@agentrhq/webcmd 0.4.0 → 0.4.1

package/dist/src/completion-shared.js

@@ -38,6 +38,7 @@ export const HOSTED_ROOT_HELP = {
         { name: 'browser', description: 'Browser control through a hosted browser session' },
         { name: 'completion <shell>', description: 'Output a shell completion script' },
         { name: 'list', description: 'List all available hosted CLI commands' },
+        { name: 'profile', description: 'Manage hosted browser profiles' },
         { name: 'setup', description: 'Configure local or hosted mode' },
     ],
     localOnlyCommands: [
@@ -49,7 +50,6 @@ export const HOSTED_ROOT_HELP = {
         { name: 'doctor', description: 'Diagnose local browser bridge connectivity' },
         { name: 'external', description: 'Manage local CLI passthrough commands' },
         { name: 'plugin', description: 'Manage plugins installed on this computer' },
-        { name: 'profile', description: 'Manage profiles in the local browser runtime' },
         { name: 'skills', description: 'Manage bundled skills on this computer' },
         { name: 'validate', description: 'Validate local CLI definitions' },
         { name: 'verify', description: 'Validate and smoke-test local adapters' },

package/dist/src/docs-sync-review.js

@@ -105,6 +105,12 @@ const BROWSER_DOCUMENTATION = [
     'skills/webcmd-browser/SKILL.md',
     'skills/webcmd-usage/SKILL.md',
 ];
+const HOSTED_DOCUMENTATION = [
+    ...BROWSER_DOCUMENTATION,
+    'docs/authentication-and-profiles.mdx',
+    'docs/local-or-cloud.mdx',
+];
+const HOSTED_PROFILE_PATHS = /^(?:src\/completion-shared|src\/hosted\/(?:browser-args|client|runner|types))\.ts$/;
 const ADAPTER_DOCUMENTATION = [
     'README.md',
     'docs/authoring.mdx',
@@ -116,11 +122,13 @@ const ADAPTER_DOCUMENTATION = [
 export function selectDocumentationPaths(files) {
     const selected = new Set();
     for (const file of files) {
-        const paths = /^(?:src\/browser\/|src\/hosted\/)/.test(file.path)
-            ? BROWSER_DOCUMENTATION
-            : /^(?:clis\/|plugins\/|src\/plugin)/.test(file.path)
-                ? ADAPTER_DOCUMENTATION
-                : GENERAL_DOCUMENTATION;
+        const paths = HOSTED_PROFILE_PATHS.test(file.path)
+            ? HOSTED_DOCUMENTATION
+            : /^src\/browser\//.test(file.path)
+                ? BROWSER_DOCUMENTATION
+                : /^(?:clis\/|plugins\/|src\/plugin)/.test(file.path)
+                    ? ADAPTER_DOCUMENTATION
+                    : GENERAL_DOCUMENTATION;
         paths.forEach((path) => selected.add(path));
     }
     return [...selected].sort();

package/dist/src/docs-sync-review.test.js

@@ -95,6 +95,42 @@ describe('review context', () => {
             'skills/webcmd-usage/SKILL.md',
         ]);
     });
+    it('selects profile documentation for hosted profile changes', () => {
+        expect(selectDocumentationPaths([changed('src/hosted/runner.ts')])).toEqual([
+            'README.md',
+            'docs/agent-prompts.mdx',
+            'docs/authentication-and-profiles.mdx',
+            'docs/browser-and-sitemap-memory.mdx',
+            'docs/cli-reference.mdx',
+            'docs/concepts.mdx',
+            'docs/local-or-cloud.mdx',
+            'skills/webcmd-browser-sitemap/SKILL.md',
+            'skills/webcmd-browser/SKILL.md',
+            'skills/webcmd-usage/SKILL.md',
+        ]);
+    });
+    it('selects profile documentation for hosted root command changes', () => {
+        expect(selectDocumentationPaths([changed('src/completion-shared.ts')])).toEqual([
+            'README.md',
+            'docs/agent-prompts.mdx',
+            'docs/authentication-and-profiles.mdx',
+            'docs/browser-and-sitemap-memory.mdx',
+            'docs/cli-reference.mdx',
+            'docs/concepts.mdx',
+            'docs/local-or-cloud.mdx',
+            'skills/webcmd-browser-sitemap/SKILL.md',
+            'skills/webcmd-browser/SKILL.md',
+            'skills/webcmd-usage/SKILL.md',
+        ]);
+    });
+    it('does not select profile documentation for unrelated hosted changes', () => {
+        expect(selectDocumentationPaths([changed('src/hosted/files.ts')])).toEqual([
+            'README.md',
+            'docs/cli-reference.mdx',
+            'docs/concepts.mdx',
+            'skills/webcmd-usage/SKILL.md',
+        ]);
+    });
     it('selects adapter and plugin documentation', () => {
         expect(selectDocumentationPaths([changed('clis/reddit/search.js')])).toEqual([
             'README.md',

