpgradeDeclined: !0 }), p4.log.message(ui2.dim("No problem. You can upgrade later from Settings."))));
       }
-      let status = await shell.getStatus(settings2.CLI_VERSION).catch(() => null);
+      let status = await shell.getStatus(settings2.CLI_VERSION).catch(log3.tolerated("reading the sp shortcut status", null));
       status && status.installed && status.outdated && await shell.install(settings2.CLI_VERSION).then(() => !0, () => !1) && !quiet && p4.log.info(`Updated the ${ui2.accent(shell.FUNCTION_NAME)} shortcut in ${status.shell.files.map(shell.tilde).join(", ")} ${ui2.dim("(new terminals pick it up)")}`);
     }, upgradeLegacySso = async (names) => {
       let { sessions, backups } = await migrate.upgradeLegacySsoProfiles(names);
@@ -6360,10 +6451,10 @@ var require_common = __commonJS({
     }, loadState = async () => {
       let [listErrors, profiles] = await aws.listProfiles();
       if (listErrors)
-        throw new ui2.CliError(ui2.errorsMessage(listErrors));
+        throw ui2.cliErrorFrom(listErrors);
       let [defaultErrors, info] = await aws.getDefaultProfile();
       if (defaultErrors)
-        throw new ui2.CliError(ui2.errorsMessage(defaultErrors));
+        throw ui2.cliErrorFrom(defaultErrors);
       let defaultProfile = profiles.find((x2) => x2.name == info.profile) || null;
       return { profiles, defaultName: defaultProfile ? defaultProfile.name : null, defaultProfile, settings: await settings2.read() };
     }, loginKey = (profile) => profile.sso_session || profile.sso_start_url || profile.name, describe = (profile, identity) => ui2.join([
@@ -7392,11 +7483,11 @@ var require_clipboard = __commonJS({
 // src/commands/login-flow.js
 var require_login_flow = __commonJS({
   "src/commands/login-flow.js"(exports2, module2) {
-    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
+    var { spawn } = require("child_process"), p4 = (init_dist4(), __toCommonJS(dist_exports2)), { renderUnicodeCompact } = require_dist(), aws = require_aws(), settings2 = require_settings(), { parseLoginOutput, isRemoteSession, atLeast } = require_login(), clipboard = require_clipboard(), ui2 = require_ui(), log3 = require_log(), { CancelError: CancelError2 } = require_common(), IS_WINDOWS = process.platform == "win32", RAW_OUTPUT_AFTER_MS = 1e4, clipboardNote = (result) => result == "local" ? ui2.ok("\u{1F4CB} copied") : result == "terminal" ? ui2.dim("\u{1F4CB} sent to your clipboard") : "", ssoLogin = async (target, { label, loginKey, interactive, loginMode }) => {
       let current = await settings2.read(), args = await aws.ssoLoginArgs(target, loginMode || settings2.getLoginMode(current)), legacyCli = !atLeast(await aws.getAwsCliVersion(), [2, 22, 0]), device = args.includes("--use-device-code") || legacyCli, remote = isRemoteSession(process.env, process.platform);
       if (!interactive)
         return plainLogin(args, label);
-      let child = spawn("aws", args, { stdio: ["ignore", "pipe", "pipe"], ...IS_WINDOWS ? { shell: !0 } : {} }), output = "", shown = !1, rawMode = !1, spin = null, parsed = {}, stdin2 = process.stdin, onKey = async (key) => {
+      let started = Date.now(), child = spawn("aws", args, { stdio: ["ignore", "pipe", "pipe"], ...IS_WINDOWS ? { shell: !0 } : {} }), output = "", shown = !1, rawMode = !1, spin = null, parsed = {}, stdin2 = process.stdin, onKey = async (key) => {
         if (key === "") {
           child.kill();
           return;
@@ -7441,7 +7532,7 @@ ${ui2.dim(`If nothing opens, visit: ${parsed.url}`)}`);
       }, RAW_OUTPUT_AFTER_MS), code = await new Promise((resolve) => {
         child.on("error", () => resolve(-1)), child.on("close", resolve);
       });
-      if (clearTimeout(fallback), cleanup(), code === 0) {
+      if (clearTimeout(fallback), cleanup(), log3.command({ cmd: "aws", args, code: child.killed ? "killed (cancelled)" : code, ms: Date.now() - started, output }), code === 0) {
         spin ? spin.stop(`${ui2.unicode ? "\u{1F513} " : ""}Logged in`) : p4.log.success("Logged in"), await rememberLogin(loginKey);
         return;
       }
@@ -7453,12 +7544,15 @@ ${ui2.dim(`If nothing opens, visit: ${parsed.url}`)}`);
 `) || lines.slice(-1)[0] || "";
       throw new ui2.CliError(`SSO login for ${label} failed.${detail ? `
 ${detail}` : ""}`, {
-        hint: /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : "Try again, or run with --debug."
