@dosu/cli 0.33.0 → 0.33.2

package/bin/dosu.js

@@ -2097,9 +2097,96 @@ var init_commander = __esm(() => {
   program = new Command;
 });
 
+// src/config/identity.ts
+function getAccessTokenUserID(accessToken) {
+  try {
+    const payload = accessToken.split(".")[1];
+    if (!payload)
+      return;
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof decoded.sub === "string" && decoded.sub.length > 0 ? decoded.sub : undefined;
+  } catch {
+    return;
+  }
+}
+
+// src/config/schema.ts
+var MODE_OSS = "oss", CONFIG_SCHEMA_VERSION = 2;
+
+// src/config/config-v1-migration.ts
+function migrateLegacyConfig(value) {
+  if (!isRecord(value))
+    return { schema_version: CONFIG_SCHEMA_VERSION };
+  const accessToken = stringValue(value.access_token) ?? "";
+  const refreshToken = stringValue(value.refresh_token) ?? "";
+  const expiresAt = numberValue(value.expires_at) ?? 0;
+  const hasSession = Boolean(accessToken || refreshToken || expiresAt);
+  const userID = stringValue(value.user_id) ?? getAccessTokenUserID(accessToken);
+  return {
+    schema_version: CONFIG_SCHEMA_VERSION,
+    mode: value.mode === MODE_OSS ? MODE_OSS : undefined,
+    active_account: hasSession ? {
+      user_id: userID,
+      session: {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_at: expiresAt
+      },
+      target: userID ? legacyTarget(value) : undefined
+    } : undefined
+  };
+}
+function legacyTarget(value) {
+  const target = {
+    deployment_id: stringValue(value.deployment_id),
+    deployment_name: stringValue(value.deployment_name),
+    api_key: stringValue(value.api_key),
+    org_id: stringValue(value.org_id),
+    space_id: stringValue(value.space_id)
+  };
+  return Object.values(target).some((field) => field !== undefined) ? target : undefined;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+var init_config_v1_migration = () => {};
+
 // src/config/config.ts
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+function getConfigUserID(cfg) {
+  return cfg.active_account?.user_id ?? getAccessTokenUserID(cfg.active_account?.session.access_token ?? "");
+}
+function replaceLoginSession(cfg, session) {
+  const previousUserID = getConfigUserID(cfg);
+  const nextUserID = session.user_id ?? getAccessTokenUserID(session.access_token);
+  const preserveTarget = Boolean(previousUserID && nextUserID && previousUserID === nextUserID);
+  cfg.active_account = {
+    user_id: nextUserID,
+    session: sessionWithoutIdentity(session),
+    target: preserveTarget ? cloneTarget(cfg.active_account?.target) : undefined
+  };
+}
+function bindAccountIdentity(cfg, userID) {
+  const account = cfg.active_account;
+  if (!account)
+    throw new Error("cannot bind an identity without an authenticated session");
+  if (account.user_id && account.user_id !== userID)
+    account.target = undefined;
+  account.user_id = userID;
+}
+function updateTarget(cfg, target) {
+  if (!cfg.active_account?.user_id) {
+    throw new Error("cannot bind a target without a verified account identity");
+  }
+  cfg.active_account.target = { ...cfg.active_account.target, ...target };
+}
 function getConfigDir() {
   const dirName = process.env.DOSU_DEV === "true" ? "dosu-cli-dev" : "dosu-cli";
   const xdgConfig = process.env.XDG_CONFIG_HOME;
@@ -2117,43 +2204,113 @@ function getConfigPath() {
 }
 function loadConfig() {
   const path2 = getConfigPath();
-  if (!existsSync(path2)) {
+  if (!existsSync(path2))
     return emptyConfig();
-  }
+  let raw;
   try {
-    const data = readFileSync(path2, "utf-8");
-    return JSON.parse(data);
+    raw = JSON.parse(readFileSync(path2, "utf-8"));
   } catch {
     return emptyConfig();
   }
+  if (isConfigV2(raw))
+    return normalizeV2(raw);
+  if (isRecord2(raw) && "schema_version" in raw)
+    return emptyConfig();
+  const migrated = migrateLegacyConfig(raw);
+  try {
+    writeConfig(path2, migrated);
+  } catch {}
+  return migrated;
 }
 function saveConfig(cfg) {
-  const path2 = getConfigPath();
-  const dir = getConfigDir();
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true, mode: 448 });
-  }
-  const tmp = `${path2}.${process.pid}.tmp`;
-  writeFileSync(tmp, JSON.stringify(cfg, null, 2), { mode: 384 });
-  renameSync(tmp, path2);
+  writeConfig(getConfigPath(), cfg);
 }
 function isAuthenticated(cfg) {
-  return cfg.access_token !== "";
+  return Boolean(cfg.active_account?.session.access_token);
 }
 function isTokenExpired(cfg) {
-  if (cfg.expires_at === 0)
+  const expiresAt = cfg.active_account?.session.expires_at ?? 0;
+  if (expiresAt === 0)
     return false;
-  return Math.floor(Date.now() / 1000) > cfg.expires_at - 300;
+  return Math.floor(Date.now() / 1000) > expiresAt - 300;
+}
+function clearConfigInPlace(cfg) {
+  cfg.mode = undefined;
+  cfg.active_account = undefined;
 }
 function emptyConfig() {
+  return { schema_version: CONFIG_SCHEMA_VERSION };
+}
+function sessionWithoutIdentity(session) {
   return {
-    access_token: "",
-    refresh_token: "",
-    expires_at: 0
+    access_token: session.access_token,
+    refresh_token: session.refresh_token,
+    expires_at: session.expires_at
   };
 }
-var MODE_OSS = "oss";
-var init_config = () => {};
+function cloneTarget(target) {
+  return target ? { ...target } : undefined;
+}
+function isConfigV2(value) {
+  return isRecord2(value) && value.schema_version === CONFIG_SCHEMA_VERSION;
+}
+function normalizeV2(value) {
+  const active = isRecord2(value.active_account) ? value.active_account : undefined;
+  const session = active && isRecord2(active.session) ? active.session : undefined;
+  if (!active || !session) {
+    return {
+      schema_version: CONFIG_SCHEMA_VERSION,
+      mode: value.mode === MODE_OSS ? MODE_OSS : undefined
+    };
+  }
+  const accessToken = stringValue2(session.access_token) ?? "";
+  const userID = stringValue2(active.user_id) ?? getAccessTokenUserID(accessToken);
+  return {
+    schema_version: CONFIG_SCHEMA_VERSION,
+    mode: value.mode === MODE_OSS ? MODE_OSS : undefined,
+    active_account: {
+      user_id: userID,
+      session: {
+        access_token: accessToken,
+        refresh_token: stringValue2(session.refresh_token) ?? "",
+        expires_at: numberValue2(session.expires_at) ?? 0
+      },
+      target: userID ? normalizeTarget(active.target) : undefined
+    }
+  };
+}
+function normalizeTarget(value) {
+  if (!isRecord2(value))
+    return;
+  const target = {
+    deployment_id: stringValue2(value.deployment_id),
+    deployment_name: stringValue2(value.deployment_name),
+    api_key: stringValue2(value.api_key),
+    org_id: stringValue2(value.org_id),
+    space_id: stringValue2(value.space_id)
+  };
+  return Object.values(target).some((field) => field !== undefined) ? target : undefined;
+}
+function writeConfig(path2, config) {
+  const dir = getConfigDir();
+  if (!existsSync(dir))
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmp = `${path2}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(config, null, 2), { mode: 384 });
+  renameSync(tmp, path2);
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue2(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function numberValue2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+var init_config = __esm(() => {
+  init_config_v1_migration();
+});
 
 // src/config/constants.ts
 function getWebAppURL() {
@@ -2208,7 +2365,7 @@ class Client {
     const url = this.baseURL + path2;
     const headers = {
       "Content-Type": "application/json",
-      "Supabase-Access-Token": this.config.access_token
+      "Supabase-Access-Token": this.config.active_account?.session.access_token ?? ""
     };
     const options = { method, headers };
     if (body !== undefined) {
@@ -2242,13 +2399,13 @@ class Client {
     return this.apiKeyRequest("POST", path2, body);
   }
   async apiKeyRequest(method, path2, body) {
-    if (!this.config.api_key) {
+    if (!this.config.active_account?.target?.api_key) {
