@lightupai/polaris 0.0.92 → 0.0.93

package/README.md

@@ -113,18 +113,36 @@ polaris install          # Install MCP server, hooks, skill, status line + resta
 polaris login            # Authenticate against production
 polaris login --local    # Authenticate against localhost (for local dev)
 
-# Manage environments
-polaris profiles         # List all profiles
-polaris use local        # Switch to local dev
-polaris use prod         # Switch to production
+# Multi-account support
+polaris profiles                        # List all logged-in accounts
+polaris use you@work.com               # Switch to a work account
+polaris use you@personal.com           # Switch to a personal account (triggers login if not yet authenticated)
 
 # Other commands
 polaris daemon           # Start the local daemon (kills any existing daemon first)
-polaris status           # Show active profile, daemon state, sessions
-polaris logout           # Remove active profile credentials
+polaris status           # Show active account, daemon state, sessions
+polaris logout           # Remove active account credentials
 polaris logout --all     # Remove all credentials
 ```
 
+### Multiple accounts
+
+Polaris supports multiple accounts (work and personal) side by side. Each Claude Code session can connect to a different account independently — switching one session does not affect others.
+
+```sh
+# Log in to both accounts (one-time)
+polaris login                          # first account (stored as you@work.com)
+polaris login                          # second account (stored as you@personal.com)
+
+# Switch the active account for the daemon
+polaris use you@personal.com
+
+# Start a new session — it will use whichever account is active at connect time
+/polaris join #my-project
+```
+
+If you pass an email that isn't logged in yet, `polaris use` opens the browser to authenticate that account, then sets it as active. Google's account picker is pre-filled with the email hint.
+
 ### Upgrading
 
 Because `polaris` is a **global install**, use `npm install -g` to upgrade — not `npx`:

package/hooks/statusline.sh

@@ -10,16 +10,7 @@ if [ -n "$POLARIS_DAEMON_SECRET" ]; then
   SECRET_HEADER="x-polaris-daemon-secret: $POLARIS_DAEMON_SECRET"
 fi
 
-# Read active profile name from ~/.polaris/config.json (best-effort)
-PROFILE=""
-CONFIG_FILE="${HOME}/.polaris/config.json"
-if [ -f "$CONFIG_FILE" ]; then
-  PROFILE=$(jq -r '.active // ""' "$CONFIG_FILE" 2>/dev/null || echo "")
-fi
-PROFILE_TAG=""
-if [ -n "$PROFILE" ]; then
-  PROFILE_TAG="[${PROFILE}] "
-fi
+# Account is read from the per-session daemon status (set after connection)
 
 # Read stdin (session JSON from the coding agent)
 INPUT=$(cat)
@@ -38,11 +29,16 @@ if [ "$CONNECTED" = "true" ]; then
   SESSION=$(echo "$STATUS" | jq -r '.session' 2>/dev/null)
   USER=$(echo "$STATUS" | jq -r '.user' 2>/dev/null)
   SLACK=$(echo "$STATUS" | jq -r '.slackChannel // empty' 2>/dev/null)
+  ACCOUNT=$(echo "$STATUS" | jq -r '.account // empty' 2>/dev/null)
+  ACCOUNT_TAG=""
+  if [ -n "$ACCOUNT" ]; then
+    ACCOUNT_TAG="[${ACCOUNT}] "
+  fi
   if [ -n "$SLACK" ]; then
-    echo "polaris: ${PROFILE_TAG}${PROJECT}/${SESSION} (${USER}) #${SLACK}"
+    echo "polaris: ${ACCOUNT_TAG}${PROJECT}/${SESSION} (${USER}) #${SLACK}"
   else
-    echo "polaris: ${PROFILE_TAG}${PROJECT}/${SESSION} (${USER})"
+    echo "polaris: ${ACCOUNT_TAG}${PROJECT}/${SESSION} (${USER})"
   fi
 else
-  echo "polaris: ${PROFILE_TAG}not connected"
+  echo "polaris: not connected"
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lightupai/polaris",
-  "version": "0.0.92",
+  "version": "0.0.93",
   "description": "Record and stream Claude Code sessions to Slack. Like Gong for AI coding — capture every prompt, response, and tool call. Multiplayer collaboration across AI coding agents.",
   "keywords": [
     "claude-code",

package/skills/polaris/SKILL.md

@@ -13,9 +13,13 @@ Manage your connection to a Polaris collaboration session.
