@amerged/ohmyhost-mcp 0.1.19 → 0.1.21

package/src/apps/product-cli/composition.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import {
   createClient,
   getGithubOrganizationConnection,
+  getProject,
   revokeCurrentSession,
 } from "@ohmyhost/sdk-ts";
 import { WORKOS_USER_API_KEY_PATTERN } from "@ohmyhost/workos-auth-contracts/user-api-keys";
@@ -18,6 +19,7 @@ import {
 
 import {
   ProductCli,
+  classifyCliFailure,
   cliMetadataResult,
   NetworkTransportError,
   LifecycleTransportError,
@@ -31,20 +33,46 @@ import {
   type TokenRevoker,
 } from "./cli.js";
 import {
+  extractProfileName,
   InvalidCommandError,
   parseProductCliCommand,
   recognizedCommandLabel,
   type ProductCliCommand,
 } from "./command.js";
 import {
-  NativeNapiKeyringCredentialStore,
+  CredentialStoreUnavailableError,
   type CredentialStore,
   type CurrentCredential,
   type StoredCredential,
 } from "./credential-store.js";
 import { GeneratedSdkProductApi, type ProductApi } from "./product-api.js";
-import { workspaceOf, type WorkspaceSession } from "./workspace.js";
-import { OwnerOnlyProjectLinkStore, readLinkedProjectId } from "./project-link-store.js";
+import {
+  defaultProfileName,
+  describeProfile,
+  isProfileName,
+  NativeKeyringProfileRegistry,
+  ProfileLimitError,
+  profileLimitAction,
+  ProfileSelectionError,
+  profileSelectionError,
+  publicProfile,
+  selectProfile,
+  selectProfileForOrganization,
+  type LocalProfile,
+  type ProfileRegistry,
+  type ProfileRequest,
+  type ProfileSelector,
+} from "./profile-store.js";
+import { verifiedUserId, workspaceOf, type WorkspaceSession } from "./workspace.js";
+import {
+  chooseLinkedProject,
+  linkedOrganization,
+  OwnerOnlyProjectLinkStore,
+  readProjectLinks,
+  removeLegacyProjectLink,
+  type DirectoryLinks,
+  type LinkedProject,
+} from "./project-link-store.js";
 import {
   initializeRepository,
   RepositoryInitBlockedError,
@@ -52,12 +80,14 @@ import {
   RepositoryInitError,
 } from "./repository-init.js";
 import { runLocalPsql } from "./psql-session.js";
-import { ResponseContractError } from "./runtime-contract.js";
+import { parseCurrentIdentity, ResponseContractError } from "./runtime-contract.js";
 import { resolveDeviceTokenExpiresAt } from "./device-token-expiry.js";
 
 export type ProductCliEnvironment = Readonly<{
   OHMYHOST_ENVIRONMENT?: string;
   OHMYHOST_TOKEN?: string;
+  /** Binds this process to one saved login by name; a request for another login is refused. */
+  OHMYHOST_PROFILE?: string;
 }>;
 
 export interface ProductCliIo {
@@ -66,15 +96,29 @@ export interface ProductCliIo {
 }
 
 export interface ProductCliCompositionOverrides {
-  readonly credentialStore?: CredentialStore;
+  /** Saved logins; the native credential store of the selected platform environment by default. */
+  readonly profiles?: ProfileRegistry;
   /** Directory whose project link supplies a missing --project; defaults to the process directory. */
   readonly workingDirectory?: string;
   readonly readSecretValue?: (signal: AbortSignal) => Promise<string>;
 }
 
+/** What one command or tool call asked for. Identifiers are context, never credentials. */
+export interface ProfileRequestInput {
+  readonly name?: string;
+  readonly organizationId?: string;
+  /** The user this call must run as; a login or OHMYHOST_TOKEN of another user is refused. */
+  readonly userId?: string;
+  /** `organization use`: the login to bind is the one in that organization or the one without. */
+  readonly bindOrganization?: boolean;
+}
+
 export interface AuthenticatedProductApiOverrides {
   readonly environment?: ProductCliEnvironment;
-  readonly credentialStore?: CredentialStore;
+  readonly profiles?: ProfileRegistry;
+  readonly request?: ProfileRequestInput;
+  /** How the caller names a login in its error guidance: a CLI flag or an MCP argument. */
+  readonly selector?: ProfileSelector;
   readonly fetch?: typeof globalThis.fetch;
   readonly now?: () => Date;
   readonly productApiOrigin?: string;
@@ -83,13 +127,23 @@ export interface AuthenticatedProductApiOverrides {
 
 export class ProductApiAuthenticationError extends Error {
   public constructor(
-    readonly code: "authentication_required" | "token_refresh_failed" | "invalid_environment_token",
+    readonly code:
+      | "authentication_required"
+      | "token_refresh_failed"
+      | "invalid_environment_token"
+      | "invalid_profile_binding",
   ) {
     super(code);
     this.name = "ProductApiAuthenticationError";
   }
 }
 
+/** Which account a transport acts as. It names the login, never a credential. */
+export interface EffectiveContext {
+  readonly credential: "profile" | "environment_token";
+  readonly profile: LocalProfile | null;
+}
+
 type OutputCommand = ReturnType<typeof recognizedCommandLabel>;
 
 const REQUEST_TIMEOUT_MS = 30_000;
@@ -126,6 +180,24 @@ function environmentToken(environment: ProductCliEnvironment = {}): string | und
   return value;
 }
 
