@autohq/cli 0.1.106 → 0.1.108

package/README.md

@@ -44,6 +44,24 @@ auto tui               # interactive dashboard
 
 Run `auto --help` for the full command tree.
 
+## Accounts and profiles
+
+Each signed-in account is stored as a named profile; the active one is a
+pointer in `~/.auto/config.yaml`. Logging in to a second account never
+discards the first.
+
+```sh
+auto auth login --profile staging   # sign in under a chosen profile name
+auto auth list                      # list stored accounts
+auto auth switch staging            # make a profile (or email) active
+auto auth remove staging            # delete a stored profile
+auto --profile staging runs list    # use a profile for one invocation
+```
+
+`AUTO_PROFILE=<name>` pins a whole shell session to a profile without
+moving the active pointer, so different terminals can act as different
+accounts at the same time.
+
 ## License
 
 Copyright Fractal Works. All rights reserved.

package/dist/agent-bridge.js

@@ -20843,7 +20843,8 @@ var SecretAesGcmAuthTagSchema = external_exports.string().trim().regex(/^[A-Za-z
 var SecretEnvValueSchema = external_exports.union([
   external_exports.string(),
   external_exports.object({
-    $secret: ResourceNameSchema
+    $secret: ResourceNameSchema,
+    optional: external_exports.boolean().optional()
   })
 ]);
 var SecretEnvSchema = external_exports.record(
@@ -26205,7 +26206,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.106",
+  version: "0.1.108",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -26229,6 +26230,7 @@ var package_default = {
     "dev:tui": "node ../../scripts/cli-tui-dev-watch.mjs",
     "skill:generate": "tsx scripts/generate-skill-content.ts",
     test: "npm run test:unit",
+    "test:mutation": "stryker run",
     "test:unit": 'tsx --test "test/**/*.unit.test.ts"',
     typecheck: "tsc --noEmit"
   },
@@ -26249,6 +26251,7 @@ var package_default = {
   devDependencies: {
     "@auto/protocol": "*",
     "@auto/schemas": "*",
+    "@stryker-mutator/core": "^9.6.1",
     "@types/react": "^19",
     tsup: "^8.5.1"
   }

package/dist/index.js

@@ -16531,7 +16531,8 @@ var init_secrets = __esm({
     SecretEnvValueSchema = external_exports.union([
       external_exports.string(),
       external_exports.object({
-        $secret: ResourceNameSchema
+        $secret: ResourceNameSchema,
+        optional: external_exports.boolean().optional()
       })
     ]);
     SecretEnvSchema = external_exports.record(
@@ -18511,7 +18512,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.106",
+      version: "0.1.108",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -18535,6 +18536,7 @@ var init_package = __esm({
         "dev:tui": "node ../../scripts/cli-tui-dev-watch.mjs",
         "skill:generate": "tsx scripts/generate-skill-content.ts",
         test: "npm run test:unit",
+        "test:mutation": "stryker run",
         "test:unit": 'tsx --test "test/**/*.unit.test.ts"',
         typecheck: "tsc --noEmit"
       },
@@ -18555,6 +18557,7 @@ var init_package = __esm({
       devDependencies: {
         "@auto/protocol": "*",
         "@auto/schemas": "*",
+        "@stryker-mutator/core": "^9.6.1",
         "@types/react": "^19",
         tsup: "^8.5.1"
       }
@@ -18597,18 +18600,36 @@ var init_tokens = __esm({
 // src/lib/config/path.ts
 import { createHash } from "crypto";
 import { homedir as homedir2 } from "os";
-import { join, normalize } from "path";
+import { basename, dirname as dirname2, join, normalize } from "path";
 function defaultConfigPath() {
   return process.env.AUTO_CLI_CONFIG ?? join(homedir2(), ".auto", "config.yaml");
 }
+function isProfilePath(path2) {
+  return basename(dirname2(path2)) === PROFILES_DIR_NAME;
+}
 function profilesDir(configPath = defaultConfigPath()) {
+  if (isProfilePath(configPath)) return dirname2(configPath);
   return normalize(join(configPath, "..", PROFILES_DIR_NAME));
 }
-function profileFileName(input) {
+function profileFilePath(configPath, name) {
+  return join(profilesDir(configPath), `${name}.yaml`);
+}
+function profileNameFromPath(path2) {
+  return basename(path2).replace(/\.yaml$/, "");
+}
+function assertValidProfileName(name) {
+  if (!PROFILE_NAME_PATTERN.test(name)) {
+    throw new Error(
+      `Invalid profile name "${name}". Profile names use lowercase letters, digits, dots, dashes, and underscores.`
+    );
+  }
+  return name;
+}
+function derivedProfileName(input) {
   const key = `${input.userEmail.toLowerCase()}
 ${serverHost(input.serverUrl)}`;
   const hash2 = createHash("sha256").update(key).digest("hex").slice(0, 8);
-  return `${slug(input.userEmail)}--${slug(serverHost(input.serverUrl))}-${hash2}.yaml`;
+  return `${slug(input.userEmail)}--${slug(serverHost(input.serverUrl))}-${hash2}`;
 }
 function serverHost(serverUrl) {
   try {
@@ -18620,62 +18641,129 @@ function serverHost(serverUrl) {
 function slug(value) {
   return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "_");
 }
-var PROFILES_DIR_NAME;
+var PROFILES_DIR_NAME, PROFILE_NAME_PATTERN;
 var init_path = __esm({
   "src/lib/config/path.ts"() {
     "use strict";
     PROFILES_DIR_NAME = "profiles";
+    PROFILE_NAME_PATTERN = /^[a-z0-9._-]+$/;
   }
 });
 
