@metabase/rde 0.1.14 → 0.1.15

package/dist/cli.mjs

@@ -50,6 +50,7 @@ var StepFailedError = class extends Error {
 var ExternalToolError = class extends Error {
 	tool;
 	argv;
+	envNames;
 	exitCode;
 	stderrTail;
 	constructor(failure) {
@@ -57,15 +58,21 @@ var ExternalToolError = class extends Error {
 		this.name = "ExternalToolError";
 		this.tool = failure.tool;
 		this.argv = failure.argv;
+		this.envNames = failure.envNames;
 		this.exitCode = failure.exitCode;
 		this.stderrTail = failure.stderrTail;
 	}
 };
+function commandLabel(failure) {
+	const command = `\`${[failure.tool, ...failure.argv].join(" ")}\``;
+	if (failure.envNames.length === 0) return command;
+	return `${command}, run by rde with ${failure.envNames.join(" and ")} set,`;
+}
 function describeToolFailure(failure) {
-	const command = [failure.tool, ...failure.argv].join(" ");
+	const command = commandLabel(failure);
 	const exit = failure.exitCode === null ? "was killed" : `exited with ${failure.exitCode}`;
 	const tail = failure.stderrTail.trim();
-	return tail.length === 0 ? `\`${command}\` ${exit}` : `\`${command}\` ${exit}: ${tail}`;
+	return tail.length === 0 ? `${command} ${exit}` : `${command} ${exit}: ${tail}`;
 }
 var MetabaseApiError = class extends Error {
 	status;
@@ -103,6 +110,9 @@ var MetabaseUnreachableError = class extends Error {
 		this.reason = reason;
 	}
 };
+function isMetabaseNotServing(error) {
+	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+}
 var DownloadError = class extends Error {
 	url;
 	constructor(url, reason) {
@@ -1348,9 +1358,6 @@ function createMetabaseClient(baseUrl, auth, signal, options = {}) {
 		user: userResource(http)
 	};
 }
-function isNotReadyYet(error) {
-	return error instanceof MetabaseInitializingError || error instanceof MetabaseUnreachableError;
-}
 async function waitForHealth(client, options) {
 	const deadline = Date.now() + options.timeoutMs;
 	const interval = options.pollIntervalMs ?? HEALTH_POLL_INTERVAL_MS;
@@ -1359,7 +1366,7 @@ async function waitForHealth(client, options) {
 			await client.health.get();
 			return;
 		} catch (error) {
-			if (!isNotReadyYet(error)) throw error;
+			if (!isMetabaseNotServing(error)) throw error;
 			if (error instanceof MetabaseInitializingError) options.onProgress(error.progress);
 		}
 		if (!await options.isRunning()) throw new MetabaseUnreachableError(client.baseUrl, "it exited before it became healthy");
@@ -1386,15 +1393,12 @@ function storedApiKey(state, secrets) {
 function hostCredentialsClient(signal) {
 	return (baseUrl, auth) => createMetabaseClient(baseUrl, auth, signal);
 }
-function isNotReady(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 async function hasAdminOutsideRde(state, client) {
 	if (state.url === null) return false;
 	try {
 		return (await client(state.url, NO_AUTH).session.properties())["has-user-setup"];
 	} catch (error) {
-		if (isNotReady(error)) return false;
+		if (isMetabaseNotServing(error)) return false;
 		throw error;
 	}
 }
@@ -1830,10 +1834,11 @@ function signalProcess(pid, signal) {
 function stderrTail(stderr) {
 	return stderr.trim().split("\n").slice(-5).join("\n");
 }
-function toolFailure(tool, argv, result) {
+function toolFailure(tool, argv, result, options = {}) {
 	return new ExternalToolError({
 		tool,
 		argv,
+		envNames: options.addedEnv === void 0 ? [] : Object.keys(options.addedEnv),
 		exitCode: result.exitCode,
 		stderrTail: stderrTail(result.stderr)
 	});
@@ -1845,6 +1850,7 @@ async function runShown(runner, output, command, args) {
 		if (exitCode !== 0) throw new ExternalToolError({
 			tool: command,
 			argv: args,
+			envNames: [],
 			exitCode,
 			stderrTail: ""
 		});
@@ -1856,6 +1862,7 @@ async function runShown(runner, output, command, args) {
 		throw new ExternalToolError({
 			tool: command,
 			argv: args,
+			envNames: [],
 			exitCode: result.exitCode,
 			stderrTail: stderrTail(printed.filter((line) => HAS_TEXT.test(line)).join("\n"))
 		});
@@ -1869,6 +1876,7 @@ function parseJsonOutput(tool, argv, stdout, schema) {
 		throw new ExternalToolError({
 			tool,