package/dist/src/generate-release-notes-cli.test.js

@@ -218,7 +218,7 @@ describe('runGenerateReleaseNotes', () => {
         expect(workflow).toContain('release_body_file="$RUNNER_TEMP/release-body.md"');
         expect(workflow).toContain('release_edit_args+=(--title "$release_title")');
         expect(workflow).toContain('release_edit_args+=(--notes-file "$release_body_file")');
-        expect(workflow).toContain('if gh release edit "${{ steps.release.outputs.tag_name }}" "${release_edit_args[@]}"; then');
+        expect(workflow).toContain('if gh release edit "${{ steps.release.outputs.tag_name || inputs.publish_tag }}" "${release_edit_args[@]}"; then');
         expect(workflow).toMatch(/Enhanced release notes could not be applied; keeping release-please notes\./);
     });
 });

package/dist/src/hosted/client.d.ts

@@ -1,5 +1,5 @@
 import { CliError, type ExitCode } from '../errors.js';
-import type { HostedBrowserActionRequest, HostedBrowserActionResponse, HostedBrowserFinishRequest, HostedBrowserFinishResponse, HostedBrowserRunActionInput, HostedBrowserRunActionResponse, HostedBrowserRunRequest, HostedBrowserRunResponse, HostedExecution, HostedExecuteResponse, HostedPrepareExecutionResponse, HostedProfilesResponse, HostedUploadArtifactResponse, HostedManifest, HostedTraceReceipt } from './types.js';
+import type { HostedBrowserActionRequest, HostedBrowserActionResponse, HostedBrowserFinishRequest, HostedBrowserFinishResponse, HostedBrowserRunActionInput, HostedBrowserRunActionResponse, HostedBrowserRunRequest, HostedBrowserRunResponse, HostedExecution, HostedExecuteResponse, HostedPrepareExecutionResponse, HostedProfileResponse, HostedProfilesResponse, HostedUploadArtifactResponse, HostedManifest, HostedTraceReceipt } from './types.js';
 export interface HostedClientOptions {
     apiBaseUrl: string;
     apiKey: string;
@@ -20,7 +20,19 @@ export declare class HostedClient {
     constructor(options: HostedClientOptions);
     getMe(): Promise<unknown>;
     getManifest(): Promise<HostedManifest>;
-    listProfiles(): Promise<HostedProfilesResponse>;
+    listProfiles(filters?: {
+        name?: string;
+        userId?: string;
+    }): Promise<HostedProfilesResponse>;
+    createProfile(input: {
+        name: string;
+        userId?: string;
+    }): Promise<HostedProfileResponse>;
+    getProfile(profileId: string): Promise<HostedProfileResponse>;
+    deleteProfile(profileId: string): Promise<{
+        ok: true;
+        deleted: true;
+    }>;
     execute(input: {
         command: string;
         args: Record<string, unknown>;

