@lambdacurry/arbor 0.21.42 → 0.21.44

package/README.md

@@ -30,6 +30,39 @@ arbor auth <token> --url https://your-arbor.example
 arbor whoami
 ```
 
+## Named profiles
+
+Keep human/owner and agent credentials in separate owner-only files instead of copying tokens or switching one shared config. Named profile credentials live under `~/.arbor/profiles/`; the token-free local registry stores only the configured default profile. Arbor still resolves the actual identity from the selected credential server-side.
+
+```bash
+# Save credentials into separate profile files.
+arbor auth <agent-token> --profile agent
+arbor auth <owner-token> --profile owner
+
+# Ordinary commands now use the least-privileged agent profile.
+arbor profile set-default agent
+arbor whoami
+
+# Explicitly use the owner for one command only; the next command returns to the default.
+arbor whoami --profile owner
+arbor whoami
+
+# Automation can select the same one-command profile without changing the default.
+ARBOR_PROFILE=owner arbor whoami
+```
+
+Without `ARBOR_CONFIG`, selection precedence is `--profile` → `ARBOR_PROFILE` → configured default → legacy `~/.arbor/config.json`. When `ARBOR_CONFIG` is set by itself it is decisive and bypasses the configured default; combining it with `--profile` or `ARBOR_PROFILE` fails as ambiguous instead of guessing. `ARBOR_TOKEN` and `ARBOR_API_URL` remain headless overrides after the credential target is selected.
+
+Profile management never prints credential material:
+
+```bash
+arbor profile list
+arbor profile show agent
+arbor profile set-default agent
+arbor profile clear-default
+arbor profile delete owner
+```
+
 ## Agent self-registration (AD-109)
 
 An agent can register _itself_ with a device-code-style handshake. A human mints a one-time **pairing key** in the Arbor web app (Settings → "Have an agent register itself") and hands it to the agent. The agent then:

package/dist/arbor.js

@@ -16,7 +16,7 @@ var __export = (target, all) => {
 // package.json
 var package_default = {
   name: "@lambdacurry/arbor",
-  version: "0.21.42",
+  version: "0.21.44",
   description: "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   keywords: [
     "agents",
@@ -18081,7 +18081,20 @@ var MCP_OUTPUT_SCHEMAS = {
     generations: exports_external.array(jsonObject),
     sessions: exports_external.array(jsonObject),
     lineage: exports_external.array(jsonObject),
-    reprovisions: exports_external.array(jsonObject)
+    reprovisions: exports_external.array(jsonObject),
+    recoverySafety: exports_external.looseObject({
+      state: exports_external.enum([
+        "safe-to-restore",
+        "possible-uncheckpointed-work",
+        "unknown-mutation-outcome",
+        "unknown-baseline"
+      ]),
+      computerId: id,
+      durableSnapshotId: id.nullable(),
+      started: exports_external.number().int().min(0),
+      acknowledged: exports_external.number().int().min(0),
+      durable: exports_external.number().int().min(0).nullable()
+    }).nullable().optional()
   }),
   computer_inventory: exports_external.looseObject({
     computers: exports_external.array(jsonObject),
@@ -18715,6 +18728,15 @@ function selectedArray(value, fields) {
     return;
   return value.map((entry) => selected(entry, fields) ?? {});
 }
+function omitNull(value) {
+  return value === null ? undefined : value;
+}
+var PROVIDER_NATIVE_EXECUTION = new Set(["foreground", "background"]);
+function omitProviderNativeExecution(value) {
+  if (typeof value === "string" && PROVIDER_NATIVE_EXECUTION.has(value))
+    return;
+  return omitNull(value);
+}
 var OUTPUT_SHAPERS = {
   contribute: (result) => defined([
     ["contributionId", result.contributionId],
@@ -18884,14 +18906,14 @@ var OUTPUT_SHAPERS = {
     ]);
   },
   computer_exec: (result, input) => defined([
-    ["stdout", result.stdout],