       throw new Error("no API key available");
     }
     const url = this.baseURL + path2;
     const headers = {
       "Content-Type": "application/json",
-      "X-Dosu-API-Key": this.config.api_key
+      "X-Dosu-API-Key": this.config.active_account?.target?.api_key
     };
     const options = { method, headers };
     if (body !== undefined) {
@@ -2265,7 +2422,7 @@ class Client {
   }
   async refreshToken() {
     this.adoptNewerDiskTokens();
-    if (!this.config.refresh_token) {
+    if (!this.config.active_account?.session.refresh_token) {
       throw new Error("no refresh token available");
     }
     try {
@@ -2279,15 +2436,21 @@ class Client {
   }
   adoptNewerDiskTokens() {
     const disk = loadConfig();
-    if (!disk.refresh_token || disk.refresh_token === this.config.refresh_token) {
+    this.assertSameActiveAccount(disk);
+    const diskSession = disk.active_account?.session;
+    const memorySession = this.config.active_account?.session;
+    if (!diskSession?.refresh_token || !memorySession || diskSession.refresh_token === memorySession.refresh_token) {
       return false;
     }
-    this.config.access_token = disk.access_token;
-    this.config.refresh_token = disk.refresh_token;
-    this.config.expires_at = disk.expires_at;
+    memorySession.access_token = diskSession.access_token;
+    memorySession.refresh_token = diskSession.refresh_token;
+    memorySession.expires_at = diskSession.expires_at;
     return true;
   }
   async refreshTokenOnce() {
+    const session = this.config.active_account?.session;
+    if (!session?.refresh_token)
+      throw new Error("no refresh token available");
     const supabaseURL = getSupabaseURL();
     const endpoint = `${supabaseURL}/auth/v1/token?grant_type=refresh_token`;
     const resp = await fetch(endpoint, {
@@ -2296,17 +2459,25 @@ class Client {
         "Content-Type": "application/json",
         apikey: getSupabaseAnonKey()
       },
-      body: JSON.stringify({ refresh_token: this.config.refresh_token })
+      body: JSON.stringify({ refresh_token: session.refresh_token })
     });
     if (resp.status !== 200) {
       throw new Error(`refresh failed with status ${resp.status}`);
     }
     const data = await resp.json();
-    this.config.access_token = data.access_token;
-    this.config.refresh_token = data.refresh_token;
-    this.config.expires_at = Math.floor(Date.now() / 1000) + data.expires_in;
+    this.assertSameActiveAccount(loadConfig());
+    session.access_token = data.access_token;
+    session.refresh_token = data.refresh_token;
+    session.expires_at = Math.floor(Date.now() / 1000) + data.expires_in;
     saveConfig(this.config);
   }
+  assertSameActiveAccount(disk) {
+    const memoryUserID = getConfigUserID(this.config);
+    const diskUserID = getConfigUserID(disk);
+    if (memoryUserID && diskUserID && memoryUserID !== diskUserID) {
+      throw new Error("authenticated account changed while this command was running; retry it");
+    }
+  }
   async getDeployments() {
     const resp = await this.get("/v1/mcp/deployments");
     if (resp.status !== 200) {
@@ -4577,7 +4748,7 @@ var init_dist4 = __esm(() => {
 function getVersionString() {
   return `v${VERSION}`;
 }
-var VERSION = "0.33.0", INSTALL_CHANNEL = "npm";
+var VERSION = "0.33.2", INSTALL_CHANNEL = "npm";
 
 // src/debug/logger.ts
 import {
@@ -4723,7 +4894,7 @@ function createTypedClient(config) {
   if (!webAppURL) {
     throw new Error("Web app URL not configured");
   }
-  if (!config.access_token) {
+  if (!config.active_account?.session.access_token) {
     throw new Error("Not authenticated. Run 'dosu login' first.");
   }
   const httpClient = new Client(config);
@@ -4742,7 +4913,7 @@ function createTypedClient(config) {
             }
           }
           return {
-            "Supabase-Access-Token": config.access_token,
+            "Supabase-Access-Token": config.active_account?.session.access_token ?? "",
             "x-dosu-cli-contract": CLI_CONTRACT_HASH
           };
         },
@@ -4759,7 +4930,7 @@ function createTypedClient(config) {
               ...options,
               headers: {
                 ...options?.headers,
-                "Supabase-Access-Token": config.access_token,
+                "Supabase-Access-Token": config.active_account?.session.access_token ?? "",
                 "x-dosu-cli-contract": CLI_CONTRACT_HASH
               }
             });
@@ -7853,12 +8024,12 @@ async function deleteOrphanDeployment(trpc, deploymentID, slug) {
 }
 async function stepConnectGitHubRepo(cfg, detected = detectGitRepo(), opts = {}) {
   logger.info("setup", "Step: connect GitHub repo(s)");
-  if (!cfg.org_id || !cfg.space_id) {
+  if (!cfg.active_account?.target?.org_id || !cfg.active_account?.target?.space_id) {
     log.warn("Cannot connect GitHub: your Dosu workspace is missing org/space context. Re-run `dosu setup` from a fresh state.");
     return { advance: false, has_connected_repo: false };
   }
-  const orgID = cfg.org_id;
-  const spaceID = cfg.space_id;
+  const orgID = cfg.active_account?.target?.org_id;
+  const spaceID = cfg.active_account?.target?.space_id;
   if (detected) {
     log.info(`Connecting GitHub repos (detected local repo: ${detected.slug})`);
   }
@@ -7962,7 +8133,7 @@ ${dim(`deployment ${deployment_id}`)}`);
       advance: true,
       has_connected_repo: true,
       deployment_id: primary.deployment_id,
-      space_id: cfg.space_id,
+      space_id: cfg.active_account?.target?.space_id,
       created_data_source_ids: survived.map((c3) => c3.data_source_id),
       created_repository_slugs: survived.map((c3) => c3.slug)
     };
@@ -9095,10 +9266,10 @@ async function buildInsights({
   now = () => new Date,
   onProgress
 }) {
-  if (!cfg.space_id) {
+  if (!cfg.active_account?.target?.space_id) {
     throw new Error("space_id missing. Run 'dosu setup' first");
   }
-  const spaceId = cfg.space_id;
+  const spaceId = cfg.active_account?.target?.space_id;
   onProgress?.("stats");
   const [currentRaw, combinedRaw] = await Promise.all([
     client.analytics.getUsageStats.query({ spaceId, days: windowDays }),
@@ -9117,7 +9288,7 @@ async function buildInsights({
   return {
     generatedAt: now().toISOString(),
     windowDays,
-    spaceName: cfg.deployment_name ?? "your space",
+    spaceName: cfg.active_account?.target?.deployment_name ?? "your space",
     current,
     previous,
     derived,
@@ -10389,13 +10560,13 @@ var init_detect = () => {};
 function createJSONProvider(opts) {
   const defaultBuildServer = (cfg) => ({
     type: "http",
-    url: mcpURL(cfg.deployment_id),
-    headers: mcpHeaders(cfg.api_key)
+    url: mcpURL(cfg.active_account.target.deployment_id),
+    headers: mcpHeaders(cfg.active_account?.target?.api_key)
   });
   const defaultBuildOSSServer = (cfg) => ({
     type: "http",
     url: mcpBaseURL(),
-    headers: mcpHeaders(cfg.api_key)
+    headers: mcpHeaders(cfg.active_account?.target?.api_key)
   });
   const buildServer = opts.buildServer ?? defaultBuildServer;
   return {
@@ -10408,7 +10579,7 @@ function createJSONProvider(opts) {
     globalConfigPath: () => expandHome(opts.globalPath),
     isConfigured: () => isJSONKeyConfigured(expandHome(opts.globalPath), opts.topKey),
     install(cfg, global) {
-      if (cfg.mode !== MODE_OSS && !cfg.deployment_id)
+      if (cfg.mode !== MODE_OSS && !cfg.active_account?.target?.deployment_id)
         throw new Error("deployment ID is required");
       let configPath;
       if (global) {
@@ -10450,8 +10621,8 @@ var AntigravityProvider = () => createJSONProvider({
   globalPath: "~/.gemini/antigravity/mcp_config.json",
   topKey: "mcpServers",
   buildServer: (cfg) => ({
-    serverUrl: mcpURL(cfg.deployment_id),
-    headers: mcpHeaders(cfg.api_key)
+    serverUrl: mcpURL(cfg.active_account.target.deployment_id),
+    headers: mcpHeaders(cfg.active_account.target.api_key)
   })
 });
 var init_antigravity = __esm(() => {