 // src/lib/config/file.ts
 import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { basename, dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3 } from "path";
 function readConfig(path2 = defaultConfigPath()) {
+  const raw = readRawConfigFile(path2);
+  if (isProfilePath(path2) || !raw.currentProfile) return raw.config;
+  return readRawConfigFile(profileFilePath(path2, raw.currentProfile)).config;
+}
+function currentProfileName(path2 = defaultConfigPath()) {
+  if (isProfilePath(path2)) return profileNameFromPath(path2);
+  return readRawConfigFile(path2).currentProfile;
+}
+function writeConfig(config2, path2 = defaultConfigPath()) {
+  if (isProfilePath(path2)) {
+    writeConfigFile(config2, path2);
+    return;
+  }
+  const raw = readRawConfigFile(path2);
+  if (raw.currentProfile) {
+    const targetPath = profileFilePath(path2, raw.currentProfile);
+    const target = readRawConfigFile(targetPath).config;
+    if (hasAccountIdentity(config2) && !sameAccount(config2, target)) {
+      setCurrentProfile(saveProfile({ config: config2, configPath: path2 }), path2);
+      return;
+    }
+    writeConfigFile(config2, targetPath);
+    return;
+  }
+  if (hasAccountIdentity(config2)) {
+    setCurrentProfile(saveProfile({ config: config2, configPath: path2 }), path2);
+    return;
+  }
+  writeConfigFile(config2, path2);
+}
+function saveProfile(input) {
+  const configPath = input.configPath ?? defaultConfigPath();
+  const name = resolveProfileName(input);
+  writeConfigFile(input.config, profileFilePath(configPath, name));
+  return name;
+}
+function setCurrentProfile(name, path2 = defaultConfigPath()) {
+  if (isProfilePath(path2)) {
+    throw new Error(
+      "Cannot change the active profile while pinned to a profile."
+    );
+  }
+  writeFile2(`${CURRENT_PROFILE_KEY}: ${assertValidProfileName(name)}
+`, path2);
+}
+function clearCurrentProfile(path2 = defaultConfigPath()) {
+  if (isProfilePath(path2)) {
+    throw new Error(
+      "Cannot change the active profile while pinned to a profile."
+    );
+  }
+  writeFile2("", path2);
+}
+function resolveProfileName(input) {
+  if (input.name !== void 0) return assertValidProfileName(input.name);
+  if (!input.config.userEmail || !input.config.serverUrl) {
+    throw new Error(
+      "A profile name is required for a config without a signed-in account."
+    );
+  }
+  return derivedProfileName({
+    userEmail: input.config.userEmail,
+    serverUrl: input.config.serverUrl
+  });
+}
+function hasAccountIdentity(config2) {
+  return Boolean(config2.userEmail && config2.serverUrl);
+}
+function sameAccount(next, current) {
+  if (!current.userEmail) return true;
+  if (next.serverUrl !== current.serverUrl) return false;
+  if (next.userId && current.userId) return next.userId === current.userId;
+  return next.userEmail?.toLowerCase() === current.userEmail.toLowerCase();
+}
+function readRawConfigFile(path2) {
   try {
     const text = readFileSync2(path2, "utf8");
     const config2 = {};
+    let currentProfile;
     for (const line of text.split(/\r?\n/)) {
       const match = /^([A-Za-z0-9_]+):\s*(.*)$/.exec(line.trim());
       if (!match) continue;
+      if (match[1] === CURRENT_PROFILE_KEY) {
+        currentProfile = match[2] || void 0;
+        continue;
+      }
       const key = CONFIG_KEYS.find((candidate) => candidate === match[1]);
       if (key) config2[key] = match[2] ?? "";
     }
-    return config2;
+    return { config: config2, currentProfile };
   } catch (err) {
-    if (err.code === "ENOENT") return {};
+    if (err.code === "ENOENT") {
+      return { config: {} };
+    }
     throw err;
   }
 }
-function writeConfig(config2, path2 = defaultConfigPath()) {
-  writeConfigFile(config2, path2);
-  if (config2.userEmail && config2.serverUrl && basename(dirname2(path2)) !== PROFILES_DIR_NAME) {
-    writeConfigFile(
-      config2,
-      join2(
-        dirname2(path2),
-        PROFILES_DIR_NAME,
-        profileFileName({
-          userEmail: config2.userEmail,
-          serverUrl: config2.serverUrl
-        })
-      )
-    );
-  }
-}
 function writeConfigFile(config2, path2) {
-  mkdirSync2(dirname2(path2), { recursive: true });
   const lines = CONFIG_KEYS.filter((key) => config2[key]).map(
     (key) => `${key}: ${config2[key]}`
   );
-  writeFileSync2(path2, `${lines.join("\n")}
-`, {
-    encoding: "utf8",
-    mode: 384
-  });
+  writeFile2(`${lines.join("\n")}
+`, path2);
+}
+function writeFile2(content, path2) {
+  mkdirSync2(dirname3(path2), { recursive: true });
+  writeFileSync2(path2, content, { encoding: "utf8", mode: 384 });
   chmodSync(path2, 384);
 }
-var CONFIG_KEYS;
+var CONFIG_KEYS, CURRENT_PROFILE_KEY;
 var init_file = __esm({
   "src/lib/config/file.ts"() {
     "use strict";
@@ -18692,6 +18780,7 @@ var init_file = __esm({
       "accessTokenOrganizationId",
       "accessTokenProjectId"
     ];
+    CURRENT_PROFILE_KEY = "currentProfile";
   }
 });
 