+        cause: Object.assign(new Error(`aws ${args.join(" ")} exited with code ${code}`), { output }),
+        hint: /invalid_grant|InvalidGrant/i.test(output) ? "Check the SSO region of this profile: it must be the region of your IAM Identity Center, not where your resources live." : `Try again. Details: ${log3.displayPath()}`
       });
     }, plainLogin = async (args, label) => {
       console.error(`Logging in to ${label}. Approve the request using the URL and code below.`), await new Promise((resolve, reject) => {
-        let child = spawn("aws", args, { stdio: ["ignore", process.stderr, process.stderr], ...IS_WINDOWS ? { shell: !0 } : {} });
-        child.on("error", reject), child.on("close", (code) => code === 0 ? resolve() : reject(new ui2.CliError(`SSO login for ${label} failed.`, { code: 2 })));
+        let started = Date.now(), child = spawn("aws", args, { stdio: ["ignore", process.stderr, process.stderr], ...IS_WINDOWS ? { shell: !0 } : {} });
+        child.on("error", reject), child.on("close", (code) => {
+          log3.command({ cmd: "aws", args, code, ms: Date.now() - started, output: "(output passed through to stderr)" }), code === 0 ? resolve() : reject(new ui2.CliError(`SSO login for ${label} failed.`, { code: 2 }));
+        });
       });
     }, rememberLogin = async (key) => {
       if (!key)
@@ -7540,7 +7634,7 @@ ${gray(S_BAR2)}`;
 // src/commands/switch.js
 var require_switch = __commonJS({
   "src/commands/switch.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), settings2 = require_settings(), shell = require_shell(), rank = require_rank(), ui2 = require_ui(), log3 = require_log(), { ask, preflight, loadState, loginKey, describe, loginState, CancelError: CancelError2 } = require_common(), { ssoLogin } = require_login_flow(), { home, ACTION_PREFIX } = require_home(), header = async (state, { warnings } = {}) => {
       p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
       let lines = [];
       if (state.defaultProfile) {
@@ -7601,20 +7695,20 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
         return result;
       let loginProfile = profile.kind == "role" && profile.source_profile ? state.profiles.find((x2) => x2.name == profile.source_profile) : profile;
       if (!(loginProfile && (loginProfile.kind == "sso" || loginProfile.kind == "login")))
-        throw new ui2.CliError(`Could not get credentials for ${profile.name}.`, { hint: firstLine(result.message) });
+        throw new ui2.CliError(`Could not get credentials for ${profile.name}.`, { hint: firstLine(result.message), cause: result });
       if (!interactive && !force)
         throw new ui2.CliError(`${profile.name} needs a login.`, { code: 2, hint: `Run: switch-profile login ${loginProfile.name}` });
       if (loginProfile.kind == "sso" ? await ssoLogin({ profile: loginProfile.name }, { label: loginProfile.sso_session || loginProfile.name, loginKey: loginKey(loginProfile), interactive }) : await aws.awsLogin(loginProfile.name), result = await tryIdentity(), result instanceof Error)
-        throw new ui2.CliError(`Logged in, but ${profile.name} still has no access.`, { hint: firstLine(result.message) });
+        throw new ui2.CliError(`Logged in, but ${profile.name} still has no access.`, { hint: firstLine(result.message), cause: result });
       return result;
     }, firstLine = (text2) => String(text2 || "").trim().split(`
 `).filter(Boolean).slice(-1)[0], switchTo = async (profile, state, opts) => (await doSwitch(profile, state, opts), { switched: !0 }), doSwitch = async (profile, state, opts) => {