@@ -10508,10 +10679,10 @@ var extensionDir = () => join14(appSupportDir(), "Code", "User", "globalStorage"
   globalPath: join14(extensionDir(), "settings", "cline_mcp_settings.json"),
   topKey: "mcpServers",
   buildServer: (cfg) => ({
-    url: mcpURL(cfg.deployment_id),
+    url: mcpURL(cfg.active_account.target.deployment_id),
     type: "streamableHttp",
     disabled: false,
-    headers: mcpHeaders(cfg.api_key)
+    headers: mcpHeaders(cfg.active_account.target.api_key)
   })
 });
 var init_cline = __esm(() => {
@@ -10534,10 +10705,10 @@ var ClineCliProvider = () => createJSONProvider({
   globalPath: join15(clineDir(), "data", "settings", "cline_mcp_settings.json"),
   topKey: "mcpServers",
   buildServer: (cfg) => ({
-    url: mcpURL(cfg.deployment_id),
+    url: mcpURL(cfg.active_account.target.deployment_id),
     type: "streamableHttp",
     disabled: false,
-    headers: mcpHeaders(cfg.api_key)
+    headers: mcpHeaders(cfg.active_account.target.api_key)
   })
 });
 var init_cline_cli = __esm(() => {
@@ -10568,15 +10739,15 @@ function writeTOML(path3, content) {
 function mcpEndpoint(cfg) {
   if (cfg.mode === MODE_OSS)
     return mcpBaseURL();
-  if (!cfg.deployment_id)
+  if (!cfg.active_account?.target?.deployment_id)
     throw new Error("deployment ID is required");
-  return mcpURL(cfg.deployment_id);
+  return mcpURL(cfg.active_account?.target?.deployment_id);
 }
 function installDosuToTOML(path3, cfg) {
   let content = readTOML(path3);
   content = removeDosuFromTOML(content);
   const url = mcpEndpoint(cfg);
-  const headers = mcpHeaders(cfg.api_key);
+  const headers = mcpHeaders(cfg.active_account?.target?.api_key);
   const headerEntries = Object.entries(headers).map(([k, v]) => `${k} = "${v}"`).join(`
 `);
   const section = `
@@ -10624,7 +10795,7 @@ var CodexProvider = () => ({
     return content.includes("[mcp_servers.dosu]");
   },
   install(cfg, global) {
-    if (cfg.mode !== MODE_OSS && !cfg.deployment_id)
+    if (cfg.mode !== MODE_OSS && !cfg.active_account?.target?.deployment_id)
       throw new Error("deployment ID is required");
     installDosuToTOML(getConfigPath2(global), cfg);
   },
@@ -10652,9 +10823,9 @@ function globalPath() {
 function mcpEndpoint2(cfg) {
   if (cfg.mode === MODE_OSS)
     return mcpBaseURL();
-  if (!cfg.deployment_id)
+  if (!cfg.active_account?.target?.deployment_id)
     throw new Error("deployment ID is required");
-  return mcpURL(cfg.deployment_id);
+  return mcpURL(cfg.active_account?.target?.deployment_id);
 }
 var CopilotProvider = () => ({
   name: () => "GitHub Copilot CLI",
@@ -10672,7 +10843,7 @@ var CopilotProvider = () => ({
         type: "http",
         url,
         tools: ["*"],
-        headers: mcpHeaders(cfg.api_key)
+        headers: mcpHeaders(cfg.active_account.target.api_key)
       };
       installJSONServer(globalPath(), "mcpServers", server);
     } else {
@@ -10680,7 +10851,7 @@ var CopilotProvider = () => ({
       const server = {
         type: "http",
         url,
-        headers: mcpHeaders(cfg.api_key)
+        headers: mcpHeaders(cfg.active_account.target.api_key)
       };
       installJSONServer(configPath, "servers", server);
     }
@@ -10711,8 +10882,8 @@ var CursorProvider = () => createJSONProvider({
   globalPath: "~/.cursor/mcp.json",
   topKey: "mcpServers",
   buildServer: (cfg) => ({
-    url: mcpURL(cfg.deployment_id),
-    headers: mcpHeaders(cfg.api_key)
+    url: mcpURL(cfg.active_account.target.deployment_id),
+    headers: mcpHeaders(cfg.active_account.target.api_key)
   }),
   localConfigPath: (cwd) => join18(cwd, ".cursor", "mcp.json")
 });
@@ -10757,9 +10928,9 @@ var init_gemini = __esm(() => {
 function mcpEndpoint3(cfg) {
   if (cfg.mode === MODE_OSS)
     return mcpBaseURL();
-  if (!cfg.deployment_id)
+  if (!cfg.active_account?.target?.deployment_id)
     throw new Error("deployment ID is required");
-  return mcpURL(cfg.deployment_id);
+  return mcpURL(cfg.active_account?.target?.deployment_id);
 }
 function maskSecret(secret) {
   if (secret.length <= 8)
@@ -10773,7 +10944,7 @@ var ManualProvider = () => ({
   supportsLocal: () => false,
   install(cfg, _global, opts = {}) {
     const url = mcpEndpoint3(cfg);
-    const apiKey = mcpHeaders(cfg.api_key)["X-Dosu-API-Key"];
+    const apiKey = mcpHeaders(cfg.active_account?.target?.api_key)["X-Dosu-API-Key"];
     const headerValue = opts.showSecret ? apiKey : maskSecret(apiKey);
     console.log("Use these details to configure the Dosu MCP server in your client:");
     console.log();
@@ -10811,9 +10982,9 @@ function resolveGlobalConfigPath() {
 function mcpEndpoint4(cfg) {
   if (cfg.mode === MODE_OSS)
     return mcpBaseURL();
-  if (!cfg.deployment_id)
+  if (!cfg.active_account?.target?.deployment_id)
     throw new Error("deployment ID is required");
-  return mcpURL(cfg.deployment_id);
+  return mcpURL(cfg.active_account?.target?.deployment_id);
 }
 var MCPorterProvider = () => ({
   name: () => "MCPorter",
@@ -10829,7 +11000,7 @@ var MCPorterProvider = () => ({
     const server = {
       type: "http",
       url: mcpEndpoint4(cfg),
-      headers: mcpHeaders(cfg.api_key)
+      headers: mcpHeaders(cfg.active_account.target.api_key)
     };
     installJSONServer(configPath, "mcpServers", server);
   },
@@ -10856,9 +11027,9 @@ var OpenCodeProvider = () => createJSONProvider({
   topKey: "mcp",
   buildServer: (cfg) => ({
     type: "remote",
-    url: mcpURL(cfg.deployment_id),
+    url: mcpURL(cfg.active_account.target.deployment_id),
     enabled: true,
-    headers: mcpHeaders(cfg.api_key)
+    headers: mcpHeaders(cfg.active_account.target.api_key)
   }),
   localConfigPath: (cwd) => join22(cwd, "opencode.json")
 });
@@ -10920,8 +11091,8 @@ var ZedProvider = () => createJSONProvider({
   buildServer: (cfg) => ({
     source: "custom",
     type: "http",
-    url: mcpURL(cfg.deployment_id),
-    headers: mcpHeaders(cfg.api_key)
+    url: mcpURL(cfg.active_account.target.deployment_id),
+    headers: mcpHeaders(cfg.active_account.target.api_key)
   }),
   localConfigPath: (cwd) => join25(cwd, ".zed", "settings.json")
 });
@@ -11137,7 +11308,7 @@ var init_agents_md_step = __esm(() => {
 
 // src/setup/analytics.ts
 async function trackCliOnboardingEvent(cfg, onboardingRunID, event, properties = {}) {
-  if (!cfg.access_token)
+  if (!cfg.active_account?.session.access_token)
     return;
   try {
     const trpc = createTypedClient(cfg);
@@ -11161,7 +11332,7 @@ async function trackCliOnboardingPreAuthEvent(onboardingRunID, event, properties
       event,
       onboarding_run_id: onboardingRunID,
       properties: {
-        ...baseProperties({ access_token: "", refresh_token: "", expires_at: 0 }),
+        ...baseProperties(emptyConfig()),
         ...properties
       }
     }), TRACKING_TIMEOUT_MS);
@@ -11176,9 +11347,9 @@ function baseProperties(cfg) {
     platform: process.platform,
     arch: process.arch,
     mode: cfg.mode ?? "cloud",
-    org_id: cfg.org_id,
-    deployment_id: cfg.deployment_id,
-    space_id: cfg.space_id
+    org_id: cfg.active_account?.target?.org_id,
+    deployment_id: cfg.active_account?.target?.deployment_id,
+    space_id: cfg.active_account?.target?.space_id
   };
 }
 function createAnonymousClient() {
@@ -11217,6 +11388,7 @@ var init_analytics = __esm(() => {
   init_dist();
   init_dist4();
   init_trpc();
+  init_config();
   init_logger();
 });
 
@@ -11748,7 +11920,7 @@ async function runSetup(opts = {}) {
     authTab?.close();
   };
   await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_auth_completed");
-  const apiClient = new Client(cfg);
+  let apiClient = new Client(cfg);
   let cloudSetupContext = null;
   if (cfg.mode !== MODE_OSS) {
     const s = spinner();
@@ -11779,14 +11951,16 @@ async function runSetup(opts = {}) {
       });
       return;
     }
-    const ok = await bindOnboardingDeployment(apiClient, cfg, cloudSetupContext.targetOrg ?? null);
+    apiClient = new Client(cfg);