@@ -21115,10 +21204,10 @@ import {
 } from "fs";
 import {
   basename as basename2,
-  dirname as dirname3,
+  dirname as dirname4,
   extname,
   isAbsolute,
-  join as join3,
+  join as join2,
   resolve
 } from "path";
 import { parseAllDocuments as parseYamlDocuments } from "yaml";
@@ -21134,7 +21223,7 @@ function readProjectApplyRequest(options) {
     );
     return { ...request, assets: assets2 };
   }
-  const directory = options.directory ?? join3(process.cwd(), ".auto");
+  const directory = options.directory ?? join2(process.cwd(), ".auto");
   const files = applyFiles(directory);
   if (files.length === 0) {
     throw new Error(`No resource files found in ${directory}`);
@@ -21197,7 +21286,7 @@ function applyFiles(root) {
   const files = [];
   for (const kind of APPLY_RESOURCE_ORDER) {
     const directory = APPLY_DIRECTORIES[kind];
-    const path2 = join3(root, directory);
+    const path2 = join2(root, directory);
     let entries;
     try {
       entries = readdirSync(path2, { withFileTypes: true });
@@ -21341,15 +21430,15 @@ function validateSessionAvatarAsset(input) {
 }
 function applyProjectRoot(directory) {
   const resolved = resolve(directory);
-  return basename2(resolved) === ".auto" ? dirname3(resolved) : resolved;
+  return basename2(resolved) === ".auto" ? dirname4(resolved) : resolved;
 }
 function applyFileProjectRoot(file2) {
-  let dir = dirname3(resolve(file2));
+  let dir = dirname4(resolve(file2));
   while (true) {
     if (basename2(dir) === ".auto") {
-      return dirname3(dir);
+      return dirname4(dir);
     }
-    const parent = dirname3(dir);
+    const parent = dirname4(dir);
     if (parent === dir) {
       return process.cwd();
     }
@@ -21383,7 +21472,7 @@ function isRecord(value) {
 function resourceApplyFiles(directory, entries) {
   const files = [];
   for (const entry of entries) {
-    const path2 = join3(directory, entry.name);
+    const path2 = join2(directory, entry.name);
     if (entry.isDirectory()) {
       files.push(
         ...resourceApplyFiles(path2, readdirSync(path2, { withFileTypes: true }))
@@ -21579,7 +21668,7 @@ var init_actions = __esm({
 