-    ["stderr", result.stderr],
-    ["exitCode", result.exitCode],
-    ["processId", result.processId],
-    ["status", result.status],
-    ["execution", result.execution],
-    ["nextAction", result.nextAction],
-    ["cwd", input.cwd === undefined ? result.cwd : undefined]
+    ["stdout", omitNull(result.stdout)],
+    ["stderr", omitNull(result.stderr)],
+    ["exitCode", omitNull(result.exitCode)],
+    ["processId", omitNull(result.processId)],
+    ["status", omitNull(result.status)],
+    ["execution", omitProviderNativeExecution(result.execution)],
+    ["nextAction", omitNull(result.nextAction)],
+    ["cwd", input.cwd === undefined ? omitNull(result.cwd) : undefined]
   ]),
   computer_process_read: (result) => defined([
     ["processId", result.processId],
@@ -18924,8 +18946,10 @@ function shapeActionOutput(actionName, value, input = {}) {
   if (!schema)
     throw new Error(`${actionName}: compact action is missing an output schema`);
   const parsed = schema.safeParse(publicValue);
-  if (!parsed.success)
-    throw new Error(`${actionName}: action returned an invalid public result`);
+  if (!parsed.success) {
+    const paths = parsed.error.issues.map((issue2) => issue2.path.map(String).join(".") || "root");
+    throw new Error(`${actionName}: action returned an invalid public result (${paths.join(", ")})`);
+  }
   return parsed.data;
 }
 // ../actions/src/tool-annotations.ts
@@ -19930,7 +19954,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_status",
     title: "Inspect a computer",
-    description: "Inspect the live PARENT Thread Computer's capabilities, execution readiness, processes, and profile. Transient session unavailability drops command capabilities and may retry computer_open once; a terminal unknown mutation is a non-retryable stop — this does not report isolated Run command state, so use computer_run_receipt for Run state or get_computer for durable lineage.",
+    description: "Inspect the live PARENT Thread Computer's capabilities, live can-I-exec readiness, processes, and profile. Transient session unavailability drops command capabilities and may retry computer_open once; a terminal unknown mutation is a non-retryable stop — this does not report isolated Run command state, so use computer_run_receipt for Run state or get_computer for restore-safety.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…")
     },
@@ -20128,7 +20152,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "get_computer",
     title: "Read a Thread computer",
-    description: "Inspect a Thread's durable Computer recipe/materialization state, compatibility, snapshot lineage, recent receipts, Runs, and reprovision outcomes; setup content and credentials stay redacted. Use computer_open or computer_status for live execution state; this surface reports durable Arbor protocol state.",
+    description: "Inspect a Thread's durable Computer recipe/materialization state, compatibility, snapshot lineage, recoverySafety, recent receipts, Runs, and reprovision outcomes; setup content and credentials stay redacted. readiness here is restore-safety (decision-required means Arbor will not silently restore); use computer_status for whether the opened session can exec now.",
     inputSchema: {
       threadId: exports_external.string().describe("the Thread, thr_…"),
       lineageLimit: exports_external.number().int().min(1).max(100).optional().describe("recent receipts/lineage rows (default 20)")
@@ -21831,105 +21855,16 @@ var ACTIONS3 = [...ACTIONS2, ...RECOVERY_ACTIONS];
 import {
   chmodSync,
   existsSync,
+  lstatSync,
   mkdirSync,
   readFileSync,
+  readdirSync,
   rmSync,
   statSync,
   writeFileSync
 } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-var CONFIG_PATH = process.env.ARBOR_CONFIG ?? join(homedir(), ".arbor", "config.json");
-var DEFAULT_API_URL = process.env.ARBOR_API_URL ?? "https://arborthreads.com";