+    const targetOrg = await resolveCurrentOnboardingTargetOrg(cfg);
+    const ok = await bindOnboardingDeployment(apiClient, cfg, targetOrg);
     if (!ok) {
       await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
         reason: "onboarding_deployment_failed"
       });
       return;
     }
-  } else if (!cfg.deployment_id || opts.deploymentID) {
+  } else if (!cfg.active_account?.target?.deployment_id || opts.deploymentID) {
     const ok = await resolveDeployment(apiClient, cfg, opts);
     if (!ok) {
       await trackCliOnboardingEvent(cfg, onboardingRunID, "cli_onboarding_failed", {
@@ -11802,7 +11976,7 @@ async function runSetup(opts = {}) {
     });
     return;
   }
-  cfg.api_key = apiKey;
+  updateTarget(cfg, { api_key: apiKey });
   saveConfig(cfg);
   const choices = await stepOneShotConfirm(inGitWorkTree());
   if (!choices) {
@@ -11868,10 +12042,12 @@ async function runSetup(opts = {}) {
   }
 }
 function applyDeployment(cfg, d) {
-  cfg.deployment_id = d.deployment_id;
-  cfg.deployment_name = d.name;
-  cfg.org_id = d.org_id;
-  cfg.space_id = d.space_id;
+  updateTarget(cfg, {
+    deployment_id: d.deployment_id,
+    deployment_name: d.name,
+    org_id: d.org_id,
+    space_id: d.space_id
+  });
 }
 function applyModeOverride(cfg, opts) {
   if (!opts.mode)
@@ -11944,7 +12120,7 @@ async function runInstallSkill() {
 async function stepAuthenticate(existingCfg, onboardingRunID) {
   logger.info("setup", "Step: authenticate");
   const cfg = existingCfg ?? loadConfig();
-  if (cfg.access_token) {
+  if (cfg.active_account?.session.access_token) {
     const s = spinner();
     s.start("Verifying session...");
     try {
@@ -11995,9 +12171,11 @@ async function openBrowserForSetup(cfg, onboardingRunID) {
     const token = result.token;
     s.stop("Authenticated");
     logger.info("setup", "Browser auth completed");
-    cfg.access_token = token.access_token;
-    cfg.refresh_token = token.refresh_token;
-    cfg.expires_at = Math.floor(Date.now() / 1000) + token.expires_in;
+    replaceLoginSession(cfg, {
+      access_token: token.access_token,
+      refresh_token: token.refresh_token,
+      expires_at: Math.floor(Date.now() / 1000) + token.expires_in
+    });
     saveConfig(cfg);
     return { cfg, authTab: result.server };
   } catch (err) {
@@ -12042,9 +12220,11 @@ async function stepWebOnboarding(cfg, onboardingRunID, authTab) {
       s.stop("Could not open a browser");
       return false;
     }
-    cfg.access_token = result.token.access_token;
-    cfg.refresh_token = result.token.refresh_token;
-    cfg.expires_at = Math.floor(Date.now() / 1000) + result.token.expires_in;
+    replaceLoginSession(cfg, {
+      access_token: result.token.access_token,
+      refresh_token: result.token.refresh_token,
+      expires_at: Math.floor(Date.now() / 1000) + result.token.expires_in
+    });
     saveConfig(cfg);
     s.stop("Onboarding finished in the browser");
     logger.info("setup", "Web onboarding handoff completed");
@@ -12068,6 +12248,8 @@ async function resolveCloudSetupContext(cfg) {
       log.error("Could not load your profile.");
       return null;
     }
+    bindAccountIdentity(cfg, profile.user_id);
+    saveConfig(cfg);
     if (profile.finished_onboarding === true) {
       return {
         kind: "setup",
@@ -12100,6 +12282,23 @@ async function resolveOnboardingTargetOrg(trpc) {
   }
   return accessibleOrgs[0] ?? null;
 }
+async function resolveCurrentOnboardingTargetOrg(cfg) {
+  try {
+    const { createTypedClient: createTypedClient2 } = await Promise.resolve().then(() => (init_trpc(), exports_trpc));
+    const trpc = createTypedClient2(cfg);
+    const profile = await trpc.user.getCliOnboardingContext.query();
+    if (!profile?.user_id)
+      return null;
+    bindAccountIdentity(cfg, profile.user_id);
+    saveConfig(cfg);
+    return await resolveOnboardingTargetOrg(trpc);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logger.error("setup", `Failed to resolve post-onboarding organization: ${msg}`);
+    log.error(`Could not determine your onboarding organization: ${msg}`);
+    return null;
+  }
+}
 async function bindOnboardingDeployment(apiClient, cfg, targetOrg) {
   if (!targetOrg) {
     log.error("Could not determine your onboarding organization.");
@@ -12235,22 +12434,24 @@ ${dim(deployments[0].name)}`);
   }
 }
 async function stepMintAPIKey(apiClient, cfg) {
-  if (!cfg.deployment_id) {
+  const target = cfg.active_account?.target;
+  const deploymentID = target?.deployment_id;
+  if (!deploymentID) {
     log.error("No MCP available for API key creation");
     return null;
   }
-  if (cfg.api_key) {
-    const valid = await apiClient.validateAPIKey(cfg.api_key, cfg.deployment_id);
+  if (target.api_key) {
+    const valid = await apiClient.validateAPIKey(target.api_key, deploymentID);
     logger.debug("setup", `Existing API key valid=${valid}`);
     if (valid) {
       log.success(`API key
 ${dim("using existing")}`);
-      return cfg.api_key;
+      return target.api_key;
     }
     log.warn("Existing API key is invalid, creating a new one...");
   }
   try {
-    const resp = await apiClient.createAPIKey(cfg.deployment_id, "dosu-cli");
+    const resp = await apiClient.createAPIKey(deploymentID, "dosu-cli");
     logger.info("setup", "API key created");
     log.success(`API key
 ${dim("created")}`);
@@ -12416,13 +12617,13 @@ function createDotsSpinner() {
   };
 }
 function isFullConfig(cfg) {
-  return Boolean(cfg.access_token && cfg.api_key && cfg.space_id && cfg.deployment_id);
+  return Boolean(cfg.active_account?.session.access_token && cfg.active_account?.target?.api_key && cfg.active_account?.target?.space_id && cfg.active_account?.target?.deployment_id);
 }
 async function ensureFullConfig() {
   let cfg = loadConfig();
   if (isFullConfig(cfg))
     return cfg;
-  const reason = !cfg.access_token ? "Insights needs you to log in first." : "Insights needs a configured Dosu deployment.";
+  const reason = !cfg.active_account?.session.access_token ? "Insights needs you to log in first." : "Insights needs a configured Dosu deployment.";
   log.warn(reason);
   const shouldSetup = await confirm({
     message: "Run setup now?",
@@ -12448,10 +12649,10 @@ function makeAskFn(cfg) {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "X-Dosu-API-Key": cfg.api_key
+          "X-Dosu-API-Key": cfg.active_account.target.api_key
         },
         body: JSON.stringify({
-          deployment_id: cfg.deployment_id,
+          deployment_id: cfg.active_account.target.deployment_id,
           question
         }),
         signal: controller.signal
@@ -12640,7 +12841,7 @@ async function runTUI() {
   console.log(import_picocolors25.default.magenta(LOGO));
   const cfg = loadConfig();
   while (true) {
-    const insightsReady = Boolean(cfg.space_id && cfg.deployment_id && cfg.api_key);
+    const insightsReady = Boolean(cfg.active_account?.target?.space_id && cfg.active_account?.target?.deployment_id && cfg.active_account?.target?.api_key);
     const options = [
       {
         label: "Setup",
@@ -12673,7 +12874,11 @@ async function runTUI() {
         break;
       case "setup":
         await runSetup();
-        Object.assign(cfg, loadConfig());
+        {
+          const fresh = loadConfig();
+          cfg.mode = fresh.mode;
+          cfg.active_account = fresh.active_account;
+        }
         break;
       case "insights":
         await executeInsights(cfg);
@@ -12686,7 +12891,7 @@ async function runTUI() {
   outro("Goodbye!");
 }
 async function handleAuthenticate(cfg) {
-  if (cfg.access_token) {
+  if (cfg.active_account?.session.access_token) {
     const s = spinner();
     s.start("Verifying session...");
     try {
@@ -12723,9 +12928,11 @@ async function handleAuthenticate(cfg) {
     }
     const token = result.token;
     s.stop("Authenticated");
-    cfg.access_token = token.access_token;
-    cfg.refresh_token = token.refresh_token;
