@jacebenson/jsn 2.0.3 → 3.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "2.0.3",
+  "version": "3.0.0",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {

package/src/app.js

@@ -33,6 +33,14 @@ export class App {
   }
 
   loadContext() {
+    const activeName = this.config.activeProfile || this.config.defaultProfile;
+    if (activeName && this.config.profiles[activeName]) {
+      this.context.profileName = activeName;
+      this.context.username = this.config.profiles[activeName].username || '';
+      return;
+    }
+
+    // Fallback: no active profile name — find by instance URL (legacy config)
     const instance = getEffectiveInstance(this.config);
     if (!instance) return;
     this.context.profileName = extractProfileName(instance);

package/src/auth.js

@@ -1,6 +1,8 @@
 // OAuth 2.0 with PKCE authentication
 // Credentials are stored in the OS keyring (shared with Go version via libsecret/secret-tool)
 // Falls back to file-based storage when keyring is unavailable.
+// Credentials are keyed by <username>@<instance> so different users on the
+// same instance have separate credential slots.
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -10,6 +12,18 @@ import { execSync } from 'node:child_process';
 import { globalConfigDir, normalizeInstanceURL } from './config.js';
 import { errAuth } from './errors.js';
 
+// ─── Credential key helpers ───
+
+/**
+ * Build a compound key for credential storage: <username>@<instance>
+ * When username is omitted (legacy), just the normalized instance URL is used.
+ */
+function credKey(instance, username) {
+  const normalized = instance.replace(/:\/\//g, '_').replace(/\//g, '_').replace(/:/g, '_');
+  if (!username) return normalized;
+  return `${username.replace(/[^a-zA-Z0-9._@-]/g, '_')}@${normalized}`;
+}
+
 // ─── PKCE state persistence (shared with Go version) ───
 
 function pkceStatePath(instance) {
@@ -60,7 +74,7 @@ function getBasicAuthFromEnv(instance) {
     // Try global env vars
     const username = process.env.SN_USERNAME;
     const password = process.env.SN_PASSWORD;
-    if (username && password) return { auth_method: 'basic', username, password };
+    if (username && password) return { auth_method: 'basic', username, password, auth_source: 'env_basic' };
     return null;
   }
 
@@ -68,12 +82,12 @@ function getBasicAuthFromEnv(instance) {
   const host = envVarName(instance);
   const instanceUser = process.env[`SN_${host}_USERNAME`];
   const instancePass = process.env[`SN_${host}_PASSWORD`];
-  if (instanceUser && instancePass) return { auth_method: 'basic', username: instanceUser, password: instancePass };
+  if (instanceUser && instancePass) return { auth_method: 'basic', username: instanceUser, password: instancePass, auth_source: 'env_basic' };
 
   // Fall back to global env vars
   const globalUser = process.env.SN_USERNAME;
   const globalPass = process.env.SN_PASSWORD;
-  if (globalUser && globalPass) return { auth_method: 'basic', username: globalUser, password: globalPass };
+  if (globalUser && globalPass) return { auth_method: 'basic', username: globalUser, password: globalPass, auth_source: 'env_basic' };
 
   return null;
 }
@@ -83,11 +97,11 @@ const KEYRING_SERVICE = 'servicenow-cli';
 const KEYRING_ATTR_SERVICE = 'service';
 const KEYRING_ATTR_USERNAME = 'username';
 
-function credentialsPath(instance) {
+function credentialsPath(key) {
   const dir = path.join(globalConfigDir(), 'credentials');
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   // Match Go's filename encoding: replace :// and / and : with _
-  const filename = instance.replace(/:\/\//g, '_').replace(/\//g, '_').replace(/:/g, '_') + '.json';
+  const filename = key + '.json';
   return path.join(dir, filename);
 }
 
@@ -117,17 +131,19 @@ function buildAuthURL(instanceURL, clientID, pkce) {
 
 // ─── Keyring via secret-tool (libsecret, same backend as Go's go-keyring) ───
 
-function keyringLookup(instance) {
+function keyringLookup(key) {
   try {
     const result = execSync(
-      `secret-tool lookup ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${instance}"`,
+      `secret-tool lookup ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${key}"`,
       { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' }
     );
     const trimmed = result.trim();
     if (!trimmed) return null;
     const parsed = JSON.parse(trimmed);
-    // Normalize field names from Go's format to Node.js format
+    // Spread all fields from keyring first, then normalize known fields
+    // so username, password, and other extras are preserved.
     return {
+      ...parsed,
       auth_method: parsed.auth_method || 'oauth',
       access_token: parsed.access_token || parsed.AccessToken || '',
       refresh_token: parsed.refresh_token || parsed.RefreshToken || '',
@@ -139,11 +155,11 @@ function keyringLookup(instance) {
   }
 }
 
