@assethub/cli 0.1.19 → 0.1.21

package/README.md

@@ -4,7 +4,7 @@ Command line interface for AssetHub.
 
 ## Personal API keys
 
-Log in once with a personal key (`ah_pat_`), then select its workspace:
+Log in once with a personal key, then select its workspace:
 
 ```sh
 assethub auth login --api-key-stdin --profile personal
@@ -19,6 +19,13 @@ Login verifies account identity through workspace discovery, including when
 in the same profile with the same key. It does not issue keys or change browser
 sessions. Pass `--cursor <nextCursor>` for another workspace list page.
 
+CLI 0.1.21 also discovers existing `sk_` keys enabled for personal access by the
+server. Run `workspace list --profile <saved-profile>` to discover a saved key
+without logging in again. Verified personal identity is saved in that profile;
+workspace selection keeps its original key. The `assethub-UUID` format is not
+eligible for this discovery. Unregistered workspace keys retain the existing
+user-token flow; rejected personal keys never fall back to another identity.
+
 `--workspace` overrides the saved selection for one command, including diagnostics,
 MCP discovery, history, and run recovery. Recovery still rejects an operation saved
 in another workspace. Personal profiles take precedence over environment API
@@ -201,17 +208,21 @@ Existing parts commands use the same canvas and durable operation storage:
 assethub parts split --source-id "$IMAGE_ASSET_ID" --canvas "$CANVAS_ID" --part-extractor V1.5 --wait
 # Select only the parts to execute; --all-ready selects all ready tasks.
 assethub parts split --source-id "$IMAGE_ASSET_ID" --canvas "$CANVAS_ID" --part-extractor V1.5 --all-ready --wait
-# Internal V3.6.1, V3.6.3 and V3.6.4 run the complete graph split through one analyze receipt.
+# Internal graph versions run the complete split through one analyze receipt.
 assethub production agents
 assethub parts split --source-id "$IMAGE_ASSET_ID" --canvas "$CANVAS_ID" --part-extractor V3.6.1 --all-ready --wait
+# CLI 0.1.20+: existing Internal V3.6.5 and Pluffy models; check server availability first.
+assethub parts split --source-id "$IMAGE_ASSET_ID" --canvas "$CANVAS_ID" --part-extractor V3.6.5 --all-ready --wait
+assethub production analyze --source-id "$IMAGE_ASSET_ID" --canvas "$CANVAS_ID" --part-extractor pluffy --wait
 assethub production automation --canvas "$CANVAS_ID" --input-json @batch.json --wait
 ```
 
 `parts split` keeps separate analysis and selected-part execution phases. Each phase
 has its own saved operation ID, with the execution linked to the analysis run.
-For Internal `V3.6.1` (`V3.6.1 Primary Images First`) and `V3.6.3`
-(`V3.6.3 Fast Analysis`, CLI 0.1.16+), and `V3.6.4`
-(`V3.6.4 Fast Analysis`, CLI 0.1.17+), analysis runs the complete
+For Internal `V3.6.1` (`V3.6.1 Primary Images First`), `V3.6.3`
+(`V3.6.3 Fast Analysis`, CLI 0.1.16+), `V3.6.4`
+(`V3.6.4 Fast Analysis`, CLI 0.1.17+), `V3.6.5 Primary Images` and
+`Chibi Character (Pluffy) v3.1` (both CLI 0.1.20+), analysis runs the complete
 Artifact Graph split. `--all-ready` waits for that one receipt and does not start a
 second production execution. Resume an interrupted graph split with
 `runs resume <operation-id>`; `--task-id`, `--mission-id`,
@@ -483,9 +494,12 @@ Image generation uses the `v2` endpoint with mandatory canvas history.
 Part extraction uses the same names shown in the AssetHub product: `V1.5`,
 `V2.0 alpha`, `V2.1 alpha`, and the Internal-only aliases `V3.6.1`
 (`V3.6.1 Primary Images First`), `V3.6.3` (`V3.6.3 Fast Analysis`),
-and `V3.6.4` (`V3.6.4 Fast Analysis`).
+`V3.6.4` (`V3.6.4 Fast Analysis`), `V3.6.5` (`V3.6.5 Primary Images`),
+and `pluffy` (`Chibi Character (Pluffy) v3.1`). CLI 0.1.20 adds the latter two;
+`3.6.5`, `pluffy v3.1`, and `pluffy 3.1` are also accepted aliases.
 Run `production agents` to check availability and `supportedOnGraphEndpoint`
-before selecting a graph version. These aliases do not change the default.