-    cfg.expires_at = Math.floor(Date.now() / 1000) + token.expires_in;
+    replaceLoginSession(cfg, {
+      access_token: token.access_token,
+      refresh_token: token.refresh_token,
+      expires_at: Math.floor(Date.now() / 1000) + token.expires_in
+    });
     saveConfig(cfg);
   } catch (err) {
     const { OAuthCallbackError: OAuthCallbackError2 } = await Promise.resolve().then(() => (init_errors(), exports_errors));
@@ -12741,13 +12948,7 @@ function handleLogout(cfg) {
     log.warn("You are not logged in.");
     return;
   }
-  cfg.access_token = "";
-  cfg.refresh_token = "";
-  cfg.expires_at = 0;
-  cfg.mode = undefined;
-  cfg.deployment_id = undefined;
-  cfg.deployment_name = undefined;
-  cfg.api_key = undefined;
+  clearConfigInPlace(cfg);
   saveConfig(cfg);
   log.success("Credentials cleared.");
 }
@@ -12892,9 +13093,11 @@ async function runLoginCheck(opts) {
   }
   if (result.status === "authenticated") {
     const cfg = loadConfig();
-    cfg.access_token = result.access_token ?? "";
-    cfg.refresh_token = result.refresh_token ?? "";
-    cfg.expires_at = Math.floor(Date.now() / 1000) + (result.expires_in ?? 3600);
+    replaceLoginSession(cfg, {
+      access_token: result.access_token ?? "",
+      refresh_token: result.refresh_token ?? "",
+      expires_at: Math.floor(Date.now() / 1000) + (result.expires_in ?? 3600)
+    });
     saveConfig(cfg);
     logger.info("auth.ticket", "Ticket redeemed via dosu login --check");
     if (opts.json) {
@@ -13085,9 +13288,11 @@ async function redeemTicket(ticket, cfg) {
       });
       return { code: 0, cfg, exit: true };
     }
-    cfg.access_token = result.access_token ?? "";
-    cfg.refresh_token = result.refresh_token ?? "";
-    cfg.expires_at = Math.floor(Date.now() / 1000) + (result.expires_in ?? 3600);
+    replaceLoginSession(cfg, {
+      access_token: result.access_token ?? "",
+      refresh_token: result.refresh_token ?? "",
+      expires_at: Math.floor(Date.now() / 1000) + (result.expires_in ?? 3600)
+    });
     saveConfig(cfg);
     logger.info("agent.flow", "Ticket redeemed; session saved");
     emitStep({ step: "auth", email: result.email });
@@ -13102,7 +13307,7 @@ async function redeemTicket(ticket, cfg) {
   }
 }
 async function verifyOrMint(cfg, opts) {
-  if (cfg.access_token) {
+  if (cfg.active_account?.session.access_token) {
     try {
       const client = new Client(cfg);
       const resp = await client.doRequestRaw("GET", "/v1/mcp/deployments");
@@ -13151,10 +13356,12 @@ async function resolveDeployment2(client, cfg, opts) {
         });
         return { code: 1, cfg };
       }
-      cfg.deployment_id = d.deployment_id;
-      cfg.deployment_name = d.name;
-      cfg.org_id = d.org_id;
-      cfg.space_id = d.space_id;
+      updateTarget(cfg, {
+        deployment_id: d.deployment_id,
+        deployment_name: d.name,
+        org_id: d.org_id,
+        space_id: d.space_id
+      });
       cfg.mode = undefined;
       saveConfig(cfg);
       emitStep({
@@ -13172,11 +13379,11 @@ async function resolveDeployment2(client, cfg, opts) {
       return { code: 1, cfg };
     }
   }
-  if (cfg.deployment_id) {
+  if (cfg.active_account?.target?.deployment_id) {
     emitStep({
       step: "deployment",
-      deployment_id: cfg.deployment_id,
-      name: cfg.deployment_name
+      deployment_id: cfg.active_account?.target?.deployment_id,
+      name: cfg.active_account?.target?.deployment_name
     });
     return { code: 0, cfg };
   }
@@ -13201,10 +13408,12 @@ async function resolveDeployment2(client, cfg, opts) {
     }
     if (mcpDeployments.length === 1) {
       const d = mcpDeployments[0];
-      cfg.deployment_id = d.deployment_id;
-      cfg.deployment_name = d.name;
-      cfg.org_id = d.org_id;
-      cfg.space_id = d.space_id;
+      updateTarget(cfg, {
+        deployment_id: d.deployment_id,
+        deployment_name: d.name,
+        org_id: d.org_id,
+        space_id: d.space_id
+      });
       cfg.mode = undefined;
       saveConfig(cfg);
       emitStep({
@@ -13242,7 +13451,9 @@ function formatCandidates(deployments) {
 `);
 }
 async function ensureAPIKey(client, cfg) {
-  if (!cfg.deployment_id) {
+  const target = cfg.active_account?.target;
+  const deploymentID = target?.deployment_id;
+  if (!deploymentID) {
     emitError({
       step: "api_key",
       reason: "no_deployment",
@@ -13251,15 +13462,15 @@ async function ensureAPIKey(client, cfg) {
     return { code: 1, cfg };
   }
   try {
-    if (cfg.api_key) {
-      const valid = await client.validateAPIKey(cfg.api_key, cfg.deployment_id);
+    if (target.api_key) {
+      const valid = await client.validateAPIKey(target.api_key, deploymentID);
       if (valid) {
         emitStep({ step: "api_key", reused: true });
         return { code: 0, cfg };
       }
     }
-    const resp = await client.createAPIKey(cfg.deployment_id, "dosu-cli");
-    cfg.api_key = resp.api_key;
+    const resp = await client.createAPIKey(deploymentID, "dosu-cli");
+    updateTarget(cfg, { api_key: resp.api_key });
     saveConfig(cfg);
     emitStep({ step: "api_key", reused: false });
     return { code: 0, cfg };
@@ -13307,18 +13518,18 @@ init_config();
 var import_picocolors2 = __toESM(require_picocolors(), 1);
 function requireLoginConfig() {
   const cfg = loadConfig();
-  if (!cfg.access_token) {
+  if (!cfg.active_account?.session.access_token) {
     console.error(import_picocolors2.default.red("Not logged in. Run 'dosu login' first."));
     process.exit(1);
   }
   return cfg;
 }
 function requireAPIKey(cfg) {
-  if (!cfg.api_key) {
+  if (!cfg.active_account?.target?.api_key) {
     console.error(import_picocolors2.default.red("API key not configured. Run 'dosu setup' first."));
     process.exit(1);
   }
-  return cfg.api_key;
+  return cfg.active_account?.target?.api_key;
 }
 
 // src/commands/output.ts
@@ -13383,7 +13594,7 @@ function formatDate(dateStr) {
 // src/commands/analytics.ts
 function requireConfig() {
   const cfg = requireLoginConfig();
-  if (!cfg.space_id) {
+  if (!cfg.active_account?.target?.space_id) {
     console.error(import_picocolors4.default.red("Missing space config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -13394,7 +13605,7 @@ function analyticsCommand() {
     const cfg = requireConfig();
     const client = createTypedClient(cfg);
     const stats = await client.analytics.getUsageStats.query({
-      spaceId: cfg.space_id,
+      spaceId: cfg.active_account.target.space_id,
       days: Number.parseInt(opts.days ?? "30", 10)
     });
     if (opts.json) {
@@ -13424,11 +13635,11 @@ init_logger();
 var import_picocolors5 = __toESM(require_picocolors(), 1);
 function requireConfig2() {
   const cfg = loadConfig();
-  if (!cfg.api_key) {
+  if (!cfg.active_account?.target?.api_key) {
     console.error(import_picocolors5.default.red("Not configured. Run 'dosu setup' first."));
     process.exit(1);
   }
-  if (!cfg.deployment_id || !cfg.space_id) {
+  if (!cfg.active_account?.target?.deployment_id || !cfg.active_account?.target?.space_id) {
     console.error(import_picocolors5.default.red("Missing deployment config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -13450,10 +13661,10 @@ function askCommand() {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "X-Dosu-API-Key": cfg.api_key
+          "X-Dosu-API-Key": cfg.active_account.target.api_key
         },
         body: JSON.stringify({
-          deployment_id: cfg.deployment_id,
+          deployment_id: cfg.active_account.target.deployment_id,
           question,
           session_id: opts.session ?? undefined
         }),
@@ -13609,7 +13820,7 @@ function checkForReadyTasks() {
     }
     const cfg = loadConfig();
     const backendURL = getBackendURL();
-    const apiKey = cfg.api_key;
+    const apiKey = cfg.active_account?.target?.api_key;
     if (backendURL && apiKey) {
       const now = Date.now();
       for (const task of cache.tasks) {