-function keyringStore(instance, creds) {
+function keyringStore(key, creds) {
   try {
     execSync(
-      `secret-tool store --label="Password for '${instance}' on '${KEYRING_SERVICE}'" ` +
-      `${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${instance}"`,
+      `secret-tool store --label="Password for '${key}' on '${KEYRING_SERVICE}'" ` +
+      `${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${key}"`,
       { stdio: ['pipe', 'ignore', 'ignore'], input: JSON.stringify(creds) }
     );
     return true;
@@ -152,10 +168,10 @@ function keyringStore(instance, creds) {
   }
 }
 
-function keyringDelete(instance) {
+function keyringDelete(key) {
   try {
     execSync(
-      `secret-tool clear ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${instance}"`,
+      `secret-tool clear ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${key}"`,
       { stdio: 'ignore' }
     );
   } catch {
@@ -165,34 +181,45 @@ function keyringDelete(instance) {
 
 // ─── File-based storage (fallback) ───
 
-function loadCredentials(instance) {
-  // Try keyring first (shared with Go version)
-  const keyringCreds = keyringLookup(instance);
-  if (keyringCreds) return keyringCreds;
-
-  // Fall back to file-based storage
+/**
+ * Load credentials for an instance keyed by <username>@<instance>.
+ * When username is omitted (legacy configs without profile user), uses
+ * bare instance key for lookup.
+ */
+function loadCredentials(instance, username) {
+  const key = username ? credKey(instance, username) : credKey(instance);
+  const keyringCreds = keyringLookup(key);
+  if (keyringCreds) {
+    return { ...keyringCreds, auth_source: 'keyring' };
+  }
   try {
-    const data = fs.readFileSync(credentialsPath(instance), 'utf-8');
-    return JSON.parse(data);
+    const data = fs.readFileSync(credentialsPath(key), 'utf-8');
+    const creds = JSON.parse(data);
+    return { ...creds, auth_source: 'file' };
   } catch {
     return null;
   }
 }
 
-function saveCredentials(instance, creds) {
+/**
+ * Save credentials for an instance.
+ * Uses <username>@<instance> key when username is available.
+ */
+function saveCredentials(instance, creds, username) {
+  const key = username ? credKey(instance, username) : credKey(instance);
   // Stamp last_seen on every credential save
   creds.last_seen = creds.last_seen || Math.floor(Date.now() / 1000);
   // Try keyring first, fall back to file
-  if (!keyringStore(instance, creds)) {
-    fs.writeFileSync(credentialsPath(instance), JSON.stringify(creds, null, 2), { mode: 0o600 });
+  if (!keyringStore(key, creds)) {
+    fs.writeFileSync(credentialsPath(key), JSON.stringify(creds, null, 2), { mode: 0o600 });
   }
 }
 
 /**
  * Get the last_seen timestamp for an instance, if available.
  */
-function getLastSeen(instance) {
-  const creds = loadCredentials(instance);
+function getLastSeen(instance, username) {
+  const creds = loadCredentials(instance, username);
   if (!creds || !creds.last_seen) return null;
   return creds.last_seen;
 }
@@ -200,17 +227,21 @@ function getLastSeen(instance) {
 /**
  * Update the last_seen timestamp for an instance to now.
  */
-function touchLastSeen(instance) {
-  const creds = loadCredentials(instance);
+function touchLastSeen(instance, username) {
+  const creds = loadCredentials(instance, username);
   if (!creds) return;
   creds.last_seen = Math.floor(Date.now() / 1000);
-  saveCredentials(instance, creds);
+  saveCredentials(instance, creds, username);
 }
 
