@jacebenson/jsn 4.2.3 → 4.3.0

package/src/cli.js

@@ -30,7 +30,7 @@ import { groupMembersCmd } from './commands/groupmembers.js';
 import { groupRolesCmd } from './commands/grouproles.js';
 import { ticketsCmd } from './commands/tickets.js';
 import { transactionsCmd } from './commands/transactions.js';
-import { instanceCmd } from './commands/instance.js';
+
 import { platformCmd } from './commands/platform.js';
 import { codesearchCmd } from './commands/codesearch.js';
 import { versionCmd } from './commands/version.js';
@@ -51,11 +51,12 @@ import {
   catalogscriptsCmd, cataloguipoliciesCmd,
   uipoliciesCmd,
   scriptactionsCmd, scheduledjobsCmd, asyncrulesCmd, triggersCmd,
-  decisiontablesCmd, assignmentsCmd,
+  assignmentsCmd,
   emailCmd,
   restmessageCmd, soapmessagesCmd,
   uimacrosCmd, uxlistsCmd, uxapplicabilityCmd,
 } from './commands/dev/_simple.js';
+import { decisiontablesCmd } from './commands/decisiontables.js';
 import { flowsCmd } from './commands/dev/flows.js';
 import { formsCmd } from './commands/dev/forms.js';
 import { listsCmd } from './commands/dev/lists.js';
@@ -69,6 +70,7 @@ import { scrapiCmd } from './commands/dev/scrapi.js';
 import { b4rulesCmd } from './commands/dev/b4rules.js';
 import { atfCmd } from './commands/atf.js';
 import { approvalsCmd } from './commands/approvals.js';
+import { perfCmd } from './commands/perf.js';
 
 function wrap(handler) {
   return async (argv) => {
@@ -167,15 +169,19 @@ export function buildCLI() {
       // / app._overrideInstance change — no more argv._overrideInstance mirror
       // or duplicated --instance branches across middlewares.
       (argv) => {
-        const session = resolveSession(argv, cfg);
-        if (session.unknownProfile) {
-          guardExit(argv, {
-            code: 'unknown_profile',
-            message: `Unknown profile "${session.unknownProfile}"`,
-            hint: 'Run "jsn auth status" to list profiles.',
-          });
+        try {
+          const session = resolveSession(argv, cfg);
+          if (session.unknownProfile) {
+            guardExit(argv, {
+              code: 'unknown_profile',
+              message: `Unknown profile "${session.unknownProfile}"`,
+              hint: 'Run "jsn auth status" to list profiles.',
+            });
+          }
+          applySession(app, session);
+        } catch (err) {
+          guardExit(argv, { code: err.code || 'usage', message: err.message, hint: err.hint });
         }
-        applySession(app, session);
       },
       // Guard mutation commands: require an instance, block read-only profiles
       (argv) => {
@@ -358,7 +364,7 @@ export function buildCLI() {
     .command(cmdbCmd(wrap))
     .command(recordsCmd(wrap))
     .command(transactionsCmd(wrap))
-    .command(instanceCmd(wrap))
+
     .command(platformCmd(wrap))
     .command(snippetsCmd(wrap))
     .command(ticketsCmd(wrap))
@@ -366,6 +372,7 @@ export function buildCLI() {
     // DEVELOPER
     .command(atfCmd(wrap))
     .command(approvalsCmd(wrap))
+    .command(perfCmd(wrap))
     .command(evalCmd(wrap))
     .command(restCmd(wrap))
     .command(skillCmd(wrap))

package/src/commands/auth.js

@@ -82,18 +82,51 @@ export function resolveInstanceArg(arg, cfg) {
   return normalizeInstanceURL(`${trimmed}.service-now.com`);
 }
 