 			argv,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `output is not JSON: ${error instanceof Error ? error.message : String(error)}`
 		});
@@ -1879,6 +1887,7 @@ function parseJsonOutput(tool, argv, stdout, schema) {
 		if (error instanceof ZodError) throw new ExternalToolError({
 			tool,
 			argv,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `unexpected output shape:\n${z.prettifyError(error)}`
 		});
@@ -2344,6 +2353,7 @@ function dockerTool(runner) {
 		throw new ExternalToolError({
 			tool: DOCKER,
 			argv: args,
+			envNames: [],
 			exitCode: 0,
 			stderrTail: `no port published on ${LOOPBACK_HOST} in: ${result.stdout.trim()}`
 		});
@@ -3095,7 +3105,7 @@ function hostDeps$14(ctx) {
 	};
 }
 function isNotMetabaseYet(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
+	return isMetabaseNotServing(error) || error instanceof MetabaseApiError;
 }
 function validateEmail(value) {
 	return EMAIL.test(value) ? void 0 : "Enter an email address";
@@ -3455,11 +3465,12 @@ const LogoutResult = z.object({
 	cleared: z.boolean(),
 	aborted: z.boolean()
 }).loose();
+const MbAuthMethod = z.enum(["oauth", "apiKey"]);
 const AuthStatus = z.object({
 	profile: z.string(),
 	present: z.boolean(),
 	url: z.string().nullable(),
-	method: z.string().nullable(),
+	method: MbAuthMethod.nullable(),
 	user: ProbedUser.nullable()
 }).loose();
 const AuthProfileStatus = z.enum([
@@ -3506,11 +3517,41 @@ const RemoteChanges = z.object({
 	remote_version: z.string().nullable(),
 	local_version: z.string().nullable()
 }).loose();
+function comparableUrl(url) {
+	const parsed = new URL(url);
+	return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+}
+function sameMetabaseUrl(a, b) {
+	return comparableUrl(a) === comparableUrl(b);
+}
+function isLoggedInAt(status, url) {
+	return status !== null && status.present && status.url !== null && sameMetabaseUrl(status.url, url);
+}
+function isOAuthLoginAt(status, url) {
+	return status !== null && status.method === MbAuthMethod.enum.oauth && isLoggedInAt(status, url);
+}
+function isApiKeyLoginAt(status, url) {
+	return status !== null && status.method === MbAuthMethod.enum.apiKey && isLoggedInAt(status, url);
+}
+function mbInstanceOf(state, secrets) {
+	const configured = configuredRuntime(state);
+	if (configured === null || secrets === null || secrets.apiKey === null) return null;
+	return {
+		url: configured.url,
+		apiKey: secrets.apiKey
+	};
+}
+function instanceEnv(instance) {
+	return { addedEnv: {
+		[ENV_MB_URL]: instance.url,
+		[ENV_MB_API_KEY]: instance.apiKey
+	} };
+}
 function mbTool(runner) {
-	async function mbJson(args, schema, stdin) {
+	async function mbJson(args, schema, options = {}) {
 		const argv = [...args, "--json"];
-		const result = await runner.run(MB, argv, stdin === void 0 ? {} : { stdin });
-		if (result.exitCode !== 0) throw toolFailure(MB, argv, result);
+		const result = await runner.run(MB, argv, options);
+		if (result.exitCode !== 0) throw toolFailure(MB, argv, result, options);
 		return parseJsonOutput(MB, argv, result.stdout, schema);
 	}
 	async function version(command = MB) {
@@ -3533,7 +3574,7 @@ function mbTool(runner) {
 			options.url,
 			"--profile",
 			options.profile
-		], LoginResult, `${options.apiKey}\n`);
+		], LoginResult, { stdin: `${options.apiKey}\n` });
 	}
 	async function authStatus(profile) {
 		return mbJson([
@@ -3543,6 +3584,14 @@ function mbTool(runner) {
 			profile
 		], AuthStatus);
 	}
+	async function authStatusIfInstalled(profile) {
+		try {
+			return await authStatus(profile);
+		} catch (error) {
+			if (error instanceof ProcessNotFoundError) return null;
+			throw error;
+		}
+	}
 	async function authLogout(profile) {
 		return mbJson([
 			"auth",
@@ -3562,50 +3611,37 @@ function mbTool(runner) {
 			"0"
 		], AuthList)).data;
 	}
-	async function gitSyncStatus(profile) {
-		return mbJson([
-			"git-sync",
-			"status",
-			"--profile",
-			profile
-		], GitSyncStatus);
+	async function gitSyncStatus(instance) {
+		return mbJson(["git-sync", "status"], GitSyncStatus, instanceEnv(instance));
 	}
