@sechroom/cli 2026.6.27 → 2026.6.28

package/dist/index.js

@@ -16,12 +16,14 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
 var CONFIG_DIR = join(homedir(), ".config", "sechroom");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var TOKEN_FILE = join(CONFIG_DIR, "token.json");
+var ACCOUNTS_FILE = join(CONFIG_DIR, "accounts.json");
+var DEFAULT_ACCOUNT = "default";
 var STATE_DIR_NAME = ".sechroom";
 var BASELINE_CONFIG_NAME = ".sechroom.json";
 var OVERRIDE_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
-var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId"];
+var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId", "workspaces"];
 var DEFAULT_BASE_URL = "https://app.sechroom.ai/api";
-var LOCAL_CONFIG_SCHEMA_VERSION = 2;
+var LOCAL_CONFIG_SCHEMA_VERSION = 3;
 function ensureDir() {
   if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
 }
@@ -44,23 +46,87 @@ function writeDcrClientId(baseUrl, clientId) {
   const p = readPersisted();
   writePersisted({ clientIds: { ...p.clientIds ?? {}, [baseUrl]: clientId } });
 }
-function readToken() {
-  const envTok = process.env.SECHROOM_TOKEN;
-  if (envTok) return { accessToken: envTok };
+function readAccountsFile() {
   try {
-    return JSON.parse(readFileSync(TOKEN_FILE, "utf8"));
+    const parsed = JSON.parse(readFileSync(ACCOUNTS_FILE, "utf8"));
+    if (parsed && typeof parsed === "object" && parsed.accounts) return parsed;
   } catch {
-    return null;
   }
+  try {
+    const legacy = JSON.parse(readFileSync(TOKEN_FILE, "utf8"));
+    if (legacy?.accessToken) {
+      const migrated = {
+        accounts: {
+          [DEFAULT_ACCOUNT]: { ...legacy, baseUrl: readPersisted().baseUrl ?? DEFAULT_BASE_URL }
+        },
+        default: DEFAULT_ACCOUNT
+      };
+      writeAccountsFile(migrated);
+      rmSync(TOKEN_FILE, { force: true });
+      return migrated;
+    }
+  } catch {
+  }
+  return { accounts: {} };
 }
-function writeToken(tok) {
+function writeAccountsFile(file) {
   ensureDir();
-  writeFileSync(TOKEN_FILE, JSON.stringify(tok, null, 2), { mode: 384 });
+  writeFileSync(ACCOUNTS_FILE, JSON.stringify(file, null, 2), { mode: 384 });
+}
+function readAccount(alias) {
+  return readAccountsFile().accounts[alias] ?? null;
+}
+function writeAccount(alias, entry) {
+  const file = readAccountsFile();
+  file.accounts[alias] = entry;
+  if (!file.default) file.default = alias;
+  writeAccountsFile(file);
+}
+function removeAccount(alias) {
+  const file = readAccountsFile();
+  if (!(alias in file.accounts)) return false;
+  delete file.accounts[alias];
+  if (file.default === alias) file.default = Object.keys(file.accounts)[0];
+  writeAccountsFile(file);
+  return true;
+}
+function listAccounts() {
+  const file = readAccountsFile();
+  return Object.entries(file.accounts).map(([alias, entry]) => ({
+    alias,
+    entry,
+    isDefault: file.default === alias
+  }));
+}
+function setDefaultAccount(alias) {
+  const file = readAccountsFile();
+  if (!(alias in file.accounts)) throw new Error(`No account "${alias}". Run \`sechroom login --account ${alias}\` first.`);
+  file.default = alias;
+  writeAccountsFile(file);
+}
+function resolveAccountAlias(flagAccount) {
+  return flagAccount ?? process.env.SECHROOM_ACCOUNT ?? readLocalConfig().account ?? readAccountsFile().default ?? DEFAULT_ACCOUNT;