package/dist/src/hosted/client.js

@@ -29,13 +29,43 @@ export class HostedClient {
         }
         return body.manifest;
     }
-    async listProfiles() {
-        const body = await this.request('/v1/profiles');
+    async listProfiles(filters = {}) {
+        const params = new URLSearchParams();
+        if (filters.name !== undefined)
+            params.set('name', filters.name);
+        if (filters.userId !== undefined)
+            params.set('userId', filters.userId);
+        const query = params.toString();
+        const body = await this.request(`/v1/profiles${query ? `?${query}` : ''}`);
         if (!isHostedProfilesResponse(body)) {
             throw protocolError('Webcmd Cloud returned an invalid profiles response.');
         }
         return body;
     }
+    async createProfile(input) {
+        const body = await this.request('/v1/profiles', {
+            method: 'POST',
+            body: JSON.stringify(input),
+        });
+        if (!isHostedProfileResponse(body)) {
+            throw protocolError('Webcmd Cloud returned an invalid profile response.');
+        }
+        return body;
+    }
+    async getProfile(profileId) {
+        const body = await this.request(`/v1/profiles/${encodeURIComponent(profileId)}`);
+        if (!isHostedProfileResponse(body)) {
+            throw protocolError('Webcmd Cloud returned an invalid profile response.');
+        }
+        return body;
+    }
+    async deleteProfile(profileId) {
+        const body = await this.request(`/v1/profiles/${encodeURIComponent(profileId)}`, { method: 'DELETE' });
+        if (!hasExactKeys(body, ['ok', 'deleted']) || body.ok !== true || body.deleted !== true) {
+            throw protocolError('Webcmd Cloud returned an invalid profile deletion response.');
+        }
+        return { ok: true, deleted: true };
+    }
     async execute(input) {
         const traceMode = normalizeTraceMode(input.trace);
         const body = await this.request('/v1/execute', {
@@ -281,12 +311,23 @@ function isHostedProfilesResponse(value) {
         && Array.isArray(value.profiles)
         && value.profiles.every(isHostedPublicProfile);
 }
+function isHostedProfileResponse(value) {
+    return hasExactKeys(value, ['ok', 'profile'])
+        && value.ok === true
+        && isHostedPublicProfile(value.profile);
+}
 function isHostedPublicProfile(value) {
-    return hasExactKeys(value, ['name', 'default', 'status', 'createdAt', 'lastUsedAt'])
-        && typeof value.name === 'string'
+    return hasExactKeys(value, [
+        'id', 'name', 'userId', 'default', 'status',
+        'createdAt', 'updatedAt', 'lastUsedAt',
+    ])
+        && typeof value.id === 'string'
+        && (value.name === null || typeof value.name === 'string')
+        && (value.userId === null || typeof value.userId === 'string')
         && typeof value.default === 'boolean'
-        && value.status === 'available'
+        && (value.status === 'pending' || value.status === 'available')
         && typeof value.createdAt === 'string'
+        && typeof value.updatedAt === 'string'
         && typeof value.lastUsedAt === 'string';
 }
 function isHostedManifestCommand(value) {