+/** Resolve a command target by explicit profile name before instance fallback. */
+export function resolveTargetProfile(argv = {}, cfg = {}, instanceURL = '') {
+  if (argv.profile && cfg.profiles?.[argv.profile]) {
+    return { name: argv.profile, profile: cfg.profiles[argv.profile] };
+  }
+  const entry = Object.entries(cfg.profiles || {})
+    .find(([, profile]) => normalizeInstanceURL(profile.instance_url) === instanceURL);
+  return entry ? { name: entry[0], profile: entry[1] } : { name: null, profile: null };
+}
+
 /**
  * Select the login method. Explicit Basic Auth wins; otherwise reuse the
  * method recorded on an existing profile. New instances remain OAuth by
  * default.
  */
-export function shouldUseBasicAuth(argv = {}, cfg = {}, instanceURL = '') {
+export function shouldUseBasicAuth(argv = {}, cfg = {}, instanceURL = '', targetProfile = null) {
   if (argv.basic || argv.password) return true;
+  if (targetProfile) return targetProfile.auth_method === 'basic';
   return Object.values(cfg.profiles || {}).some(profile =>
     profile.instance_url === instanceURL && profile.auth_method === 'basic'
   );
 }
 
+export function shouldUseGckAuth(argv = {}, cfg = {}, instanceURL = '', targetProfile = null) {
+  if (argv.gck || argv.headers) return true;
+  if (targetProfile) return targetProfile.auth_method === 'gck';
+  return Object.values(cfg.profiles || {}).some(profile =>
+    profile.instance_url === instanceURL && profile.auth_method === 'gck'
+  );
+}
+
+export function validateLoginSelectors(argv = {}, targetProfile = null) {
+  const basic = argv.basic === true || argv.password === true;
+  const gck = argv.gck === true || argv.headers !== undefined;
+  if (basic && gck) {
+    throw errUsage('Basic and browser-session selectors are mutually exclusive; choose --basic/--password or --gck/--headers.');
+  }
+  if (basic && targetProfile?.auth_method === 'gck') {
+    throw errUsage('This profile is configured for gck authentication; use --gck/--headers or change the profile method.');
+  }
+  if (gck && targetProfile?.auth_method === 'basic') {
+    throw errUsage('This profile is configured for basic authentication; use --basic/--password or change the profile method.');
+  }
+}
+
 /**
  * Pick a profile by name — interactive search picker when ambiguous,
  * auto-selects when there's exactly one, throws when none configured.
@@ -129,6 +162,46 @@ export function resolveWizardInstance(app, argv = {}) {
   return process.env.SERVICENOW_INSTANCE_URL || app._overrideInstance || argv.instance || '';
 }
 
+export async function readBrowserSessionInput() {
+  const stdin = process.stdin;
+  console.log('Paste the complete cURL command, then press Ctrl+D:');
+  if (!stdin.isTTY || typeof stdin.setRawMode !== 'function') {
+    const chunks = [];
+    for await (const chunk of stdin) chunks.push(chunk);
+    return Buffer.concat(chunks).toString();
+  }
+
+  return new Promise((resolve, reject) => {
+    let pasted = '';
+    const finish = () => {
+      stdin.setRawMode(false);
+      stdin.pause();
+      stdin.removeListener('data', onData);
+      stdin.removeListener('error', onError);
+      process.stdout.write('\n');
+    };
+    const onError = (err) => { finish(); reject(err); };
+    const onData = (chunk) => {
+      const text = chunk.toString();
+      const eof = text.indexOf('\x04');
+      if (eof !== -1) {
+        pasted += text.slice(0, eof);
+        finish();
+        resolve(pasted);
+      } else if (text.includes('\x03')) {
+        finish();
+        reject(new Error('Browser session input cancelled'));
+      } else {
+        pasted += text;
+      }
+    };
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on('data', onData);
+    stdin.on('error', onError);
+  });
+}
+
 /**
  * Interactive first-run wizard (formerly `jsn setup`).
  *
@@ -139,7 +212,7 @@ export function resolveWizardInstance(app, argv = {}) {
  */
 export async function loginWizard(app, argv = {}) {
   const readline = (await import('node:readline')).default;
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  let rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
 
   console.log('Welcome to JSN - ServiceNow CLI');
@@ -174,24 +247,31 @@ export async function loginWizard(app, argv = {}) {
     profile.skip_confirmations = true;
   }
 