-	async function gitSyncHasRemoteChanges(profile) {
-		return mbJson([
-			"git-sync",
-			"has-remote-changes",
-			"--profile",
-			profile
-		], RemoteChanges);
+	async function gitSyncHasRemoteChanges(instance) {
+		return mbJson(["git-sync", "has-remote-changes"], RemoteChanges, instanceEnv(instance));
 	}
-	async function gitSyncImport(profile, options) {
+	async function gitSyncImport(instance, options) {
 		return mbJson([
 			"git-sync",
 			"import",
-			"--profile",
-			profile,
 			"--branch",
 			options.branch,
 			"--wait"
-		], GitSyncOutcome);
+		], GitSyncOutcome, instanceEnv(instance));
 	}
-	async function gitSyncExport(profile, options) {
+	async function gitSyncExport(instance, options) {
 		return mbJson([
 			"git-sync",
 			"export",
-			"--profile",
-			profile,
 			"--branch",
 			options.branch,
 			"--message",
 			options.message,
 			"--wait"
-		], GitSyncOutcome);
+		], GitSyncOutcome, instanceEnv(instance));
 	}
 	return {
 		version,
 		authLogin,
 		authStatus,
+		authStatusIfInstalled,
 		authLogout,
 		authList,
 		gitSyncStatus,
@@ -3626,7 +3662,8 @@ const ADMINISTRATORS_GROUP_NAME = "Administrators";
 function hostDeps$13(ctx) {
 	return {
 		client: (baseUrl, auth) => createMetabaseClient(baseUrl, auth, ctx.signal),
-		runner: processRunner(ctx.signal)
+		runner: processRunner(ctx.signal),
+		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
 async function adminCredentials(ctx) {
@@ -3682,6 +3719,13 @@ async function authenticates(client) {
 		throw error;
 	}
 }
+async function forgetCompletion(ctx) {
+	const { [STEP_ID$9]: record, ...steps } = ctx.state.steps;
+	if (record !== void 0) await ctx.saveState({
+		...ctx.state,
+		steps
+	});
+}
 async function workingApiKey(ctx, deps, url) {
 	const stored = ctx.secrets.apiKey;
 	if (stored !== null) {
@@ -3691,6 +3735,7 @@ async function workingApiKey(ctx, deps, url) {
 		}))) return stored;
 		ctx.ui.warn("Metabase rejects the stored API key; replacing it");
 	}
+	await forgetCompletion(ctx);
 	const sessionId = await superuserSession(ctx, deps, url);
 	const apiKey = await freshApiKey(ctx, deps.client(url, {
 		kind: "session",
@@ -3702,20 +3747,24 @@ async function workingApiKey(ctx, deps, url) {
 	});
 	return apiKey;
 }
-async function defaultProfileStatus(mb) {
-	try {
-		return await mb.authStatus(DEFAULT_MB_PROFILE);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return null;
-		throw error;
-	}
+function elsewhereUrl(status, url, movedFrom) {
+	if (status === null || !status.present || status.url === null) return null;
+	if (sameMetabaseUrl(status.url, url)) return null;
+	if (movedFrom !== null && sameMetabaseUrl(status.url, movedFrom)) return null;
+	return status.url;
 }
 async function chooseProfile(ctx, mb, url) {
 	const profile = ctx.state.mbProfile;
-	if (profile !== "default") return profile;
-	const existing = await defaultProfileStatus(mb);
-	if (existing === null || !existing.present || existing.url === null || existing.url === url || existing.url === ctx.state.movedFrom) return profile;
-	const previous = existing.url;
+	const status = await mb.authStatusIfInstalled(profile);
+	if (profile !== "default") return {
+		profile,
+		status
+	};
+	const previous = elsewhereUrl(status, url, ctx.state.movedFrom);
+	if (previous === null) return {
+		profile,
+		status
+	};
 	const named = namedMbProfile(ctx.state.name);
 	if (await ctx.prompts.select({
 		key: API_KEY_KEYS.profile,
@@ -3730,13 +3779,19 @@ async function chooseProfile(ctx, mb, url) {
 		recommended: "default"
 	}) === "default") {
 		ctx.ui.info(`Replacing mb profile ${DEFAULT_MB_PROFILE}, which pointed at ${previous}`);
-		return profile;
+		return {
+			profile,
+			status
+		};
 	}
 	await ctx.saveState({
 		...ctx.state,
 		mbProfile: named
 	});
-	return named;
+	return {
+		profile: named,
+		status: await mb.authStatusIfInstalled(named)
+	};
 }
 function usageNote(profile) {
 	if (profile === "default") return `${mbCommand(profile)} <command> uses this instance`;
@@ -3748,31 +3803,34 @@ function apiKeyStep(deps = hostDeps$13) {
 		title: "Connect the Metabase CLI",