package/dist/src/hosted/client.test.js

@@ -165,31 +165,84 @@ describe('HostedClient', () => {
         });
         await expect(client.getManifest()).rejects.toMatchObject({ code: 'HOSTED_PROTOCOL' });
     });
-    it('parses hosted profile rows without provider identifiers', async () => {
+    it('manages public hosted profiles over the authenticated HTTP API', async () => {
+        const requests = [];
+        const profile = {
+            id: 'profile_work',
+            name: 'Work',
+            userId: 'user_64256',
+            default: false,
+            status: 'available',
+            createdAt: '2026-07-08T00:00:00.000Z',
+            updatedAt: '2026-07-08T00:00:00.000Z',
+            lastUsedAt: '2026-07-08T00:00:00.000Z',
+        };
         const client = new HostedClient({
             apiBaseUrl: 'https://api.example.com',
             apiKey: 'wcmd_live_test',
-            fetchImpl: async () => new Response(JSON.stringify({
-                ok: true,
-                profiles: [{
-                        name: 'default',
-                        default: true,
-                        status: 'available',
-                        createdAt: '2026-07-08T00:00:00.000Z',
-                        lastUsedAt: '2026-07-08T00:00:00.000Z',
-                    }],
-            }), { status: 200 }),
+            fetchImpl: async (url, init) => {
+                requests.push({
+                    url: String(url),
+                    method: init?.method ?? 'GET',
+                    ...(init?.body ? { body: String(init.body) } : {}),
+                });
+                const path = new URL(String(url)).pathname;
+                if (path === '/v1/profiles' && init?.method === 'POST') {
+                    return new Response(JSON.stringify({ ok: true, profile }), { status: 201 });
+                }
+                if (path.startsWith('/v1/profiles/') && init?.method === 'DELETE') {
+                    return new Response(JSON.stringify({ ok: true, deleted: true }));
+                }
+                if (path.startsWith('/v1/profiles/')) {
+                    return new Response(JSON.stringify({ ok: true, profile }));
+                }
+                return new Response(JSON.stringify({ ok: true, profiles: [profile] }));
+            },
         });
-        await expect(client.listProfiles()).resolves.toEqual({
-            ok: true,
-            profiles: [{
-                    name: 'default',
-                    default: true,
-                    status: 'available',
-                    createdAt: '2026-07-08T00:00:00.000Z',
-                    lastUsedAt: '2026-07-08T00:00:00.000Z',
-                }],
+        await expect(client.listProfiles({ name: 'Work', userId: 'user_64256' }))
+            .resolves.toEqual({ ok: true, profiles: [profile] });
+        await expect(client.createProfile({ name: 'Work', userId: 'user_64256' }))
+            .resolves.toMatchObject({ profile: { id: 'profile_work', status: 'available' } });
+        await expect(client.getProfile('profile_work')).resolves.toMatchObject({
+            profile: { id: 'profile_work' },
+        });
+        await expect(client.deleteProfile('profile/work')).resolves.toEqual({ ok: true, deleted: true });
+        expect(requests).toEqual([
+            { url: 'https://api.example.com/v1/profiles?name=Work&userId=user_64256', method: 'GET' },
+            {
+                url: 'https://api.example.com/v1/profiles',
+                method: 'POST',
+                body: JSON.stringify({ name: 'Work', userId: 'user_64256' }),
+            },
+            { url: 'https://api.example.com/v1/profiles/profile_work', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles/profile%2Fwork', method: 'DELETE' },
+        ]);
+    });
+    it.each([
+        { name: 'private provider field', change: { kernelProfileId: 'private' } },
+        { name: 'missing updatedAt', change: { updatedAt: undefined } },
+        { name: 'non-nullable name shape', change: { name: 7 } },
+        { name: 'non-nullable user ID shape', change: { userId: false } },
+    ])('rejects a hosted profile with $name', async ({ change }) => {
+        const profile = {
+            id: 'profile_work',
+            name: null,
+            userId: null,
+            default: false,
+            status: 'pending',
+            createdAt: '2026-07-08T00:00:00.000Z',
+            updatedAt: '2026-07-08T00:00:00.000Z',
+            lastUsedAt: '2026-07-08T00:00:00.000Z',
+            ...change,
+        };
+        if (change.updatedAt === undefined)
+            delete profile.updatedAt;
+        const client = new HostedClient({
+            apiBaseUrl: 'https://api.example.com',
+            apiKey: 'key',
+            fetchImpl: async () => new Response(JSON.stringify({ ok: true, profiles: [profile] })),
         });
+        await expect(client.listProfiles()).rejects.toMatchObject({ code: 'HOSTED_PROTOCOL' });
     });
     it('maps hosted error envelopes to CliError-compatible errors', async () => {
         const client = new HostedClient({

package/dist/src/hosted/manifest.test.js

@@ -98,6 +98,7 @@ describe('hosted manifest helpers', () => {
         expect(result).toEqual({ handled: true, exitCode: 0 });
         expect(stdout.text()).toBe(formatRootHelp(HOSTED_ROOT_HELP));
         expect(stdout.text()).toContain('completion');
+        expect(stdout.text()).toMatch(/profile\s+Manage hosted browser profiles/);
         expect(stdout.text()).toContain('--profile <name>');
         expect(stdout.text()).toContain('Local-only commands:');
         expect(stdout.text()).toContain('Run `webcmd setup` and choose local mode to use local-only commands.');
@@ -160,6 +161,6 @@ describe('hosted manifest helpers', () => {
             stdout: stdout.stream,
             fetchImpl: async () => new Response(JSON.stringify({ ok: true, manifest }), { status: 200 }),
         });
-        expect(stdout.text().trim().split('\n')).toEqual(['browser', 'completion', 'github', 'list', 'setup']);
+        expect(stdout.text().trim().split('\n')).toEqual(['browser', 'completion', 'github', 'list', 'profile', 'setup']);
     });
 });