 // src/lib/config/profiles.ts
 import { readdirSync as readdirSync2 } from "fs";
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 function listProfiles(configPath = defaultConfigPath()) {
   const dir = profilesDir(configPath);
   let entries;
@@ -21590,8 +21679,12 @@ function listProfiles(configPath = defaultConfigPath()) {
     throw err;
   }
   return entries.filter((entry) => entry.endsWith(".yaml")).sort().map((entry) => {
-    const path2 = join4(dir, entry);
-    return { path: path2, config: readConfig(path2) };
+    const path2 = join3(dir, entry);
+    return {
+      name: profileNameFromPath(path2),
+      path: path2,
+      config: readConfig(path2)
+    };
   }).filter((profile) => profile.config.userEmail);
 }
 function findAccountProfile(input) {
@@ -21630,6 +21723,9 @@ var init_pkce = __esm({
 // src/commands/auth/login.ts
 async function login(input) {
   const style = input.style ?? plainStyle;
+  if (input.options.profile !== void 0) {
+    assertValidProfileName(input.options.profile);
+  }
   const serverUrl = resolveApiBaseUrl({ explicit: input.options.apiUrl });
   if (input.options.device) {
     const device = await postJson(
@@ -21673,6 +21769,7 @@ async function login(input) {
         serverUrl,
         fetch: input.fetch,
         configPath: input.configPath,
+        profileName: input.options.profile,
         writeOutput: input.writeOutput,
         style
       });
@@ -21718,6 +21815,7 @@ async function login(input) {
         serverUrl,
         fetch: input.fetch,
         configPath: input.configPath,
+        profileName: input.options.profile,
         writeOutput: input.writeOutput,
         style
       });
@@ -21738,6 +21836,7 @@ async function login(input) {
     serverUrl,
     fetch: input.fetch,
     configPath: input.configPath,
+    profileName: input.options.profile,
     writeOutput: input.writeOutput,
     style
   });
@@ -21805,13 +21904,28 @@ async function finishLogin(input) {
       );
     }
   }
-  writeConfig(config2, input.configPath);
+  persistLogin(config2, input);
   input.writeOutput(
     input.style.success(
       token2.user ? `Logged in as ${token2.user.email}.` : "Logged in."
     )
   );
 }
+function persistLogin(config2, input) {
+  if (!input.token.user) {
+    writeConfig(config2, input.configPath);
+    return;
+  }
+  const pinned = input.configPath !== void 0 && isProfilePath(input.configPath);
+  const name = saveProfile({
+    config: config2,
+    name: input.profileName ?? (pinned && input.configPath ? profileNameFromPath(input.configPath) : void 0),
+    configPath: input.configPath
+  });
+  if (!pinned) {
+    setCurrentProfile(name, input.configPath);
+  }
+}
 async function sleep(ms) {
   await new Promise((resolve2) => setTimeout(resolve2, ms));
 }
@@ -21823,6 +21937,7 @@ var init_login = __esm({
     init_tokens();
     init_browser();
     init_file();
+    init_path();
     init_profiles2();
     init_loopback();
     init_style();
@@ -21874,9 +21989,9 @@ var init_resources3 = __esm({
 
 // src/commands/edit/actions.ts
 import { spawn as spawn2 } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join5 } from "path";
+import { join as join4 } from "path";
 import { parseAllDocuments as parseYamlDocuments2, stringify as stringify2 } from "yaml";
 async function editResource(input) {
   const reference = parseProjectResourceReference(input.resource);
@@ -21891,8 +22006,8 @@ async function editResource(input) {
   const document = editableResourceDocument(reference.kind, current);
   const source = `${stringify2(document).trimEnd()}
 `;
-  const tempRoot = mkdtempSync(join5(tmpdir(), "auto-edit-"));
-  const filePath = join5(tempRoot, `${reference.kind}-${reference.name}.yaml`);
+  const tempRoot = mkdtempSync(join4(tmpdir(), "auto-edit-"));
+  const filePath = join4(tempRoot, `${reference.kind}-${reference.name}.yaml`);
   writeFileSync3(filePath, source, "utf8");
   let removeTempFile = false;
   try {
@@ -21929,7 +22044,7 @@ async function editResource(input) {
 Edited file retained at ${filePath}`);
   } finally {
     if (removeTempFile) {
-      rmSync(tempRoot, { recursive: true, force: true });
+      rmSync2(tempRoot, { recursive: true, force: true });
     }
   }
 }
@@ -26972,6 +27087,7 @@ async function launch(opts) {
   const apiClient = createApiClient({
     env: process.env,
     fetch,
+    configPath: opts.configPath,
     writeError: (e) => process.stderr.write(`${e}
 `)
   });
@@ -27164,6 +27280,7 @@ var init_launcher = __esm({
 });
 