       let { interactive, json } = opts, identity = await connect(profile, state, { interactive, quiet: json, force: opts.force }), [defaultErrors] = await aws.setDefaultProfile(profile.name);
       if (defaultErrors)
-        throw new ui2.CliError(ui2.errorsMessage(defaultErrors));
+        throw ui2.cliErrorFrom(defaultErrors);
       let current = await settings2.read();
       await settings2.update({ usage: rank.recordUsage(current.usage, profile.name) });
-      let terminal = await shell.exportProfile(profile.name).catch(() => !1);
+      let terminal = await shell.exportProfile(profile.name).catch(log3.tolerated("handing the profile to sp", !1));
       if (json) {
         process.stdout.write(JSON.stringify({ profile: profile.name, account: identity.account, arn: identity.arn, region: profile.region || null, default: !0, terminal }) + `
 `);
@@ -7634,7 +7728,7 @@ ${ui2.dim(viaShortcut ? "Switching clears them from this terminal." : `Unset ${s
 ${ui2.dim("set as the default profile")}`), await offerShortcut(profile);
     }, exportHint = (name) => process.platform == "win32" ? `$env:AWS_PROFILE = "${name}"   ${ui2.dim("(PowerShell)")}
    set AWS_PROFILE=${name}   ${ui2.dim("(CMD)")}` : `export AWS_PROFILE=${name}`, offerShortcut = async (profile) => {
-      let status = await shell.getStatus(settings2.CLI_VERSION).catch(() => null), hint = `${ui2.dim("To use it in this terminal only, run:")}
+      let status = await shell.getStatus(settings2.CLI_VERSION).catch(log3.tolerated("reading the sp shortcut status", null)), hint = `${ui2.dim("To use it in this terminal only, run:")}
    ${ui2.accent(exportHint(profile.name))}`;
       if (status && status.installed) {
         p4.outro(`${hint}
@@ -7690,7 +7784,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
           return result;
         if (next == "throw")
           throw error;
-        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && ui2.printError(error), state = await loadState();
+        next == "back" && p4.cancel(ui2.dim(`${ui2.unicode ? "\u2190" : "<-"} Back`)), next == "error" && (log3.error(`${route.key} failed (back to the home screen)`, error), ui2.printError(error)), state = await loadState();
       }
     }, switchCommand = async (query, opts) => {
       let interactive = ui2.isInteractive(opts);
@@ -7729,7 +7823,7 @@ ${ui2.dim(`Open a new terminal or run: ${installed.reload}`)}`), installed.name
 // src/commands/index.js
 var require_commands = __commonJS({
   "src/commands/index.js"(exports2, module2) {
-    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
+    var p4 = (init_dist4(), __toCommonJS(dist_exports2)), log3 = require_log(), aws = require_aws(), transforms = require_transforms(), settings2 = require_settings(), shell = require_shell(), migrate = require_migrate(), rank = require_rank(), { resolveLoginMode, isRemoteSession, configureSsoFailure } = require_login(), ui2 = require_ui(), { ask, preflight, loadState, loginKey, describe, loginState, upgradeLegacySso } = require_common(), { ssoLogin, rememberLogin } = require_login_flow(), { switchCommand, switchTo, connect, enableShortcut } = require_switch(), intro2 = (opts) => {
       !opts.fromPicker && !opts.json && p4.intro(`${ui2.badge("switch-profile")} ${ui2.dim(settings2.CLI_VERSION)}`);
     }, begin = async (opts, { needsInput } = {}) => {
       let interactive = ui2.isInteractive(opts);
@@ -7748,7 +7842,7 @@ var require_commands = __commonJS({
       return interactive && !opts.json && intro2(opts), switchTo(findProfile(state, name), state, { ...opts, interactive });
     }, status = async (args, opts) => {
       await begin(opts);