package/dist/src/hosted/root-command-surface.test.js

@@ -156,6 +156,13 @@ const generatedTerminalCorpus = profileForms.flatMap(profile => dispatchForms.fl
     { name: `${profile.name}/clustered-version/${dispatch.name}`, argv: [...profile.tokens, '-Vx', ...dispatch.tokens], kind: 'version' },
 ]));
 describe('hosted root command surface', () => {
+    it('advertises hosted profile management as a root command, not a local-only namespace', () => {
+        expect(HOSTED_ROOT_HELP.commands).toContainEqual({
+            name: 'profile',
+            description: 'Manage hosted browser profiles',
+        });
+        expect(HOSTED_ROOT_HELP.localOnlyCommands?.some(command => command.name === 'profile')).toBe(false);
+    });
     it.each([
         { name: 'no args', argv: [], expected: { kind: 'help', exitCode: 1 } },
         { name: 'profile only', argv: ['--profile', 'work'], expected: { kind: 'help', exitCode: 1 } },

package/dist/src/hosted/runner.js

@@ -146,6 +146,18 @@ async function dispatchHosted(argv, client, stdout, stderr, now) {
         await renderHostedList(manifest, parsed.format, parsed.formatExplicit, stdout);
         return;
     }
+    if (args[0] === 'profile') {
+        if (args[1] === 'rename' || args[1] === 'use') {
+            throw new ConfigError(`webcmd profile ${args[1]} is not available in hosted mode.`, 'Hosted mode supports: webcmd profile list, create, get, and delete.');
+        }
+        const parsed = parseHostedProfileSurface(args.slice(1), normalized.literal);
+        if (parsed.kind === 'help') {
+            await writeToStream(stdout, parsed.output);
+            return;
+        }
+        await dispatchHostedProfile(parsed, client, stdout);
+        return;
+    }
     const manifest = await client.getManifest();
     validateManifestContractIdentity(manifest);
     const site = args[0];
@@ -552,6 +564,87 @@ function parseHostedListSurface(argv, literal) {
         throw new CommanderStructuralError("error: command 'list' did not run\n", 1);
     return { kind: 'run', format: parsedFormat, formatExplicit };
 }
+function parseHostedProfileSurface(argv, literal) {
+    let stdout = '';
+    let stderr = '';
+    let parsed;
+    const root = new Command('webcmd');
+    const profile = root.command('profile').description('Manage hosted browser profiles');
+    const output = {
+        writeOut: (value) => { stdout += value; },
+        writeErr: (value) => { stderr += value; },
+    };
+    root.exitOverride().configureOutput(output);
+    profile.exitOverride().configureOutput(output);
+    const configureFormat = (command) => command.option('-f, --format <fmt>', 'Output format: table, json, yaml, md, csv', 'table');
+    const setParsed = (command, surface, value, userId) => {
+        const options = surface.opts();
+        parsed = {
+            kind: 'run',
+            command,
+            format: options.format,
+            formatExplicit: surface.getOptionValueSource('format') === 'cli',
+            ...(value !== undefined ? { value } : {}),
+            ...(userId !== undefined ? { userId } : {}),
+        };
+    };
+    const list = configureFormat(profile.command('list'));
+    list.exitOverride().configureOutput(output).action(() => setParsed('list', list));
+    const create = configureFormat(profile.command('create').argument('<name>').option('--user-id <id>'));
+    create.exitOverride().configureOutput(output).action((name, options) => setParsed('create', create, name, options.userId));
+    const get = configureFormat(profile.command('get').argument('<profile>'));
+    get.exitOverride().configureOutput(output).action((selector) => setParsed('get', get, selector));
+    const remove = configureFormat(profile.command('delete').argument('<profile-id>'));
+    remove.exitOverride().configureOutput(output).action((profileId) => setParsed('delete', remove, profileId));
+    try {
+        root.parse(literal ? ['--', 'profile', ...argv] : ['profile', ...argv], { from: 'user' });
+    }
+    catch (error) {
+        if (!(error instanceof CommanderError))
+            throw error;
+        if (error.code === 'commander.helpDisplayed')
+            return { kind: 'help', output: stdout };
+        throw new CommanderStructuralError(stderr || `${error.message}\n`, error.exitCode);
+    }
+    if (!parsed) {
+        throw new CommanderStructuralError("error: command 'profile' did not run\n", 1);
+    }
+    return parsed;
+}
+async function dispatchHostedProfile(parsed, client, stdout) {
+    let result;
+    if (parsed.command === 'list') {
+        result = (await client.listProfiles()).profiles;
+    }
+    else if (parsed.command === 'create') {
+        result = (await client.createProfile({
+            name: parsed.value,
+            ...(parsed.userId !== undefined ? { userId: parsed.userId } : {}),
+        })).profile;
+    }
+    else if (parsed.command === 'get') {
+        result = resolveHostedProfile((await client.listProfiles()).profiles, parsed.value);
+    }
+    else {
+        result = await client.deleteProfile(parsed.value);
+    }
+    await renderOutput(result, {
+        fmt: parsed.format,
+        fmtExplicit: parsed.formatExplicit,
+        stdout,
+    });
+}
+function resolveHostedProfile(profiles, selector) {
+    const matches = profiles.filter(profile => profile.id === selector || profile.name === selector || profile.userId === selector);
+    const distinct = [...new Map(matches.map(profile => [profile.id, profile])).values()];
+    if (distinct.length === 0) {
+        throw new CliError('PROFILE_NOT_FOUND', 'Profile was not found.', undefined, EXIT_CODES.EMPTY_RESULT);
+    }
+    if (distinct.length > 1) {
+        throw new CliError('AMBIGUOUS_PROFILE', 'The profile selector matched multiple profiles.', 'Use the immutable profile ID returned by webcmd profile list.', EXIT_CODES.TEMPFAIL);
+    }
+    return distinct[0];
+}
 function parseHostedCompletionSurface(argv, literal) {
     let stdout = '';
     let stderr = '';