+/** The saved login this process is bound to; an empty value means no binding. */
+function environmentProfile(environment: ProductCliEnvironment = {}): string | undefined {
+  const value = environment.OHMYHOST_PROFILE;
+  if (value === undefined || value === "") return undefined;
+  if (!isProfileName(value)) throw new ProductApiAuthenticationError("invalid_profile_binding");
+  return value;
+}
+
+const profileRequest = (
+  input: ProfileRequestInput | undefined,
+  bound: string | undefined,
+): ProfileRequest => ({
+  ...(input?.name === undefined ? {} : { name: input.name }),
+  ...(bound === undefined ? {} : { bound }),
+  ...(input?.organizationId === undefined ? {} : { organizationId: input.organizationId }),
+  ...(input?.userId === undefined ? {} : { userId: input.userId }),
+});
+
 export const createProductionAuthenticatedProductApi = async (
   signal: AbortSignal,
   overrides: AuthenticatedProductApiOverrides = {},
@@ -134,51 +206,142 @@ export const createProductionAuthenticatedProductApi = async (
   return new GeneratedSdkProductApi(transport.baseUrl, transport.accessToken, transport.fetch);
 };
 
-/** Private client composition data, never a public API or MCP response. */
+/**
+ * Private client composition data, never a public API or MCP response. Each call chooses its own
+ * login from its request and the process binding; nothing another process chose can change it.
+ */
 export const createAuthenticatedProductTransport = async (
   signal: AbortSignal,
   overrides: AuthenticatedProductApiOverrides = {},
 ) => {
-  const profile = resolveProductCliEnvironment(overrides.environment);
+  const platform = resolveProductCliEnvironment(overrides.environment);
   const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const baseUrl = overrides.productApiOrigin ?? platform.apiOrigin;
   const boundedFetch = createBoundedFetch(
     overrides.fetch ?? fetch,
     signal,
     REQUEST_TIMEOUT_MS,
     MAX_PUBLIC_RESPONSE_BYTES,
   );
-  if (apiToken !== undefined)
+  const registry =
+    overrides.profiles ?? new NativeKeyringProfileRegistry(undefined, platform.credentialService);
+  const binding = overrides.request?.bindOrganization === true;
+  const request = profileRequest(overrides.request, bound);
+  if (apiToken !== undefined) {
+    // A user API token carries a fixed scope; it must match whatever this call asked for.
+    await verifyEnvironmentTokenContext({
+      token: apiToken,
+      request: binding ? profileRequest({}, bound) : request,
+      registry,
+      baseUrl,
+      fetch: boundedFetch,
+    });
     return {
-      baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+      baseUrl,
       accessToken: apiToken,
       fetch: boundedFetch,
-      // A user API token carries a fixed scope; there is no session that could select a workspace.
       workspace: undefined,
+      context: { credential: "environment_token", profile: null } as EffectiveContext,
     };
-  const store =
-    overrides.credentialStore ??
-    new NativeNapiKeyringCredentialStore(undefined, profile.credentialService);
-  const stored = await store.read();
-  if (stored === undefined) throw new ProductApiAuthenticationError("authentication_required");
+  }
   const now = overrides.now ?? (() => new Date());
   const refresher =
     overrides.tokenRefresher ??
     new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now);
-  const credential = await currentCredential(stored, store, signal, now, refresher);
+  const profiles = await loadProfiles(registry, {
+    baseUrl,
+    fetch: boundedFetch,
+    signal,
+    now,
+    refresher,
+  });
+  const selection =
+    binding && request.organizationId !== undefined
+      ? selectProfileForOrganization(profiles, {
+          ...request,
+          organizationId: request.organizationId,
+        })
+      : selectProfile(profiles, request);
+  if (selection.outcome !== "selected")
+    throw profileSelectionError(
+      selection,
+      request,
+      platform.commandPrefix,
+      overrides.selector ?? "cli",
+    );
+  const profile = selection.profile;
+  const store = registry.credential(profile);
+  const stored = await store.read();
+  if (stored === undefined) throw missingLogin(profile, platform.commandPrefix);
+  const credential = await currentCredential(stored, store, signal, now, refresher, () =>
+    registry.remove(profile),
+  );
   return {
-    baseUrl: overrides.productApiOrigin ?? profile.apiOrigin,
+    baseUrl,
     accessToken: credential.accessToken,
     fetch: boundedFetch,
-    workspace: { store, refresher } satisfies WorkspaceSession,
+    workspace: { store, refresher, profiles: registry, profile } satisfies WorkspaceSession,
+    context: { credential: "profile", profile } as EffectiveContext,
+  };
+};
+
+/** The saved logins and this process's binding; the MCP `profile_list` answer. */
+export const listSavedProfiles = async (
+  signal: AbortSignal,
+  overrides: AuthenticatedProductApiOverrides = {},
+): Promise<{
+  readonly profiles: readonly ReturnType<typeof publicProfile>[];
+  readonly bound: string | null;
+  readonly environment_token: boolean;
+}> => {
+  const platform = resolveProductCliEnvironment(overrides.environment);
+  const apiToken = environmentToken(overrides.environment);
+  const bound = environmentProfile(overrides.environment);
+  const registry =
+    overrides.profiles ?? new NativeKeyringProfileRegistry(undefined, platform.credentialService);
+  const now = overrides.now ?? (() => new Date());
+  const profiles =
+    apiToken === undefined
+      ? await loadProfiles(registry, {
+          baseUrl: overrides.productApiOrigin ?? platform.apiOrigin,
+          fetch: createBoundedFetch(
+            overrides.fetch ?? fetch,
+            signal,
+            REQUEST_TIMEOUT_MS,
+            MAX_PUBLIC_RESPONSE_BYTES,
+          ),
+          signal,
+          now,
+          refresher:
+            overrides.tokenRefresher ??
+            new PublicWorkosTokenRefresher(overrides.environment, overrides.fetch, now),
+        })
+      : await registry.list();
+  return {
+    profiles: profiles.map(publicProfile),
+    bound: bound ?? null,
+    environment_token: apiToken !== undefined,
   };
 };
 