-  const authMethod = await ask('Authentication method (OAuth/Basic) [OAuth]: ');
-  const useBasic = authMethod.toLowerCase().startsWith('b');
+  const authMethod = await ask('Authentication method (OAuth/Basic/Browser session) [OAuth]: ');
+  const useGck = authMethod.toLowerCase().startsWith('g') || authMethod.toLowerCase().startsWith('browser');
+  const useBasic = !useGck && authMethod.toLowerCase().startsWith('b');
 
   let loggedIn = false;
   if (useBasic) {
     const username = await ask('Username: ');
     rl.close(); // Close outer readline before askHidden creates its own
-    const { loadCredentials, askHidden, saveCredentials } = await import('../auth.js');
-    const existingCreds = loadCredentials(instance) || loadCredentials(instance, username);
+    const { askHidden } = await import('../auth.js');
+    const existingCreds = app.auth.loadCredentials(instance) || app.auth.loadCredentials(instance, username);
     if (existingCreds && existingCreds.auth_method === 'basic') {
       console.log(`Using existing credentials for ${instance}`);
     } else {
       const password = await askHidden('Password: ');
-      saveCredentials(instance, { auth_method: 'basic', username, password }, username);
+      app.auth.saveCredentials(instance, { auth_method: 'basic', username, password }, username);
       console.log('Basic auth credentials saved');
     }
     profile.username = username;
     profile.auth_method = 'basic';
+  } else if (useGck) {
+    rl.close();
+    const input = await readBrowserSessionInput();
+    await app.auth.loginWithGck(instance, input);
+    profile.auth_method = 'gck';
+    loggedIn = true;
   } else {
     profile.auth_method = 'oauth';
   }
@@ -205,6 +285,11 @@ export async function loginWizard(app, argv = {}) {
   // so a piped/scripted call never blocks on prompts.
   const { canPrompt } = await import('../helpers.js');
   if (canPrompt()) {
+    // @inquirer/prompts owns stdin while these confirmations run. Close the
+    // older readline interface before handing stdin to Inquirer. This matters
+    // on Windows Git Bash: leaving both readers attached can make the later
+    // OAuth question see EOF and let Node exit instead of waiting for input.
+    rl.close();
     const { confirm } = await import('@inquirer/prompts');
     profile.read_only = await confirm({ message: 'Read-only profile (blocks mutation commands)?', default: profile.read_only || false });
     profile.skip_confirmations = await confirm({ message: 'Skip confirmations (deletes run without prompting)?', default: profile.skip_confirmations || false });
@@ -214,23 +299,22 @@ export async function loginWizard(app, argv = {}) {
 
   await saveConfig(app.config);
 
-  if (!useBasic) {
+  if (!useBasic && !useGck) {
+    // Recreate readline after Inquirer has released stdin. Do not reuse the
+    // interface that was open before the confirmation prompts.
+    rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const loginNow = await ask('Login now? [Y/n]: ');
     rl.close();
     if (!loginNow || loginNow.toLowerCase() !== 'n') {
       await app.auth.login(instance);
       // Re-save credentials under <user>@<instance> after verifying username
       try {
-        const { SDKClient } = await import('../sdk.js');
-        const sdk = new SDKClient(instance, app.auth);
+        const sdk = app.getSDKForProfile
+          ? app.getSDKForProfile(instance, { authMethod: 'oauth' })
+          : app.sdk;
         const user = await sdk.getCurrentUser();
         if (user && user.user_name) {
-          const { loadCredentials, saveCredentials } = await import('../auth.js');
-          const stored = loadCredentials(instance);
-          if (stored && stored.access_token) {
-            stored.username = user.user_name;
-            saveCredentials(instance, stored, user.user_name);
-          }
+          app.auth.migrateLegacyCredential(instance, user.user_name);
           profile.username = user.user_name;
         }
       } catch {
@@ -242,9 +326,14 @@ export async function loginWizard(app, argv = {}) {
       // Probe domain separation capability once and stamp the profile, so
       // `jsn domains` (and its help entry) only appear on instances with it.
       try {
-        const { SDKClient } = await import('../sdk.js');
         const domainsMod = await import('./dev/domains.js');
-        const sdk = new SDKClient(instance, app.auth);
+        const sdk = app.getSDKForProfile
+          ? app.getSDKForProfile(instance, {
+            profile,
+            authMethod: profile.auth_method || 'oauth',
+            username: profile.username,
+          })
+          : app.sdk;
         profile.domain_separation = await domainsMod.isDomainSeparationInstalled({ sdk });
         await setProfile(app.config, profileName, profile);
 