 		redoHint: "`rde status` shows the mb profile it uses.",
 		async detect(ctx) {
-			if (ctx.secrets.apiKey === null) return "todo";
-			const mb = mbTool(deps(ctx).runner);
-			const profile = ctx.state.mbProfile;
+			const configured = configuredRuntime(ctx.state);
+			const apiKey = ctx.secrets.apiKey;
+			if (configured === null || apiKey === null || ctx.state.steps[STEP_ID$9]?.status !== "done") return "todo";
+			const resolved = deps(ctx);
+			if (!await resolved.instanceRunning()) return "todo";
+			if (!isLoggedInAt(await mbTool(resolved.runner).authStatusIfInstalled(ctx.state.mbProfile), configured.url)) return "todo";
 			try {
-				if (!(await mb.authStatus(profile)).present) return "todo";
+				return await authenticates(resolved.client(configured.url, {
+					kind: "api-key",
+					key: apiKey
+				})) ? "done" : "todo";
 			} catch (error) {
-				if (error instanceof ProcessNotFoundError) return "todo";
+				if (isMetabaseNotServing(error) || error instanceof MetabaseApiError) return "todo";
 				throw error;
 			}
-			return (await mb.authList()).find((candidate) => candidate.profile === profile)?.status === "ok" ? "done" : "todo";
 		},
 		async run(ctx) {
 			const resolved = deps(ctx);
 			const configured = requireConfiguredRuntime(ctx.state);
 			const apiKey = await workingApiKey(ctx, resolved, configured.url);
 			const mb = mbTool(resolved.runner);
-			const profile = await chooseProfile(ctx, mb, configured.url);
-			await mb.authLogin({
+			const { profile, status } = await chooseProfile(ctx, mb, configured.url);
+			if (isOAuthLoginAt(status, configured.url)) ctx.ui.info(`mb profile ${profile} is logged in to this instance with OAuth; leaving it as it is (\`mb auth logout --profile ${profile}\` first to use rde's API key instead)`);
+			else await mb.authLogin({
 				url: configured.url,
 				profile,
 				apiKey
 			});
-			const entry = (await mb.authList()).find((candidate) => candidate.profile === profile);
-			if (entry === void 0) throw new ConfigError(`\`mb auth list\` does not show profile ${profile} after login`);
-			if (entry.status !== "ok") throw new ConfigError(`mb profile ${profile} reports ${entry.status} after login`);
 			if (ctx.state.movedFrom !== null) await ctx.saveState({
 				...ctx.state,
 				movedFrom: null
@@ -6019,7 +6077,7 @@ async function applySettings(run, configured) {
 async function remoteHasContent(run, gitRemote) {
 	switch (gitRemote.kind) {
 		case "local-bare": return run.git.hasMetabaseContent(gitRemote.workdir);
-		case "hosted": return (await mbTool(run.deps.runner).gitSyncHasRemoteChanges(run.ctx.state.mbProfile)).has_changes;
+		case "hosted": return (await mbTool(run.deps.runner).gitSyncHasRemoteChanges(run.instance)).has_changes;
 	}
 }
 function reportImport(run, outcome) {
@@ -6041,7 +6099,7 @@ async function importExistingContent(run, gitRemote) {
 	const spinner = run.ctx.ui.spinner("Importing the repository's content into Metabase…");
 	let outcome;
 	try {
-		outcome = await mbTool(run.deps.runner).gitSyncImport(run.ctx.state.mbProfile, { branch: gitRemote.branch });
+		outcome = await mbTool(run.deps.runner).gitSyncImport(run.instance, { branch: gitRemote.branch });
 	} catch (error) {
 		spinner.fail("Import failed");
 		throw error;
@@ -6085,15 +6143,17 @@ function isMbUnavailable(error) {
 }
 async function runGitSync(ctx, deps) {
 	const configured = requireConfiguredRuntime(ctx.state);
-	if (ctx.secrets.apiKey === null) throw new ConfigError("no API key yet; the api-key step comes first");
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) throw new ConfigError("no API key yet; the api-key step comes first");
 	const run = {
 		ctx,
 		deps,
 		git: gitTool(deps.runner),
-		client: deps.client(configured.url, {
+		client: deps.client(instance.url, {
 			kind: "api-key",
-			key: ctx.secrets.apiKey
-		})
+			key: instance.apiKey
+		}),
+		instance
 	};
 	const flow = await runFlow({
 		remote: remoteScreen(run),
@@ -6123,8 +6183,10 @@ function gitSyncStep(deps = hostDeps$12) {
 			if (!hasRemoteSync(ctx.state.license)) return "not-applicable";