-function deleteCredentials(instance) {
-  keyringDelete(instance);
+/**
+ * Delete credentials for an instance keyed by <username>@<instance>.
+ */
+function deleteCredentials(instance, username) {
+  const key = username ? credKey(instance, username) : credKey(instance);
+  keyringDelete(key);
   try {
-    fs.unlinkSync(credentialsPath(instance));
+    fs.unlinkSync(credentialsPath(key));
   } catch {
     // ignore
   }
@@ -271,12 +302,58 @@ export class AuthManager {
     this.httpClient = { timeout: 30000 };
   }
 
+  /**
+   * Resolve the username for credential keying from the active profile.
+   * Returns null when no profile is configured — callers fall back to bare
+   * instance key for backward compatibility with legacy / no-profile usage.
+   */
+  _activeUsername() {
+    const cfg = this.configProvider.config;
+    const name = cfg.activeProfile || cfg.defaultProfile;
+    if (name && cfg.profiles[name] && cfg.profiles[name].username) {
+      return cfg.profiles[name].username;
+    }
+    return null;
+  }
+
   getLastSeen(instance) {
-    return getLastSeen(instance);
+    return getLastSeen(instance, this._activeUsername());
   }
 
   touchLastSeen(instance) {
-    return touchLastSeen(instance);
+    return touchLastSeen(instance, this._activeUsername());
+  }
+
+  /**
+   * Check if legacy bare-instance credentials exist (stored before
+   * user@instance keying). Returns true when old-style creds are found
+   * but wouldn't be picked up by the current username-scoped lookup.
+   */
+  hasLegacyCredentials(instance) {
+    if (!instance) return false;
+    const bareCreds = loadCredentials(instance);
+    if (!bareCreds) return false;
+    // If active profile has a username, the bare key won't be found
+    // by loadCredentials(instance, username). That's the legacy case.
+    const username = this._activeUsername();
+    if (!username) return false; // No username set — bare key IS the active path
+    const userCreds = loadCredentials(instance, username);
+    return !!bareCreds && !userCreds;
+  }
+
+  /**
+   * Return the auth source for an instance without throwing.
+   * Mirrors the auth resolution order in getCredentials().
+   * For older stored credentials without auth_source, falls back
+   * to the saved auth_method field.
+   */
+  getAuthSource(instance) {
+    if (process.env.SERVICENOW_OAUTH_TOKEN) return 'env_token';
+    if (getBasicAuthFromEnv(instance)) return 'env_basic';
+    const creds = loadCredentials(instance, this._activeUsername());
+    if (!creds) return null;
+    // New creds have auth_source; older ones only have auth_method
+    return creds.auth_source || creds.auth_method || 'stored';
   }
 
   isAuthenticated() {
@@ -295,7 +372,7 @@ export class AuthManager {
   isAuthenticatedFor(instance) {
     if (!instance) return false;
     if (getBasicAuthFromEnv(instance)) return true;
-    const creds = loadCredentials(instance);
+    const creds = loadCredentials(instance, this._activeUsername());
     if (!creds) return false;
     if (creds.expires_at && Date.now() >= creds.expires_at * 1000) return false;
     return !!creds.access_token;
@@ -303,7 +380,7 @@ export class AuthManager {
 
   async getCredentials() {
     if (process.env.SERVICENOW_OAUTH_TOKEN) {
-      return { auth_method: 'oauth', access_token: process.env.SERVICENOW_OAUTH_TOKEN };
+      return { auth_method: 'oauth', access_token: process.env.SERVICENOW_OAUTH_TOKEN, auth_source: 'env_token' };
     }
     const instance = this.configProvider.getEffectiveInstance();
     if (!instance) {
@@ -319,7 +396,7 @@ export class AuthManager {
     // Check basic auth from env vars first
     const basicCreds = getBasicAuthFromEnv(instance);
     if (basicCreds) return basicCreds;
-    const creds = loadCredentials(instance);
+    const creds = loadCredentials(instance, this._activeUsername());
     if (!creds) {
       throw errAuth(`Not authenticated for ${instance}`);
     }
@@ -377,7 +454,8 @@ export class AuthManager {
 
     console.log('\nExchanging authorization code for tokens...');
     const newCreds = await this.exchangeCode(instanceURL, clientID, code, pkce);
-    saveCredentials(instanceURL, newCreds);
+    // Save with username for per-user credential keying
+    saveCredentials(instanceURL, newCreds, newCreds.username);
     return newCreds;
   }
 