@@ -348,8 +437,9 @@ export async function modifyProfile(app, argv = {}) {
       return;
     }
     const { isDomainSeparationInstalled } = await import('./dev/domains.js');
-    const { SDKClient } = await import('../sdk.js');
-    const sdk = new SDKClient(profile.instance_url, app.auth);
+    const sdk = app.getSDKForProfile
+      ? app.getSDKForProfile(profile.instance_url, { profile, authMethod: profile.auth_method, username: profile.username })
+      : app.sdk;
     if (!(await isDomainSeparationInstalled({ sdk }))) {
       throw new Error(`Domain separation is not installed on ${profile.instance_url}`);
     }
@@ -374,8 +464,9 @@ export async function modifyProfile(app, argv = {}) {
         value: 'domain',
       });
     }
-    const { SDKClient } = await import('../sdk.js');
-    const sdk = new SDKClient(profile.instance_url, app.auth);
+    const sdk = app.getSDKForProfile
+      ? app.getSDKForProfile(profile.instance_url, { profile, authMethod: profile.auth_method, username: profile.username })
+      : app.sdk;
     flag = await select({
       message: `Modify ${name} (${profile.instance_url})`,
       choices,
@@ -420,22 +511,38 @@ export async function removeProfile(app, name) {
   if (!app.config.profiles[name]) {
     throw new Error(`Profile not found: ${name}`);
   }
-  const instance = app.config.profiles[name].instance_url;
+  const profile = app.config.profiles[name];
+  const instance = profile.instance_url;
+  const otherBareProfiles = Object.entries(app.config.profiles)
+    .filter(([profileName, other]) => profileName !== name
+      && other.instance_url === instance
+      && !other.username)
+    .length;
   delete app.config.profiles[name];
   if (app.config.defaultProfile === name) app.config.defaultProfile = '';
   if (app.config.activeProfile === name) app.config.activeProfile = '';
   saveConfig(app.config);
 
-  // Only clear credentials if no other profile uses this instance URL
-  const stillInUse = instance && Object.values(app.config.profiles || {})
-    .some(p => p.instance_url === instance);
-  if (instance && !stillInUse) {
-    app.auth.logout(instance);
+  // Delete only this profile's credential identity. Other profiles may share
+  // the instance URL but must retain their separate credentials.
+  if (instance && (profile.username || otherBareProfiles === 0)) {
+    app.auth.logout(instance, profile.username || null);
   }
 
   app.ok({ removed: name }, { summary: `Removed profile: ${name}` });
 }
 
+/** Bare credentials are safe to clear only when their target is identifiable. */
+function canLogoutBareProfile(app, instance, target, explicitlySelected) {
+  if (target?.username) return true;
+  const sameInstance = Object.entries(app.config.profiles || {})
+    .filter(([, profile]) => profile.instance_url === instance);
+  if (explicitlySelected) {
+    return sameInstance.filter(([, profile]) => !profile.username).length === 1;
+  }
+  return sameInstance.length <= 1;
+}
+
 export function authCmd(wrap) {
   return {
     command: 'auth [subcommand]',
@@ -455,6 +562,14 @@ export function authCmd(wrap) {
               describe: 'Authenticate with Basic Auth via env vars (SN_USERNAME/SN_PASSWORD)',
               type: 'boolean',
             })
+            .option('gck', {
+              describe: 'Authenticate with a browser session from pasted request headers',
+              type: 'boolean',
+            })
+            .option('headers', {
+              describe: 'Browser request headers or cURL command for browser-session auth',
+              type: 'string',
+            })
             .option('print-url', {
               describe: 'Print the OAuth URL and exit (saves PKCE state for --code)',
               type: 'boolean',
@@ -479,7 +594,15 @@ export function authCmd(wrap) {
             }),
           handler: wrap(async (argv, app) => {
             let instanceURL;
-            if (argv.instance) {
+            if (argv.profile) {
+              const namedProfile = app.config.profiles?.[argv.profile];
+              if (!namedProfile?.instance_url) {
+                throw errUsage(`Profile "${argv.profile}" is not configured.`);
+              }
+              // An explicit profile is authoritative, including in an
+              // interactive terminal. Never let the picker retarget it.
+              instanceURL = normalizeInstanceURL(namedProfile.instance_url);
+            } else if (argv.instance) {
               instanceURL = resolveInstanceArg(argv.instance, app.config);
             } else if (app.isInteractive()) {
               // gh-faithful: interactive terminals always get a picker —
@@ -517,18 +640,28 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
               }
             }
 