+before selecting a graph version. These aliases do not change the V1.5 default
+or grant access to Internal models; the server still authorizes the account.
 Retired names are no longer accepted by the CLI.
 Internal agent IDs are intentionally not part of the CLI interface.
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA4BA,OAAO,EAIL,KAAK,wBAAwB,EAO7B,KAAK,YAAY,EAEjB,KAAK,UAAU,EAgBhB,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAAC,kBAAkB,EAAc,MAAM,gCAAgC,CAAA;AAI9E,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAA;AA6IxD,eAAO,MAAM,KAAK,s3aAkIjB,CAAA;AA8pFD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACxC,OAAO,KAAK,KACX,wBA0BF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,KAAK,KACX,IAAI,CAAC,UAAU,EAAE,QAAQ,CAM1B,CAAA;AA6fF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,SAAS,MAAM,EAAE,KACtB,YAAY,EAuGd,CAAA;AAgsCD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,OAAO,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,GAAG,SAAS,EAC9B,aAAa,MAAM,EAAE,EACrB,OAAO,KAAK,KACX,cAoBF,CAAA;AAED,KAAK,iBAAiB,GAAG,IAAI,CAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,EAC5C,SAAS,GACT,UAAU,GACV,KAAK,GACL,WAAW,GACX,QAAQ,GACR,OAAO,GACP,OAAO,GACP,UAAU,CACb,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,MAAM,iBAAiB;;;;;;;;;;;;;;CAUvB,CAAA;AAEF,eAAO,MAAM,sBAAsB,GACjC,SAAS,UAAU,CAAC,OAAO,iBAAiB,CAAC,EAC7C,MAAM,iBAAiB,EACvB,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAYf,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AA4BA,OAAO,EAIL,KAAK,wBAAwB,EAO7B,KAAK,YAAY,EAEjB,KAAK,UAAU,EAgBhB,MAAM,sBAAsB,CAAA;AAc7B,OAAO,EAAC,kBAAkB,EAAc,MAAM,gCAAgC,CAAA;AAI9E,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAA;AA2JxD,eAAO,MAAM,KAAK,s3aAkIjB,CAAA;AA4sFD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACxC,OAAO,KAAK,KACX,wBA0BF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,KAAK,KACX,IAAI,CAAC,UAAU,EAAE,QAAQ,CAM1B,CAAA;AA6fF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,SAAS,MAAM,EAAE,KACtB,YAAY,EAuGd,CAAA;AAgsCD,MAAM,MAAM,cAAc,GAAG;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,OAAO,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC9B,YAAY,MAAM,GAAG,SAAS,EAC9B,aAAa,MAAM,EAAE,EACrB,OAAO,KAAK,KACX,cAoBF,CAAA;AAED,KAAK,iBAAiB,GAAG,IAAI,CAC3B,OAAO,CAAC,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,EAC5C,SAAS,GACT,UAAU,GACV,KAAK,GACL,WAAW,GACX,QAAQ,GACR,OAAO,GACP,OAAO,GACP,UAAU,CACb,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,MAAM,iBAAiB;;;;;;;;;;;;;;CAUvB,CAAA;AAEF,eAAO,MAAM,sBAAsB,GACjC,SAAS,UAAU,CAAC,OAAO,iBAAiB,CAAC,EAC7C,MAAM,iBAAiB,EACvB,SAAS,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAYf,CAAA"}

package/dist/index.js

@@ -34,6 +34,8 @@ const artifactGraphPartExtractorApiValues = new Set([
     'ah_agent_graph_v3_6_1',
     'ah_agent_graph_v3_6_3',
     'ah_agent_graph_v3_6_4',
+    'ah_agent_graph_v3_6_5',
+    'ah_agent_graph_pluffy_v3_1',
 ]);
 const partExtractorOptions = [
     {
@@ -66,6 +68,16 @@ const partExtractorOptions = [
         apiValue: 'ah_agent_graph_v3_6_4',
         aliases: ['v3.6.4', '3.6.4'],
     },
+    {
+        publicName: 'V3.6.5 Primary Images',
+        apiValue: 'ah_agent_graph_v3_6_5',
+        aliases: ['v3.6.5', '3.6.5'],
+    },
+    {
+        publicName: 'Chibi Character (Pluffy) v3.1',
+        apiValue: 'ah_agent_graph_pluffy_v3_1',
+        aliases: ['pluffy', 'pluffy v3.1', 'pluffy 3.1'],
+    },
 ];
 const partExtractorPublicNames = partExtractorOptions
     .map(option => option.publicName)
@@ -432,6 +444,39 @@ const readStdinBlob = async (type) => await new Promise((resolve, reject) => {
     });
     stdin.on('error', reject);
 });
+const isPersonalProfile = (profile) => profile?.authentication === 'personal' || Boolean(profile?.apiKey?.startsWith('ah_pat_'));
+const personalProfileAuthentication = (apiKey, baseUrl, profile) => profile?.apiKey === apiKey && new URL(profile.baseUrl).origin === new URL(baseUrl).origin
+    ? profile.authentication : undefined;
+const canDiscoverPersonalKey = (key) => Boolean(key && (key.startsWith('ah_pat_') || /^sk_[a-f0-9]{64}$/i.test(key)));
+const preferredApiKey = (flags, stored) => getFlag(flags, 'api-key') ??