+/** An index entry whose credential is gone, for example after it was removed by hand. */
+const missingLogin = (profile: LocalProfile, commandPrefix: string): ProfileSelectionError =>
+  new ProfileSelectionError(
+    "authentication_required",
+    5,
+    `The saved login ${profile.name} has no credential on this computer. Run '${commandPrefix} login${
+      profile.organizationId === null ? "" : ` --organization ${profile.organizationId}`
+    } --profile-name ${profile.name} --json'.`,
+  );
+
 const currentCredential = async (
   stored: StoredCredential,
   store: CredentialStore,
   signal: AbortSignal,
   now: () => Date,
   tokenRefresher: TokenRefresher,
+  forget: () => Promise<void>,
 ): Promise<CurrentCredential> => {
   const expiresAt = stored.expiresAt === undefined ? NaN : Date.parse(stored.expiresAt);
   if (Number.isFinite(expiresAt) && expiresAt > now().getTime() + REQUEST_TIMEOUT_MS) {
@@ -200,19 +363,173 @@ const currentCredential = async (
       throw new Error("invalid refreshed credential");
     }
     // WorkOS returns a bare credential; the selection only survives if we carry it forward.
-    // WorkOS returns a bare credential; the selection only survives if we carry it forward.
     const carried = { ...refreshed, ...workspaceOf(stored) };
     await store.replace(carried);
     return carried;
   } catch (error) {
     if (error instanceof TokenRefreshRejectedError) {
-      await store.clear();
+      // The provider ended this login; only this saved login is removed.
+      await forget();
       throw new ProductApiAuthenticationError("authentication_required");
     }
     throw new ProductApiAuthenticationError("token_refresh_failed");
   }
 };
 