-            const targetProfile = Object.values(app.config.profiles || {})
-              .find(profile => profile.instance_url === instanceURL);
-            const targetUsername = targetProfile?.username || '';
-            const useBasic = shouldUseBasicAuth(argv, app.config, instanceURL);
+            const target = resolveTargetProfile(argv, app.config, instanceURL);
+            const targetProfile = target.profile;
+            validateLoginSelectors(argv, targetProfile);
+            let targetUsername = targetProfile?.username || '';
+            const useBasic = shouldUseBasicAuth(argv, app.config, instanceURL, targetProfile);
+            const useGck = shouldUseGckAuth(argv, app.config, instanceURL, targetProfile);
             // --basic (with --password as a compatibility alias): authenticate
             // with basic auth from env vars and persist it for this profile.
-            if (useBasic) {
-              await app.auth.loginWithPassword(instanceURL, targetUsername || undefined);
+            if (useGck) {
+              const input = argv.headers || await readBrowserSessionInput();
+              const credentials = await app.auth.loginWithGck(instanceURL, input, targetUsername || undefined);
+              targetUsername = credentials?.username || targetUsername;
+            } else if (useBasic) {
+              const credentials = await app.auth.loginWithPassword(instanceURL, targetUsername || undefined);
+              // A new profile has no configured username yet. The auth
+              // manager saves env/stored credentials under creds.username;
+              // carry that identity into verification and profile creation.
+              targetUsername = credentials?.username || targetUsername;
             }
             // --print-url with --wait-file: print URL and wait for code file
             else if (argv.printUrl && argv.waitFile) {
-              await app.auth.buildAuthURL(instanceURL, argv.waitFile);
+              await app.auth.buildAuthURL(instanceURL, argv.waitFile, targetUsername || undefined);
             }
             // --print-url: just print the URL and exit
             else if (argv.printUrl) {
@@ -538,21 +671,32 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
             }
             // --code: exchange the provided authorization code directly
             else if (argv.code) {
-              await app.auth.loginWithCode(instanceURL, argv.code);
+              await app.auth.loginWithCode(instanceURL, argv.code, targetUsername || undefined);
             } else {
               // Interactive: full OAuth flow with browser + prompt
-              await app.auth.login(instanceURL);
+              await app.auth.login(instanceURL, targetUsername || undefined);
             }
 
             // Verify auth by fetching current user
             let username = '';
             try {
-              if (!app.sdk || targetUsername) {
-                const { SDKClient } = await import('../sdk.js');
-                const authProvider = targetUsername
-                  ? { getCredentials: () => app.auth.getCredentialsFor(instanceURL, targetUsername) }
-                  : app.auth;
-                app.sdk = new SDKClient(instanceURL, authProvider);
+              const activeName = app.config.activeProfile || app.config.defaultProfile;
+              const activeProfile = app.config.profiles?.[activeName];
+              const activeInstance = app.getEffectiveInstance?.() || activeProfile?.instance_url || '';
+              const activeUsername = activeProfile?.username || '';
+              const activeMethod = activeProfile?.auth_method || '';
+              const targetMethod = useGck ? 'gck' : useBasic ? 'basic' : 'oauth';
+              const targetDiffers = instanceURL !== activeInstance
+                || targetUsername !== activeUsername
+                || targetMethod !== activeMethod;
+              if (!app.sdk || targetDiffers) {
+                app.sdk = app.getSDKForProfile
+                  ? app.getSDKForProfile(instanceURL, {
+                    authMethod: targetMethod,
+                    username: targetUsername,
+                    profile: targetProfile,
+                  })
+                  : app.sdk;
               }
               const user = await app.sdk.getCurrentUser();
               username = user?.user_name || user?.name || '';
@@ -560,17 +704,24 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
               // Non-fatal — token is saved, just couldn't verify
             }
 