+}
+function writeLocalAccount(alias) {
+  const home = findConfigHome() ?? process.cwd();
+  const overridePath = join(home, OVERRIDE_CONFIG_NAME);
+  mkdirSync(dirname(overridePath), { recursive: true });
+  const current = readJsonConfig(overridePath) ?? {};
+  writeFileSync(
+    overridePath,
+    JSON.stringify({ ...current, account: alias }, null, 2),
+    { mode: 384 }
+  );
+  return overridePath;
+}
+function readToken() {
+  const envTok = process.env.SECHROOM_TOKEN;
+  if (envTok) return { accessToken: envTok };
+  return readAccount(resolveAccountAlias());
 }
 function clearToken() {
-  if (!existsSync(TOKEN_FILE)) return void 0;
-  rmSync(TOKEN_FILE);
-  return TOKEN_FILE;
+  const alias = resolveAccountAlias();
+  return removeAccount(alias) ? `${ACCOUNTS_FILE} (account "${alias}")` : void 0;
 }
 function clearPersisted() {
   if (!existsSync(CONFIG_FILE)) return void 0;
@@ -95,11 +161,14 @@ function readLocalConfig() {
     tenant: merged.tenant,
     workspaceId: merged.workspaceId,
     defaultProjectId: merged.defaultProjectId,
-    path: existsSync(baselinePath) ? baselinePath : overridePath
+    workspaces: merged.workspaces,
+    account: merged.account,
+    path: existsSync(baselinePath) ? baselinePath : overridePath,
+    home
   };
 }
-function writeLocalConfig(patch) {
-  const home = findConfigHome() ?? process.cwd();
+function writeLocalConfig(patch, opts) {
+  const home = (opts?.here ? process.cwd() : findConfigHome()) ?? process.cwd();
   const baselinePath = join(home, BASELINE_CONFIG_NAME);
   const overridePath = join(home, OVERRIDE_CONFIG_NAME);
   const current = readJsonConfig(baselinePath) ?? {};
@@ -117,6 +186,30 @@ function committedBindingPath(dir) {
   const p = join(dir, BASELINE_CONFIG_NAME);
   return existsSync(p) ? p : void 0;
 }
+function selectWorkspaceBinding(local, explicitName) {
+  const bindings = local.workspaces ?? [];
+  if (explicitName) {
+    const hit = bindings.find((b) => b.name === explicitName);
+    if (!hit)
+      throw new Error(
+        `No workspace binding named "${explicitName}" in ${local.home ?? "this repo"}'s .sechroom.json` + (bindings.length > 0 ? ` (have: ${bindings.map((b) => b.name).join(", ")})` : "") + ". Add one with `sechroom workspace bind`."
+      );
+    return hit;
+  }
+  if (!local.home || bindings.length === 0) return void 0;
+  const rel = process.cwd().startsWith(local.home) ? process.cwd().slice(local.home.length).replace(/^[/\\]/, "") : "";
+  const norm = (p) => p.replace(/\/\*\*$/, "").replace(/[/\\]+$/, "");
+  let best;
+  for (const b of bindings) {
+    for (const raw of b.paths ?? []) {
+      const prefix = norm(raw);
+      if (prefix.length === 0) continue;
+      const matches = rel === prefix || rel.startsWith(prefix + "/");
+      if (matches && (!best || prefix.length > best.len)) best = { binding: b, len: prefix.length };
+    }
+  }
+  return best?.binding;
+}
 function resolveConfig(flags) {
   const local = readLocalConfig();
   const persisted = readPersisted();
@@ -127,9 +220,11 @@ function resolveConfig(flags) {
       "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, run `sechroom config set tenant <id>`, or `sechroom config set --local tenant <id>` for this directory."