@@ -414,7 +492,7 @@ export class AuthManager {
           console.log(`\nAuthorization code found in ${filePath}`);
           removePKCEState(instanceURL);
           const newCreds = await this.exchangeCode(instanceURL, clientID, code, pkce);
-          saveCredentials(instanceURL, newCreds);
+          saveCredentials(instanceURL, newCreds, newCreds.username);
           console.log('Token exchange successful!\n');
           return newCreds;
         }
@@ -444,7 +522,7 @@ export class AuthManager {
         `  jsn auth login --password ${instanceURL}`
       );
     }
-    saveCredentials(instanceURL, creds);
+    saveCredentials(instanceURL, creds, creds.username);
     console.log(`✓ Basic auth credentials saved for ${instanceURL}`);
     return creds;
   }
@@ -469,7 +547,7 @@ export class AuthManager {
     removePKCEState(instanceURL);
 
     const newCreds = await this.exchangeCode(instanceURL, clientID, code, pkce);
-    saveCredentials(instanceURL, newCreds);
+    saveCredentials(instanceURL, newCreds, newCreds.username);
     return newCreds;
   }
 
@@ -501,6 +579,8 @@ export class AuthManager {
       refresh_token: tokenResp.refresh_token,
       expires_at: expiresAt,
       created_at: Math.floor(Date.now() / 1000),
+      // The username will be set after post-login verification in the auth command
+      auth_source: 'oauth',
     };
   }
 
@@ -529,11 +609,12 @@ export class AuthManager {
       access_token: tokenResp.access_token,
       refresh_token: tokenResp.refresh_token,
       created_at: Math.floor(Date.now() / 1000),
+      auth_source: 'oauth',
     };
     if (tokenResp.expires_in) {
       newCreds.expires_at = Math.floor(Date.now() / 1000) + tokenResp.expires_in;
     }
-    saveCredentials(instance, newCreds);
+    saveCredentials(instance, newCreds, creds.username);
     return newCreds;
   }
 
@@ -541,6 +622,8 @@ export class AuthManager {
     if (!instance) {
       throw errAuth('No instance specified');
     }
-    deleteCredentials(instance);
+    deleteCredentials(instance, this._activeUsername());
   }
 }
+
+export { saveCredentials, loadCredentials, deleteCredentials, askHidden };

package/src/cli.js

@@ -6,6 +6,7 @@ import process from 'node:process';
 import { loadConfig, getEffectiveInstance } from './config.js';
 import { App } from './app.js';
 import { renderHelp } from './help.js';
+import { isMutationCommand } from './mutations.js';
 
 // Command modules
 import { setupCmd } from './commands/setup.js';
@@ -122,6 +123,24 @@ export const cli = yargs(hideBin(process.argv))
       }
     }
 
+    // Read-only profile check — block mutation commands on read-only profiles
+    const activeProfileName = cfg.activeProfile || cfg.defaultProfile;
+    if (activeProfileName && cfg.profiles[activeProfileName] && cfg.profiles[activeProfileName].read_only) {
+      const skipReadOnlyCheck = ['help', 'version', 'setup', 'auth', 'profiles', 'profile', 'skill', undefined].includes(cmd);
+      if (!skipReadOnlyCheck && isMutationCommand(argv)) {
+        process.stderr.write(`\n🔒 Profile "${activeProfileName}" is read-only.\n`);
+        process.stderr.write(`  Mutation commands are disabled on this profile.\n`);
+        const nonReadOnlyProfiles = Object.entries(cfg.profiles || {})
+          .filter(([n, p]) => n !== activeProfileName && !p.read_only)
+          .map(([n]) => n);
+        if (nonReadOnlyProfiles.length > 0) {
+          process.stderr.write(`  Switch to a writable profile:  jsn profiles use ${nonReadOnlyProfiles[0]}\n`);
+        }
+        process.stderr.write('\n');
+        process.exit(1);
+      }
+    }
+
     // Auto-check skill on every command (fire-and-forget, non-blocking)
     const skipSkillCheck = ['help', 'version', 'completion', 'skill'].includes(cmd)
       || process.env.JSN_NO_SKILL_CHECK === '1'

package/src/commands/auth.js

@@ -125,11 +125,25 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
             }
 
             app.config.profiles[profileName] = {
+              ...(app.config.profiles[profileName] || {}),
               instance_url: instanceURL,
-              auth_method: 'oauth',
+              auth_method: argv.password ? 'basic' : 'oauth',
               username: username || undefined,
             };
 