 			if (ctx.state.steps[STEP_ID$8]?.status === "skipped") return "not-applicable";
 			if (ctx.state.gitRemote === null || ctx.state.steps[STEP_ID$8]?.status !== "done") return "todo";
+			const instance = mbInstanceOf(ctx.state, ctx.secrets);
+			if (instance === null) return "todo";
 			try {
-				return (await mbTool(deps(ctx).runner).gitSyncStatus(ctx.state.mbProfile)).branch === null ? "todo" : "done";
+				return (await mbTool(deps(ctx).runner).gitSyncStatus(instance)).branch === null ? "todo" : "done";
 			} catch (error) {
 				if (isMbUnavailable(error)) return "todo";
 				throw error;
@@ -6564,9 +6626,6 @@ function hostDatabasesDeps(signal) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function isNotServingYet$2(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function requireApiKey$2(state, apiKey) {
 	if (apiKey === null) throw new ConfigError(`instance ${state.name} has no API key yet; run \`rde init\``);
 	return apiKey;
@@ -6707,7 +6766,7 @@ function databasesStep(options, deps = hostDeps$10) {
 			try {
 				return (await client.database.list()).data.some((database) => isOwn(database.id)) ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet$2(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -6886,6 +6945,7 @@ async function stillWrong(install, after, deps) {
 	const fail = (stderrTail) => new ExternalToolError({
 		tool: install.command,
 		argv: install.args,
+		envNames: [],
 		exitCode: 0,
 		stderrTail
 	});
@@ -6978,7 +7038,7 @@ function hostDeps$8(ctx) {
 }
 function isNoTokenYet(error) {
 	if (error instanceof MetabaseApiError) return error.status === NOT_FOUND_STATUS$2;
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
+	return isMetabaseNotServing(error);
 }
 function validateToken(value) {
 	if (value.length === 0 || TOKEN_PATTERN.test(value)) return;
@@ -7054,7 +7114,8 @@ function licenseStep(deps = hostDeps$8) {
 					validThru: status["valid-thru"] ?? null
 				}
 			});
-			await mbTool(resolved.runner).authLogin({
+			const mb = mbTool(resolved.runner);
+			if (isApiKeyLoginAt(await mb.authStatus(ctx.state.mbProfile), configured.url)) await mb.authLogin({
 				url: configured.url,
 				profile: ctx.state.mbProfile,
 				apiKey
@@ -7413,9 +7474,6 @@ function hostDeps$5(ctx) {
 		now: () => /* @__PURE__ */ new Date()
 	};
 }
-function isNotServingYet$1(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function isNotFound$2(error) {
 	return error instanceof MetabaseApiError && error.status === NOT_FOUND_STATUS$1;
 }
@@ -7576,7 +7634,7 @@ function sampleDatabaseStep(deps = hostDeps$5) {
 			try {
 				return await recordedDatabase(record, client) === null ? "todo" : "done";
 			} catch (error) {
-				if (isNotServingYet$1(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -7613,7 +7671,7 @@ function hostDeps$4(ctx) {
 	};
 }
 function isNotHealthy(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError || error instanceof MetabaseApiError;
+	return isMetabaseNotServing(error) || error instanceof MetabaseApiError;
 }
 async function runningVersion(client) {
 	return (await client.session.properties()).version.tag;
@@ -7718,9 +7776,6 @@ function hostDeps$3(ctx) {
 		probe: hostAgentProbe()
 	};
 }
-function isNotServing$1(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function loginLine(kind, email) {
 	switch (kind) {
 		case "generated":
@@ -7737,7 +7792,7 @@ async function databaseLines$1(state, apiKey, deps) {
 			key: apiKey
 		}).database.listWithStubs()).data;
 	} catch (error) {
-		if (isNotServing$1(error)) return ["Databases: Metabase is not running; `rde start`"];
+		if (isMetabaseNotServing(error)) return ["Databases: Metabase is not running; `rde start`"];
 		if (isRejectedCredential(error)) return ["Databases: Metabase rejects the stored API key; `rde init --only api-key`"];
 		throw error;
 	}
@@ -7819,9 +7874,6 @@ function hostDeps$2(ctx) {
 		instanceRunning: () => isInstanceRunning(ctx.state, hostRuntimeDeps(ctx.state.name, ctx.signal))
 	};
 }
-function isNotServingYet(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 function transformsStep(deps = hostDeps$2) {