-      let state = await loadState(), terminal = process.env.AWS_PROFILE || null, shortcut = await shell.getStatus(settings2.CLI_VERSION).catch(() => null), d = state.defaultProfile, login2 = d ? await loginState(d, state) : { text: null, needsLogin: !1 };
+      let state = await loadState(), terminal = process.env.AWS_PROFILE || null, shortcut = await shell.getStatus(settings2.CLI_VERSION).catch(log3.tolerated("reading the sp shortcut status", null)), d = state.defaultProfile, login2 = d ? await loginState(d, state) : { text: null, needsLogin: !1 };
       if (opts.json) {
         let at = d ? (state.settings.logins || {})[loginKey(d)] : null;
         process.stdout.write(JSON.stringify({
@@ -7813,21 +7907,31 @@ var require_commands = __commonJS({
         return importFromSso(state, { ...opts, interactive });
       let taken = state.profiles.map((x2) => x2.name), name = await ask(p4.text({ message: "Profile name", placeholder: "e.g. acme-prod", validate: validateProfileName(taken) }));
       if (kind == "sso") {
+        let [configErrors, configStr] = await aws.getConfigFile();
+        if (configErrors)
+          throw ui2.cliErrorFrom(configErrors);
+        let sessions = transforms.listSsoSessions(configStr);
         p4.log.message([
           "Handing over to aws configure sso. You will be asked for:",
-          `${ui2.dim("1.")} a session name ${ui2.dim("(reuse the same one for every profile of a portal: one login covers them all)")}`,
+          `${ui2.dim("1.")} a session name ${ui2.dim("(a short name such as acme, not the URL; reuse the same one for every profile of a portal: one login covers them all)")}`,
           `${ui2.dim("2.")} the start URL ${ui2.dim("(e.g. https://acme.awsapps.com/start)")}`,
-          `${ui2.dim("3.")} the SSO region ${ui2.dim("(where IAM Identity Center lives, not where you deploy)")}`
+          `${ui2.dim("3.")} the SSO region ${ui2.dim("(where IAM Identity Center lives, not where you deploy)")}`,
+          ...sessions.length ? [ui2.dim(`Portals already set up: ${sessions.map((x2) => `${x2.name} (${x2.sso_region || "?"})`).join(", ")}. Type one of these names to reuse it.`)] : []
         ].join(`
 `));
         let [errors, upgraded] = await aws.createSsoProfile(name);
-        if (errors)
-          throw new ui2.CliError(ui2.errorsMessage(errors));
+        if (errors) {
+          let failed = errors.find((e) => e.output != null);
+          if (!failed)
+            throw ui2.cliErrorFrom(errors);
+          let { message, hint } = configureSsoFailure(failed.output, sessions);
+          throw new ui2.CliError(message, { hint, errors });
+        }
         upgraded && p4.log.info(`No session name was given, so ${name} now uses an [sso-session] for auto-refresh. You'll log in once more.`);
       } else if (kind == "login") {
         let region = await chooseRegion("Default region", "us-east-1"), [configErrors, configStr] = await aws.getConfigFile();
         if (configErrors)
-          throw new ui2.CliError(ui2.errorsMessage(configErrors));
+          throw ui2.cliErrorFrom(configErrors);
         let ini = require_ini();
         await aws.writeAwsFile(aws.AWS_CONFIG_FILE, ini.setSection(configStr, `profile ${name}`, [["region", region], [transforms.VERSION_KEY, settings2.CLI_VERSION]])), p4.log.step("Signing in with aws login\u2026"), await aws.awsLogin(name);
       } else {
@@ -7836,7 +7940,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
           return p4.outro(ui2.dim("Nothing changed."));
         let aws_access_key_id = await ask(p4.text({ message: "Access key ID", validate: (v) => v ? void 0 : "Required." })), aws_secret_access_key = await ask(p4.password({ message: "Secret access key", validate: (v) => v ? void 0 : "Required." })), region = await chooseRegion("Default region", "us-east-1"), [errors] = await aws.createProfile({ name, aws_access_key_id, aws_secret_access_key, region });