package/dist/src/hosted/runner.test.js

@@ -10,7 +10,7 @@ import { createProgram } from '../cli.js';
 import { formatRootHelp } from '../command-presentation.js';
 import { HOSTED_ROOT_HELP } from '../completion-shared.js';
 import { PKG_VERSION } from '../version.js';
-import { makeHostedConfig } from './config.js';
+import { makeHostedConfig, makeLocalConfig } from './config.js';
 import { runHostedCli } from './runner.js';
 const [packageMajor, packageMinor] = PKG_VERSION.split('.');
 const compatiblePatchVersion = `${packageMajor}.${packageMinor}.99`;
@@ -223,6 +223,131 @@ function captureLocalBrowserStructure(argv) {
     }
 }
 describe('runHostedCli', () => {
+    const publicProfile = {
+        id: 'profile_work',
+        name: 'Work',
+        userId: 'user_64256',
+        default: false,
+        status: 'available',
+        createdAt: '2026-07-24T00:00:00.000Z',
+        updatedAt: '2026-07-24T00:00:00.000Z',
+        lastUsedAt: '2026-07-24T00:00:00.000Z',
+    };
+    it('lists, creates, resolves, gets, and deletes hosted profiles without fetching the manifest', async () => {
+        const requests = [];
+        const fetchImpl = vi.fn(async (url, init) => {
+            const request = {
+                url: String(url),
+                method: init?.method ?? 'GET',
+                ...(init?.body ? { body: JSON.parse(String(init.body)) } : {}),
+            };
+            requests.push(request);
+            if (request.method === 'POST') {
+                return new Response(JSON.stringify({ ok: true, profile: publicProfile }), { status: 201 });
+            }
+            if (request.method === 'DELETE') {
+                return new Response(JSON.stringify({ ok: true, deleted: true }));
+            }
+            return new Response(JSON.stringify({ ok: true, profiles: [publicProfile] }));
+        });
+        for (const argv of [
+            ['profile', 'list', '-f', 'json'],
+            ['profile', 'create', 'Work', '--user-id', 'user_64256', '-f', 'json'],
+            ['profile', 'get', 'Work', '-f', 'json'],
+            ['profile', 'get', 'user_64256', '-f', 'json'],
+            ['profile', 'get', 'profile_work', '-f', 'json'],
+            ['profile', 'delete', 'profile_work', '-f', 'json'],
+        ]) {
+            const stdout = sink();
+            const stderr = sink();
+            const result = await runHostedCli(argv, {
+                config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
+                stdout: stdout.stream,
+                stderr: stderr.stream,
+                fetchImpl,
+            });
+            expect(result).toEqual({ handled: true, exitCode: 0 });
+            expect(stderr.text()).toBe('');
+            expect(stdout.text()).toContain(argv[1] === 'delete' ? '"deleted": true' : '"id": "profile_work"');
+        }
+        expect(requests).toEqual([
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            {
+                url: 'https://api.example.com/v1/profiles',
+                method: 'POST',
+                body: { name: 'Work', userId: 'user_64256' },
+            },
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles', method: 'GET' },
+            { url: 'https://api.example.com/v1/profiles/profile_work', method: 'DELETE' },
+        ]);
+        expect(requests.some(request => request.url.endsWith('/v1/manifest'))).toBe(false);
+    });
+    it('deduplicates universal profile matches and rejects missing or ambiguous selectors', async () => {
+        const cases = [
+            {
+                selector: 'same',
+                profiles: [{ ...publicProfile, id: 'profile_same', name: 'same', userId: 'same' }],
+                exitCode: 0,
+                stdout: '"id": "profile_same"',
+                stderr: '',
+            },
+            {
+                selector: 'missing',