@@ -13650,11 +13861,11 @@ var INDEX_POLL_INTERVAL_MS = 2000;
 var INDEX_POLL_TIMEOUT_MS = 120000;
 function requireConfig3() {
   const cfg = requireLoginConfig();
-  if (!cfg.api_key) {
+  if (!cfg.active_account?.target?.api_key) {
     console.error(import_picocolors9.default.red("API key not configured. Run 'dosu setup' first."));
     process.exit(1);
   }
-  if (!cfg.org_id) {
+  if (!cfg.active_account?.target?.org_id) {
     console.error(import_picocolors9.default.red("Missing org config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -13732,7 +13943,10 @@ async function ensureSyncedRepo(cfg, client, detected, explicitDataSourceId, non
   if (explicitDataSourceId) {
     return explicitDataSourceId;
   }
-  let sources = await listDataSources(client, cfg.org_id);
+  const orgID = cfg.active_account?.target?.org_id;
+  if (!orgID)
+    throw new Error("missing org config");
+  let sources = await listDataSources(client, orgID);
   let match = findMatch(sources, detected);
   if (!match) {
     if (nonInteractive) {
@@ -13751,7 +13965,7 @@ async function ensureSyncedRepo(cfg, client, detected, explicitDataSourceId, non
       console.error(import_picocolors9.default.red(`Could not connect ${detected.slug}. Run 'dosu setup' and retry.`));
       process.exit(1);
     }
-    sources = await listDataSources(client, cfg.org_id);
+    sources = await listDataSources(client, orgID);
     match = findMatch(sources, detected);
     if (!match) {
       console.error(import_picocolors9.default.red(`Could not find ${detected.slug} after connecting. Retry shortly.`));
@@ -13759,7 +13973,7 @@ async function ensureSyncedRepo(cfg, client, detected, explicitDataSourceId, non
     }
   }
   if (match.is_indexed !== true) {
-    const indexed = await waitForIndexed(client, cfg.org_id, detected, nonInteractive);
+    const indexed = await waitForIndexed(client, orgID, detected, nonInteractive);
     if (!indexed) {
       if (nonInteractive) {
         console.error(import_picocolors9.default.red(`${detected.slug} is still indexing. Re-run once indexing finishes.`));
@@ -13950,7 +14164,7 @@ function deploymentsCommand() {
   cmd.command("list").description("List all deployments").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig4();
     const client = createTypedClient(cfg);
-    const deployments = cfg.org_id ? await client.workspaces.listForOrg.query(cfg.org_id) : await client.workspaces.listAll.query({});
+    const deployments = cfg.active_account?.target?.org_id ? await client.workspaces.listForOrg.query(cfg.active_account?.target?.org_id) : await client.workspaces.listAll.query({});
     if (opts.json) {
       printResult(deployments, opts);
       return;
@@ -13965,21 +14179,21 @@ function deploymentsCommand() {
       d.org_id ? d.org_id.slice(0, 8) : "—",
       d.enabled ? import_picocolors10.default.green("active") : import_picocolors10.default.dim("disabled")
     ]), { rawData: deployments });
-    if (cfg.deployment_id) {
+    if (cfg.active_account?.target?.deployment_id) {
       console.log(`
-${import_picocolors10.default.dim(`Current: ${cfg.deployment_name ?? cfg.deployment_id}`)}`);
+${import_picocolors10.default.dim(`Current: ${cfg.active_account?.target?.deployment_name ?? cfg.active_account?.target?.deployment_id}`)}`);
     }
   });
   cmd.command("info").description("Show current deployment details").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig4();
-    if (!cfg.deployment_id) {
+    if (!cfg.active_account?.target?.deployment_id) {
       console.error(import_picocolors10.default.red("No deployment selected. Run 'dosu setup' or 'dosu deployments switch'."));
       process.exit(1);
     }
     const client = createTypedClient(cfg);
-    const deployment = await client.workspaces.get.query(cfg.deployment_id);
+    const deployment = await client.workspaces.get.query(cfg.active_account?.target?.deployment_id);
     if (!deployment) {
-      console.error(import_picocolors10.default.red(`Deployment not found: ${cfg.deployment_id}`));
+      console.error(import_picocolors10.default.red(`Deployment not found: ${cfg.active_account?.target?.deployment_id}`));
       process.exit(1);
     }
     if (opts.json) {
@@ -14005,10 +14219,12 @@ ${import_picocolors10.default.dim(`Current: ${cfg.deployment_name ?? cfg.deploym
       console.error(import_picocolors10.default.red(`Deployment not found: ${id}`));
       process.exit(1);
     }
-    cfg.deployment_id = deployment.deployment_id;
-    cfg.deployment_name = deployment.name;
-    cfg.org_id = deployment.org_id;
-    cfg.space_id = deployment.space_id;
+    updateTarget(cfg, {
+      deployment_id: deployment.deployment_id,
+      deployment_name: deployment.name,
+      org_id: deployment.org_id,
+      space_id: deployment.space_id
+    });
     saveConfig(cfg);
     if (opts.json) {
       printResult({ success: true, deployment_id: deployment.deployment_id, name: deployment.name }, opts);
@@ -14029,7 +14245,7 @@ var import_picocolors11 = __toESM(require_picocolors(), 1);
 import { readFileSync as readFileSync5 } from "node:fs";
 function requireConfig5() {
   const cfg = requireLoginConfig();
-  if (!cfg.space_id) {
+  if (!cfg.active_account?.target?.space_id) {
     console.error(import_picocolors11.default.red("Missing space config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -14131,7 +14347,7 @@ function docsCommand() {
   cmd.command("list").description("List documents").option("--search <query>", "Search documents").option("--tag <id>", "Filter by tag ID").option("--limit <n>", "Maximum results", "20").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig5();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId(client, cfg.active_account.target.space_id);
     const result = await client.page.listWithTags.query({
       knowledge_store_id: ksId,
       searchTerm: opts.search,
@@ -14183,7 +14399,7 @@ ${page.body}`);
   cmd.command("create").description("Create a new document").requiredOption("--title <title>", "Document title").option("--body <markdown>", "Document body (markdown)").option("--body-file <path>", "Read body from file").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig5();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId(client, cfg.active_account.target.space_id);
     const body = readBody(opts);
     const result = await client.page.create.mutate({
       knowledge_store_id: ksId,
@@ -14199,7 +14415,7 @@ ${page.body}`);
   cmd.command("update").description("Update a document").argument("<id>", "Page ID").option("--title <title>", "New title").option("--body <markdown>", "New body (markdown)").option("--body-file <path>", "Read body from file").option("--json", "Output as JSON").action(async (id, opts) => {
     const cfg = requireConfig5();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId(client, cfg.active_account.target.space_id);
     const body = readBody(opts);
     const result = await client.page.update.mutate({
       id,
@@ -14269,7 +14485,7 @@ ${page.body}`);
   cmd.command("generate").description("Generate a document using AI").requiredOption("--title <title>", "Document title").option("--instructions <text>", "Custom generation instructions").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig5();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId(client, cfg.active_account.target.space_id);
     const result = await backendPost2("/doc/generate", requireAPIKey(cfg), {
       knowledge_store_id: ksId,
       title: opts.title,
@@ -14293,7 +14509,7 @@ ${page.body}`);
   cmd.command("import").description("Import documents from an external platform").argument("<platform>", "Platform: github, gitlab, confluence, notion, coda").requiredOption("--files <ids>", "Comma-separated file/page IDs to import").option("--json", "Output as JSON").action(async (platform2, opts) => {
     const cfg = requireConfig5();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId(client, cfg.active_account.target.space_id);