         if (errors)
-          throw new ui2.CliError(ui2.errorsMessage(errors));
+          throw ui2.cliErrorFrom(errors);
       }
       p4.log.success(`Profile ${ui2.accent(name)} created`);
       let next = await loadState();
@@ -7854,7 +7958,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
     }, importFromSso = async (state, opts) => {
       let { interactive } = opts, [configErrors, configStr] = await aws.getConfigFile();
       if (configErrors)
-        throw new ui2.CliError(ui2.errorsMessage(configErrors));
+        throw ui2.cliErrorFrom(configErrors);
       let sessions = transforms.listSsoSessions(configStr), sessionName = opts.fromSso && opts.fromSso !== !0 ? opts.fromSso : null;
       if (sessionName && !sessions.some((s) => s.name == sessionName))
         throw new ui2.CliError(`There is no [sso-session ${sessionName}] in ~/.aws/config.`, { code: 3, hint: sessions.length ? `Known sessions: ${sessions.map((s) => s.name).join(", ")}` : "Run switch-profile add in a terminal to add a portal." });
@@ -7892,7 +7996,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
         entries = accounts.flatMap((a2, i2) => roles[i2].map((roleName) => ({ ...a2, roleName }))), spin && spin.stop(`Found ${accounts.length} account${accounts.length == 1 ? "" : "s"} and ${entries.length} role${entries.length == 1 ? "" : "s"}`);
       } catch (err) {
         throw spin && spin.error("Could not read the accounts"), new ui2.CliError(`Could not list the accounts of ${sessionName}.`, { hint: String(err.message).trim().split(`
-`).slice(-1)[0] });
+`).slice(-1)[0], cause: err });
       }
       let sessionRegions = state.profiles.filter((x2) => x2.sso_session == sessionName && x2.region).map((x2) => x2.region), region = opts.region || (interactive ? await chooseRegion("Default region for these profiles", sessionRegions[0] || session.sso_region) : session.sso_region), prefix = opts.prefix || (interactive ? await ask(p4.text({ message: `Name prefix ${ui2.dim("(profiles become <prefix>-<account>-<role>)")}`, initialValue: sessionName, validate: (v) => /^[a-z0-9_-]*$/.test(v || "") ? void 0 : "Lowercase letters, numbers, - and _ only." })) : sessionName), preview = transforms.populateSsoProfiles(configStr, { ssoSession: sessionName, entries, region, prefix, prune: !1, version: settings2.CLI_VERSION });
       if (!preview.added.length && !preview.stale.length)
@@ -7953,7 +8057,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
       }
       let [errors] = await aws.deleteProfiles(names);
       if (errors)
-        throw new ui2.CliError(ui2.errorsMessage(errors));
+        throw ui2.cliErrorFrom(errors);
       p4.outro(`${ui2.ok(ui2.sym.ok)} Removed ${names.join(", ")}`);
     }, LOGIN_MODE_LABELS = {
       auto: "Auto: device code over SSH, browser otherwise",
@@ -8012,7 +8116,7 @@ AWS recommends SSO or console sign-in instead.`), !await ask(p4.confirm({ messag
 });
 
 // src/cli.js
-var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports2)), ui = require_ui(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
+var { Command } = require_commander(), p3 = (init_dist4(), __toCommonJS(dist_exports2)), ui = require_ui(), log2 = require_log(), { CLI_VERSION } = require_settings(), { CancelError } = require_common(), commands = require_commands();
 process.env.AWS_CLI_AGENT_TOOLKIT_HINT_DISABLED = "true";
 var EXAMPLES = `
 Examples:
@@ -8027,19 +8131,28 @@ Examples:
 sets AWS_PROFILE in the current terminal. Without it, use 'npx switch-profile'.