     );
   }
-  const workspaceId = process.env.SECHROOM_WORKSPACE ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
-  return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, workspaceId, defaultProjectId, clientId: persisted.clientId };
+  const binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  const workspaceId = process.env.SECHROOM_WORKSPACE ?? binding?.workspaceId ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
+  const defaultProjectId = (binding ? binding.defaultProjectId : void 0) ?? local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
+  const account = resolveAccountAlias(flags.account);
+  return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, account, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 function describeConfig(flags) {
   const local = readLocalConfig();
@@ -144,10 +239,17 @@ function describeConfig(flags) {
     return { value: void 0, source: "unset" };
   };
   const baseUrl = pick(flags.baseUrl, process.env.SECHROOM_BASE_URL, local.baseUrl, g.baseUrl, DEFAULT_BASE_URL);
+  let binding;
+  try {
+    binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
+  } catch {
+    binding = void 0;
+  }
+  const workspaceId = process.env.SECHROOM_WORKSPACE ? { value: process.env.SECHROOM_WORKSPACE, source: "env" } : binding ? { value: binding.workspaceId, source: `binding "${binding.name}"${localTag !== "local" ? ` (${local.path})` : ""}` } : pick(void 0, void 0, local.workspaceId, g.workspaceId);
   return {
     baseUrl: { value: baseUrl.value, source: baseUrl.source },
     tenant: pick(flags.tenant, process.env.SECHROOM_TENANT, local.tenant, g.tenant),
-    workspaceId: pick(void 0, process.env.SECHROOM_WORKSPACE, local.workspaceId, g.workspaceId),
+    workspaceId,
     localPath: local.path
   };
 }
@@ -245,14 +347,25 @@ async function exchange(meta, clientId, code, verifier, redirectUri) {
     })
   });
   if (!res.ok) throw new Error(`Token exchange failed (${res.status}): ${await res.text()}`);
-  persistTokenResponse(await res.json());
+  return await res.json();
 }
-function persistTokenResponse(json) {
-  const tok = json;
-  writeToken({
+function decodeEmail(accessToken) {
+  try {
+    const payload = accessToken.split(".")[1];
+    if (!payload) return void 0;
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof claims.email === "string" ? claims.email : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function persistTokenResponse(account, baseUrl, tok) {
+  writeAccount(account, {
+    baseUrl,
     accessToken: tok.access_token,
     refreshToken: tok.refresh_token,
-    expiresAt: tok.expires_in ? Date.now() + tok.expires_in * 1e3 : void 0
+    expiresAt: tok.expires_in ? Date.now() + tok.expires_in * 1e3 : void 0,
+    email: decodeEmail(tok.access_token)
   });
 }
 async function login(cfg) {
@@ -276,14 +389,25 @@ ${authUrl}
 `);
   await open(authUrl.toString());
   const code = await loopback.code;
-  await exchange(meta, clientId, code, verifier, loopback.redirectUri);
-  process.stderr.write("Signed in. Token cached.\n");
+  const tok = await exchange(meta, clientId, code, verifier, loopback.redirectUri);
+  persistTokenResponse(cfg.account, cfg.baseUrl, tok);
+  const email = decodeEmail(tok.access_token);
+  process.stderr.write(`Signed in${email ? ` as ${email}` : ""} (account "${cfg.account}"). Token cached.