+                profiles: [publicProfile],
+                exitCode: 66,
+                stdout: '',
+                stderr: 'code: PROFILE_NOT_FOUND',
+            },
+            {
+                selector: 'shared',
+                profiles: [
+                    { ...publicProfile, id: 'profile_one', name: 'shared' },
+                    { ...publicProfile, id: 'profile_two', name: 'Other', userId: 'shared' },
+                ],
+                exitCode: 75,
+                stdout: '',
+                stderr: 'code: AMBIGUOUS_PROFILE',
+            },
+        ];
+        for (const testCase of cases) {
+            const stdout = sink();
+            const stderr = sink();
+            const fetchImpl = vi.fn(async () => new Response(JSON.stringify({ ok: true, profiles: testCase.profiles })));
+            const result = await runHostedCli(['profile', 'get', testCase.selector, '-f', 'json'], {
+                config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
+                stdout: stdout.stream,
+                stderr: stderr.stream,
+                fetchImpl,
+            });
+            expect(result.exitCode).toBe(testCase.exitCode);
+            expect(stdout.text()).toContain(testCase.stdout);
+            expect(stderr.text()).toContain(testCase.stderr);
+            if (testCase.selector === 'shared') {
+                expect(stderr.text()).toContain('Use the immutable profile ID returned by webcmd profile list.');
+            }
+            expect(fetchImpl).toHaveBeenCalledTimes(1);
+        }
+    });
+    it.each(['rename', 'use'])('rejects local-only profile %s in hosted mode without an API call', async (command) => {
+        const stderr = sink();
+        const fetchImpl = vi.fn();
+        const result = await runHostedCli(['profile', command, 'value'], {
+            config: makeHostedConfig({ apiBaseUrl: 'https://api.example.com', apiKey: 'key' }),
+            stderr: stderr.stream,
+            fetchImpl,
+        });
+        expect(result).toEqual({ handled: true, exitCode: 78 });
+        expect(stderr.text()).toContain(`webcmd profile ${command} is not available in hosted mode.`);
+        expect(fetchImpl).not.toHaveBeenCalled();
+    });
+    it.each(['list', 'rename', 'use'])('leaves profile %s to the existing local command surface', async (command) => {
+        const result = await runHostedCli(['profile', command, 'value'], {
+            config: makeLocalConfig(),
+        });
+        expect(result).toEqual({ handled: false, exitCode: 0 });
+    });
     it.each([
         ['missing-site'],
         ['missing-site', 'child'],

package/dist/src/hosted/types.d.ts

@@ -40,16 +40,23 @@ export interface HostedManifest {
     commands: HostedCommand[];
 }
 export interface HostedPublicProfile {
-    name: string;
+    id: string;
+    name: string | null;
+    userId: string | null;
     default: boolean;
-    status: 'available';
+    status: 'pending' | 'available';
     createdAt: string;
+    updatedAt: string;
     lastUsedAt: string;
 }
 export interface HostedProfilesResponse {
     ok: true;
     profiles: HostedPublicProfile[];
 }
+export interface HostedProfileResponse {
+    ok: true;
+    profile: HostedPublicProfile;
+}
 export interface HostedExecution {
     id: string;
     command: string;

package/hosted-contract.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "webcmdVersion": "0.4.0",
+  "webcmdVersion": "0.4.1",
   "outputFormats": [
     "table",
     "plain",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentrhq/webcmd",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Turn websites, browser sessions, desktop apps, and local tools into deterministic CLI surfaces for humans and AI agents.",
   "engines": {
     "node": ">=20.0.0"
@@ -114,4 +114,4 @@
   "overrides": {
     "postcss": "^8.5.10"
   }
-}
+}