 // src/cli/program.ts
+import { existsSync as existsSync4 } from "fs";
 import { Command, Option as Option3 } from "commander";
 
 // src/commands/agent-bridge/git-credentials.ts
@@ -29135,7 +29252,9 @@ init_base_url();
 init_login();
 
 // src/commands/auth/profile.ts
+import { existsSync as existsSync2, rmSync } from "fs";
 init_file();
+init_path();
 init_profiles2();
 async function handleAuthStatus(context) {
   const result = await fetchAuthStatus(context);
@@ -29161,43 +29280,58 @@ function logout(context) {
   );
   context.writeOutput(context.io.style.success("Logged out."));
 }
-function switchAccount(context, accountEmail, options = {}) {
+function listAccounts(context) {
   const profiles = listProfiles(context.configPath);
   if (profiles.length === 0) {
     throw new Error("No stored accounts. Run `auto auth login` first.");
   }
-  const active = readConfig(context.configPath);
-  if (!accountEmail) {
-    for (const profile of profiles) {
-      context.writeOutput(
-        accountLine(profile.config, active, context.io.style)
-      );
-    }
+  for (const profile of profiles) {
+    context.writeOutput(
+      accountLine(profile, activeProfileName(context), context.io.style)
+    );
+  }
+}
+function switchAccount(context, accountRef, options = {}) {
+  if (!accountRef) {
+    listAccounts(context);
     return;
   }
-  const matches = profiles.map((profile) => profile.config).filter(
-    (config2) => config2.userEmail?.toLowerCase() === accountEmail.toLowerCase() && (!options.server || config2.serverUrl === options.server)
+  if (context.pinnedProfile) {
+    throw new Error(
+      "Cannot switch the active account while pinned to a profile via --profile or AUTO_PROFILE."
+    );
+  }
+  const profiles = listProfiles(context.configPath);
+  if (profiles.length === 0) {
+    throw new Error("No stored accounts. Run `auto auth login` first.");
+  }
+  const byName = profiles.find((profile) => profile.name === accountRef);
+  const matches = byName ? [byName] : profiles.filter(
+    (profile) => profile.config.userEmail?.toLowerCase() === accountRef.toLowerCase() && (!options.server || profile.config.serverUrl === options.server)
   );
   if (matches.length === 0) {
     throw new Error(
-      `No stored account for ${accountEmail}. Run \`auto auth login\` to add it.`
+      `No stored account for ${accountRef}. Run \`auto auth login\` to add it.`
     );
   }
-  const match = matches.length === 1 ? matches[0] : matches.find((config2) => config2.serverUrl === active.serverUrl);
+  const active = readConfig(context.configPath);
+  const match = matches.length === 1 ? matches[0] : matches.find(
+    (profile) => profile.config.serverUrl === active.serverUrl
+  );
   if (!match) {
     throw new Error(
-      `Multiple servers have a stored account for ${accountEmail}: ${matches.map((config2) => config2.serverUrl).join(
+      `Multiple servers have a stored account for ${accountRef}: ${matches.map((profile) => profile.config.serverUrl).join(
         ", "
-      )}. Pick one with \`auto auth switch ${accountEmail} --server <url>\`.`
+      )}. Pick one with \`auto auth switch ${accountRef} --server <url>\`.`
     );
   }
-  writeConfig(match, context.configPath);
+  setCurrentProfile(match.name, context.configPath);
   context.writeOutput(
     context.io.style.success(
-      `Switched to ${match.userEmail} (${match.serverUrl}).`
+      `Switched to ${match.config.userEmail} (${match.config.serverUrl}).`
     )
   );
-  if (!match.refreshToken) {