-var DEFAULT_CONFIG_PATH = join(homedir(), ".arbor", "config.json");
-var DEFAULT_TOKEN_OVERWRITE_REFUSAL = "refusing to overwrite ~/.arbor/config.json — a token already exists. Set ARBOR_CONFIG to an isolated path (e.g. ~/.arbor/<agent>.config.json) and retry.";
-var LOCK_TIMEOUT_MS = 5000;
-var LOCK_STALE_MS = 30000;
-var LOCK_POLL_MS = 20;
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function acquireConfigLock(configPath) {
-  const lockPath = `${configPath}.lock`;
-  const deadline = Date.now() + LOCK_TIMEOUT_MS;
-  for (;; ) {
-    try {
-      mkdirSync(lockPath);
-      return () => {
-        try {
-          rmSync(lockPath, { recursive: true, force: true });
-        } catch {}
-      };
-    } catch (err) {
-      if (err?.code !== "EEXIST")
-        throw err;
-      try {
-        if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
-          rmSync(lockPath, { recursive: true, force: true });
-          continue;
-        }
-      } catch {
-        continue;
-      }
-      if (Date.now() >= deadline) {
-        throw new Error(`timed out waiting for another arbor process to finish writing ${configPath}. If none is running, remove ${lockPath}.`);
-      }
-      sleepSync(LOCK_POLL_MS);
-    }
-  }
-}
-function defaultConfigOverwriteBlocked(opts) {
-  const isolated = opts?.isolated ?? Boolean(process.env.ARBOR_CONFIG);
-  const path = opts?.path ?? DEFAULT_CONFIG_PATH;
-  if (isolated)
-    return false;
-  if (!existsSync(path))
-    return false;
-  try {
-    const cfg = JSON.parse(readFileSync(path, "utf8"));
-    return Boolean(cfg.token);
-  } catch {
-    return false;
-  }
-}
-function loadConfig() {
-  const envToken = process.env.ARBOR_TOKEN || undefined;
-  const envUrl = process.env.ARBOR_API_URL || undefined;
-  if (existsSync(CONFIG_PATH)) {
-    try {
-      const cfg = JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
-      return { apiUrl: envUrl ?? (cfg.apiUrl || DEFAULT_API_URL), token: envToken ?? cfg.token };
-    } catch {}
-  }
-  return { apiUrl: envUrl ?? DEFAULT_API_URL, token: envToken };
-}
-function writeConfigGuarded(opts) {
-  mkdirSync(dirname(opts.configPath), { recursive: true });
-  const release = acquireConfigLock(opts.configPath);
-  try {
-    if (!opts.allowDefaultTokenOverwrite && defaultConfigOverwriteBlocked({ isolated: opts.isolated, path: opts.defaultPath })) {
-      throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
-    }
-    writeFileSync(opts.configPath, `${JSON.stringify(opts.cfg, null, 2)}
-`, { mode: 384 });
-    chmodSync(opts.configPath, 384);
-  } finally {
-    release();
-  }
-}
-function saveConfig(cfg, opts) {
-  writeConfigGuarded({
-    cfg,
-    configPath: CONFIG_PATH,
-    defaultPath: DEFAULT_CONFIG_PATH,
-    isolated: Boolean(process.env.ARBOR_CONFIG),
-    allowDefaultTokenOverwrite: opts?.allowDefaultTokenOverwrite
-  });
-}
-function clearToken() {
-  const cfg = loadConfig();
-  saveConfig({ apiUrl: cfg.apiUrl }, { allowDefaultTokenOverwrite: true });
-}
 
 // src/errors.ts
 var ERROR_CODES = new Set([
@@ -22069,6 +22004,310 @@ class UsageError extends Error {
   }
 }
 
+// src/config.ts
+var PROD_API_URL = "https://arborthreads.com";
+var PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+function arborDir() {
+  return join(homedir(), ".arbor");
+}
+function defaultConfigPath() {
+  return join(arborDir(), "config.json");
+}
+function profilesDir() {
+  return join(arborDir(), "profiles");
+}
+function registryPath() {
+  return join(arborDir(), "profiles.json");
+}
+function namedConfigPath(name) {
+  return join(profilesDir(), `${name}.json`);
+}
+var CONFIG_PATH = process.env.ARBOR_CONFIG ?? join(homedir(), ".arbor", "config.json");
+var DEFAULT_TOKEN_OVERWRITE_REFUSAL = "refusing to overwrite ~/.arbor/config.json — a token already exists. Set ARBOR_CONFIG to an isolated path (e.g. ~/.arbor/<agent>.config.json) and retry.";