+`);
 }
 async function requireToken(cfg) {
   if (process.env.SECHROOM_TOKEN) return process.env.SECHROOM_TOKEN;
-  const cached = readToken();
+  const cached = readAccount(cfg.account);
   if (!cached?.accessToken) {
-    throw new Error("Not signed in. Run `sechroom login` (or set SECHROOM_TOKEN for headless use).");
+    throw new Error(
+      `Not signed in (account "${cfg.account}"). Run \`sechroom login --account ${cfg.account}\` (or set SECHROOM_TOKEN for headless use).`
+    );
+  }
+  if (cached.baseUrl !== cfg.baseUrl) {
+    const matching = listAccounts().filter((a) => a.entry.baseUrl === cfg.baseUrl).map((a) => a.alias);
+    throw new Error(
+      `Account "${cfg.account}" is signed in to ${cached.baseUrl}, but this call targets ${cfg.baseUrl}. ` + (matching.length > 0 ? `Use --account ${matching[0]} (signed in there)` + (matching.length > 1 ? ` \u2014 or one of: ${matching.join(", ")}` : "") + ", or " : "") + `run \`sechroom login --account ${cfg.account}\` against it.`
+    );
   }
   const nearExpiry = cached.expiresAt !== void 0 && Date.now() > cached.expiresAt - 6e4;
   if (nearExpiry && cached.refreshToken) {
@@ -297,10 +421,10 @@ async function requireToken(cfg) {
       })
     });
     if (res.ok) {
-      persistTokenResponse(await res.json());
-      return readToken().accessToken;
+      persistTokenResponse(cfg.account, cfg.baseUrl, await res.json());
+      return readAccount(cfg.account).accessToken;
     }
-    throw new Error("Session expired and refresh failed. Run `sechroom login` again.");
+    throw new Error(`Session expired and refresh failed. Run \`sechroom login --account ${cfg.account}\` again.`);
   }
   return cached.accessToken;
 }
@@ -545,6 +669,62 @@ function fail(error) {
   process.exit(1);
 }
 
+// src/commands/accounts.ts
+function registerAccounts(program2) {
+  const accounts = program2.command("accounts").description("Manage signed-in identities (multi-account)");
+  accounts.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom login --account work               sign in a second identity under the "work" alias
+  $ sechroom accounts list                      see every signed-in identity + which is active here
+  $ sechroom accounts use work                  make "work" the machine default
+  $ sechroom accounts use work --local          pin "work" for THIS directory only (gitignored)
+  $ sechroom logout --account work              sign the "work" identity out`
+  );
+  accounts.command("list").description("List signed-in accounts (alias, email, server, expiry)").action((_opts, cmd) => {
+    const active2 = resolveAccountAlias(cmd.optsWithGlobals().account);
+    const rows = listAccounts().map(({ alias, entry, isDefault }) => ({
+      alias,
+      email: entry.email,
+      baseUrl: entry.baseUrl,
+      expiresAt: entry.expiresAt ? new Date(entry.expiresAt).toISOString() : void 0,
+      isDefault,
+      isActiveHere: alias === active2
+    }));
+    if (cmd.optsWithGlobals().json) return emit({ accounts: rows, active: active2 }, true);
+    if (rows.length === 0) {
+      console.log(style.dim("No accounts signed in. Run `sechroom login` (optionally --account <alias>)."));
+      return;
+    }
+    for (const r of rows) {
+      const markers = [r.isActiveHere ? style.green("active") : "", r.isDefault ? style.dim("default") : ""].filter(Boolean).join(" ");
+      console.log(
+        `${r.alias.padEnd(16)} ${(r.email ?? "\u2014").padEnd(28)} ${r.baseUrl} ${markers}`
+      );
+    }
+  });
+  accounts.command("use <alias>").description("Select the account used for calls (machine default, or --local for this directory)").option("--local", "pin for this directory only (gitignored .sechroom/config.json)").action((alias, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (opts.local) {
+      const path = writeLocalAccount(alias);
+      if (json) return emit({ account: alias, scope: "local", path }, true);
+      console.log(style.green(`Account "${alias}" pinned for this directory (${path}).`));
+      return;
+    }
+    setDefaultAccount(alias);
+    if (json) return emit({ account: alias, scope: "global" }, true);
+    console.log(style.green(`Account "${alias}" is now the machine default.`));
+  });
+  accounts.command("remove <alias>").description("Forget an account's cached token (local removal \u2014 does not revoke at the server)").action((alias, _opts, cmd) => {
+    const removed = removeAccount(alias);
+    if (cmd.optsWithGlobals().json) return emit({ removed: removed ? [alias] : [] }, true);