 
 Based on the arguments provided, do ONE of the following:
 
-**`/polaris join #channel-name`** — Connect to a channel:
+**`/polaris join #channel-name`** — Connect to an existing project, or create a new one:
 1. Call `polaris_connect` with the given channel and user identity `user:manu.bansal`
-2. A session name is auto-generated
+2. If the response is `project_not_found`:
+   - Show the list of existing projects from the response
+   - Ask the user: "Project '#channel-name' doesn't exist. Create it? [y/N]"
+   - If yes: call `polaris_connect` again with `create: true`
+   - If no: stop and show the existing project list so they can pick one
 3. Report the connection status including the session name
 
 **`/polaris rename <new-name>`** — Rename the current channel:

package/src/cli/cli.ts

@@ -6,9 +6,9 @@
 //   polaris login        — authenticate via Google SSO (production)
 //   polaris login --local — authenticate against localhost
 //   polaris login --url <url> — authenticate against a custom URL
-//   polaris login --profile <name> — explicit profile name
-//   polaris use <profile> — switch active profile
-//   polaris profiles     — list profiles
+//   polaris login --profile <name> — explicit profile key (default: email)
+//   polaris use <email>  — switch active account (triggers login if not found)
+//   polaris profiles     — list accounts
 //   polaris daemon       — start the local daemon
 //   polaris status       — show connection status
 //   polaris recover      — re-POST locally logged events missing upstream
@@ -279,8 +279,9 @@ Based on the arguments provided, do ONE of the following:
 
 // --- Login ---
 
-async function login(appUrl: string, profileName?: string) {
-  const derivedName = profileName ?? deriveProfileName(appUrl);
+async function login(appUrl: string, profileName?: string, loginHint?: string) {
+  // Profile key is determined after auth (we use the email). profileName is an
+  // explicit override (e.g. --profile flag); otherwise we'll use userInfo.email.
 
   // Browser OAuth
   let resolveToken: (token: string) => void;
@@ -306,9 +307,10 @@ async function login(appUrl: string, profileName?: string) {
   });
 
   const callbackPort = callbackServer.port;
-  const authUrl = `${appUrl}/auth/cli?port=${callbackPort}`;
+  let authUrl = `${appUrl}/auth/cli?port=${callbackPort}`;
+  if (loginHint) authUrl += `&login_hint=${encodeURIComponent(loginHint)}`;
 
-  console.log(`  Opening browser for Google sign-in (${derivedName})...`);
+  console.log(`  Opening browser for Google sign-in...`);
   console.log(`  If the browser doesn't open, visit: ${authUrl}\n`);
 
   const proc = Bun.spawn(
@@ -344,9 +346,10 @@ async function login(appUrl: string, profileName?: string) {
   console.log(`  Organization: ${orgName}`);
   console.log(`  Participant ID: ${userInfo.participant_id}`);
 
-  // Save to profile
+  // Save to profile — keyed by email unless an explicit --profile name was given
   const config = await loadConfig();
-  config.profiles[derivedName] = {
+  const profileKey = profileName ?? userInfo.email;
+  config.profiles[profileKey] = {
     api: appToApi(appUrl),
     app: appUrl,
     token,
@@ -355,7 +358,7 @@ async function login(appUrl: string, profileName?: string) {
     org_id: userInfo.org_id,
     participant_id: userInfo.participant_id,
   };
-  config.active = derivedName;
+  config.active = profileKey;
   await saveConfig(config);
 
   // Also write legacy credentials.json for backward compat (daemon reads it)
@@ -365,7 +368,7 @@ async function login(appUrl: string, profileName?: string) {
     service_url: appUrl,
   }, null, 2));
 
-  console.log(`  ✓ Profile "${derivedName}" saved and set as active`);
+  console.log(`  ✓ Logged in as ${userInfo.email}`);
 
   // Re-install skill with personalized participant ID
   await mkdir(join(CLAUDE_DIR, "skills", "polaris"), { recursive: true });
@@ -434,54 +437,78 @@ Based on the arguments provided, do ONE of the following:
 
 // --- Use ---
 
-async function use(profileName: string) {
+// Accepts an email address or a legacy profile key. If the account isn't
+// found locally, starts the login flow (with login_hint pre-filled).
+async function use(arg: string) {
   const config = await loadConfig();
-  if (!config.profiles[profileName]) {
-    console.error(`Profile "${profileName}" not found.`);
-    const names = Object.keys(config.profiles);
-    if (names.length > 0) {
-      console.error(`Available profiles: ${names.join(", ")}`);
-    } else {
-      console.error("No profiles configured. Run: polaris login");
-    }
-    process.exit(1);
+
+  // 1. Direct key match (backward compat with old "prod" / "local" style names)
+  let matchedKey: string | undefined;
+  if (config.profiles[arg]) {
+    matchedKey = arg;
+  } else {
+    // 2. Search by email field
+    const entry = Object.entries(config.profiles).find(([, p]) => p.email === arg);
+    if (entry) matchedKey = entry[0];
   }
-  config.active = profileName;
-  await saveConfig(config);
 
-  // Update legacy credentials.json for daemon
-  const profile = config.profiles[profileName];
-  await writeFile(LEGACY_CREDENTIALS_FILE, JSON.stringify({