+            // Re-save OAuth credentials with username now that we have it,
+            // so they're keyed by <user>@<instance> for per-user isolation.
+            // Also clean up the old bare-instance key so migration is clean.
+            if (!argv.password && username) {
+              const { saveCredentials, loadCredentials, deleteCredentials } = await import('../auth.js');
+              const stored = loadCredentials(instanceURL);
+              if (stored && stored.access_token) {
+                stored.username = username;
+                saveCredentials(instanceURL, stored, username);
+                deleteCredentials(instanceURL); // remove bare-instance legacy key
+              }
+            }
+
             // Set as default if this is the first one
             const setDefault = !app.config.instanceURL && !app.config.defaultProfile;
             if (setDefault) {
@@ -188,6 +202,8 @@ Examples:
               const instance = profile.instance_url;
               const isAuth = app.auth.isAuthenticatedFor(instance);
               const lastSeen = app.auth.getLastSeen(instance);
+              const authSource = isAuth ? app.auth.getAuthSource(instance) : null;
+              const legacy = !isAuth && app.auth.hasLegacyCredentials(instance) ? true : undefined;
 
               // Try live verification
               let verified = null;
@@ -216,6 +232,8 @@ Examples:
                 name,
                 instance,
                 authenticated: isAuth,
+                legacy,
+                auth_source: authSource || (legacy ? 'legacy' : undefined),
                 verified,
                 verified_as: verifiedAt || undefined,
                 last_seen: lastSeen || undefined,
@@ -233,6 +251,20 @@ Examples:
             };
 
             app.ok(result, { summary: `${profiles.length} profile(s)` });
+
+            // Warn about legacy credentials that need re-authentication
+            const legacyProfiles = profiles.filter(p => p.legacy);
+            if (legacyProfiles.length > 0) {
+              process.stderr.write(
+                '\n⚠️  This release changed how credentials are stored.\n' +
+                '   Some profiles still use the old format.\n' +
+                '   Run the following to re-authenticate:\n'
+              );
+              for (const p of legacyProfiles) {
+                process.stderr.write(`     jsn auth login ${p.name}\n`);
+              }
+              process.stderr.write('\n');
+            }
           }),
         })
         .command({

package/src/commands/profiles.js

@@ -29,6 +29,11 @@ export function profilesCmd(wrap) {
               alias: 'p',
               describe: 'Password for basic auth',
               type: 'string',
+            })
+            .option('read-only', {
+              describe: 'Mark profile as read-only (blocks mutation commands)',
+              type: 'boolean',
+              default: false,
             }),
           handler: wrap(async (argv, app) => {
             const name = argv.name;
@@ -51,11 +56,16 @@ export function profilesCmd(wrap) {
                 auth_method: 'basic',
                 username: argv.username,
                 password: argv.password,
-              });
+              }, argv.username);
               profile.auth_method = 'basic';
               profile.username = argv.username;
             }
 
+            // If read-only flag is set, mark the profile
+            if (argv['read-only']) {
+              profile.read_only = true;
+            }
+
             await setProfile(app.config, name, profile);
 