     const fileIds = opts.files.split(",").map((id) => id.trim());
     const importFn = {
       github: (input) => client.docImports.importGithubFiles.mutate(input),
@@ -14311,7 +14527,7 @@ ${page.body}`);
     try {
       const result = await fn({
         knowledge_store_id: ksId,
-        space_id: cfg.space_id,
+        space_id: cfg.active_account.target.space_id,
         [idField]: fileIds
       });
       if (opts.json) {
@@ -14514,7 +14730,7 @@ async function runUserPromptSubmit(input, now = Date.now(), agent = DEFAULT_AGEN
     return;
   }
   const cfg = loadConfig();
-  if (!cfg.api_key || !cfg.deployment_id) {
+  if (!cfg.active_account?.target?.api_key || !cfg.active_account?.target?.deployment_id) {
     logger.debug("hooks", "submit skipped reason=not-configured");
     return;
   }
@@ -14523,7 +14739,7 @@ async function runUserPromptSubmit(input, now = Date.now(), agent = DEFAULT_AGEN
   let resp;
   try {
     resp = await tc.requestCreateTicket(cfg, {
-      deployment_id: cfg.deployment_id,
+      deployment_id: cfg.active_account?.target?.deployment_id,
       agent,
       session_id: sessionId,
       turn_id: input.turn_id ?? String(now),
@@ -14568,7 +14784,7 @@ async function runPostToolUse(input, now = Date.now()) {
     return;
   }
   const cfg = loadConfig();
-  if (!cfg.api_key || !cfg.deployment_id) {
+  if (!cfg.active_account?.target?.api_key || !cfg.active_account?.target?.deployment_id) {
     saveState({ ...state, lastCheckedAt: now });
     return;
   }
@@ -14620,7 +14836,7 @@ async function runStop(input, now = Date.now()) {
   if (state.status !== "pending" || now > state.expiresAt)
     return printContinue();
   const cfg = loadConfig();
-  if (!cfg.api_key || !cfg.deployment_id)
+  if (!cfg.active_account?.target?.api_key || !cfg.active_account?.target?.deployment_id)
     return printContinue();
   const tc = await Promise.resolve().then(() => (init_ticket_client(), exports_ticket_client));
   const pollMs = stopPollMs();
@@ -14914,11 +15130,11 @@ async function collectDoctorChecks(opts) {
   } else {
     checks.push({ name: "auth", status: "fail", detail: "not logged in (run 'dosu login')" });
   }
-  if (cfg.deployment_id || cfg.mode === MODE_OSS) {
+  if (cfg.active_account?.target?.deployment_id || cfg.mode === MODE_OSS) {
     checks.push({
       name: "deployment",
       status: "ok",
-      detail: cfg.deployment_name ?? cfg.deployment_id ?? "oss"
+      detail: cfg.active_account?.target?.deployment_name ?? cfg.active_account?.target?.deployment_id ?? "oss"
     });
   } else {
     checks.push({
@@ -14927,9 +15143,9 @@ async function collectDoctorChecks(opts) {
       detail: "no deployment selected (run 'dosu setup')"
     });
   }
-  if (cfg.api_key && cfg.deployment_id) {
+  if (cfg.active_account?.target?.api_key && cfg.active_account?.target?.deployment_id) {
     const { Client: Client2 } = await Promise.resolve().then(() => (init_client(), exports_client));
-    const ok = await new Client2(cfg).validateAPIKey(cfg.api_key, cfg.deployment_id);
+    const ok = await new Client2(cfg).validateAPIKey(cfg.active_account?.target?.api_key, cfg.active_account?.target?.deployment_id);
     checks.push({
       name: "backend",
       status: ok ? "ok" : "fail",
@@ -15020,7 +15236,7 @@ init_trpc();
 var import_picocolors15 = __toESM(require_picocolors(), 1);
 function requireConfig6() {
   const cfg = requireLoginConfig();
-  if (!cfg.org_id) {
+  if (!cfg.active_account?.target?.org_id) {
     console.error(import_picocolors15.default.red("Missing org config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15056,7 +15272,7 @@ function integrationsCommand() {
           const conn = await client.nango.getConnection.query({
             provider: nangoProvider,
             providerConfigKey: nangoProvider,
-            orgId: cfg.org_id
+            orgId: cfg.active_account.target.org_id
           });
           results.push({ platform: platform4, connected: conn !== null });
         } catch {
@@ -15091,7 +15307,7 @@ function integrationsCommand() {
       const conn = await client.nango.getConnection.query({
         provider: nangoProvider,
         providerConfigKey: nangoProvider,
-        orgId: cfg.org_id
+        orgId: cfg.active_account.target.org_id
       });
       const connected = conn !== null;
       if (opts.json) {
@@ -15110,7 +15326,7 @@ function integrationsCommand() {
   cmd.command("slack-channels").description("List Slack channels").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig6();
     const client = createTypedClient(cfg);
-    const channels = await client.slackChannel.getAll.query(cfg.org_id);
+    const channels = await client.slackChannel.getAll.query(cfg.active_account.target.org_id);
     if (opts.json) {
       printResult(channels, opts);
       return;
@@ -15157,7 +15373,7 @@ init_trpc();
 var import_picocolors16 = __toESM(require_picocolors(), 1);
 function requireConfig7() {
   const cfg = requireLoginConfig();
-  if (!cfg.org_id || !cfg.space_id) {
+  if (!cfg.active_account?.target?.org_id || !cfg.active_account?.target?.space_id) {
     console.error(import_picocolors16.default.red("Missing org/space config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15169,7 +15385,7 @@ function knowledgeCommand() {
     const cfg = requireConfig7();
     const client = createTypedClient(cfg);
     const dataSources = await client.dataSource.list.query({
-      org_id: cfg.org_id,
+      org_id: cfg.active_account.target.org_id,
       excluded_provider_slugs: []
     });
     const dataSourceIds = dataSources.map((ds) => ds.id).filter((id) => id !== null);
@@ -15205,7 +15421,7 @@ ${results.length - limit} more results not shown.`));
   cmd.command("list").description("Show knowledge store information").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig7();
     const client = createTypedClient(cfg);
-    const store = await client.knowledgeStore.getBySpaceId.query({ space_id: cfg.space_id });
+    const store = await client.knowledgeStore.getBySpaceId.query({ space_id: cfg.active_account.target.space_id });
     if (opts.json) {
       printResult(store, opts);
       return;
@@ -15227,7 +15443,7 @@ init_trpc();
 var import_picocolors17 = __toESM(require_picocolors(), 1);
 function requireConfig8() {
   const cfg = requireLoginConfig();
-  if (!cfg.org_id) {
+  if (!cfg.active_account?.target?.org_id) {
     console.error(import_picocolors17.default.red("Missing org config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15257,7 +15473,7 @@ function membersCommand() {
     const client = createTypedClient(cfg);
     const role = opts.role.toUpperCase() === "ADMIN" ? "ADMIN" : "MEMBER";
     await client.invitations.invite.mutate({
-      orgId: cfg.org_id,
+      orgId: cfg.active_account.target.org_id,
       email,
       role
     });
@@ -15288,7 +15504,7 @@ function membersCommand() {
     const cfg = requireConfig8();
     const client = createTypedClient(cfg);
     await client.invitations.acceptInvitation.mutate({
-      orgId: cfg.org_id,
+      orgId: cfg.active_account.target.org_id,
       email
     });
     if (opts.json) {
@@ -15301,7 +15517,7 @@ function membersCommand() {
     const cfg = requireConfig8();
     const client = createTypedClient(cfg);
     await client.invitations.rejectInvitation.mutate({
-      orgId: cfg.org_id,
+      orgId: cfg.active_account.target.org_id,
       email
     });
     if (opts.json) {
@@ -15343,9 +15559,9 @@ function orgCommand() {
       return;
     }
     printTable(["ID", "Name"], orgs.map((o2) => [o2.org_id.slice(0, 8), o2.name]), { rawData: orgs });
-    if (cfg.org_id) {
+    if (cfg.active_account?.target?.org_id) {
       console.log(`
-${import_picocolors18.default.dim(`Current: ${cfg.org_id}`)}`);
+${import_picocolors18.default.dim(`Current: ${cfg.active_account?.target?.org_id}`)}`);
     }
   });
   return cmd;
@@ -15459,15 +15675,15 @@ function reviewCommand() {