-    token: profile.token,
-    email: profile.email,
-    name: profile.name,
-    org_id: profile.org_id,
-    participant_id: profile.participant_id,
-    service_url: profile.app,
-  }, null, 2));
+  if (matchedKey) {
+    config.active = matchedKey;
+    await saveConfig(config);
+    const profile = config.profiles[matchedKey];
+    // Update legacy credentials.json for daemon
+    await writeFile(LEGACY_CREDENTIALS_FILE, JSON.stringify({
+      token: profile.token,
+      email: profile.email,
+      name: profile.name,
+      org_id: profile.org_id,
+      participant_id: profile.participant_id,
+      service_url: profile.app,
+    }, null, 2));
+    console.log(`Active account: ${profile.email}`);
+    console.log("Restart the daemon for this to take effect.");
+    return;
+  }
 
-  console.log(`Active profile: ${profileName} (${profile.api})`);
-  console.log("Restart the daemon for this to take effect.");
+  // 3. Not found locally — start auth (pre-fill email hint when it looks like
+  //    an email address so Google can skip account selection)
+  console.log(`Account "${arg}" not found locally. Starting authentication...\n`);
+  const isEmail = arg.includes("@");
+  await login(DEFAULT_APP_URL, undefined, isEmail ? arg : undefined);
+  console.log("\n✓ Login complete!");
+  // Replace daemon so new credentials are picked up immediately
+  await killExistingDaemon();
+  const daemonPath = join(import.meta.dir, "..", "daemon", "daemon.ts");
+  Bun.spawn(["bun", "run", daemonPath], {
+    stdout: "ignore",
+    stderr: "ignore",
+    env: { ...process.env },
+  }).unref?.();
+  console.log("  ✓ Daemon started in background");
 }
 
 // --- Profiles ---
 
 async function profiles() {
   const config = await loadConfig();
-  const names = Object.keys(config.profiles);
-  if (names.length === 0) {
-    console.log("No profiles configured. Run: polaris login");
+  const keys = Object.keys(config.profiles);
+  if (keys.length === 0) {
+    console.log("No accounts configured. Run: polaris login");
     return;
   }
-  console.log("Profiles:\n");
-  for (const name of names) {
-    const p = config.profiles[name];
-    const active = name === config.active ? " (active)" : "";
-    console.log(`  ${name}${active}`);
-    console.log(`    API: ${p.api}`);
-    console.log(`    User: ${p.name} (${p.email})`);
+  console.log("Accounts:\n");
+  for (const key of keys) {
+    const p = config.profiles[key];
+    const active = key === config.active ? " (active)" : "";
+    // Use email as the primary label; show key only when it differs (legacy style)
+    const label = p.email || key;
+    const keyHint = p.email && key !== p.email ? ` [key: ${key}]` : "";
+    console.log(`  ${label}${active}${keyHint}`);
+    if (p.name) console.log(`    Name: ${p.name}`);
+    console.log(`    API:  ${p.api}`);
     console.log("");
   }
+  console.log(`Use \`polaris use <email>\` to switch accounts.`);
 }
 
 // --- Daemon ---
@@ -852,7 +879,7 @@ switch (command) {
 
   case "use":
     if (!args[1]) {
-      console.error("Usage: polaris use <profile>");
+      console.error("Usage: polaris use <email>");
       process.exit(1);
     }
     await use(args[1]);
@@ -908,8 +935,8 @@ switch (command) {
     console.log("  polaris install        — install local components (no auth)");
     console.log("  polaris login          — authenticate (production)");
     console.log("  polaris login --local  — authenticate (local dev)");
-    console.log("  polaris use <profile>  — switch active profile");
-    console.log("  polaris profiles       — list all profiles");
+    console.log("  polaris use <email>    — switch active account (triggers login if needed)");
+    console.log("  polaris profiles       — list all accounts");
     console.log("  polaris daemon         — start the local daemon");
     console.log("  polaris status         — show connection status");
     console.log("  polaris recover        — re-POST locally logged events missing upstream");

package/src/client/client.ts

@@ -51,10 +51,10 @@ function sessionStatePath(): string {
   return `${homedir()}/.polaris/sessions/${hash}.json`;
 }
 
-async function saveSessionState(project: string, session: string, user: string): Promise<void> {
+async function saveSessionState(project: string, session: string, user: string, profile: string): Promise<void> {
   try {
     await mkdir(`${homedir()}/.polaris/sessions`, { recursive: true });
-    await writeFile(sessionStatePath(), JSON.stringify({ project, session, user, cwd: process.cwd() }));
+    await writeFile(sessionStatePath(), JSON.stringify({ project, session, user, profile, cwd: process.cwd() }));
   } catch { /* best-effort */ }
 }
 
@@ -64,19 +64,29 @@ async function clearSessionState(): Promise<void> {
   } catch { /* best-effort */ }
 }
 
-async function loadSessionState(): Promise<{ project: string; session: string; user: string } | null> {
+async function loadSessionState(): Promise<{ project: string; session: string; user: string; profile: string } | null> {
   try {
     const data = JSON.parse(await readFile(sessionStatePath(), "utf-8"));