             app.ok({
@@ -80,9 +90,26 @@ export function profilesCmd(wrap) {
                 username: profile.username || '',
                 authenticated: isAuth,
                 default: isDefault,
+                read_only: profile.read_only || false,
               });
             }
-            app.ok({ profiles }, { summary: `${profiles.length} profile(s)` });
+
+            // Build context-aware breadcrumb: suggest switching to a non-active profile
+            const breadcrumbs = [];
+            if (profiles.length > 0) {
+              const activeName = app.config.activeProfile || app.config.defaultProfile;
+              const nonActiveProfiles = profiles.filter(p => p.name !== activeName);
+              if (nonActiveProfiles.length > 0) {
+                const suggestName = nonActiveProfiles[0].name;
+                breadcrumbs.push({
+                  action: 'switch',
+                  cmd: `jsn profiles use ${suggestName}`,
+                  description: 'Switch to a different profile',
+                });
+              }
+            }
+
+            app.ok({ profiles }, { summary: `${profiles.length} profile(s)`, breadcrumbs });
           }),
         })
         .command({
@@ -108,7 +135,8 @@ export function profilesCmd(wrap) {
               throw new Error('No profiles configured');
             }
             const profile = app.config.profiles[name];
-            app.ok({ name, ...profile }, { summary: `Profile: ${name}` });
+            const readOnlyNote = profile.read_only ? ' [READ-ONLY]' : '';
+            app.ok({ name, ...profile }, { summary: `Profile: ${name}${readOnlyNote}` });
           }),
         })
         .command({
@@ -119,6 +147,7 @@ export function profilesCmd(wrap) {
             if (!app.config.profiles[name]) {
               throw new Error(`Profile not found: ${name}`);
             }
+            const instance = app.config.profiles[name].instance_url;
             delete app.config.profiles[name];
             if (app.config.defaultProfile === name) {
               app.config.defaultProfile = '';
@@ -127,6 +156,14 @@ export function profilesCmd(wrap) {
               app.config.activeProfile = '';
             }
             saveConfig(app.config);
+
+            // Only clean up credentials if no other profile uses this instance URL
+            const stillInUse = instance && Object.values(app.config.profiles || {})
+              .some(p => p.instance_url === instance);
+            if (instance && !stillInUse) {
+              app.auth.logout(instance);
+            }
+
             app.ok({ removed: name }, { summary: `Removed profile: ${name}` });
           }),
         })

package/src/commands/setup.js

@@ -5,6 +5,14 @@ export function setupCmd(wrap) {
   return {
     command: 'setup',
     describe: 'Interactive first-time setup',
+    builder: (yargs) => {
+      return yargs
+        .option('read-only', {
+          describe: 'Mark profile as read-only (blocks mutation commands)',
+          type: 'boolean',
+          default: false,
+        });
+    },
     handler: wrap(async (_argv, app) => {
       const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
       const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
@@ -19,17 +27,69 @@ export function setupCmd(wrap) {
       }
       console.log(`Instance: ${instance}`);
 
-      const profileName = await ask('Profile name (default): ') || 'default';
-      await setProfile(app.config, profileName, { instance_url: instance });
+      // Warn if another profile already uses this instance URL
+      const existing = Object.entries(app.config.profiles || {}).find(([, p]) => p.instance_url === instance);
+      if (existing) {
+        console.log(`Note: instance is also used by profile "${existing[0]}".`);
+      }
+
+      const profileName = (await ask('Profile name (default): ')) || 'default';
+      const profile = { instance_url: instance };
+      if (_argv['read-only']) {
+        profile.read_only = true;
+      }
+
+      const authMethod = await ask('Authentication method (OAuth/Basic) [OAuth]: ');
+      const useBasic = authMethod.toLowerCase().startsWith('b');
+
+      if (useBasic) {
+        const username = await ask('Username: ');
+        rl.close(); // Close outer readline before askHidden creates its own
+        const { loadCredentials, askHidden } = await import('../auth.js');
+        const existing = loadCredentials(instance) || loadCredentials(instance, username);
+        if (existing && existing.auth_method === 'basic') {
+          console.log(`Using existing credentials for ${instance}`);
+        } else {
+          const password = await askHidden('Password: ');
+          const { saveCredentials } = await import('../auth.js');
+          saveCredentials(instance, { auth_method: 'basic', username, password }, username);
+          profile.username = username;
+          console.log('Basic auth credentials saved');
+        }
+        profile.auth_method = 'basic';
+      } else {
+        profile.auth_method = 'oauth';
+      }
+
+      await setProfile(app.config, profileName, profile);
       // Set as active profile so subsequent commands know which instance to use
       app.config.activeProfile = profileName;
       app.config.defaultProfile = profileName;
       saveConfig(app.config);
 
-      const loginNow = await ask('Login now? [Y/n]: ');
-      if (!loginNow || loginNow.toLowerCase() !== 'n') {
-        await app.auth.login(instance);
-        console.log('Login successful!');
+      if (!useBasic) {
+        const loginNow = await ask('Login now? [Y/n]: ');
+        if (!loginNow || loginNow.toLowerCase() !== 'n') {
+          await app.auth.login(instance);
+          // Re-save credentials under <user>@<instance> after verifying username
+          try {
+            const { SDKClient } = await import('./sdk.js');
+            const sdk = new SDKClient(instance, app.auth);
+            const user = await sdk.getCurrentUser();
+            if (user && user.user_name) {
+              const { loadCredentials, saveCredentials } = await import('../auth.js');
+              const stored = loadCredentials(instance);
+              if (stored && stored.access_token) {
+                stored.username = user.user_name;
+                saveCredentials(instance, stored, user.user_name);
+              }
+              profile.username = user.user_name;
+            }
+          } catch {
+            // Non-fatal — token saved, username will be set on next auth login
+          }
+          console.log('Login successful!');
+        }
       }
 