+    (hasFlag(flags, 'profile') || stored?.workspaceId || isPersonalProfile(stored)
+        ? stored?.apiKey
+        : env.ASSETHUB_API_KEY?.trim() || stored?.apiKey);
+const personalAccount = async (auth) => {
+    const knownPersonal = isPersonalProfile(auth);
+    if (!knownPersonal && !canDiscoverPersonalKey(auth.apiKey))
+        return undefined;
+    try {
+        const account = await createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }).list();
+        if (account.authentication !== 'personal')
+            throw new Error('Workspace API did not verify personal authentication');
+        return account;
+    }
+    catch (error) {
+        if (!knownPersonal && error instanceof WorkspaceClientError && error.status === 401 && error.code === 'PERSONAL_KEY_NOT_REGISTERED')
+            return undefined;
+        throw error;
+    }
+};
+const rememberPersonalProfile = async (auth, configPath, config, userId) => {
+    if (auth.source !== 'profile')
+        return;
+    config.profiles = { ...config.profiles, [auth.profile]: {
+            apiKey: auth.apiKey, authentication: 'personal', userId,
+            workspaceId: config.profiles?.[auth.profile]?.workspaceId, baseUrl: auth.baseUrl, updatedAt: new Date().toISOString(),
+        } };
+    await writeAuthConfig(configPath, config);
+};
 const resolveAuth = async (flags) => {
     const explicitProfile = hasFlag(flags, 'profile') ? requireFlag(flags, 'profile') : undefined;
     const overrideKey = hasFlag(flags, 'api-key') ? requireFlag(flags, 'api-key') : undefined;
@@ -440,7 +485,7 @@ const resolveAuth = async (flags) => {
         : undefined;
     const profile = explicitProfile ?? config?.defaultProfile ?? defaultProfileName;
     const storedProfile = config?.profiles?.[profile];
-    const selected = Boolean(explicitProfile || storedProfile?.workspaceId || storedProfile?.apiKey?.startsWith('ah_pat_'));
+    const selected = Boolean(explicitProfile || storedProfile?.workspaceId || isPersonalProfile(storedProfile));
     if (selected && (!storedProfile || (!storedProfile.apiKey && !overrideKey)))
         throw new Error('Selected profile has no workspace API key. Use workspace use <id> or auth login --api-key-stdin --profile <name>.');
     const baseUrl = getFlag(flags, 'base-url') ??