-    if (data.project && data.session && data.user) return data;
+    if (data.project && data.session && data.user) return { ...data, profile: data.profile ?? "" };
   } catch { /* no saved state */ }
   return null;
 }
 
+async function loadActiveProfile(): Promise<string> {
+  try {
+    const data = JSON.parse(await readFile(`${homedir()}/.polaris/config.json`, "utf-8"));
+    return data.active ?? "";
+  } catch {
+    return "";
+  }
+}
+
 // --- Current connection state ---
 
 let currentProject = "";
 let currentSession = "";
 let currentUser = "";
+let currentProfile = "";
 
 // --- MCP Server ---
 
@@ -98,14 +108,15 @@ mcp.setRequestHandler(ListToolsRequestSchema, async () => ({
   tools: [
     {
       name: "polaris_connect",
-      description: "Connect this session to a Polaris project and session. Creates the session if it doesn't exist.",
+      description: "Connect this session to an existing Polaris project. Use create:true to create a new project.",
       inputSchema: {
         type: "object" as const,
         properties: {
-          channel: { type: "string", description: "Project workspace to join (e.g., #my-project). Becomes the Slack channel name if a floor is connected. Omit to list existing projects." },
+          channel: { type: "string", description: "Project workspace to join (e.g., #my-project). Omit to list existing projects." },
           user: { type: "string", description: "Your participant ID (e.g., user:manu)" },
           session: { type: "string", description: "Session name (optional — auto-generated if omitted)" },
           agent: { type: "string", description: "Agent identity (optional — defaults to agent:claude)" },
+          create: { type: "boolean", description: "Create the project if it doesn't exist (default: false). Only set true when explicitly starting a new project." },
         },
         required: ["user"],
       },
@@ -206,7 +217,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
   const { name, arguments: args } = req.params;
 
   if (name === "polaris_connect") {
-    const { channel, user, session, agent } = args as { channel?: string; user: string; session?: string; agent?: string };
+    const { channel, user, session, agent, create } = args as { channel?: string; user: string; session?: string; agent?: string; create?: boolean };
 
     // If no channel specified, list available channels
     if (!channel) {
@@ -215,7 +226,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
         if (res.ok) {
           const body = await res.json() as { channels: string[] };
           if (body.channels.length === 0) {
-            return { content: [{ type: "text", text: "No projects found. Start one with: `/polaris join #my-project`" }] };
+            return { content: [{ type: "text", text: "No projects found. Create one with: `/polaris join #my-project` with create:true" }] };
           }
           return { content: [{ type: "text", text: `Available projects:\n${body.channels.map(c => `  ${c}`).join("\n")}\n\nJoin one with: /polaris join #project-name` }] };
         }
@@ -224,20 +235,31 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
     }
 
     const project = channel.replace(/^#/, ""); // strip leading # if present
+    const activeProfile = await loadActiveProfile();
     try {
       const res = await daemonPost("/connect", {
         ccSessionId: CC_SESSION_ID,
         project,
         user,
+        profile: activeProfile,
         ...(session ? { session } : {}),
         ...(agent ? { agent } : {}),
+        ...(create ? { create: true } : {}),
       });
-      const body = await res.json() as { status?: string; project?: string; session?: string; user?: string; agent?: string; error?: string };
+      const body = await res.json() as { status?: string; project?: string; session?: string; user?: string; agent?: string; error?: string; existing?: string[]; account?: string };
+      if (res.status === 404 && body.error === "project_not_found") {
+        const accountLine = body.account ? ` in ${body.account}` : "";
+        const list = body.existing && body.existing.length > 0
+          ? `\n\nAvailable projects:\n${body.existing.map(p => `  #${p}`).join("\n")}`
+          : "\n\nNo projects exist yet in this account.";
+        return { content: [{ type: "text", text: `Project "#${project}" not found${accountLine}.${list}\n\nTo create it: polaris_connect with create:true` }] };
+      }
       if (res.ok) {
         currentProject = body.project ?? project;
         currentSession = body.session ?? session ?? "";
         currentUser = user;
-        await saveSessionState(currentProject, currentSession, currentUser);
+        currentProfile = activeProfile;
+        await saveSessionState(currentProject, currentSession, currentUser, currentProfile);
         return { content: [{ type: "text", text: `Connected to #${currentProject}/${currentSession} as ${user}.` }] };
       }
       return { content: [{ type: "text", text: `Failed to connect: ${body.error ?? "unknown error"}` }] };
@@ -252,6 +274,7 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
       currentProject = "";
       currentSession = "";