+interface ProfileLoadContext {
+  readonly baseUrl: string;
+  readonly fetch: typeof globalThis.fetch;
+  readonly signal: AbortSignal;
+  readonly now: () => Date;
+  readonly refresher: TokenRefresher;
+}
+
+/**
+ * The saved logins of this platform environment. A login saved by a client before named profiles
+ * becomes one named login, verified with the API; it is removed only once that login is written.
+ */
+export const loadProfiles = async (
+  registry: ProfileRegistry,
+  context: ProfileLoadContext,
+): Promise<readonly LocalProfile[]> => {
+  const legacy = registry.legacy();
+  const stored = await legacy.read();
+  if (stored !== undefined) await migrateLegacyLogin(registry, legacy, stored, context);
+  return registry.list();
+};
+
+const migrateLegacyLogin = async (
+  registry: ProfileRegistry,
+  legacy: CredentialStore,
+  stored: StoredCredential,
+  context: ProfileLoadContext,
+): Promise<void> => {
+  let credential: CurrentCredential;
+  try {
+    credential = await currentCredential(
+      stored,
+      legacy,
+      context.signal,
+      context.now,
+      context.refresher,
+      () => legacy.clear(),
+    );
+  } catch (error) {
+    // The provider had already ended that login, so it was removed and nothing is left to move.
+    if (error instanceof ProductApiAuthenticationError && error.code === "authentication_required")
+      return;
+    throw error;
+  }
+  const api = new GeneratedSdkProductApi(context.baseUrl, credential.accessToken, context.fetch);
+  let identity: unknown;
+  try {
+    identity = await api.getCurrentIdentity();
+  } catch (error) {
+    // The API refused it, so it cannot be verified or moved. It stays: only the provider ends a
+    // login for good, which the next refresh then detects and removes.
+    if (!isProblem(error, "unauthenticated")) throw error;
+    return;
+  }
+  const userId = verifiedUserId(identity);
+  const organizationId = parseCurrentIdentity(identity).organization_ids[0] ?? null;
+  const organizationName =
+    organizationId === null
+      ? null
+      : ((await api.getAccountProfile()).organizations.find(
+          (organization) => organization.id === organizationId,
+        )?.name ?? null);
+  // A saved login of the same account may hold a stale or missing credential, for example after an
+  // interrupted earlier move, so it receives the one just verified under its own name. The old entry
+  // goes only after that write: until then it keeps the refreshed, usable credential.
+  const login = { userId, organizationId, organizationName };
+  await registry.save(
+    { name: defaultProfileName(await registry.list(), login), ...login },
+    credential,
+  );
+  await legacy.clear();
+};
+
+const isProblem = (error: unknown, code: string): boolean =>
+  typeof error === "object" && error !== null && "code" in error && error.code === code;
+
+/**
+ * OHMYHOST_TOKEN overrides saved logins, but it cannot silently stand in for another account: a
+ * requested login or organization must be the token's own, or nothing is sent.
+ */
+const verifyEnvironmentTokenContext = async (input: {
+  readonly token: string;
+  readonly request: ProfileRequest;
+  readonly registry: ProfileRegistry;
+  readonly baseUrl: string;
+  readonly fetch: typeof globalThis.fetch;
+}): Promise<{ readonly userId: string; readonly organizationId: string | null } | null> => {
+  const { request } = input;
+  const named = request.name ?? request.bound;
+  if (named === undefined && request.organizationId === undefined && request.userId === undefined)
+    return null;
+  const refuse = (target: string): ProfileSelectionError =>
+    new ProfileSelectionError(
+      "environment_token_context_mismatch",
+      2,
+      `${target} Unset OHMYHOST_TOKEN to use the saved login, or load the key of that account from its private env file. Nothing was sent.`,
+    );
+  if (request.name !== undefined && request.bound !== undefined && request.name !== request.bound)
+    throw refuse(
+      `This call names profile ${request.name}, but the process is bound to OHMYHOST_PROFILE=${request.bound}.`,
+    );
+  const profile =
+    named === undefined
+      ? undefined
+      : (await input.registry.list()).find((saved) => saved.name === named);
+  if (named !== undefined && profile === undefined)
+    throw refuse(
+      `OHMYHOST_TOKEN overrides saved logins in this process, and no saved login is named ${named}.`,
+    );
+  const { userId, organizationId } = await readTokenIdentity(input);
+  const owner = `OHMYHOST_TOKEN belongs to user ${userId} in organization ${organizationId ?? "none"},`;
+  if (
+    profile !== undefined &&
+    (profile.userId !== userId || profile.organizationId !== organizationId)
+  )
+    throw refuse(`${owner} but this call names ${describeProfile(profile)}.`);
+  if (request.organizationId !== undefined && request.organizationId !== organizationId)
+    throw refuse(`${owner} but this call targets organization ${request.organizationId}.`);
+  if (request.userId !== undefined && request.userId !== userId)
+    throw refuse(`${owner} but this call targets user ${request.userId}.`);
+  return { userId, organizationId };
+};
+
+/** Whose key OHMYHOST_TOKEN is, as the API reports it. */
+const readTokenIdentity = async (input: {
+  readonly token: string;
+  readonly baseUrl: string;
+  readonly fetch: typeof globalThis.fetch;
+}): Promise<{ readonly userId: string; readonly organizationId: string | null }> => {
+  const identity = parseCurrentIdentity(
+    await new GeneratedSdkProductApi(input.baseUrl, input.token, input.fetch).getCurrentIdentity(),
+  );
+  return {
+    userId: identity.actor_id.startsWith("user:") ? identity.actor_id.slice(5) : identity.actor_id,
+    organizationId: identity.organization_ids[0] ?? null,
+  };
+};
+
+/** The organization a command names explicitly; `organization use` names its target instead. */
+const commandOrganizationId = (command: ProductCliCommand): string | undefined => {
+  if (command.kind === "organization-use" || command.kind === "login") return undefined;
+  if (command.kind === "feedback-submit") return command.report.organization_id;
+  return "organizationId" in command && typeof command.organizationId === "string"
+    ? command.organizationId
+    : undefined;
+};
+
+const commandProjectId = (command: ProductCliCommand): string | undefined => {
+  if (command.kind === "managed-mail") return command.request.projectId;
+  return "projectId" in command && typeof command.projectId === "string"
+    ? command.projectId
+    : undefined;
+};
+
 export const runProductionCli = async (
   argv: readonly string[],
   environment: ProductCliEnvironment,
@@ -221,22 +538,82 @@ export const runProductionCli = async (
   overrides: ProductCliCompositionOverrides = {},
 ): Promise<number> => {
   const diagnostics = new StderrDiagnosticSink(io);
+  const written = (result: CliResult): number => {
+    io.writeStdout(result.stdout);
+    if (result.stderr.length > 0) io.writeStderr(result.stderr);
+    return result.exitCode;
+  };
+  let args: readonly string[];
+  let profileName: string | undefined;
+  try {
+    const extracted = extractProfileName(argv);
+    args = extracted.argv;
+    profileName = extracted.profileName;
+  } catch {
+    return written(invalidCommandFailure(recognizedCommandLabel(argv)));
+  }
+  const workingDirectory = overrides.workingDirectory ?? process.cwd();
   let command: ProductCliCommand;
+  let linked: Extract<LinkedProject, { outcome: "linked" }> | null;
+  let links: DirectoryLinks = { links: [], legacy: null };
   try {
-    const parsed = await parseWithLinkedProject(argv, async () => {
-      const profile = resolveProductCliEnvironment(environment);
-      return readLinkedProjectId(
-        join(overrides.workingDirectory ?? process.cwd(), profile.linkDirectory),
-        profile.apiOrigin,
+    const parsed = await parseWithLinkedProject(args, async () => {
+      let platform: ReturnType<typeof resolveProductCliEnvironment>;
+      try {
+        platform = resolveProductCliEnvironment(environment);
+      } catch {
+        return { outcome: "none" };
+      }
+      links = await readProjectLinks(
+        join(workingDirectory, platform.linkDirectory),
+        platform.apiOrigin,
+      );
+      let named = profileName;
+      try {
+        named ??= environmentProfile(environment);
+      } catch {
+        // An invalid binding is reported once the command is known.
+      }
+      const profiles =
+        named === undefined
+          ? []
+          : await (
+              overrides.profiles ??
+              new NativeKeyringProfileRegistry(undefined, platform.credentialService)
+            ).list();
+      // The login a command names picks that organization's link of this checkout.
+      return chooseLinkedProject(
+        links,