+    console.log(
+      removed ? style.green(`Account "${alias}" removed.`) : style.dim(`No account "${alias}".`)
+    );
+  });
+}
+
 // src/commands/memory.ts
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
@@ -1022,6 +1202,26 @@ Examples:
 // src/commands/workspace.ts
 function registerWorkspace(program2) {
   const workspace = program2.command("workspace").description("Create, browse, and manage workspaces");
+  workspace.command("bind <workspaceId>").description("Bind a workspace to this repo (.sechroom.json). With --name it becomes a NAMED v3 binding (multi-workspace); --paths scopes it to subtrees.").option("--name <name>", "binding name (enables multi-workspace; selectable via --binding / path match)").option("--paths <csv>", "comma-separated directory prefixes (relative to the repo root) this binding covers, e.g. frontend,docs").option("--default-project <id>", "informational default project for this binding").option("--here", "write the binding file at THIS directory even when a parent already carries one").action((workspaceId, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (!opts.name) {
+      const path2 = writeLocalConfig({ workspaceId, ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {} }, { here: Boolean(opts.here) });
+      if (json) return emit({ workspaceId, path: path2 }, true);
+      console.log(style.green(`Workspace ${workspaceId} bound (${path2}).`));
+      return;
+    }
+    const local = readLocalConfig();
+    const bindings = (local.workspaces ?? []).filter((b) => b.name !== opts.name);
+    bindings.push({
+      name: opts.name,
+      workspaceId,
+      ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {},
+      ...opts.paths ? { paths: String(opts.paths).split(",").map((p) => p.trim()).filter(Boolean) } : {}
+    });
+    const path = writeLocalConfig({ workspaces: bindings }, { here: Boolean(opts.here) });
+    if (json) return emit({ binding: opts.name, workspaceId, paths: opts.paths ?? null, path }, true);
+    console.log(style.green(`Binding "${opts.name}" \u2192 ${workspaceId} saved (${path}).`));
+  });
   workspace.addHelpText(
     "after",
     `
@@ -3179,7 +3379,7 @@ async function ensureTenant(baseUrl, g, opts) {
   const local = readLocalConfig();
   let tenant = g.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
   if (!tenant) {
-    const client = await makeClient({ baseUrl, tenant: "", clientId: persisted.clientId });
+    const client = await makeClient({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: persisted.clientId });
     const { data, error } = await client.GET("/auth/me/tenants", {});
     if (error) {
       fail(`Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`);
@@ -3214,7 +3414,7 @@ async function ensureTenant(baseUrl, g, opts) {
     }
   }
   const existingWorkspace = local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const wsClient = await makeClient({ baseUrl, tenant, clientId: persisted.clientId });
+  const wsClient = await makeClient({ baseUrl, tenant, account: resolveAccountAlias(), clientId: persisted.clientId });
   const workspaceId = await resolveWorkspaceBinding(wsClient, existingWorkspace, {
     yes: opts.yes,
     json: opts.json,
@@ -3236,7 +3436,7 @@ async function ensureTenant(baseUrl, g, opts) {
   if (opts.persist !== false) {
     const patch = { baseUrl, tenant, ...workspaceId ? { workspaceId } : {} };
     if (storeLocal) {
-      const path = writeLocalConfig(patch);
+      const path = writeLocalConfig(patch, { here: Boolean(opts.here) });
       if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved to ${path} (directory-local)
 `);
     } else {
@@ -3249,7 +3449,7 @@ async function ensureTenant(baseUrl, g, opts) {
 `);
     }
   }
-  return { baseUrl, tenant, workspaceId, defaultProjectId, clientId: persisted.clientId };
+  return { baseUrl, tenant, account: resolveAccountAlias(), workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 async function ensureAuth(cfg, yes) {
   if (process.env.SECHROOM_TOKEN) return;
@@ -3406,7 +3606,7 @@ async function runRecurse(cfg, g, opts) {
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -3432,13 +3632,13 @@ Examples:
     if (opts.designLane) process.env.SECHROOM_DESIGN_LANE = opts.designLane;
     if (opts.recurse) {
       const baseUrl2 = resolveBaseUrl(g);
-      await ensureAuth({ baseUrl: baseUrl2, tenant: "", clientId: readPersisted().clientId }, yes);
+      await ensureAuth({ baseUrl: baseUrl2, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