+            // Basic/GCK auth establishes the target identity before the
+            // profile exists; preserve it when verification is unavailable.
+            username = username || targetUsername;
+
             // Save to profiles — deduplicate by instance URL
             if (!app.config.profiles) {
               app.config.profiles = {};
             }
 
-            // Check if a profile already exists for this instance
-            let profileName = null;
-            for (const [existingName, existingProfile] of Object.entries(app.config.profiles)) {
-              if (existingProfile.instance_url === instanceURL) {
-                profileName = existingName;
-                break;
+            // Preserve an explicitly selected profile even when another profile
+            // shares the same instance URL.
+            let profileName = target.name;
+            if (!profileName) {
+              for (const [existingName, existingProfile] of Object.entries(app.config.profiles)) {
+                if (existingProfile.instance_url === instanceURL) {
+                  profileName = existingName;
+                  break;
+                }
               }
             }
 
@@ -582,7 +733,7 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
             app.config.profiles[profileName] = {
               ...(app.config.profiles[profileName] || {}),
               instance_url: instanceURL,
-              auth_method: useBasic ? 'basic' : 'oauth',
+              auth_method: useGck ? 'gck' : useBasic ? 'basic' : 'oauth',
               username: username || undefined,
               read_only: argv['read-only'] || undefined,
               skip_confirmations: argv['skip-confirmations'] || undefined,
@@ -594,7 +745,7 @@ Find your instance URL in your browser's address bar when logged into ServiceNow
             // The legacy bare-instance key is cleaned up behind the
             // AuthManager seam (credential-store internals don't leak here).
             if (!useBasic && username) {
-              app.auth.migrateLegacyCredential(instanceURL, username);
+              app.auth.migrateLegacyCredential?.(instanceURL, username);
             }
 
             // Set as default if this is the first one
@@ -637,40 +788,69 @@ Examples:
   jsn auth logout https://dev12345.service-now.com`);
               }
             }
-            app.auth.logout(instanceURL);
+            const target = resolveTargetProfile(argv, app.config, instanceURL);
+            const username = target.profile?.username ?? null;
+            if (username || canLogoutBareProfile(app, instanceURL, target.profile, !!argv.profile)) {
+              app.auth.logout(instanceURL, username);
+            }
             app.ok({ logged_out: true, instance: instanceURL }, { summary: `✓ Logged out from ${instanceURL}` });
           }),
         })
         .command({
           command: 'status',
           describe: 'Show detailed authentication status',
-          handler: wrap(async (_argv, app) => {
-            const defaultInstance = getEffectiveInstance(app.config);
+          handler: wrap(async (argv, app) => {
+            const configuredDefault = app.config.profiles?.[app.config.defaultProfile];
+            const defaultInstance = configuredDefault?.instance_url || app.config.instanceURL || '';
 
             // Check environment auth
             const envToken = process.env.SERVICENOW_OAUTH_TOKEN || '';
 
             const profiles = [];
-            for (const [name, profile] of Object.entries(app.config.profiles || {})) {
+            const configuredProfiles = Object.entries(app.config.profiles || {});
+            const selectedProfiles = argv.profile
+              ? configuredProfiles.filter(([name]) => name === argv.profile)
+              : configuredProfiles;
+            for (const [name, profile] of selectedProfiles) {
               const instance = profile.instance_url;
-              const isAuth = app.auth.isAuthenticatedFor(instance);
-              const lastSeen = app.auth.getLastSeen(instance);
-              const authSource = isAuth ? app.auth.getAuthSource(instance) : null;
-              const legacy = !isAuth && app.auth.hasLegacyCredentials(instance) ? true : undefined;
+              const authOptions = { authMethod: profile.auth_method, username: profile.username };
+              const identityOptions = { username: profile.username, authMethod: profile.auth_method };
+              const isAuth = app.auth.isAuthenticatedFor(instance, identityOptions);
+              const lastSeen = app.auth.getLastSeen(instance, identityOptions);
+              const authState = app.auth.getAuthState(instance, authOptions);
+              const legacy = !isAuth && app.auth.hasLegacyCredentials(instance, identityOptions) ? true : undefined;
+              // Keep the established status field contract: unauthenticated
+              // profiles omit auth_source, except legacy credentials retain
+              // their historical `legacy` marker. getAuthState remains the
+              // safe metadata seam for authenticated profiles.
+              const authSource = isAuth ? authState.auth_source : (legacy ? 'legacy' : undefined);
 