       currentUser = "";
+      currentProfile = "";
       await clearSessionState();
       return { content: [{ type: "text", text: "Disconnected from Polaris." }] };
     } catch {
@@ -390,9 +413,11 @@ mcp.setRequestHandler(CallToolRequestSchema, async (req) => {
 // --- Register with daemon and connect stdio ---
 
 async function main() {
+  const activeProfile = await loadActiveProfile();
+
   // Register with daemon (best-effort — daemon might not be running yet)
   try {
-    await daemonPost("/register", { ccSessionId: CC_SESSION_ID });
+    await daemonPost("/register", { ccSessionId: CC_SESSION_ID, profile: activeProfile });
   } catch {
     console.error("Warning: Polaris daemon not reachable. Start it with `bun run src/daemon/daemon.ts`.");
   }
@@ -400,19 +425,22 @@ async function main() {
   // Auto-reconnect if a previous session was active in this workspace
   const saved = await loadSessionState();
   if (saved) {
+    const reconnectProfile = saved.profile || activeProfile;
     try {
       const res = await daemonPost("/connect", {
         ccSessionId: CC_SESSION_ID,
         project: saved.project,
         session: saved.session,
         user: saved.user,
+        profile: reconnectProfile,
       });
       const body = await res.json() as { status?: string; project?: string; session?: string; user?: string; error?: string };
       if (res.ok) {
         currentProject = body.project ?? saved.project;
         currentSession = body.session ?? saved.session;
         currentUser = saved.user;
-        console.error(`Polaris auto-reconnected to #${currentProject}/${currentSession}`);
+        currentProfile = reconnectProfile;
+        console.error(`Polaris auto-reconnected to #${currentProject}/${currentSession} (${reconnectProfile || "default"})`);
       } else {
         // Session or project no longer exists — clear stale state
         await clearSessionState();

package/src/daemon/daemon.ts

@@ -11,6 +11,7 @@ interface SessionMapping {
   session: string;
   user: string;
   agent: string;
+  profile: string; // which account profile this session is using
   slackChannel?: string;
   ws: WebSocket | null;
   pendingMapping?: boolean; // true until the first hook event from this shell claims the mapping
@@ -46,49 +47,75 @@ async function loadConfig(): Promise<PolarisConfig | null> {
   }
 }
 
-function getServiceUrl(): string {
-  // 1. Env var override (Makefile uses this for local dev)
+function getServiceUrlForProfile(profile: string): string {
+  // 1. Env var override (Makefile / tests)
   if (process.env.POLARIS_SERVICE_URL) return process.env.POLARIS_SERVICE_URL;
-  // 2. Active profile (read synchronously from cache — loaded at startup)
-  if (cachedConfig?.active && cachedConfig.profiles[cachedConfig.active]) {
+  // 2. Named profile
+  if (profile && cachedConfig?.profiles[profile]?.api) return cachedConfig.profiles[profile].api;
+  // 3. Active profile
+  if (cachedConfig?.active && cachedConfig.profiles[cachedConfig.active]?.api) {
     return cachedConfig.profiles[cachedConfig.active].api;
   }
-  // 3. Fallback
   return "https://api.withpolaris.ai";
 }
 
-let cachedToken: string | null | undefined = undefined;
-async function getAuthToken(): Promise<string | null> {
-  if (cachedToken !== undefined) return cachedToken;
-  // 1. Env var (for testing). Empty string means "no auth".
+function getServiceUrl(): string {
+  return getServiceUrlForProfile(cachedConfig?.active ?? "");
+}
+
+// Per-profile token cache. Key "" is used for env-var / test mode.
+const tokenCache = new Map<string, string | null>();
+
+async function getTokenForProfile(profile: string): Promise<string | null> {
+  // Env var always wins (test mode) — ignore profile entirely
   if (process.env.POLARIS_AUTH_TOKEN !== undefined) {
-    cachedToken = process.env.POLARIS_AUTH_TOKEN || null;
-    return cachedToken;
+    return process.env.POLARIS_AUTH_TOKEN || null;
   }
-  // 2. Active profile in config.json
+  if (tokenCache.has(profile)) return tokenCache.get(profile)!;
   const config = await loadConfig();
+  // Named profile
+  if (profile && config?.profiles[profile]?.token) {
+    tokenCache.set(profile, config.profiles[profile].token);
+    return config.profiles[profile].token;
+  }
+  // Active profile fallback
   if (config?.active && config.profiles[config.active]?.token) {
-    cachedToken = config.profiles[config.active].token;
-    return cachedToken;
+    tokenCache.set(profile, config.profiles[config.active].token);
+    return config.profiles[config.active].token;
   }
-  // 3. Legacy credentials.json
+  // Legacy credentials.json
   try {
     const credsPath = join(homedir(), ".polaris", "credentials.json");
     const creds = JSON.parse(await readFile(credsPath, "utf-8"));
-    cachedToken = creds.token ?? null;
-    return cachedToken;
+    tokenCache.set(profile, creds.token ?? null);
+    return creds.token ?? null;
   } catch {
-    cachedToken = null;
+    tokenCache.set(profile, null);
     return null;
   }
 }
 
-async function authHeaders(): Promise<Record<string, string>> {
-  const token = await getAuthToken();