 
 Exit codes: 0 ok \xB7 1 error \xB7 2 login required \xB7 3 bad input \xB7 130 cancelled`, run = (action) => async (...args) => {
-  let opts = args[args.length - 1].optsWithGlobals();
+  let cmd = args[args.length - 1], opts = cmd.optsWithGlobals();
   opts.debug && (process.env.SWITCH_PROFILE_DEBUG = "1");
   try {
     await action(...args.slice(0, -2), opts);
   } catch (err) {
     if (err instanceof CancelError) {
-      p3.cancel(`Cancelled ${ui.unicode ? "\u{1F44B}" : ""}`), process.exitCode = 130;
+      log2.info("cancelled by the user"), p3.cancel(`Cancelled ${ui.unicode ? "\u{1F44B}" : ""}`), process.exitCode = 130;
       return;
     }
-    opts.json && err instanceof ui.CliError ? process.stderr.write(JSON.stringify({ error: err.message, hint: err.hint || null, code: err.exitCode }) + `
+    log2.error(`${cmd.name()} failed`, err), opts.json && err instanceof ui.CliError ? process.stderr.write(JSON.stringify({ error: err.message, hint: err.hint || null, code: err.exitCode }) + `
 `) : ui.printError(err), process.exitCode = err.exitCode || 1;
   }
+}, crashed = (err) => {
+  log2.error("unexpected crash", err);
+  try {
+    ui.printError(err instanceof Error ? err : new Error(String(err)));
+  } catch {
+    console.error(err);
+  }
+  process.exit(1);
 }, main = (argv) => {
+  log2.start({ version: CLI_VERSION, argv }), process.on("uncaughtException", crashed), process.on("unhandledRejection", crashed), process.on("exit", (code) => log2.info(`exit ${code}`));
   let program = new Command();
   return program.name("switch-profile").description("Switch between AWS profiles, log in with SSO, and keep every terminal on the right account.").version(CLI_VERSION, "-v, --version").argument("[profile...]", "profile name or search text").option("--json", "machine-readable output").option("--no-input", "never prompt (fails with a hint instead)").option("--debug", "show error details").addHelpText("after", EXAMPLES).showSuggestionAfterError().action(run((words, opts) => commands.switch((words || []).join(" "), opts))), program.command("use").argument("<profile>").description("switch to a profile by its exact name").action(run(commands.use)), program.command("status").description("show the current profile and login state").action(run((opts) => commands.status([], opts))), program.command("login").argument("[profile]", "defaults to this terminal's profile, then the default profile").description("log in again now, even if the session is still valid").option("--device", "use a device code (approve from any device)").option("--browser", "use the browser on this machine").action(run(commands.login)), program.command("logout").description("end every SSO session on this machine").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.logout([], opts))), program.command("add").description("add profiles: import an SSO portal, or create one").option("--from-sso [session]", "import (or re-sync) every account and role of an [sso-session]").option("--region <region>", "default region of imported profiles").option("--prefix <prefix>", "name prefix of imported profiles").option("--prune", "remove imported profiles that no longer exist").option("-y, --yes", "do not ask for confirmation").action(run((opts) => commands.add([], opts))), program.command("remove").alias("rm").argument("[profiles...]").description("remove profiles").option("-y, --yes", "do not ask for confirmation").action(run(commands.remove)), program.command("settings").description("per-terminal switching, login mode and more").action(run((opts) => commands.settings([], opts))), program.command("switch", { hidden: !0 }).action(run((opts) => commands.switch("", opts))), program.parseAsync(argv);
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switch-profile",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "main": "index.js",
   "bin": {
     "switch-profile": "index.js"