+        profiles.find((profile) => profile.name === named)?.organizationId ?? undefined,
       );
     });
     command = parsed.command;
-    if (parsed.linkedProjectId !== null)
-      io.writeStderr(`ohmyhost: using linked project ${parsed.linkedProjectId}\n`);
+    linked = parsed.linked;
+    if (linked !== null) io.writeStderr(`ohmyhost: using linked project ${linked.projectId}\n`);
   } catch (error) {
+    if (error instanceof LinkedProjectAmbiguousError)
+      return written(
+        errorDocument(
+          recognizedCommandLabel(args),
+          2,
+          "linked_project_selection_required",
+          false,
+          `This directory is linked to projects of several organizations (${error.organizationIds.join(", ")}). Pass --project ULID, or choose the login with --profile-name NAME; '${resolveProductCliEnvironment(environment).commandPrefix} profile list --json' shows the saved logins.`,
+        ),
+      );
+    if (error instanceof CredentialStoreUnavailableError)
+      return written(
+        errorDocument(
+          recognizedCommandLabel(args),
+          3,
+          "credential_store_unavailable",
+          true,
+          "Unlock or repair the selected credential store and retry.",
+        ),
+      );
     const result =
       error instanceof InvalidCommandError
-        ? invalidCommandFailure(recognizedCommandLabel(argv))
+        ? invalidCommandFailure(recognizedCommandLabel(args))
         : errorDocument("unknown", 1, "internal_error", false, "Retry the command.");
     if (!(error instanceof InvalidCommandError)) {
       diagnostics.record({
@@ -246,102 +623,230 @@ export const runProductionCli = async (
         errorKind: "unexpected",
       });
     }
-    io.writeStdout(result.stdout);
-    return result.exitCode;
+    return written(result);
   }
   if (command.kind === "init") {
+    if (profileName !== undefined) return written(invalidCommandFailure("init"));
     return runOfflineInit(command, io, diagnostics);
   }
   if (command.kind === "help" || command.kind === "version") {
-    const result = cliMetadataResult(
-      command.kind,
-      command.kind === "help" ? command.topic : undefined,
+    return written(
+      cliMetadataResult(command.kind, command.kind === "help" ? command.topic : undefined),
     );
-    io.writeStdout(result.stdout);
-    return result.exitCode;
   }
-  let profile: ReturnType<typeof resolveProductCliEnvironment>;
+  let platform: ReturnType<typeof resolveProductCliEnvironment>;
   try {
-    profile = resolveProductCliEnvironment(environment);
+    platform = resolveProductCliEnvironment(environment);
   } catch {
-    const result = errorDocument(
-      recognizedCommandLabel(argv),
-      2,
-      "invalid_environment",
-      false,
-      "Set OHMYHOST_ENVIRONMENT to development or production.",
+    return written(
+      errorDocument(
+        recognizedCommandLabel(args),
+        2,
+        "invalid_environment",
+        false,
+        "Set OHMYHOST_ENVIRONMENT to development or production.",
+      ),
     );
-    io.writeStdout(result.stdout);
-    return result.exitCode;
   }
   let apiToken: string | undefined;
   try {
     apiToken = environmentToken(environment);
   } catch {
-    const result = errorDocument(
-      recognizedCommandLabel(argv),
-      2,
-      "invalid_environment_token",
-      false,
-      "Set OHMYHOST_TOKEN to a valid user API key, or unset it to use interactive login.",
+    return written(
+      errorDocument(
+        recognizedCommandLabel(args),
+        2,
+        "invalid_environment_token",
+        false,
+        "Set OHMYHOST_TOKEN to a valid user API key, or unset it to use interactive login.",
+      ),
     );
-    io.writeStdout(result.stdout);
-    return result.exitCode;
   }
-  if (apiToken !== undefined && (command.kind === "login" || command.kind === "logout")) {
-    const result = errorDocument(
-      recognizedCommandLabel(argv),
-      2,
-      "environment_token_active",
-      false,
-      "Unset OHMYHOST_TOKEN before changing interactive login credentials. Logout does not revoke a user API key.",
+  let bound: string | undefined;
+  try {
+    bound = environmentProfile(environment);
+  } catch {
+    return written(
+      errorDocument(
+        recognizedCommandLabel(args),
+        2,
+        "invalid_profile_binding",
+        false,
+        `Set OHMYHOST_PROFILE to the name of a saved login ('${platform.commandPrefix} profile list --json'), or unset it.`,
+      ),
     );
-    io.writeStdout(result.stdout);
-    return result.exitCode;
   }
-  const selectedOverrides = {
-    ...overrides,
-    credentialStore:
-      overrides.credentialStore ??
-      new NativeNapiKeyringCredentialStore(undefined, profile.credentialService),
-  };
-  if (command.kind === "logout" && !command.revoke) {
-    return runOfflineLogout(io, diagnostics, selectedOverrides);
+  if (apiToken !== undefined && (command.kind === "login" || command.kind === "logout")) {
+    return written(
+      errorDocument(
+        recognizedCommandLabel(args),
+        2,
+        "environment_token_active",
+        false,
+        "Unset OHMYHOST_TOKEN before changing interactive login credentials. Logout does not revoke a user API key.",
+      ),
+    );
   }
-  // Login itself reads the account profile, so every authenticated command needs the origin.
-  const productApiOrigin = profile.apiOrigin;
+  // A command handed over from an OHMYHOST_TOKEN process runs only with a key of that account,
+  // never with a saved login, even one of the same user.
+  const requiredToken = command.kind === "secret-set" ? command.environmentToken : undefined;
+  // Either handed form names its account; the login or key that would run it must be exactly that
+  // account, so a login of the same name on another computer is refused before anything is read.
+  const handedAccount =
+    command.kind === "secret-set" ? (requiredToken ?? command.profileAccount) : undefined;
+  if (requiredToken !== undefined && apiToken === undefined)
+    return written(
+      errorDocument(
+        recognizedCommandLabel(args),
+        2,
+        "environment_token_required",
+        false,
+        `This command runs only with OHMYHOST_TOKEN holding a key of user ${requiredToken.userId} in organization ${requiredToken.organizationId}; a saved login cannot run it. Load that key from its private env file into this process and retry. Nothing was sent.`,
+      ),
+    );
+  const registry =
+    overrides.profiles ?? new NativeKeyringProfileRegistry(undefined, platform.credentialService);
+  const linkDirectory = join(workingDirectory, platform.linkDirectory);
+  const projectId = commandProjectId(command);
+  // The organization this command is about: named on the command, or recorded by this checkout's
+  // link of its project. It narrows the saved logins and is checked against OHMYHOST_TOKEN.
+  const organizationId =
+    handedAccount?.organizationId ??
+    commandOrganizationId(command) ??
+    linked?.organizationId ??
+    (projectId === undefined ? undefined : linkedOrganization(links, projectId));
+  const request = profileRequest(
+    {
+      ...(profileName === undefined ? {} : { name: profileName }),
+      ...(organizationId === undefined || organizationId === null ? {} : { organizationId }),
+      ...(handedAccount === undefined ? {} : { userId: handedAccount.userId }),
+    },
+    bound,
+  );
   const transport = new FetchWorkosPublicTransport(signal, REQUEST_TIMEOUT_MS);
+  const now = (): Date => new Date();
+  const refresher = new PublicWorkosTokenRefresher(environment);
+  const boundedFetch = (): typeof globalThis.fetch =>
+    createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES);
+  let profile: LocalProfile | undefined;
+  try {
+    if (apiToken !== undefined) {
+      if (command.kind !== "profile-list")
+        await verifyEnvironmentTokenContext({
+          token: apiToken,
+          request,
+          registry,
+          baseUrl: platform.apiOrigin,
+          fetch: boundedFetch(),
+        });
+      if (linked !== null && linked.organizationId === null)
+        await adoptLegacyLink({
+          links,
+          directory: linkDirectory,
+          repositoryRoot: workingDirectory,
+          apiOrigin: platform.apiOrigin,
+          organizationId: (
+            await readTokenIdentity({
+              token: apiToken,
+              baseUrl: platform.apiOrigin,
+              fetch: boundedFetch(),
+            })
+          ).organizationId,
+          accessToken: apiToken,
+          fetch: boundedFetch(),
+          actor: "OHMYHOST_TOKEN",
+          commandPrefix: platform.commandPrefix,
+        });
+    } else if (command.kind === "logout" && !command.revoke) {
+      // Removing a saved login needs no network: it is chosen from the local index alone.