+var LOCK_TIMEOUT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+var LOCK_POLL_MS = 20;
+var activeTarget;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireConfigLock(configPath) {
+  const lockPath = `${configPath}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (;; ) {
+    try {
+      mkdirSync(lockPath);
+      return () => {
+        try {
+          rmSync(lockPath, { recursive: true, force: true });
+        } catch {}
+      };
+    } catch (err) {
+      if (err?.code !== "EEXIST")
+        throw err;
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+          rmSync(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another arbor process to finish writing ${configPath}. If none is running, remove ${lockPath}.`);
+      }
+      sleepSync(LOCK_POLL_MS);
+    }
+  }
+}
+function validateProfileName(name, field = "profile") {
+  if (!PROFILE_NAME.test(name)) {
+    throw new UsageError(`invalid profile name: ${JSON.stringify(name)}`, {
+      reason: "validation.invalid_value",
+      field
+    });
+  }
+}
+function rejectSymlink(path, label) {
+  if (!existsSync(path))
+    return;
+  if (lstatSync(path).isSymbolicLink())
+    throw new Error(`${label} must not be a symbolic link: ${path}`);
+}
+function ensureArborDir() {
+  const dir = arborDir();
+  rejectSymlink(dir, "Arbor config directory");
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+}
+function ensureProfilesDir() {
+  ensureArborDir();
+  const dir = profilesDir();
+  rejectSymlink(dir, "Arbor profiles directory");
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+}
+function readRegistry() {
+  const path = registryPath();
+  if (!existsSync(path))
+    return {};
+  rejectSymlink(path, "Arbor profile registry");
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (parsed.defaultProfile !== undefined)
+      validateProfileName(parsed.defaultProfile);
+    return { defaultProfile: parsed.defaultProfile };
+  } catch (err) {
+    if (err instanceof UsageError)
+      throw err;
+    throw new Error(`could not read Arbor profile registry ${path}`);
+  }
+}
+function writeRegistry(registry2) {
+  ensureArborDir();
+  const path = registryPath();
+  rejectSymlink(path, "Arbor profile registry");
+  const release = acquireConfigLock(path);
+  try {
+    const safe = registry2.defaultProfile ? { defaultProfile: registry2.defaultProfile } : {};
+    writeFileSync(path, `${JSON.stringify(safe, null, 2)}
+`, { mode: 384 });
+    chmodSync(path, 384);
+  } finally {
+    release();
+  }
+}
+function profileExists(name, field = "profile") {
+  validateProfileName(name, field);
+  const path = namedConfigPath(name);
+  if (!existsSync(path))
+    return false;
+  rejectSymlink(path, `Arbor profile ${name}`);
+  return lstatSync(path).isFile();
+}
+function legacyTarget() {
+  const defaultPath = defaultConfigPath();
+  const envPath = process.env.ARBOR_CONFIG;
+  return {
+    path: envPath ?? defaultPath,
+    defaultPath,
+    isolated: Boolean(envPath),
+    named: false
+  };
+}
+function resolveTarget(opts) {
+  const profileFlag = opts?.profileFlag;
+  const envProfile = process.env.ARBOR_PROFILE;
+  if (process.env.ARBOR_CONFIG && profileFlag !== undefined) {
+    throw new UsageError("ARBOR_CONFIG and --profile are ambiguous; choose one credential selector", {
+      reason: "validation.invalid_value",
+      field: "profile"
+    });
+  }
+  if (process.env.ARBOR_CONFIG && envProfile !== undefined) {
+    throw new UsageError("ARBOR_CONFIG and ARBOR_PROFILE are ambiguous; choose one credential selector", { reason: "validation.invalid_value", field: "ARBOR_PROFILE" });
+  }
+  if (process.env.ARBOR_CONFIG)
+    return legacyTarget();
+  const registryDefault = readRegistry().defaultProfile;
+  const selected2 = profileFlag ?? envProfile ?? registryDefault;