+function emailFromToken(token: string | null): string | null {
+  if (!token) return null;
+  try {
+    const payload = JSON.parse(atob(token.split(".")[1]));
+    return payload.email ?? null;
+  } catch {
+    return null;
+  }
+}
+
+async function authHeadersForProfile(profile: string): Promise<Record<string, string>> {
+  const token = await getTokenForProfile(profile);
   if (token) return { "Content-Type": "application/json", Authorization: `Bearer ${token}` };
   return { "Content-Type": "application/json" };
 }
 
+// Non-session calls (channel listing, team, etc.) use the active profile
+async function authHeaders(): Promise<Record<string, string>> {
+  return authHeadersForProfile(cachedConfig?.active ?? "");
+}
+
 // --- Daemon shared-secret auth ---
 //
 // When a secret is resolved (env POLARIS_DAEMON_SECRET, else config.json
@@ -111,7 +138,7 @@ function getDaemonSecret(): string | null {
 // --- Cloud WebSocket management ---
 
 function connectCloudWs(mapping: SessionMapping) {
-  const serviceUrl = getServiceUrl();
+  const serviceUrl = getServiceUrlForProfile(mapping.profile);
   const wsUrl = serviceUrl.replace(/^http/, "ws");
   const ws = new WebSocket(`${wsUrl}/projects/${mapping.project}/sessions/${mapping.session}/ws`);
 
@@ -198,6 +225,7 @@ interface OutboxEntry {
   t: string;
   project: string;
   session: string;
+  profile: string; // which account to use when flushing
   body: unknown; // the exact { sender, payload } body for the events endpoint
 }
 
@@ -212,10 +240,10 @@ function ensureOutboxDir(): Promise<void> {
   return outboxReady;
 }
 
-async function enqueueOutbox(project: string, session: string, body: unknown): Promise<void> {
+async function enqueueOutbox(project: string, session: string, profile: string, body: unknown): Promise<void> {
   try {
     await ensureOutboxDir();
-    const entry: OutboxEntry = { t: new Date().toISOString(), project, session, body };
+    const entry: OutboxEntry = { t: new Date().toISOString(), project, session, profile, body };
     const file = join(OUTBOX_DIR, `${Date.now()}-${crypto.randomUUID().slice(0, 8)}.json`);
     await writeFile(file, JSON.stringify(entry) + "\n");
     pendingOutbox.add(file);
@@ -234,14 +262,15 @@ function scheduleOutboxFlush(): void {
 }
 
 async function flushOutbox(): Promise<void> {
-  const serviceUrl = getServiceUrl();
   let hadFailure = false;
   for (const file of Array.from(pendingOutbox)) {
     try {
       const entry = JSON.parse(await readFile(file, "utf-8")) as OutboxEntry;
+      const profile = entry.profile ?? ""; // legacy entries without profile use active
+      const serviceUrl = getServiceUrlForProfile(profile);
       const res = await fetch(
         `${serviceUrl}/projects/${entry.project}/sessions/${entry.session}/events`,
-        { method: "POST", headers: await authHeaders(), body: JSON.stringify(entry.body) }
+        { method: "POST", headers: await authHeadersForProfile(profile), body: JSON.stringify(entry.body) }
       );
       if (res.ok || (res.status >= 400 && res.status < 500)) {
         if (!res.ok) {
@@ -306,10 +335,10 @@ async function backfill(mapping: SessionMapping, duration?: string, from?: strin
   } else {
     // Auto-detect: query API for most recent event, backfill from there
     try {
-      const serviceUrl = getServiceUrl();
+      const serviceUrl = getServiceUrlForProfile(mapping.profile);
       const res = await fetch(
         `${serviceUrl}/projects/${mapping.project}/sessions/${mapping.session}/messages`,
-        { headers: await authHeaders() }
+        { headers: await authHeadersForProfile(mapping.profile) }
       );
       if (res.ok) {
         const events = (await res.json()) as Array<{ timestamp: string }>;
@@ -362,8 +391,8 @@ async function backfill(mapping: SessionMapping, duration?: string, from?: strin
 
   // Replay events to the API
   let recovered = 0;
-  const serviceUrl = getServiceUrl();
-  const headers = await authHeaders();
+  const serviceUrl = getServiceUrlForProfile(mapping.profile);
+  const headers = await authHeadersForProfile(mapping.profile);
 
   for (const entry of logEntries) {
     const hookEvent = entry.payload.hook_event_name as string | undefined;
@@ -449,16 +478,50 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
             session?: string;
             user: string;
             agent?: string;
+            profile?: string;
+            create?: boolean;
           };
           await logEvent("/connect", body);
           if (!body.ccSessionId || !body.project || !body.user) {
             return error("ccSessionId, project, and user are required", 400);
           }
 
+          // Resolve profile: explicit > active > ""
+          const profile = body.profile || cachedConfig?.active || "";
+          const serviceUrl = getServiceUrlForProfile(profile);
+          const headers = await authHeadersForProfile(profile);
+
           // Generate session name if not provided
           const sessionName = body.session || generateSessionName();
           const agentId = body.agent || "agent:claude";
 
+          // Check whether the project exists. If not, refuse unless create: true.