 	return {
 		id: STEP_ID,
@@ -7838,7 +7890,7 @@ function transformsStep(deps = hostDeps$2) {
 			try {
 				return await client.setting.transformsDecided() ? "done" : "todo";
 			} catch (error) {
-				if (isNotServingYet(error) || isRejectedCredential(error)) return "todo";
+				if (isMetabaseNotServing(error) || isRejectedCredential(error)) return "todo";
 				throw error;
 			}
 		},
@@ -9365,31 +9417,46 @@ async function credentialRows(state, secrets, apiKey, deps) {
 		stateFileRow(files)
 	];
 }
-function withoutTrailingSlash(url) {
-	return url.replace(/\/+$/, "");
+function brokenProfileRepair(profile, method) {
+	if (method === MbAuthMethod.enum.oauth) return {
+		hint: `\`mb auth login --profile ${profile}\` logs it in again; or \`mb auth logout --profile ${profile}\`, then \`rde init --only api-key\` hands the profile to rde's API key`,
+		step: null
+	};
+	return {
+		hint: "`rde init --only api-key` logs it in again",
+		step: API_KEY_STEP
+	};
 }
-async function mbProfileRow(state, url, profiles, mbUnusableReason, healthy) {
+function unprobedReason(method, healthy, access) {
+	if (access.kind === "accepted") return null;
+	if (method !== MbAuthMethod.enum.oauth) return access.reason;
+	return healthy ? null : NOT_HEALTHY_REASON;
+}
+async function mbProfileRow(state, url, deps, profiles, mbUnusableReason, healthy, access) {
+	const id = "mb-profile";
 	const label = "mb profile";
-	if (mbUnusableReason !== null) return skipped("mb-profile", label, mbUnusableReason);
-	if (!healthy) return skipped("mb-profile", label, NOT_HEALTHY_REASON);
-	const entry = (await profiles()).find((candidate) => candidate.profile === state.mbProfile);
-	if (entry === void 0) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} is not configured`,
+	const profile = state.mbProfile;
+	if (mbUnusableReason !== null) return skipped(id, label, mbUnusableReason);
+	const status = await mbTool(deps.runner).authStatus(profile);
+	if (!status.present || status.url === null) return failed(id, label, {
+		detail: `${profile} is not configured`,
 		hint: "`rde init --only api-key`",
-		step: "api-key"
+		step: API_KEY_STEP
 	});
-	if (withoutTrailingSlash(entry.url) !== withoutTrailingSlash(url)) return failed("mb-profile", label, {
-		detail: `${state.mbProfile} points at ${entry.url}, not at this instance (${url})`,
+	if (!sameMetabaseUrl(status.url, url)) return failed(id, label, {
+		detail: `${profile} points at ${status.url}, not at this instance (${url})`,
 		hint: "`rde init --only api-key` logs it back in against the instance",
-		step: "api-key"
+		step: API_KEY_STEP
 	});
-	if (entry.status !== "ok") return failed("mb-profile", label, {
-		detail: `${state.mbProfile}: ${entry.status}`,
-		hint: "`rde init --only api-key` logs it in again",
-		step: "api-key"
+	const unprobed = unprobedReason(status.method, healthy, access);
+	if (unprobed !== null) return skipped(id, label, unprobed);
+	const how = status.method === MbAuthMethod.enum.oauth ? " (OAuth)" : "";
+	const entry = (await profiles()).find((candidate) => candidate.profile === profile);
+	if (entry === void 0 || entry.status !== "ok") return failed(id, label, {
+		detail: `${profile}${how}: ${entry === void 0 ? "not listed by `mb auth list`" : entry.status}`,
+		...brokenProfileRepair(profile, status.method)
 	});
-	const user = entry.user === null ? "" : ` as ${entry.user.name}`;
-	return ok("mb-profile", label, `${state.mbProfile}: ok${user}`);
+	return ok(id, label, `${profile}${how}: ok${entry.user === null ? "" : ` as ${entry.user.name}`}`);
 }
 function hostOf(url) {
 	return URL.canParse(url) ? new URL(url).host : "an address that is not a URL";
@@ -9410,8 +9477,8 @@ async function mbProfileEnvRow(name, rdeProfile, profiles, mbUnusableReason) {
 async function environmentRows(env, rdeProfile, profiles, mbUnusableReason) {
 	const rows = [];
 	if (env.profile !== null) rows.push(await mbProfileEnvRow(env.profile, rdeProfile, profiles, mbUnusableReason));
-	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says, rde's own included`, unsetHint(ENV_MB_URL)));