@@ -450,15 +495,18 @@ const resolveAuth = async (flags) => {
     if (overrideKey)
         return { apiKey: overrideKey, baseUrl, profile, source: 'flag', workspaceId: getFlag(flags, 'workspace') };
     if (selected && storedProfile?.apiKey) {
-        if ((storedProfile.workspaceId || storedProfile.apiKey.startsWith('ah_pat_')) &&
+        if ((storedProfile.workspaceId || isPersonalProfile(storedProfile) || canDiscoverPersonalKey(storedProfile.apiKey)) &&
             new URL(baseUrl).origin !== new URL(storedProfile.baseUrl).origin)
             throw new Error('Selected workspace belongs to another API origin; select a workspace for this origin or supply an explicit API key');
-        return { apiKey: storedProfile.apiKey, baseUrl, profile, source: 'profile', workspaceId: getFlag(flags, 'workspace') ?? storedProfile.workspaceId };
+        return { apiKey: storedProfile.apiKey, authentication: storedProfile.authentication, baseUrl, profile, source: 'profile', workspaceId: getFlag(flags, 'workspace') ?? storedProfile.workspaceId };
     }
     if (env.ASSETHUB_API_KEY?.trim())
         return { apiKey: env.ASSETHUB_API_KEY, baseUrl, profile, source: 'env', workspaceId: getFlag(flags, 'workspace') };
-    if (storedProfile?.apiKey)
+    if (storedProfile?.apiKey) {
+        if (canDiscoverPersonalKey(storedProfile.apiKey) && new URL(baseUrl).origin !== new URL(storedProfile.baseUrl).origin)
+            throw new Error('Saved API key belongs to another API origin; supply an explicit API key for this origin');
         return { apiKey: storedProfile.apiKey, baseUrl, profile, source: 'profile', workspaceId: getFlag(flags, 'workspace') ?? storedProfile.workspaceId };
+    }
     throw new Error('Missing workspace API key. Use "workspace use <id>" after user login, "auth login --api-key-stdin", or ASSETHUB_API_KEY.');
 };
 const createContext = async (flags, args) => {
@@ -1256,18 +1304,22 @@ const workspaceAuth = async (flags, allowPersonal = false) => {
     const explicitProfile = hasFlag(flags, 'profile') ? requireFlag(flags, 'profile') : undefined;
     const profile = explicitProfile ?? config.defaultProfile ?? defaultProfileName;
     const stored = config.profiles?.[profile];
-    const preferredKey = getFlag(flags, 'api-key') ??
-        (explicitProfile || stored?.workspaceId || stored?.apiKey?.startsWith('ah_pat_')
-            ? stored?.apiKey
-            : env.ASSETHUB_API_KEY?.trim() || stored?.apiKey);
-    if (allowPersonal && preferredKey?.startsWith('ah_pat_')) {
+    const preferredKey = preferredApiKey(flags, stored);
+    if (allowPersonal && (canDiscoverPersonalKey(preferredKey) || (preferredKey === stored?.apiKey && isPersonalProfile(stored)))) {
         const auth = await resolveAuth(flags);
-        return {
-            configPath, config, profile, accessToken: auth.apiKey,
-            workspaceMfaToken: undefined, baseUrl: auth.baseUrl,
-            selectedWorkspaceId: auth.workspaceId, personal: true,
-            client: createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }),
-        };
+        auth.authentication = personalProfileAuthentication(auth.apiKey, auth.baseUrl, stored);
+        const knownPersonal = isPersonalProfile(auth);
+        const account = knownPersonal ? undefined : await personalAccount(auth);
+        if (knownPersonal || account) {
+            if (account)
+                await rememberPersonalProfile(auth, configPath, config, account.userId);
+            return {
+                configPath, config, profile, accessToken: auth.apiKey,
+                workspaceMfaToken: undefined, baseUrl: auth.baseUrl,
+                selectedWorkspaceId: auth.workspaceId, personal: true,
+                client: createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }),
+            };
+        }
     }
     const environmentToken = explicitProfile ? undefined : env.ASSETHUB_ACCESS_TOKEN?.trim();
     const accessToken = environmentToken || stored?.accessToken;
@@ -1380,6 +1432,7 @@ const commandWorkspace = async (subcommand, positionals, flags) => {
             throw new Error('Workspace API did not verify personal authentication');
         profiles[auth.profile] = {
             apiKey: auth.accessToken,
+            authentication: 'personal',
             userId: account.userId,
             workspaceId,
             baseUrl: auth.baseUrl,
@@ -1392,7 +1445,7 @@ const commandWorkspace = async (subcommand, positionals, flags) => {
     const cached = Object.entries(profiles).find(([, entry]) => entry.userId === account.userId &&
         entry.workspaceId === workspaceId &&
         new URL(entry.baseUrl).origin === new URL(auth.baseUrl).origin &&
-        entry.apiKey && !entry.apiKey.startsWith('ah_pat_'));
+        entry.apiKey && !isPersonalProfile(entry));
     let apiKey;
     for (const candidate of new Set([cached?.[1].apiKey, suppliedKey])) {
         if (!candidate)
@@ -1495,22 +1548,19 @@ const commandAuth = async (subcommand, flags) => {
             throw new Error('API key is empty. Pass --api-key, use --api-key-stdin, or set ASSETHUB_API_KEY.');