+          const checkRes = await fetch(`${serviceUrl}/projects/${body.project}`, { headers });
+          if (!checkRes.ok) {
+            if (checkRes.status === 404) {
+              // Return existing project list so the caller can show a helpful error
+              const listRes = await fetch(`${serviceUrl}/projects`, { headers });
+              const projects: string[] = listRes.ok
+                ? ((await listRes.json() as { name: string }[]).map((p) => p.name))
+                : [];
+              if (!body.create) {
+                const account = emailFromToken(await getTokenForProfile(profile));
+                return json({ error: "project_not_found", project: body.project, existing: projects, account }, 404);
+              }
+              // create: true — create the project now
+              const createRes = await fetch(`${serviceUrl}/projects`, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ name: body.project }),
+              });
+              if (!createRes.ok && createRes.status !== 409) {
+                return error(`Failed to create project: ${await createRes.text()}`, 500);
+              }
+            } else {
+              return error(`Failed to verify project: ${await checkRes.text()}`, 500);
+            }
+          }
+
           // Disconnect existing cloud WS if switching sessions
           disconnectCloudWs(body.ccSessionId);
 
@@ -468,19 +531,12 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
             session: sessionName,
             user: body.user,
             agent: agentId,
+            profile,
             ws: null,
             pendingMapping: true, // waiting for hook event to map the real CC session ID
           };
           sessions.set(body.ccSessionId, mapping);
 
-          // Ensure the project exists on the cloud service (create if not)
-          const serviceUrl = getServiceUrl();
-          await fetch(`${serviceUrl}/projects`, {
-            method: "POST",
-            headers: await authHeaders(),
-            body: JSON.stringify({ name: body.project }),
-          }); // Ignore 409 (already exists)
-
           // Ensure the session exists (create if not, claim driver)
           // Retry with new name on 409 (collision with generated name)
           let attempts = 0;
@@ -488,7 +544,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
           while (!created && attempts < 3) {
             const sessionRes = await fetch(`${serviceUrl}/projects/${body.project}/sessions`, {
               method: "POST",
-              headers: await authHeaders(),
+              headers,
               body: JSON.stringify({ name: mapping.session, driver: body.user }),
             });
             if (sessionRes.ok) {
@@ -498,7 +554,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
                 // Explicit session name — claim driver instead of retrying
                 await fetch(`${serviceUrl}/projects/${body.project}/sessions/${mapping.session}/driver`, {
                   method: "POST",
-                  headers: await authHeaders(),
+                  headers,
                   body: JSON.stringify({ driver: body.user }),
                 });
                 created = true;
@@ -519,9 +575,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
 
           // Fetch Slack channel name for status display
           try {
-            const projRes = await fetch(`${serviceUrl}/projects/${body.project}`, {
-              headers: await authHeaders(),
-            });
+            const projRes = await fetch(`${serviceUrl}/projects/${body.project}`, { headers });
             if (projRes.ok) {
               const projData = await projRes.json() as { slack_channel_name?: string };
               mapping.slackChannel = projData.slack_channel_name ?? undefined;
@@ -630,7 +684,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
 
           // Relay to cloud service; on network failure or upstream 5xx,
           // persist to the write-ahead outbox instead of dropping
-          const serviceUrl = getServiceUrl();
+          const serviceUrl = getServiceUrlForProfile(mapping.profile);
           const relayBody = { sender, payload: body };
           let res: Response | null = null;
           try {
@@ -638,7 +692,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
               `${serviceUrl}/projects/${mapping.project}/sessions/${mapping.session}/events`,
               {
                 method: "POST",
-                headers: await authHeaders(),
+                headers: await authHeadersForProfile(mapping.profile),
                 body: JSON.stringify(relayBody),
               }
             );
@@ -649,7 +703,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
           if (!res || res.status >= 500) {
             console.error(`polaris daemon: upstream relay failed (${res ? res.status : "network error"}) — queued to outbox`);
             await logEvent("/events", body, { status: res?.status ?? 0, body: "queued to outbox" });
-            await enqueueOutbox(mapping.project, mapping.session, relayBody);
+            await enqueueOutbox(mapping.project, mapping.session, mapping.profile, relayBody);
             // The event is durably accepted (outbox), so still drain injects
             if (hookEvent === "UserPromptSubmit") {
               const queue = injectQueues.get(mapping.ccSessionId);
@@ -684,11 +738,13 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
           const body = (await req.json()) as { oldName: string; newName: string };
           if (!body.oldName || !body.newName) return error("oldName and newName required", 400);
 
-          // Call cloud API to rename in DB
-          const serviceUrl = getServiceUrl();
+          // Find the profile for the session connected to this project
+          const renamingSession = Array.from(sessions.values()).find((m) => m.project === body.oldName);
+          const renameProfile = renamingSession?.profile ?? cachedConfig?.active ?? "";
+          const serviceUrl = getServiceUrlForProfile(renameProfile);
           const res = await fetch(`${serviceUrl}/projects/${body.oldName}/rename`, {
             method: "POST",
-            headers: await authHeaders(),
+            headers: await authHeadersForProfile(renameProfile),
             body: JSON.stringify({ name: body.newName }),
           });
           if (!res.ok) {
@@ -750,6 +806,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
           session: mapping.session,
           user: mapping.user,
           slackChannel,
+          account: emailFromToken(await getTokenForProfile(mapping.profile)),
         });
       }
 
@@ -775,7 +832,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
           const mapping = sessions.get(body.ccSessionId);