-	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says, rde's own included", unsetHint(ENV_MB_API_KEY)));
+	if (env.url !== null) rows.push(note$1(`env.${ENV_MB_URL}`, ENV_MB_URL, `every \`mb\` call goes to ${hostOf(env.url)}, whatever \`--profile\` says`, unsetHint(ENV_MB_URL)));
+	if (env.apiKeySet) rows.push(note$1(`env.${ENV_MB_API_KEY}`, ENV_MB_API_KEY, "set (value not shown): every `mb` call sends it, whatever `--profile` says", unsetHint(ENV_MB_API_KEY)));
 	return rows;
 }
 const PROFILE_STATUS_WORDS = {
@@ -9513,12 +9580,13 @@ async function sampleDatabaseRow(record, deps, dockerOk, access) {
 function isMbFailure$1(error) {
 	return error instanceof ProcessNotFoundError || error instanceof ExternalToolError;
 }
-async function gitSyncRow(state, deps) {
+async function gitSyncRow(state, instance, deps) {
 	const label = "remote sync";
 	if (!hasRemoteSync(state.license)) return skipped("git-sync", label, `needs a license with ${REMOTE_SYNC_FEATURE}`);
 	if (state.gitRemote === null) return skipped("git-sync", label, "not configured; `rde init --from git-sync`");
+	if (instance === null) return skipped("git-sync", label, "no API key in the secrets file");
 	try {
-		const status = await mbTool(deps.runner).gitSyncStatus(state.mbProfile);
+		const status = await mbTool(deps.runner).gitSyncStatus(instance);
 		if (status.branch === null) return failed("git-sync", label, {
 			detail: "Metabase reports no branch",
 			hint: "`rde init --only git-sync`",
@@ -9676,13 +9744,13 @@ async function instanceRows(state, secrets, deps, dockerOk, profiles, mbUnusable
 		properties === null ? skipped("version", "Metabase version", NOT_HEALTHY_REASON) : versionRow(state, properties),
 		properties === null ? skipped("admin", "admin user", NOT_HEALTHY_REASON) : adminRow(state, properties),
 		...await credentialRows(state, secrets, apiKey, deps),
-		await mbProfileRow(state, configured.url, profiles, mbUnusableReason, healthy)
+		await mbProfileRow(state, configured.url, deps, profiles, mbUnusableReason, healthy, apiKey.access)
 	];
 	const access = apiKey.access;
 	if (access.kind === "unusable") rows.push(skipped("license", "license", access.reason), skipped("databases", "databases", access.reason));
 	else rows.push(await licenseRow(access.client), await databasesRow(state, access.client));
 	rows.push(state.sampleDatabase === null ? skipped("sample-database", SAMPLE_LABEL, "not connected; `rde init` adds one") : await sampleDatabaseRow(state.sampleDatabase, deps, dockerOk, access));
-	rows.push(await gitSyncRow(state, deps));
+	rows.push(await gitSyncRow(state, mbInstanceOf(state, secrets), deps));
 	return rows;
 }
 async function collectDoctor(instance, state, secrets, deps) {
@@ -10257,20 +10325,12 @@ async function moveToPort(ctx, port, deps) {
 	await runtimeFromState(next, deps.runtime).reconfigure();
 	ctx.ui.info(`Moved instance ${ctx.state.name} from port ${previous} to ${port}`);
 }
-async function profileStatus(runner, profile) {
-	try {
-		return await mbTool(runner).authStatus(profile);
-	} catch (error) {
-		if (error instanceof ProcessNotFoundError) return null;
-		throw error;
-	}
-}
 async function followMove(ctx, from, runner) {
 	const configured = requireConfiguredRuntime(ctx.state);
 	const apiKey = ctx.secrets.apiKey;
 	const profile = ctx.state.mbProfile;
-	const status = apiKey === null ? null : await profileStatus(runner, profile);
-	if (apiKey !== null && status !== null && status.present && status.url === from) {
+	const status = apiKey === null ? null : await mbTool(runner).authStatusIfInstalled(profile);
+	if (apiKey !== null && isLoggedInAt(status, from)) {
 		await mbTool(runner).authLogin({
 			url: configured.url,
 			profile,
@@ -10353,15 +10413,12 @@ function setupOf(ctx, steps) {
 		resume: `rde init --from ${pending.id}`
 	};
 }
-function isNotServing(error) {
-	return error instanceof MetabaseUnreachableError || error instanceof MetabaseInitializingError;
-}
 async function databasesOf(ctx, deps, health) {
 	if (health !== "healthy" || ctx.secrets.apiKey === null) return null;