+  if (selected2 === undefined)
+    return legacyTarget();
+  const field = profileFlag !== undefined ? "profile" : envProfile !== undefined ? "ARBOR_PROFILE" : "profile";
+  validateProfileName(selected2, field);
+  if (!opts?.allowMissingProfile && !profileExists(selected2, field)) {
+    throw new UsageError(`unknown profile: ${selected2}`, {
+      reason: "validation.invalid_value",
+      field
+    });
+  }
+  return {
+    path: namedConfigPath(selected2),
+    defaultPath: defaultConfigPath(),
+    isolated: true,
+    profile: selected2,
+    named: true
+  };
+}
+function configureConfigTarget(opts) {
+  activeTarget = resolveTarget(opts);
+}
+function currentTarget() {
+  return activeTarget ?? resolveTarget();
+}
+function getConfigPath() {
+  return currentTarget().path;
+}
+function listProfiles() {
+  const registry2 = readRegistry();
+  const dir = profilesDir();
+  if (!existsSync(dir))
+    return { defaultProfile: registry2.defaultProfile, profiles: [] };
+  rejectSymlink(dir, "Arbor profiles directory");
+  const profiles2 = readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.name.endsWith(".json")).map((entry) => {
+    const name = entry.name.slice(0, -5);
+    validateProfileName(name);
+    const path = join(dir, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error(`Arbor profile ${name} must not be a symbolic link: ${path}`);
+    if (!entry.isFile())
+      throw new Error(`Arbor profile ${name} is not a regular file: ${path}`);
+    return { name, default: registry2.defaultProfile === name };
+  }).sort((a, b) => a.name.localeCompare(b.name));
+  return { defaultProfile: registry2.defaultProfile, profiles: profiles2 };
+}
+function profileShow(name) {
+  validateProfileName(name);
+  if (!profileExists(name)) {
+    throw new UsageError(`unknown profile: ${name}`, {
+      reason: "validation.invalid_value",
+      field: "profile"
+    });
+  }
+  const registry2 = readRegistry();
+  const cfg = JSON.parse(readFileSync(namedConfigPath(name), "utf8"));
+  return {
+    name,
+    default: registry2.defaultProfile === name,
+    apiUrl: cfg.apiUrl || PROD_API_URL
+  };
+}
+function setDefaultProfile(name) {
+  if (name !== null) {
+    validateProfileName(name);
+    if (!profileExists(name)) {
+      throw new UsageError(`unknown profile: ${name}`, {
+        reason: "validation.invalid_value",
+        field: "profile"
+      });
+    }
+  }
+  writeRegistry(name ? { defaultProfile: name } : {});
+}
+function clearDefaultProfile() {
+  setDefaultProfile(null);
+}
+function deleteProfile(name) {
+  validateProfileName(name);
+  const registry2 = readRegistry();
+  if (registry2.defaultProfile === name) {
+    throw new UsageError(`cannot delete default profile ${name}; select another default or run profile clear-default first`, { reason: "validation.invalid_value", field: "profile" });
+  }
+  if (!profileExists(name)) {
+    throw new UsageError(`unknown profile: ${name}`, {
+      reason: "validation.invalid_value",
+      field: "profile"
+    });
+  }
+  const path = namedConfigPath(name);
+  rejectSymlink(path, `Arbor profile ${name}`);
+  rmSync(path);
+}
+function defaultConfigOverwriteBlocked(opts) {
+  const target = currentTarget();
+  const isolated = opts?.isolated ?? target.isolated;
+  const path = opts?.path ?? target.defaultPath;
+  if (isolated)
+    return false;
+  if (!existsSync(path))
+    return false;
+  try {
+    const cfg = JSON.parse(readFileSync(path, "utf8"));
+    return Boolean(cfg.token);
+  } catch {
+    return false;
+  }
+}
+function loadConfig() {
+  const target = currentTarget();
+  const envToken = process.env.ARBOR_TOKEN || undefined;
+  const envUrl = process.env.ARBOR_API_URL || undefined;
+  if (target.named)
+    rejectSymlink(target.path, `Arbor profile ${target.profile}`);
+  if (existsSync(target.path)) {