+      return await runOfflineLogout(registry, request, platform.commandPrefix, io, diagnostics);
+    } else if (command.kind !== "login") {
+      // A login adds its own entry and needs nothing else; every other command first moves a
+      // login saved before named profiles into one, then chooses among the saved logins.
+      const profiles = await loadProfiles(registry, {
+        baseUrl: platform.apiOrigin,
+        fetch: boundedFetch(),
+        signal,
+        now,
+        refresher,
+      });
+      if (command.kind !== "profile-list") {
+        const selection =
+          command.kind === "organization-use"
+            ? selectProfileForOrganization(profiles, {
+                ...request,
+                organizationId: command.organizationId,
+              })
+            : selectProfile(profiles, request);
+        if (selection.outcome !== "selected")
+          throw profileSelectionError(selection, request, platform.commandPrefix, "cli");
+        profile = selection.profile;
+        io.writeStderr(`ohmyhost: acting as ${describeProfile(profile)}\n`);
+        if (linked !== null && linked.organizationId === null) {
+          const selected = await createAuthenticatedProductTransport(signal, {
+            environment,
+            profiles: registry,
+            request: { name: profile.name },
+          });
+          await adoptLegacyLink({
+            links,
+            directory: linkDirectory,
+            repositoryRoot: workingDirectory,
+            apiOrigin: platform.apiOrigin,
+            organizationId: profile.organizationId,
+            accessToken: selected.accessToken,
+            fetch: selected.fetch,
+            actor: `profile ${profile.name}`,
+            commandPrefix: platform.commandPrefix,
+          });
+        }
+      }
+    }
+  } catch (error) {
+    return written(
+      compositionFailure(recognizedCommandLabel(args), error, signal, platform.commandPrefix),
+    );
+  }
+  const selected = profile;
+  const productApiOrigin = platform.apiOrigin;
   const lifecycle = new GeneratedSdkSessionRevoker({
     environment,
-    credentialStore: selectedOverrides.credentialStore,
+    profiles: registry,
+    ...(selected === undefined ? {} : { request: { name: selected.name } }),
   });
   const cli = new ProductCli({
     ...(apiToken === undefined ? {} : { apiToken }),
-    commandPrefix: profile.commandPrefix,
-    credentialStore: () => selectedOverrides.credentialStore,
+    commandPrefix: platform.commandPrefix,
+    profiles: registry,
+    ...(selected === undefined ? {} : { profile: selected }),
+    // A login in a process bound to one saved login renews exactly that one.
+    ...((profileName ?? bound) === undefined ? {} : { profileName: profileName ?? bound }),
+    ...(bound === undefined ? {} : { profileBinding: bound }),
     deviceFlow: new WorkosDeviceFlowClient(
       {
-        clientId: profile.clientId,
+        clientId: platform.clientId,
         scope: "openid offline_access",
-        verificationUri: profile.verificationUri,
+        verificationUri: platform.verificationUri,
       },
       transport,
-      { now: () => new Date() },
+      { now },
     ),
     deviceAuthorizationPresenter: new StderrDeviceAuthorizationPresenter(io),
     productApi: (accessToken) =>
-      new GeneratedSdkProductApi(
-        productApiOrigin,
-        accessToken,
-        createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
-      ),
-    // Login receives read-only workspace and GitHub queries instead of the product surface.
+      new GeneratedSdkProductApi(productApiOrigin, accessToken, boundedFetch()),
+    // Login receives read-only identity, workspace and GitHub queries instead of the product surface.
     accountProfile: async (accessToken) =>
       await new GeneratedSdkProductApi(
         productApiOrigin,
         accessToken,
-        createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+        boundedFetch(),
       ).getAccountProfile(),
+    currentIdentity: async (accessToken) =>
+      await new GeneratedSdkProductApi(
+        productApiOrigin,
+        accessToken,
+        boundedFetch(),
+      ).getCurrentIdentity(),
     githubConnectionStatus: (accessToken, organizationId) =>
       getGithubOrganizationConnection(
         { organization_id: organizationId },
@@ -350,19 +855,16 @@ export const runProductionCli = async (
             baseUrl: productApiOrigin,
             auth: accessToken,
             throwOnError: true,
-            fetch: createBoundedFetch(fetch, signal, REQUEST_TIMEOUT_MS, MAX_PUBLIC_RESPONSE_BYTES),
+            fetch: boundedFetch(),
           }),
           signal,
         },
       ),
-    projectLinkStore: new OwnerOnlyProjectLinkStore(
-      join(process.cwd(), profile.linkDirectory),
-      process.cwd(),
-    ),
-    productApiOrigin: profile.apiOrigin,
-    tokenRefresher: new PublicWorkosTokenRefresher(environment),
+    projectLinkStore: new OwnerOnlyProjectLinkStore(linkDirectory, workingDirectory),
+    productApiOrigin,
+    tokenRefresher: refresher,
     tokenRevoker: lifecycle,
-    now: () => new Date(),
+    now,
     waitUntil,
     lifecycleTimeoutMs: REQUEST_TIMEOUT_MS,
     createCorrelationId: randomUUID,
@@ -373,10 +875,98 @@ export const runProductionCli = async (
       ((readSignal) => readSecretValueFromStandardInput(process.stdin, readSignal)),
     spawnPsql: runLocalPsql,
   });
-  const result = await cli.runCommand(command, signal);
-  io.writeStdout(result.stdout);
-  if (result.stderr.length > 0) io.writeStderr(result.stderr);
-  return result.exitCode;
+  return written(await cli.runCommand(command, signal));
+};
+
+/**
+ * A link written before links named their organization is used only after the API confirms that
+ * the acting account can see its project; it is then rewritten for that organization.
+ */
+const adoptLegacyLink = async (input: {
+  readonly links: DirectoryLinks;
+  readonly directory: string;
+  readonly repositoryRoot: string;
+  readonly apiOrigin: string;
+  readonly organizationId: string | null;
+  readonly accessToken: string;
+  readonly fetch: typeof globalThis.fetch;
+  readonly actor: string;
+  readonly commandPrefix: string;
+}): Promise<void> => {
+  const legacy = input.links.legacy;
+  if (legacy === null) return;
+  const refuse = (): ProfileSelectionError =>
+    new ProfileSelectionError(
+      "linked_project_organization_mismatch",
+      2,
+      `This directory's link names project ${legacy.project_id}, which ${input.actor} cannot see${
+        input.organizationId === null ? "" : ` in organization ${input.organizationId}`
+      }. Nothing was sent to it. Pass --project ULID or --profile-name NAME for the account that owns it, or run '${input.commandPrefix} link' again for this account.`,
+    );
+  let organizationId: string;
+  try {
+    const project = await getProject(
+      { project_id: legacy.project_id },
+      {
+        client: createClient({
+          baseUrl: input.apiOrigin,
+          auth: input.accessToken,
+          fetch: input.fetch,
+          throwOnError: true,
+        }),
+      },
+    );
+    organizationId = project.organization_id;
+  } catch (error) {
+    if (isProblem(error, "resource_not_found") || isProblem(error, "forbidden")) throw refuse();
+    throw error;
+  }
+  if (organizationId !== input.organizationId) throw refuse();
+  await new OwnerOnlyProjectLinkStore(input.directory, input.repositoryRoot).save({
+    version: 2,
+    api_origin: input.apiOrigin,
+    organization_id: organizationId,
+    project_id: legacy.project_id,
+    installation_id: legacy.installation_id,
+    repository_full_name: legacy.repository_full_name,
+  });
+  await removeLegacyProjectLink(input.directory);
+};
+
+/** Failures while choosing the account, before the command itself runs. */
+const compositionFailure = (
+  command: OutputCommand,
+  error: unknown,
+  signal: AbortSignal,
+  commandPrefix: string,
+): CliResult => {
+  if (error instanceof ProfileSelectionError)
+    return errorDocument(command, error.exitCode, error.code, false, error.suggestedAction);
+  if (error instanceof ProfileLimitError)
+    return errorDocument(
+      command,
+      2,
+      "profile_limit_reached",
+      false,
+      profileLimitAction(commandPrefix),
+    );
+  if (error instanceof ProductApiAuthenticationError)
+    return error.code === "authentication_required"
+      ? errorDocument(
+          command,
+          5,
+          "authentication_required",
+          false,
+          `Run '${commandPrefix} login --json'.`,
+        )
+      : errorDocument(
+          command,
+          5,
+          "token_refresh_failed",
+          true,
+          `Run '${commandPrefix} login --json' if retrying does not succeed.`,
+        );
+  return classifyCliFailure(command, error, signal);
 };
 