+  if (!match.config.refreshToken) {
     context.writeOutput(
       context.io.style.warn(
         "This account has no stored credentials; run `auto auth login`."
@@ -29205,13 +29339,43 @@ function switchAccount(context, accountEmail, options = {}) {
     );
   }
 }
-function accountLine(config2, active, style) {
-  const isActive = Boolean(config2.userEmail) && config2.userEmail === active.userEmail && config2.serverUrl === active.serverUrl;
+function removeProfile(context, name) {
+  assertValidProfileName(name);
+  if (context.pinnedProfile === name) {
+    throw new Error(`Cannot remove profile "${name}" while pinned to it.`);
+  }
+  const configPath = context.configPath ?? defaultConfigPath();
+  const path2 = profileFilePath(configPath, name);
+  if (!existsSync2(path2)) {
+    const names = listProfiles(context.configPath).map(
+      (profile) => profile.name
+    );
+    throw new Error(
+      `No stored profile "${name}". Stored profiles: ${names.join(", ") || "(none)"}.`
+    );
+  }
+  if (currentProfileName(context.configPath) === name) {
+    clearCurrentProfile(context.configPath);
+  }
+  rmSync(path2);
+  context.writeOutput(context.io.style.success(`Removed profile "${name}".`));
+}
+function activeProfileName(context) {
+  const name = currentProfileName(context.configPath);
+  if (name) return name;
+  const active = readConfig(context.configPath);
+  if (!active.userEmail) return void 0;
+  return listProfiles(context.configPath).find(
+    (profile) => profile.config.userEmail === active.userEmail && profile.config.serverUrl === active.serverUrl
+  )?.name;
+}
+function accountLine(profile, activeName, style) {
   return [
-    config2.userEmail,
-    style.dim(`server=${config2.serverUrl ?? "(unset)"}`),
-    config2.refreshToken ? void 0 : style.warn("logged_out"),
-    isActive ? style.success("(active)") : void 0
+    profile.name,
+    profile.config.userEmail,
+    style.dim(`server=${profile.config.serverUrl ?? "(unset)"}`),
+    profile.config.refreshToken ? void 0 : style.warn("logged_out"),
+    profile.name === activeName ? style.success("(active)") : void 0
   ].filter(Boolean).join(" ");
 }
 async function fetchAuthStatus(context) {
@@ -29377,6 +29541,7 @@ function registerAuthCommands(program, context) {
     await login({
       options: {
         ...options,
+        profile: globalOptions.profile,
         apiUrl: resolveApiBaseUrl({
           explicit: [options.apiUrl, globalOptions.apiUrl],
           env: context.env
@@ -29399,11 +29564,13 @@ function registerAuthCommands(program, context) {
     await handleWhoami(context);
   });
   auth.command("logout").description("Remove the local user refresh token.").action(() => logout(context));
+  auth.command("list").description("List stored account profiles.").action(() => listAccounts(context));
   auth.command("switch").description(
     "Switch the active account to a stored profile, or list stored accounts."
-  ).argument("[email]", "Email of a stored account").option("--server <url>", "Auto web server URL of the stored account").action(
-    (email3, options) => switchAccount(context, email3, options)
+  ).argument("[account]", "Profile name or email of a stored account").option("--server <url>", "Auto web server URL of the stored account").action(
+    (account, options) => switchAccount(context, account, options)
   );
+  auth.command("remove").description("Remove a stored account profile.").argument("<name>", "Profile name to remove").action((name) => removeProfile(context, name));
 }
 