+    try {
+      const cfg = JSON.parse(readFileSync(target.path, "utf8"));
+      return { apiUrl: envUrl ?? (cfg.apiUrl || PROD_API_URL), token: envToken ?? cfg.token };
+    } catch (err) {
+      if (err instanceof Error && /symbolic link/i.test(err.message))
+        throw err;
+    }
+  }
+  return { apiUrl: envUrl ?? PROD_API_URL, token: envToken };
+}
+function writeConfigGuarded(opts) {
+  mkdirSync(dirname(opts.configPath), { recursive: true });
+  const release = acquireConfigLock(opts.configPath);
+  try {
+    if (!opts.allowDefaultTokenOverwrite && defaultConfigOverwriteBlocked({ isolated: opts.isolated, path: opts.defaultPath })) {
+      throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+    }
+    writeFileSync(opts.configPath, `${JSON.stringify(opts.cfg, null, 2)}
+`, { mode: 384 });
+    chmodSync(opts.configPath, 384);
+  } finally {
+    release();
+  }
+}
+function saveConfig(cfg, opts) {
+  const target = currentTarget();
+  if (target.named) {
+    ensureProfilesDir();
+    rejectSymlink(target.path, `Arbor profile ${target.profile}`);
+  }
+  writeConfigGuarded({
+    cfg,
+    configPath: target.path,
+    defaultPath: target.defaultPath,
+    isolated: target.isolated,
+    allowDefaultTokenOverwrite: opts?.allowDefaultTokenOverwrite
+  });
+}
+function clearToken() {
+  const cfg = loadConfig();
+  saveConfig({ apiUrl: cfg.apiUrl }, { allowDefaultTokenOverwrite: true });
+}
+
 // src/source.ts
 var SNIFF = [
   ["CLAUDECODE", "Claude Code"],
@@ -23004,6 +23243,11 @@ Usage: arbor <command> [--flags]
   login [--url <api-url>]   authorize in your browser (device flow) → stores a token
   auth <token> [--url …]    save a token directly (a PAT or agent key) — headless, no browser
   connect <pairing-key>     register THIS agent: relay the URL+code to your human to approve (AD-109)
+  profile list              list configured profile names (never credentials)
+  profile show <name>       show safe local metadata for one profile
+  profile set-default <name> configure the ordinary-command default profile
+  profile clear-default      intentionally return ordinary commands to legacy config
+  profile delete <name>      delete a non-default named profile
   orient                    print how to work well in Arbor (the room etiquette — when + why)
   whoami                    print who your token resolves to
   logout                    forget the stored token
@@ -23012,6 +23256,7 @@ Usage: arbor <command> [--flags]
   help                      show this help
 
 Global flags (any command):
+  --profile <name>          use one named credential for this command only
   --json                    emit a structured { ok, data|error, meta } envelope on stdout (machine mode)
   --quiet / --no-quiet      suppress / force advisory text (auto-quiet under --json or a pipe)
   --fields a,b,arr:N        keep only these TOP-LEVEL fields; an "arr:N" entry tail-slices an ARRAY field to
@@ -23067,6 +23312,15 @@ async function main() {
   const ctx = resolveCommandOutput(positionals, flags);
   const [cmd] = positionals;
   try {
+    const profileFlag = stringFlag(flags.profile, "profile");
+    if (cmd !== "profile") {
+      configureConfigTarget({
+        profileFlag,
+        allowMissingProfile: cmd === "login" || cmd === "auth" || cmd === "connect"
+      });
+    } else if (profileFlag !== undefined) {
+      throw new UsageError("--profile selects a credential for a command; profile management names its target positionally");
+    }
     if (flags.version !== undefined && positionals.length === 0 || cmd === "version") {
       renderVersion(ctx);
       return;
@@ -23087,7 +23341,7 @@ async function main() {
       case "login": {
         await login({ url: stringFlag(flags.url, "url") });
         advise(`
-  ✓ Logged in (${CONFIG_PATH}).
+  ✓ Logged in (${getConfigPath()}).