 const runOfflineInit = async (
@@ -602,30 +1192,35 @@ export class GeneratedSdkSessionRevoker implements TokenRevoker {
   }
 }
 
+/** This checkout is linked for several organizations and nothing chose one of them. */
+export class LinkedProjectAmbiguousError extends Error {
+  public constructor(readonly organizationIds: readonly string[]) {
+    super("Several organizations' links apply");
+    this.name = "LinkedProjectAmbiguousError";
+  }
+}
+
 /**
- * A command run inside a linked directory may omit --project; the link supplies it. The
- * link is read only when the command needs a project it did not name.
+ * A command run inside a linked directory may omit --project; the link supplies it. The link is
+ * read only when the command needs a project it did not name.
  */
 export async function parseWithLinkedProject(
   argv: readonly string[],
-  linkedProjectId: () => Promise<string | null>,
-): Promise<{ readonly command: ProductCliCommand; readonly linkedProjectId: string | null }> {
+  linkedProject: () => Promise<LinkedProject>,
+): Promise<{
+  readonly command: ProductCliCommand;
+  readonly linked: Extract<LinkedProject, { outcome: "linked" }> | null;
+}> {
   try {
-    return { command: parseProductCliCommand(argv), linkedProjectId: null };
+    return { command: parseProductCliCommand(argv), linked: null };
   } catch (error) {
     if (!(error instanceof InvalidCommandError) || argv.includes("--project")) throw error;
-    let projectId: string | null;
+    const linked = await linkedProject();
+    if (linked.outcome === "ambiguous")
+      throw new LinkedProjectAmbiguousError(linked.organizationIds);
+    if (linked.outcome === "none") throw error;
     try {
-      projectId = await linkedProjectId();
-    } catch {
-      projectId = null;
-    }
-    if (projectId === null) throw error;
-    try {
-      return {
-        command: parseProductCliCommand([...argv, "--project", projectId]),
-        linkedProjectId: projectId,
-      };
+      return { command: parseProductCliCommand([...argv, "--project", linked.projectId]), linked };
     } catch {
       throw error;
     }
@@ -780,15 +1375,43 @@ const boundedSignal = (parent: AbortSignal, timeoutMs: number): AbortSignal =>
 const isAbortOrTimeout = (error: unknown): boolean =>
   error instanceof DOMException && (error.name === "AbortError" || error.name === "TimeoutError");
 