       rl.close();

package/src/config.js

@@ -120,6 +120,22 @@ export function saveConfig(cfg) {
     format: cfg.format || undefined,
   };
   fs.writeFileSync(globalConfigPath(), JSON.stringify(payload, null, 2), { mode: 0o600 });
+
+  // Sync managed fields to local config if it exists, so profile operations
+  // (use, remove, create, auth login) aren't silently reverted on next load.
+  if (fs.existsSync(localConfigPath())) {
+    try {
+      const localData = JSON.parse(fs.readFileSync(localConfigPath(), 'utf-8'));
+      const merged = { ...localData };
+      if (payload.profiles !== undefined) merged.profiles = payload.profiles;
+      if (payload.default_profile !== undefined) merged.default_profile = payload.default_profile;
+      if (payload.instance_url !== undefined) merged.instance_url = payload.instance_url;
+      if (payload.format !== undefined) merged.format = payload.format;
+      fs.writeFileSync(localConfigPath(), JSON.stringify(merged, null, 2), { mode: 0o600 });
+    } catch {
+      // Local config unreadable — skip sync, global save already succeeded
+    }
+  }
 }
 
 export function saveLocalConfig(cfg) {

package/src/mutations.js

@@ -0,0 +1,52 @@
+// Centralized mutation command registry
+// Used by the read-only profile middleware to block mutation commands.
+// Each entry is a command path array matching argv._ tokens.
+
+export const MUTATION_COMMANDS = [
+  // Incidents
+  ['incidents', 'create'],
+  ['incidents', 'update'],
+  ['incidents', 'delete'],
+  // Changes
+  ['changes', 'create'],
+  ['changes', 'update'],
+  ['changes', 'delete'],
+  // Records
+  ['records', 'create'],
+  ['records', 'update'],
+  ['records', 'delete'],
+  // Requests
+  ['requests', 'create'],
+  ['requests', 'update'],
+  ['requests', 'delete'],
+  // Tasks
+  ['tasks', 'create'],
+  ['tasks', 'update'],
+  ['tasks', 'delete'],
+  // Dev
+  ['dev', 'eval'],
+  ['dev', 'updatesets', 'set'],
+  ['dev', 'updatesets', 'create'],
+  ['dev', 'scopes', 'set'],
+];
+
+/**
+ * Check if the parsed argv matches any mutation command pattern.
+ * @param {object} argv — yargs parsed argv with `_` array
+ * @returns {boolean}
+ */
+export function isMutationCommand(argv) {
+  const cmd = argv._ || [];
+  for (const pattern of MUTATION_COMMANDS) {
+    if (pattern.length !== cmd.length) continue;
+    let match = true;
+    for (let i = 0; i < pattern.length; i++) {
+      if (pattern[i] !== cmd[i]) {
+        match = false;
+        break;
+      }
+    }
+    if (match) return true;
+  }
+  return false;
+}

package/src/output.js

@@ -192,12 +192,15 @@ export class OutputWriter {
             staleStr = ` (${p.days_since_last_seen}d ago — may have been released)`;
           }
 
+          // Show lock icon for read-only profiles
+          const lockIcon = p.read_only ? ' 🔒' : '';
+
           if (p.name) {
-            this.writer.write(`${prefix}${authIcon} ${p.name} — ${p.instance}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.name} — ${p.instance}${lockIcon}${verifiedStr}${staleStr}\n`);
           } else if (p.username) {
-            this.writer.write(`${prefix}${authIcon} ${p.instance} (as ${p.username})${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.instance} (as ${p.username})${lockIcon}${verifiedStr}${staleStr}\n`);
           } else {
-            this.writer.write(`${prefix}${authIcon} ${p.instance}${verifiedStr}${staleStr}\n`);
+            this.writer.write(`${prefix}${authIcon} ${p.instance}${lockIcon}${verifiedStr}${staleStr}\n`);
           }
         }
       }