       const cfg2 = await ensureTenant(baseUrl2, g, { yes: true, json, persist: false });
       await runRecurse(cfg2, g, { yes, dryRun, json, lane: opts.lane, designLane: opts.designLane });
       return;
     }
     const baseUrl = resolveBaseUrl(g);
-    await ensureAuth({ baseUrl, tenant: "", clientId: readPersisted().clientId }, yes);
+    await ensureAuth({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
     const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local), workspace: opts.workspace, persist: !check });
     const tz = await ensureTimezone(cfg, { yes, dryRun: dryRun || check });
     if (!json && tz.action !== "already-set") {
@@ -3935,9 +4135,23 @@ function removeMaterialisedSkills(dir) {
   return removed;
 }
 function registerReset(program2) {
-  program2.command("logout").description("Sign out \u2014 remove the cached (global) auth token").action((_opts, cmd) => {
+  program2.command("logout").description("Sign out \u2014 remove the active account's cached token (--account <alias> for a specific one, --all for every account)").option("--account <alias>", "sign a specific account out").option("--all", "sign every account out").action((opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (opts.all) {
+      const removed2 = listAccounts().map((a) => a.alias);
+      for (const alias of removed2) removeAccount(alias);
+      if (json) return emit({ removed: removed2 }, true);
+      console.log(removed2.length > 0 ? style.green(`Signed out ${removed2.length} account(s): ${removed2.join(", ")}.`) : style.dim("Already signed out (no accounts)."));
+      return;
+    }
+    if (opts.account) {
+      const ok2 = removeAccount(opts.account);
+      if (json) return emit({ removed: ok2 ? [opts.account] : [] }, true);
+      console.log(ok2 ? style.green(`Signed out account "${opts.account}".`) : style.dim(`No account "${opts.account}".`));
+      return;
+    }
     const removed = clearToken();
-    if (cmd.optsWithGlobals().json) return emit({ removed: removed ? [removed] : [] }, true);
+    if (json) return emit({ removed: removed ? [removed] : [] }, true);
     console.log(
       removed ? style.green("Signed out \u2014 auth token removed.") : style.dim("Already signed out (no token).")
     );
@@ -3999,7 +4213,7 @@ function resolveVersion() {
   }
 }
 var program = new Command();
-program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--json", "Emit compact JSON (for scripts and agents)", false);
+program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--binding <name>", "Named workspace binding from .sechroom.json `workspaces` (overrides path auto-selection / SECHROOM_BINDING)").option("--json", "Emit compact JSON (for scripts and agents)", false);
 program.addHelpText(
   "after",
   `
@@ -4032,11 +4246,12 @@ Examples:
   $ sechroom login                                          sign in to the configured base URL + tenant
   $ sechroom login --base-url https://staging.app.sechroom.ai/api
   $ export SECHROOM_TOKEN=<bearer>                          headless: skip login entirely (CI / agents)`
-).action(async (_opts, cmd) => {
+).option("--account <alias>", "sign in under a named account alias (multi-account; default: the active alias)").action(async (opts, cmd) => {
   const g = cmd.optsWithGlobals();
   const persisted = readPersisted();
   const baseUrl = g.baseUrl ?? process.env.SECHROOM_BASE_URL ?? persisted.baseUrl ?? "https://app.sechroom.ai/api";
-  await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "" });
+  const account = resolveAccountAlias(opts.account);
+  await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "", account });
 });
 var config = program.command("config").description("Manage persisted CLI config");
 config.addHelpText(
@@ -4072,7 +4287,7 @@ config.command("set <key> <value>").description("Set baseUrl | tenant | workspac
 });
 config.command("show").description("Print resolved config + sources (flag > env > local > global > default)").action((_opts, cmd) => {
   const g = cmd.optsWithGlobals();
-  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant });
+  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant, binding: g.binding });
   if (g.json) {
     process.stdout.write(
       JSON.stringify({
@@ -4093,6 +4308,7 @@ local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
 `
   );
 });
+registerAccounts(program);
 registerMemory(program);
 registerWorklog(program);
 registerLookup(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.27",
+  "version": "2026.6.28",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",