   const cmd = new Command("review").description("Review workflow (doc changes and draft replies)");
   cmd.command("list").description("List pending review items (doc changes and draft replies)").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig10();
-    if (!cfg.space_id) {
+    if (!cfg.active_account?.target?.space_id) {
       console.error(import_picocolors19.default.red("Missing space config. Run 'dosu setup' to reconfigure."));
       process.exit(1);
     }
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId2(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId2(client, cfg.active_account?.target?.space_id);
     const result = await client.review.listPending.query({
       knowledgeStoreId: ksId,
-      deploymentId: cfg.deployment_id
+      deploymentId: cfg.active_account?.target?.deployment_id
     });
     const { items, truncated, total } = result;
     if (opts.json) {
@@ -15683,7 +15899,7 @@ init_trpc();
 var import_picocolors20 = __toESM(require_picocolors(), 1);
 function requireConfig11() {
   const cfg = requireLoginConfig();
-  if (!cfg.org_id) {
+  if (!cfg.active_account?.target?.org_id) {
     console.error(import_picocolors20.default.red("Missing org config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15695,7 +15911,7 @@ function sourcesCommand() {
     const cfg = requireConfig11();
     const client = createTypedClient(cfg);
     const dataSources = await client.dataSource.list.query({
-      org_id: cfg.org_id,
+      org_id: cfg.active_account.target.org_id,
       excluded_provider_slugs: []
     });
     if (opts.json) {
@@ -15777,7 +15993,7 @@ init_trpc();
 var import_picocolors21 = __toESM(require_picocolors(), 1);
 function requireConfig12() {
   const cfg = requireLoginConfig();
-  if (!cfg.space_id) {
+  if (!cfg.active_account?.target?.space_id) {
     console.error(import_picocolors21.default.red("Missing space config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15798,7 +16014,7 @@ function suggestCommand() {
   cmd.command("list").description("List pending document suggestions").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig12();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId3(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId3(client, cfg.active_account.target.space_id);
     const suggestions = await client.suggestedDoc.listForKnowledgeStore.query({
       knowledgeStoreId: ksId
     });
@@ -15818,13 +16034,13 @@ function suggestCommand() {
   cmd.command("generate").description("Generate new document suggestions from data sources").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig12();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId3(client, cfg.space_id);
-    if (!cfg.org_id) {
+    const ksId = await getKnowledgeStoreId3(client, cfg.active_account.target.space_id);
+    if (!cfg.active_account?.target?.org_id) {
       console.error(import_picocolors21.default.red("Missing org config. Run 'dosu setup' to reconfigure."));
       process.exit(1);
     }
     const dataSources = await client.dataSource.list.query({
-      org_id: cfg.org_id,
+      org_id: cfg.active_account?.target?.org_id,
       excluded_provider_slugs: []
     });
     const dataSourceIds = dataSources.map((ds) => ds.id).filter((id) => id !== null);
@@ -15857,7 +16073,7 @@ init_trpc();
 var import_picocolors22 = __toESM(require_picocolors(), 1);
 function requireConfig13() {
   const cfg = requireLoginConfig();
-  if (!cfg.space_id) {
+  if (!cfg.active_account?.target?.space_id) {
     console.error(import_picocolors22.default.red("Missing space config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15881,7 +16097,7 @@ function threadsCommand() {
       read: undefined,
       resolved: undefined,
       search: undefined,
-      space_id: cfg.space_id,
+      space_id: cfg.active_account.target.space_id,
       workspaces: undefined,
       limit: Math.min(Number.parseInt(opts.limit ?? "20", 10), 100)
     };
@@ -15976,7 +16192,7 @@ init_trpc();
 var import_picocolors23 = __toESM(require_picocolors(), 1);
 function requireConfig14() {
   const cfg = requireLoginConfig();
-  if (!cfg.space_id) {
+  if (!cfg.active_account?.target?.space_id) {
     console.error(import_picocolors23.default.red("Missing space config. Run 'dosu setup' to reconfigure."));
     process.exit(1);
   }
@@ -15997,7 +16213,7 @@ function topicsCommand() {
   cmd.command("list").description("List all topics").option("--json", "Output as JSON").action(async (opts) => {
     const cfg = requireConfig14();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId4(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId4(client, cfg.active_account.target.space_id);
     const topics = await client.topic.listTopicsByKnowledgeStore.query({
       knowledge_store_id: ksId
     });
@@ -16018,7 +16234,7 @@ function topicsCommand() {
   cmd.command("pages").description("List pages with a specific topic").argument("<topic-id>", "Topic ID").option("--search <query>", "Search within the topic's pages").option("--limit <n>", "Maximum results", "10").option("--json", "Output as JSON").action(async (topicId, opts) => {
     const cfg = requireConfig14();
     const client = createTypedClient(cfg);
-    const ksId = await getKnowledgeStoreId4(client, cfg.space_id);
+    const ksId = await getKnowledgeStoreId4(client, cfg.active_account.target.space_id);
     const result = await client.topic.getPagesByTopicId.query({
       knowledge_store_id: ksId,
       topic_id: topicId,
@@ -16291,9 +16507,11 @@ Run 'dosu --help' to see available commands.`;
         token = result.token;
       }
     }
-    cfg.access_token = token.access_token;
-    cfg.refresh_token = token.refresh_token;
-    cfg.expires_at = Math.floor(Date.now() / 1000) + token.expires_in;
+    replaceLoginSession(cfg, {
+      access_token: token.access_token,
+      refresh_token: token.refresh_token,
+      expires_at: Math.floor(Date.now() / 1000) + token.expires_in
+    });
     saveConfig(cfg);
     console.log("Successfully authenticated!");
     console.log(`Credentials saved to ${getConfigPath()}`);
@@ -16304,14 +16522,7 @@ Run 'dosu --help' to see available commands.`;
       console.log("You are not logged in.");
       return;
     }
-    cfg.access_token = "";
-    cfg.refresh_token = "";
-    cfg.expires_at = 0;
-    cfg.deployment_id = undefined;
-    cfg.deployment_name = undefined;
-    cfg.api_key = undefined;
-    cfg.org_id = undefined;
-    cfg.space_id = undefined;
+    clearConfigInPlace(cfg);
     saveConfig(cfg);
     console.log("Successfully logged out.");
   });
@@ -16331,9 +16542,9 @@ Run 'dosu --help' to see available commands.`;
     if (cfg.mode === MODE_OSS) {
       console.log("Mode: OSS");
       console.log("MCP: Public libraries only");
-    } else if (cfg.deployment_id) {
-      console.log(`MCP: ${cfg.deployment_name}`);
-      console.log(`MCP ID: ${cfg.deployment_id}`);
+    } else if (cfg.active_account?.target?.deployment_id) {
+      console.log(`MCP: ${cfg.active_account?.target?.deployment_name}`);
+      console.log(`MCP ID: ${cfg.active_account?.target?.deployment_id}`);
     } else {
       console.log("MCP: None selected");
       console.log("Run 'dosu deployments list' to see available MCPs, then 'dosu deployments switch <id>' to select one.");
@@ -16354,10 +16565,10 @@ Run 'dosu --help' to see available commands.`;
     if (isTokenExpired(cfg) && !await ensureFreshSession(cfg)) {
       throw new Error("session expired. Run 'dosu login' to re-authenticate");
     }
-    if (cfg.mode !== MODE_OSS && !cfg.deployment_id) {
+    if (cfg.mode !== MODE_OSS && !cfg.active_account?.target?.deployment_id) {
       throw new Error("no MCP selected. Run 'dosu' to open the TUI and select an MCP");
     }
-    if (!cfg.api_key) {
+    if (!cfg.active_account?.target?.api_key) {
       throw new Error("no API key available. Run 'dosu setup' to create one");
     }
     if (provider.id() === "manual") {