Make active profile name available for other owners in status and list

client/cmd/profile.go

@@ -117,10 +117,12 @@ func listProfilesFunc(cmd *cobra.Command, _ []string) error {
 	} else {
 		fmt.Fprintln(tw, "NAME\tACTIVE")
 	}
+	anyActive := false
 	for _, profile := range resp.Profiles {
 		marker := ""
 		if profile.IsActive {
 			marker = "✓"
+			anyActive = true
 		}
 		name := profilemanager.StripCtrlChars(profile.Name)
 		id := profilemanager.ID(profile.Id)
@@ -130,7 +132,19 @@ func listProfilesFunc(cmd *cobra.Command, _ []string) error {
 			fmt.Fprintf(tw, "%s\t%s\n", name, marker)
 		}
 	}
-	return tw.Flush()
+	if err := tw.Flush(); err != nil {
+		return err
+	}
+
+	// None of the caller's profiles is active: another user may hold the daemon.
+	// Surface it so the empty ACTIVE column is not mistaken for "nothing active".
+	if !anyActive {
+		if active, aerr := daemonClient.GetActiveProfile(cmd.Context(), &proto.GetActiveProfileRequest{}); aerr == nil && active.GetUsername() != "" && !usernamesMatch(active.GetUsername(), currUser.Username) {
+			cmd.Printf("\nActive profile belongs to another user: %s (user %s)\n",
+				profilemanager.StripCtrlChars(active.GetProfileName()), active.GetUsername())
+		}
+	}
+	return nil
 }
 
 func addProfileFunc(cmd *cobra.Command, args []string) error {

client/cmd/status.go

@@ -5,6 +5,8 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"os/user"
+	"runtime"
 	"strings"
 	"time"
 
@@ -172,10 +174,12 @@ func getStatus(ctx context.Context, fullPeerStatus bool, shouldRunProbes bool) (
 	return resp, nil
 }
 
-// getActiveProfileName asks the daemon for the active profile's display
-// name. The daemon runs as root and can read the per-user profile files to
-// resolve the ID to its human-readable name. Returns an empty string on any
-// error so status output degrades gracefully.
+// getActiveProfileName asks the daemon for the active profile's display name.
+// The daemon runs as root and can read the per-user profile files to resolve the
+// ID to its human-readable name. When the active profile belongs to another local
+// user, the name is annotated with that owner so the caller understands why the
+// daemon is not under their control. Returns an empty string on any error so
+// status output degrades gracefully.
 func getActiveProfileName(ctx context.Context) string {
 	conn, err := DialClientGRPCServer(ctx, daemonAddr)
 	if err != nil {
@@ -188,7 +192,22 @@ func getActiveProfileName(ctx context.Context) string {
 		return ""
 	}
 
-	return resp.GetProfileName()
+	name := resp.GetProfileName()
+	if owner := resp.GetUsername(); owner != "" {
+		if curr, uerr := user.Current(); uerr != nil || !usernamesMatch(owner, curr.Username) {
+			name = fmt.Sprintf("%s (user %s)", name, owner)
+		}
+	}
+	return name
+}
+
+// usernamesMatch compares usernames case-insensitively on Windows (domain
+// accounts) and exactly elsewhere.
+func usernamesMatch(a, b string) bool {
+	if runtime.GOOS == "windows" {
+		return strings.EqualFold(a, b)
+	}
+	return a == b
 }
 
 func parseFilters() error {