 	try {
 		return await listDatabases(ctx.state, ctx.secrets.apiKey, { client: deps.client });
 	} catch (error) {
-		if (isNotServing(error) || isRejectedCredential(error)) return null;
+		if (isMetabaseNotServing(error) || isRejectedCredential(error)) return null;
 		throw error;
 	}
 }
@@ -10391,10 +10448,13 @@ function isMbFailure(error) {
 }
 async function gitSyncOf(ctx, deps) {
 	if (ctx.state.gitRemote === null) return null;
+	if (configuredRuntime(ctx.state) === null) return { error: "no Metabase runtime configured; `rde init`" };
+	const instance = mbInstanceOf(ctx.state, ctx.secrets);
+	if (instance === null) return { error: "no API key in the secrets file; `rde init --only api-key`" };
 	try {
 		const mb = mbTool(deps.runner);
-		const status = await mb.gitSyncStatus(ctx.state.mbProfile);
-		const changes = await mb.gitSyncHasRemoteChanges(ctx.state.mbProfile);
+		const status = await mb.gitSyncStatus(instance);
+		const changes = await mb.gitSyncHasRemoteChanges(instance);
 		return {
 			branch: status.branch,
 			dirty: status.is_dirty,
@@ -10555,7 +10615,6 @@ const stop = defineRdeCommand({
 });
 //#endregion
 //#region src/steps/uninstall.ts
-const API_KEY_METHOD = "apiKey";
 function hostUninstallDeps(signal, childOutput) {
 	const runner = processRunner(signal);
 	return {
@@ -10714,8 +10773,8 @@ async function findJar(source, removeImage) {
 }
 function isInstanceProfile(status, urls) {
 	if (!status.present) return false;
-	if (urls !== null) return status.url !== null && urls.includes(status.url);
-	return status.method === API_KEY_METHOD && status.user?.name === "rde";
+	if (urls !== null) return urls.some((url) => isLoggedInAt(status, url));
+	return status.method === MbAuthMethod.enum.apiKey && status.user?.name === "rde";
 }
 function instanceUrls(state) {
 	if (state.url === null) return null;
@@ -10723,23 +10782,34 @@ function instanceUrls(state) {
 }
 async function findMbProfiles(candidates, urls, runner) {
 	const mb = mbTool(runner);
-	const removals = [];
+	const found = {
+		removals: [],
+		kept: []
+	};
 	for (const profile of candidates) {
 		let status;
 		try {
 			status = await mb.authStatus(profile);
 		} catch (error) {
-			if (error instanceof ProcessNotFoundError) return [];
+			if (error instanceof ProcessNotFoundError) return {
+				removals: [],
+				kept: []
+			};
 			throw error;
 		}
-		if (isInstanceProfile(status, urls)) removals.push({
+		if (!isInstanceProfile(status, urls)) continue;
+		if (status.method === MbAuthMethod.enum.oauth) {
+			found.kept.push(`mb profile ${profile}, logged in with OAuth; \`mb auth logout --profile ${profile}\` logs it out`);
+			continue;
+		}
+		found.removals.push({
 			label: `mb profile ${profile}`,
 			remove: async () => {
 				await mb.authLogout(profile);
 			}
 		});
 	}
-	return removals;
+	return found;
 }
 function skillLabel(names, entries) {
 	const agents = [...new Set(entries.flatMap((entry) => entry.agents))];
@@ -10821,7 +10891,8 @@ async function planUninstall(options, deps) {
 		if (jar.kept !== null) kept.push(jar.kept);
 	}
 	const profiles = state === null ? await findMbProfiles([.../* @__PURE__ */ new Set([mbProfileFor(options.instance), namedMbProfile(options.instance)])], null, deps.runner) : await findMbProfiles([state.mbProfile], instanceUrls(state), deps.runner);
-	removals.push(...profiles);
+	removals.push(...profiles.removals);
+	kept.push(...profiles.kept);
 	if (options.removeSkill) {
 		const skill = await findSkill(deps.runner, deps.childOutput);
 		if (skill !== null) removals.push(skill);
@@ -11238,7 +11309,7 @@ const upgradeCommand = defineRdeCommand({
 const main = defineCommand({
 	meta: {
 		name: "rde",
-		version: "0.1.14",
+		version: "0.1.15",
 		description: "Prepares a local machine for data-engineering work with Metabase and coding agents"
 	},
 	subCommands: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metabase/rde",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Prepares a local machine for data-engineering work with Metabase and coding agents",
   "license": "AGPL-3.0",
   "bin": {