 // src/lib/stdio/readline.ts
@@ -32204,9 +32371,9 @@ function withApiBaseUrl2(context, commandOptions) {
 // src/commands/sessions/connect.ts
 init_resources2();
 init_browser();
-import { existsSync as existsSync2, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, mkdtempSync as mkdtempSync2, writeFileSync as writeFileSync4 } from "fs";
 import { homedir as homedir3, tmpdir as tmpdir2 } from "os";
-import { join as join6 } from "path";
+import { join as join5 } from "path";
 var POLL_INTERVAL_MS2 = 2e3;
 var POLL_TIMEOUT_MS2 = 5 * 6e4;
 var SLACK_APPS_URL = "https://api.slack.com/apps";
@@ -32377,7 +32544,7 @@ async function promptForIconUploads(input, options) {
   }
 }
 function stagedLocationLabel(stagedPath) {
-  return stagedPath.startsWith(`${join6(homedir3(), "Downloads")}/`) ? "Downloads" : "the printed path";
+  return stagedPath.startsWith(`${join5(homedir3(), "Downloads")}/`) ? "Downloads" : "the printed path";
 }
 async function stageAvatarImage(input) {
   try {
@@ -32389,9 +32556,9 @@ async function stageAvatarImage(input) {
     }
     const contentType = response.headers.get("content-type") ?? "";
     const extension = contentType.includes("jpeg") ? ".jpg" : ".png";
-    const downloads = join6(homedir3(), "Downloads");
-    const directory = existsSync2(downloads) ? downloads : mkdtempSync2(join6(tmpdir2(), "auto-avatar-"));
-    const path2 = join6(directory, `${input.session}-avatar${extension}`);
+    const downloads = join5(homedir3(), "Downloads");
+    const directory = existsSync3(downloads) ? downloads : mkdtempSync2(join5(tmpdir2(), "auto-avatar-"));
+    const path2 = join5(directory, `${input.session}-avatar${extension}`);
     writeFileSync4(path2, Buffer.from(await response.arrayBuffer()));
     return path2;
   } catch {
@@ -32534,6 +32701,10 @@ function registerToolCommands(program, context) {
   });
 }
 
+// src/cli/program.ts
+init_path();
+init_profiles2();
+
 // src/lib/output/iostreams.ts
 init_style();
 function createIOStreams(flags) {
@@ -32627,9 +32798,12 @@ function createProgram(options = {}) {
       "stream-json",
       "tui"
     ])
-  ).option("--no-color", "disable color output").option("--api-url <url>", "override API base URL");
+  ).option("--no-color", "disable color output").option("--api-url <url>", "override API base URL").option(
+    "--profile <name>",
+    "use this stored profile for the invocation (or set AUTO_PROFILE); for `auth login`, the profile name to store the login under"
+  );
   program.configureHelp({ showGlobalOptions: true });
-  program.hook("preAction", () => {
+  program.hook("preAction", (_thisCommand, actionCommand) => {
     if (!options.io) {
       const g = program.opts();
       context.io = createIOStreams({
@@ -32639,15 +32813,34 @@ function createProgram(options = {}) {
         writeError: options.writeError
       });
     }
+    const isLogin = actionCommand.name() === "login" && actionCommand.parent?.name() === "auth";
+    const flagPin = isLogin ? void 0 : program.opts().profile;
+    const pin = flagPin ?? context.env.AUTO_PROFILE;
+    if (pin && context.pinnedProfile !== pin) {
+      assertValidProfileName(pin);
+      const base = options.configPath ?? defaultConfigPath();
+      const pinnedPath = profileFilePath(base, pin);
+      if (!existsSync4(pinnedPath)) {
+        const names = listProfiles(base).map((profile) => profile.name);
+        throw new Error(
+          `No stored profile "${pin}". Stored profiles: ${names.join(", ") || "(none)"}.`
+        );
+      }
+      context.configPath = pinnedPath;
+      context.pinnedProfile = pin;
+    }
   });
   const launchTui = async () => {
     const g = program.opts();
     if (options.launchTui) {
-      await options.launchTui({ apiUrl: g.apiUrl });
+      await options.launchTui({
+        apiUrl: g.apiUrl,
+        configPath: context.configPath
+      });
       return;
     }
     const { launch: launch2 } = await Promise.resolve().then(() => (init_launcher(), launcher_exports));
-    await launch2({ apiUrl: g.apiUrl });
+    await launch2({ apiUrl: g.apiUrl, configPath: context.configPath });
     process.exit(0);
   };
   program.action(async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.106",
+  "version": "0.1.108",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"
@@ -24,6 +24,7 @@
     "dev:tui": "node ../../scripts/cli-tui-dev-watch.mjs",
     "skill:generate": "tsx scripts/generate-skill-content.ts",
     "test": "npm run test:unit",
+    "test:mutation": "stryker run",
     "test:unit": "tsx --test \"test/**/*.unit.test.ts\"",
     "typecheck": "tsc --noEmit"
   },
@@ -44,6 +45,7 @@
   "devDependencies": {
     "@auto/protocol": "*",
     "@auto/schemas": "*",
+    "@stryker-mutator/core": "^9.6.1",
     "@types/react": "^19",
     "tsup": "^8.5.1"
   }