fix(whoami): report the active project from config, not the key-bound team

[leggetter]

Fixes #318

Problem

After switching projects with hookdeck project use, hookdeck whoami still reported the previously active project and organization, even though every other command correctly targeted the newly selected project.

Root cause: whoami displays whatever GET /cli-auth/validate returns, and ValidateAPIKey() deliberately strips the X-Team-ID / X-Project-ID headers (via clientForCLIAuthValidate()) so a stale project_id can't 401 a valid key. As a result the server always resolves the project from the API key's bound team, ignoring the config's active project_id.

Fix

whoami keeps using the validate response for the user identity, but now resolves the project/org/mode display values from the profile's active project_id when it differs from the key-bound team:

• Looks the active project up via the existing ListProjects() client call and parses org/name with project.ParseProjectName (same path project use / project list use).
• No extra API call when there's no active project_id or it matches the key-bound project.
• If the lookup fails or the active project no longer exists, falls back to the key-bound values and prints an explicit warning (including a hookdeck project use hint for the stale-project case) instead of silently reporting the wrong project.
• The "Project type" line now also prefers the resolved project's mode over the validate response's mode.

The intentional header-stripping in clientForCLIAuthValidate() is untouched.

Testing

• New TestResolveActiveProject unit tests cover: no active project, active == key-bound (asserts no extra list call), active resolved from the list, unparsable project name fallback, list-error fallback with warning, and deleted/missing project fallback with warning.
• go build ./... and go test ./... pass locally (one pre-existing, unrelated failure in pkg/listen/healthcheck that requires binding port 443, which this sandbox disallows).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Tt8HTLV1iCoQyxH9vozKra

---

Generated by Claude Code

[Copilot]

Pull request overview

Fixes hookdeck whoami showing a stale project/organization after hookdeck project use by continuing to trust /cli-auth/validate for user identity while resolving the displayed project/org/mode from the active project_id in config when it differs from the key-bound project.

Changes:

• Add resolveActiveProject to prefer the config’s active project_id by looking it up via ListProjects() (which uses the header-stripping client) and parsing the [Org] Project format via project.ParseProjectName.
• Update whoami output to use the resolved project/org and to prefer the resolved project mode when deriving “Project type”.
• Add unit tests covering “no active project”, “active == key-bound (no list call)”, “resolved from list”, parse fallback, list error fallback with warning, and missing/deleted project fallback with warning.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pkg/cmd/whoami.go	Resolve displayed project/org/mode from the active project_id (when it differs) and print explicit warnings on fallback.
pkg/cmd/whoami_test.go	Add focused unit tests for resolveActiveProject behavior and fallback paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.