Verify new profiles from the profile directory, not the project directory

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Verify new profiles from the profile directory instead of the current
+  directory. Vercel CLI 59 resolves the team from a linked project in the
+  working directory, so adding an account outside that team failed with
+  `Not authorized`.
 - `install.sh` installs into `~/.vcx` with a fresh manifest instead of
   `bun install --global`. Bun 1.4.0 fails with `refusing to install dependency
   with unsafe name` on some machines when the global manifest carries entries

dist/vercel.d.ts

@@ -2,6 +2,8 @@ export interface VercelRunOptions {
     globalConfig?: string;
     capture?: boolean;
     env?: NodeJS.ProcessEnv;
+    /** Working directory for Vercel. Defaults to the current directory. */
+    cwd?: string;
 }
 export interface VercelRunResult {
     code: number;

src/cli.ts

@@ -466,9 +466,13 @@ async function forwardToVercel(
 }
 
 async function verifyProfile(profileDir: string): Promise<string> {
+  // Vercel resolves the team from a linked project in the working directory,
+  // and an account outside that team gets "Not authorized". Verify from the
+  // profile directory instead, which never holds a project link.
   const result = await runVercel(["whoami"], {
     globalConfig: profileDir,
     capture: true,
+    cwd: profileDir,
   });
   if (result.missingBinary) throw missingVercelError();
   if (result.code !== 0) {

src/vercel.ts

@@ -5,6 +5,8 @@ export interface VercelRunOptions {
   globalConfig?: string;
   capture?: boolean;
   env?: NodeJS.ProcessEnv;
+  /** Working directory for Vercel. Defaults to the current directory. */
+  cwd?: string;
 }
 
 export interface VercelRunResult {
@@ -33,6 +35,7 @@ export async function runVercel(
     const capture = options.capture === true;
     const child = spawn(binary, vercelArgs, {
       env: childEnv,
+      ...(options.cwd ? { cwd: options.cwd } : {}),
       stdio: capture ? ["inherit", "pipe", "pipe"] : "inherit",
       windowsHide: false,
     });

test/cli.test.mjs

@@ -46,6 +46,7 @@ if (logPath) {
     commandArgs,
     globalConfig: globalConfig ?? null,
     envToken: process.env.VERCEL_TOKEN ?? null,
+    cwd: process.cwd(),
   }) + "\\n");
 }
 
@@ -522,3 +523,38 @@ test("links Vercel's global config directory to the active profile", async (t) =
   assert.equal(back.status, 0, back.stderr);
   assert.equal(await linkTarget(), await realpath(profileDir("work")));
 });
+
+test("verifies a new profile from its own directory, not the project directory", async (t) => {
+  const sandbox = await createSandbox(t);
+  const projectDir = join(sandbox.root, "project");
+  await mkdir(join(projectDir, ".vercel"), { recursive: true });
+  await writeFile(
+    join(projectDir, ".vercel", "project.json"),
+    JSON.stringify({ orgId: "team_other", projectId: "prj_1" }),
+  );
+
+  const added = spawnSync(
+    process.execPath,
+    [CLI_PATH, "profile", "add", "work", "--token", "tok-work"],
+    { cwd: projectDir, encoding: "utf8", env: childEnv(sandbox) },
+  );
+  assert.equal(added.status, 0, added.stderr);
+
+  const whoami = (await readLog(sandbox)).find(
+    (entry) => entry.commandArgs[0] === "whoami",
+  );
+  assert.ok(whoami, "verification ran whoami");
+  // The staged directory is renamed after verification, so compare prefixes
+  // instead of resolving it. Either form of the path is fine (macOS reports
+  // /private/var for /var).
+  const profilesDir = join(sandbox.configDir, "profiles");
+  const inside = (base) => whoami.cwd.startsWith(base);
+  assert.ok(
+    !inside(projectDir) && !inside(await realpath(projectDir)),
+    `verify ran in the project directory: ${whoami.cwd}`,
+  );
+  assert.ok(
+    inside(profilesDir) || inside(await realpath(profilesDir)),
+    `verify cwd ${whoami.cwd} should be inside the profiles directory`,
+  );
+});