           if (!mapping || !mapping.project) return error("Not connected", 400);
 
-          const serviceUrl = getServiceUrl();
+          const serviceUrl = getServiceUrlForProfile(mapping.profile);
           const relayBody = {
             // Replies come from the agent, not the human driver
             sender: mapping.agent,
@@ -791,7 +848,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
               `${serviceUrl}/projects/${mapping.project}/sessions/${mapping.session}/events`,
               {
                 method: "POST",
-                headers: await authHeaders(),
+                headers: await authHeadersForProfile(mapping.profile),
                 body: JSON.stringify(relayBody),
               }
             );
@@ -801,7 +858,7 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
           if (!res || res.status >= 500) {
             console.error(`polaris daemon: upstream reply relay failed (${res ? res.status : "network error"}) — queued to outbox`);
             await logEvent("/reply", body, { status: res?.status ?? 0, body: "queued to outbox" });
-            await enqueueOutbox(mapping.project, mapping.session, relayBody);
+            await enqueueOutbox(mapping.project, mapping.session, mapping.profile, relayBody);
             return json({ status: "queued" });
           }
           if (!res.ok) {
@@ -823,10 +880,10 @@ export function startDaemon(port = Number(process.env.POLARIS_DAEMON_PORT ?? 432
         const mapping = sessions.get(ccSessionId);
         if (!mapping || !mapping.project) return error("Not connected", 400);
 
-        const serviceUrl = getServiceUrl();
+        const serviceUrl = getServiceUrlForProfile(mapping.profile);
         const res = await fetch(
           `${serviceUrl}/projects/${mapping.project}/sessions/${targetSession}/messages`,
-          { headers: await authHeaders() }
+          { headers: await authHeadersForProfile(mapping.profile) }
         );
         if (!res.ok) {
           const err = await res.text();

package/tests/client.test.ts

@@ -53,6 +53,7 @@ describe("end-to-end: daemon + cloud service", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     await post(daemonUrl, "/events", {
@@ -74,6 +75,7 @@ describe("end-to-end: daemon + cloud service", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const wsUrl = serviceUrl.replace("http", "ws");
@@ -99,12 +101,14 @@ describe("end-to-end: daemon + cloud service", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
     await post(daemonUrl, "/connect", {
       ccSessionId: "multi-2",
       project: "pj",
       session: "fxk",
       user: "user:krishna",
+      create: true,
     });
 
     await post(daemonUrl, "/events", {
@@ -139,6 +143,7 @@ describe("capture.sh with daemon", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const hookPayload = JSON.stringify({

package/tests/daemon.test.ts

@@ -69,6 +69,7 @@ describe("daemon /connect", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
     expect(res.status).toBe(200);
     const body = await res.json();
@@ -96,6 +97,7 @@ describe("daemon /connect", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const res = await post(daemonUrl, "/connect", {
@@ -103,6 +105,7 @@ describe("daemon /connect", () => {
       project: "pj",
       session: "fxk",
       user: "user:manu",
+      create: true,
     });
     expect(res.status).toBe(200);
 
@@ -119,6 +122,7 @@ describe("daemon /disconnect", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const res = await post(daemonUrl, "/disconnect", { ccSessionId: "cc-5" });
@@ -137,6 +141,7 @@ describe("daemon /events (hook relay)", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const res = await post(daemonUrl, "/events", {
@@ -173,6 +178,7 @@ describe("daemon /status", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const res = await get(daemonUrl, "/status/cc-7");
@@ -195,12 +201,14 @@ describe("daemon /status", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
     await post(daemonUrl, "/connect", {
       ccSessionId: "cc-8b",
       project: "pj",
       session: "fxk",
       user: "user:krishna",
+      create: true,
     });
 
     const res = await get(daemonUrl, "/status");

package/tests/e2e.test.ts

@@ -56,6 +56,7 @@ describe("e2e: two drivers on same project", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
     expect(manuRes.status).toBe(200);
 
@@ -65,6 +66,7 @@ describe("e2e: two drivers on same project", () => {
       project: "pj",
       session: "fxk",
       user: "user:krishna",
+      create: true,
     });
     expect(krishnaRes.status).toBe(200);
 
@@ -108,12 +110,14 @@ describe("e2e: advisor injection", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
     await post(daemonUrl, "/connect", {
       ccSessionId: "cc-krishna",
       project: "pj",
       session: "fxk",
       user: "user:krishna",
+      create: true,
     });
 
     // Priya advises fxk only
@@ -141,6 +145,7 @@ describe("e2e: advisor injection", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     // Subscribe to session-level WS
@@ -171,12 +176,14 @@ describe("e2e: project-level WebSocket", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
     await post(daemonUrl, "/connect", {
       ccSessionId: "cc-proj-b",
       project: "pj",
       session: "fxk",
       user: "user:krishna",
+      create: true,
     });
 
     // Subscribe to project-level WS
@@ -213,6 +220,7 @@ describe("e2e: handoff", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     // Manu works
@@ -270,6 +278,7 @@ describe("e2e: status line", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const connRes = await get(daemonUrl, "/status/cc-status-1");
@@ -290,6 +299,7 @@ describe("e2e: status line", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     await post(daemonUrl, "/disconnect", { ccSessionId: "cc-status-2" });
@@ -307,6 +317,7 @@ describe("e2e: capture.sh through daemon", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     const hookPayload = JSON.stringify({
@@ -365,6 +376,7 @@ describe("e2e: session switching", () => {
       project: "pj",
       session: "fxm",
       user: "user:manu",
+      create: true,
     });
 
     await post(daemonUrl, "/events", {

package/tests/reply-attribution.test.ts

@@ -63,6 +63,7 @@ describe("daemon /reply attribution", () => {
       session: "fx-reply",
       user: "user:manu",
       agent: "agent:replybot",
+      create: true,
     });
     expect(connectRes.status).toBe(200);
 
@@ -86,6 +87,7 @@ describe("daemon /reply attribution", () => {
       project: "pj-reply",
       session: "fx-reply-default",
       user: "user:krishna",
+      create: true,
     });
 
     const replyRes = await post(daemonUrl, "/reply", {