+/**
+ * Remove one saved login without network access. Only the chosen login is removed; a login saved
+ * before named profiles is removed only when no named login exists.
+ */
 const runOfflineLogout = async (
+  registry: ProfileRegistry,
+  request: ProfileRequest,
+  commandPrefix: string,
   io: ProductCliIo,
   diagnostics: StderrDiagnosticSink,
-  overrides: ProductCliCompositionOverrides,
 ): Promise<number> => {
   let result: CliResult;
   try {
-    await (overrides.credentialStore ?? new NativeNapiKeyringCredentialStore()).clear();
-    result = resultDocument("logout", 0, "logged_out");
+    const selection = selectProfile(await registry.list(), request);
+    if (selection.outcome === "selected") {
+      await registry.remove(selection.profile);
+      result = resultDocument("logout", 0, "logged_out", {
+        profile: publicProfile(selection.profile),
+      });
+    } else if (
+      selection.outcome === "none" &&
+      request.name === undefined &&
+      request.bound === undefined
+    ) {
+      // Nothing is saved under a name: a login of an earlier client goes, and none is logged out.
+      await registry.legacy().clear();
+      result = resultDocument("logout", 0, "logged_out");
+    } else {
+      const failure = profileSelectionError(selection, request, commandPrefix, "cli");
+      result = errorDocument(
+        "logout",
+        failure.exitCode,
+        failure.code,
+        false,
+        failure.suggestedAction,
+      );
+    }
   } catch {
     diagnostics.record({
       correlationId: randomUUID(),
@@ -841,9 +1464,14 @@ export const readSecretValueFromStandardInput = async (
 const invalidCommandFailure = (command: OutputCommand): CliResult =>
   errorDocument(command, 2, "invalid_command", false, "Check 'ohmyhost --help'.");
 
-const resultDocument = (command: OutputCommand, exitCode: number, status: string): CliResult => ({
+const resultDocument = (
+  command: OutputCommand,
+  exitCode: number,
+  status: string,
+  body: Readonly<Record<string, unknown>> = {},
+): CliResult => ({
   exitCode,
-  stdout: `${JSON.stringify({ version: 1, command, status })}\n`,
+  stdout: `${JSON.stringify({ version: 1, command, status, ...body })}\n`,
   stderr: "",
 });