-              // Try live verification
+              // Try live verification through AuthManager's read-only probe seam.
               let verified = null;
               let verifiedAt = null;
-              if (isAuth && instance) {
+              let probe;
+              if (!instance) {
+                probe = app.auth.probeUnavailable?.('missing_instance') || { status: 'not_attempted', code: 'missing_instance', classification: 'unavailable' };
+              } else {
                 try {
-                  const { SDKClient } = await import('../sdk.js');
-                  const sdk = new SDKClient(instance, app.auth);
-                  const user = await sdk.getCurrentUser();
-                  if (user && user.user_name) {
+                  const sdk = app.getSDKForProfile
+                    ? app.getSDKForProfile(instance, { ...authOptions, profile })
+                    : app.sdk || { getCurrentUser: async () => null };
+                  let user;
+                  probe = await app.auth.probeCurrentUser(instance, {
+                    getCurrentUser: async (options) => {
+                      user = await sdk.getCurrentUser(options);
+                      return user;
+                    },
+                  }, authOptions);
+                  if (probe.status === 'succeeded' && user?.user_name) {
                     verified = true;
                     verifiedAt = user.user_name;
+                  } else if (probe.status !== 'not_attempted') {
+                    verified = false;
                   }
                 } catch {
+                  probe = app.auth.probeUnavailable?.('sdk_construction_failed') || { status: 'not_attempted', code: 'sdk_construction_failed', classification: 'configuration_error' };
                   verified = false;
                 }
               }
@@ -686,16 +866,22 @@ Examples:
                 instance,
                 authenticated: isAuth,
                 legacy,
-                auth_source: authSource || (legacy ? 'legacy' : undefined),
+                auth_source: authSource,
                 verified,
                 verified_as: verifiedAt || undefined,
                 last_seen: lastSeen || undefined,
                 days_since_last_seen: daysSinceLastSeen,
                 stale: daysSinceLastSeen > 7,
-                default: instance === defaultInstance,
+                default: name === app.config.defaultProfile,
                 read_only: profile.read_only || false,
                 skip_confirmations: profile.skip_confirmations || false,
                 include_counts: profile.include_counts !== false,
+                diagnostics: {
+                  auth_method: authState.auth_method,
+                  auth_source: authState.auth_source,
+                  state: authState.state,
+                  probe,
+                },
               });
             }
 
@@ -746,17 +932,31 @@ Examples:
               }
             }
 
-            const creds = await app.auth.getCredentialsFor(instanceURL);
-            const refreshed = await app.auth.refreshToken(instanceURL, creds);
+            const target = resolveTargetProfile(argv, app.config, instanceURL);
+            const targetProfile = target.profile;
+            const targetAuthOptions = {
+              authMethod: targetProfile ? targetProfile.auth_method : 'oauth',
+              username: targetProfile?.username,
+            };
+            const creds = await app.auth.getCredentialsFor(
+              instanceURL,
+              targetProfile?.username,
+              targetAuthOptions
+            );
+            const refreshed = await app.auth.refreshToken(instanceURL, creds, targetProfile?.username ?? null);
 
             // Re-probe domain separation on refresh so the capability flag
             // stays in sync if the plugin was installed/removed since setup.
             try {
-              const { SDKClient } = await import('../sdk.js');
               const { isDomainSeparationInstalled } = await import('./dev/domains.js');
-              const sdk = new SDKClient(instanceURL, app.auth);
+              const sdk = app.getSDKForProfile
+                ? app.getSDKForProfile(instanceURL, {
+                  ...targetAuthOptions,
+                  profile: targetProfile,
+                })
+                : app.sdk;
               const hasDS = await isDomainSeparationInstalled({ sdk });
-              const name = app.config.activeProfile || app.config.defaultProfile;
+              const name = target.name || app.config.activeProfile || app.config.defaultProfile;
               if (name && app.config.profiles[name] && app.config.profiles[name].instance_url === instanceURL) {
                 app.config.profiles[name].domain_separation = hasDS;
                 await saveConfig(app.config);