         }
         const baseUrl = getFlag(flags, 'base-url') ?? env.ASSETHUB_API_BASE_URL ?? defaultBaseUrl;
-        const personal = apiKey.startsWith('ah_pat_');
-        const account = personal
-            ? await createWorkspaceClient({ accessToken: apiKey, baseUrl }).list()
-            : undefined;
-        if (personal && account?.authentication !== 'personal')
-            throw new Error('Workspace API did not verify personal authentication');
+        const config = await readAuthConfig(configPath);
+        const authentication = personalProfileAuthentication(apiKey, baseUrl, config.profiles?.[profile]);
+        const account = await personalAccount({ apiKey, baseUrl, authentication });
+        const personal = account !== undefined;
         if (!personal && !hasFlag(flags, 'skip-verify')) {
             const client = createAssetHubClient({ apiKey, baseUrl });
             await client.v2.listModels();
         }
-        const config = await readAuthConfig(configPath);
         const profiles = config.profiles ?? {};
         profiles[profile] = {
             apiKey,
             baseUrl,
-            ...(account ? { userId: account.userId } : {}),
+            ...(account ? { authentication: 'personal', userId: account.userId } : {}),
             updatedAt: new Date().toISOString(),
         };
         await writeAuthConfig(configPath, {
@@ -1531,9 +1581,22 @@ const commandAuth = async (subcommand, flags) => {
     if (subcommand === 'status') {
         const config = await readAuthConfig(configPath);
         const current = config.profiles?.[getFlag(flags, 'profile') ?? config.defaultProfile ?? profile];
+        let apiAuth;
+        const preferredKey = preferredApiKey(flags, current);
+        if (canDiscoverPersonalKey(preferredKey) || (preferredKey === current?.apiKey && isPersonalProfile(current))) {
+            apiAuth = await resolveAuth(flags);
+            apiAuth.authentication = personalProfileAuthentication(apiAuth.apiKey, apiAuth.baseUrl, current);
+            const account = await personalAccount(apiAuth);
+            if (account) {
+                if (apiAuth.workspaceId)
+                    await createAssetHubClient(apiAuth).v2.getCapabilities();
+                await rememberPersonalProfile(apiAuth, configPath, config, account.userId);
+                print({ authenticated: true, authentication: 'personal', userId: account.userId, workspaceId: apiAuth.workspaceId,
+                    profile: apiAuth.profile, source: apiAuth.source, baseUrl: apiAuth.baseUrl });
+                return;
+            }
+        }
         if (!hasFlag(flags, 'api-key') &&
-            !current?.apiKey?.startsWith('ah_pat_') &&
-            (hasFlag(flags, 'profile') || !env.ASSETHUB_API_KEY?.startsWith('ah_pat_')) &&
             ((!hasFlag(flags, 'profile') && env.ASSETHUB_ACCESS_TOKEN?.trim()) ||
                 (current?.accessToken && !current.apiKey))) {
             const auth = await workspaceAuth(flags);
@@ -1548,22 +1611,12 @@ const commandAuth = async (subcommand, flags) => {
             });
             return;
         }
-        const auth = await resolveAuth(flags);
+        const auth = apiAuth ?? await resolveAuth(flags);
         const client = createAssetHubClient({
             apiKey: auth.apiKey,
             baseUrl: auth.baseUrl,
             workspaceId: auth.workspaceId,
         });
-        if (auth.apiKey.startsWith('ah_pat_')) {
-            const account = await createWorkspaceClient({ accessToken: auth.apiKey, baseUrl: auth.baseUrl, workspaceId: auth.workspaceId }).list();
-            if (account.authentication !== 'personal')
-                throw new Error('Workspace API did not verify personal authentication');
-            if (auth.workspaceId)
-                await client.v2.getCapabilities();
-            print({ authenticated: true, authentication: 'personal', userId: account.userId, workspaceId: auth.workspaceId,
-                profile: auth.profile, source: auth.source, baseUrl: auth.baseUrl });
-            return;
-        }
         const models = await client.v2.listModels();
         print({
             authenticated: true,
@@ -3798,7 +3851,7 @@ const run = async () => {
         const stored = config.profiles?.[explicitProfile ?? config.defaultProfile ?? defaultProfileName];
         if (explicitProfile && !stored)
             throw new Error('Selected profile does not exist');
-        const selected = explicitProfile || stored?.workspaceId || stored?.apiKey?.startsWith('ah_pat_');
+        const selected = explicitProfile || stored?.workspaceId || isPersonalProfile(stored);
         const baseUrl = getFlag(parsed.flags, 'base-url') ??
             (selected ? stored?.baseUrl : env.ASSETHUB_API_BASE_URL ?? stored?.baseUrl) ?? defaultBaseUrl;
         const workspaceId = getFlag(parsed.flags, 'workspace') ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assethub/cli",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Command line interface for AssetHub.",
   "type": "module",
   "bin": {