   `, ctx);
         await renderMe(ctx, "login");
         return;
@@ -23098,7 +23352,7 @@ async function main() {
           throw new UsageError("usage: arbor auth <token> [--url <api-url>]");
         const url2 = stringFlag(flags.url, "url") ?? loadConfig().apiUrl;
         saveConfig({ apiUrl: url2, token }, { allowDefaultTokenOverwrite: true });
-        advise(`  ✓ Token saved (${CONFIG_PATH}).
+        advise(`  ✓ Token saved (${getConfigPath()}).
   `, ctx);
         await renderMe(ctx, "auth");
         return;
@@ -23109,7 +23363,7 @@ async function main() {
           throw new UsageError("usage: arbor connect <pairing-key> [--url <api-url>]");
         await connect({ pairingKey: key, url: stringFlag(flags.url, "url") });
         advise(`
-  ✓ Connected (${CONFIG_PATH}).
+  ✓ Connected (${getConfigPath()}).
   `, ctx);
         await renderMe(ctx, "connect");
         advise(`
@@ -23123,9 +23377,59 @@ ${CLI_NOTE}
       }
       case "logout":
         clearToken();
-        emitDual({ loggedOut: true }, `Logged out — token cleared from ${CONFIG_PATH}.
+        emitDual({ loggedOut: true }, `Logged out — token cleared from ${getConfigPath()}.
 `, "logout", ctx);
         return;
+      case "profile": {
+        const subcommand = positionals[1];
+        if (subcommand === "list") {
+          if (positionals.length !== 2)
+            throw new UsageError("usage: arbor profile list");
+          const data = listProfiles();
+          const human = data.profiles.length ? `${data.profiles.map((profile3) => `${profile3.default ? "*" : " "} ${profile3.name}`).join(`
+`)}
+` : `No named profiles configured.
+`;
+          emitDual(data, human, "profile list", ctx);
+          return;
+        }
+        if (subcommand === "show") {
+          const name = positionals[2];
+          if (!name || positionals.length !== 3)
+            throw new UsageError("usage: arbor profile show <name>");
+          const data = profileShow(name);
+          emitDual(data, `${data.name}${data.default ? " (default)" : ""} — ${data.apiUrl}
+`, "profile show", ctx);
+          return;
+        }
+        if (subcommand === "set-default") {
+          const name = positionals[2];
+          if (!name || positionals.length !== 3)
+            throw new UsageError("usage: arbor profile set-default <name>");
+          setDefaultProfile(name);
+          emitDual({ defaultProfile: name }, `Default profile: ${name}
+`, "profile set-default", ctx);
+          return;
+        }
+        if (subcommand === "clear-default") {
+          if (positionals.length !== 2)
+            throw new UsageError("usage: arbor profile clear-default");
+          clearDefaultProfile();
+          emitDual({ defaultProfile: null }, `Default profile cleared; ordinary commands use legacy config.
+`, "profile clear-default", ctx);
+          return;
+        }
+        if (subcommand === "delete") {
+          const name = positionals[2];
+          if (!name || positionals.length !== 3)
+            throw new UsageError("usage: arbor profile delete <name>");
+          deleteProfile(name);
+          emitDual({ deleted: true, profile: name }, `Deleted profile: ${name}
+`, "profile delete", ctx);
+          return;
+        }
+        throw new UsageError("usage: arbor profile <list|show|set-default|clear-default|delete> [name]");
+      }
       case "whoami":
         await renderMe(ctx, "whoami");
         return;
@@ -23135,8 +23439,12 @@ ${CLI_NOTE}
       case "health":
         await renderHealth(ctx);
         return;
-      default:
-        await runObjectVerb(positionals, flags, ctx);
+      default: {
+        const actionFlags = { ...flags };
+        delete actionFlags.profile;
+        await runObjectVerb(positionals, actionFlags, ctx);
+        break;
+      }
     }
   } catch (err) {
     const action = matchCommand(positionals)?.action.name ?? cmd ?? "arbor";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.21.42",
+  "version": "0.21.44",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",