@sechroom/cli 2026.6.28 → 2026.6.29-rc.692f8a8f

package/dist/index.js

@@ -16,14 +16,12 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
 var CONFIG_DIR = join(homedir(), ".config", "sechroom");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var TOKEN_FILE = join(CONFIG_DIR, "token.json");
-var ACCOUNTS_FILE = join(CONFIG_DIR, "accounts.json");
-var DEFAULT_ACCOUNT = "default";
 var STATE_DIR_NAME = ".sechroom";
 var BASELINE_CONFIG_NAME = ".sechroom.json";
 var OVERRIDE_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
-var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId", "workspaces"];
+var BINDING_FIELDS = ["schemaVersion", "baseUrl", "tenant", "workspaceId", "defaultProjectId"];
 var DEFAULT_BASE_URL = "https://app.sechroom.ai/api";
-var LOCAL_CONFIG_SCHEMA_VERSION = 3;
+var LOCAL_CONFIG_SCHEMA_VERSION = 2;
 function ensureDir() {
   if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true, mode: 448 });
 }
@@ -46,87 +44,23 @@ function writeDcrClientId(baseUrl, clientId) {
   const p = readPersisted();
   writePersisted({ clientIds: { ...p.clientIds ?? {}, [baseUrl]: clientId } });
 }
-function readAccountsFile() {
-  try {
-    const parsed = JSON.parse(readFileSync(ACCOUNTS_FILE, "utf8"));
-    if (parsed && typeof parsed === "object" && parsed.accounts) return parsed;
-  } catch {
-  }
+function readToken() {
+  const envTok = process.env.SECHROOM_TOKEN;
+  if (envTok) return { accessToken: envTok };
   try {
-    const legacy = JSON.parse(readFileSync(TOKEN_FILE, "utf8"));
-    if (legacy?.accessToken) {
-      const migrated = {
-        accounts: {
-          [DEFAULT_ACCOUNT]: { ...legacy, baseUrl: readPersisted().baseUrl ?? DEFAULT_BASE_URL }
-        },
-        default: DEFAULT_ACCOUNT
-      };
-      writeAccountsFile(migrated);
-      rmSync(TOKEN_FILE, { force: true });
-      return migrated;
-    }
+    return JSON.parse(readFileSync(TOKEN_FILE, "utf8"));
   } catch {
+    return null;
   }
-  return { accounts: {} };
 }
-function writeAccountsFile(file) {
+function writeToken(tok) {
   ensureDir();
-  writeFileSync(ACCOUNTS_FILE, JSON.stringify(file, null, 2), { mode: 384 });
-}
-function readAccount(alias) {
-  return readAccountsFile().accounts[alias] ?? null;
-}
-function writeAccount(alias, entry) {
-  const file = readAccountsFile();
-  file.accounts[alias] = entry;
-  if (!file.default) file.default = alias;
-  writeAccountsFile(file);
-}
-function removeAccount(alias) {
-  const file = readAccountsFile();
-  if (!(alias in file.accounts)) return false;
-  delete file.accounts[alias];
-  if (file.default === alias) file.default = Object.keys(file.accounts)[0];
-  writeAccountsFile(file);
-  return true;
-}
-function listAccounts() {
-  const file = readAccountsFile();
-  return Object.entries(file.accounts).map(([alias, entry]) => ({
-    alias,
-    entry,
-    isDefault: file.default === alias
-  }));
-}
-function setDefaultAccount(alias) {
-  const file = readAccountsFile();
-  if (!(alias in file.accounts)) throw new Error(`No account "${alias}". Run \`sechroom login --account ${alias}\` first.`);
-  file.default = alias;
-  writeAccountsFile(file);
-}
-function resolveAccountAlias(flagAccount) {
-  return flagAccount ?? process.env.SECHROOM_ACCOUNT ?? readLocalConfig().account ?? readAccountsFile().default ?? DEFAULT_ACCOUNT;
-}
-function writeLocalAccount(alias) {
-  const home = findConfigHome() ?? process.cwd();
-  const overridePath = join(home, OVERRIDE_CONFIG_NAME);
-  mkdirSync(dirname(overridePath), { recursive: true });
-  const current = readJsonConfig(overridePath) ?? {};
-  writeFileSync(
-    overridePath,
-    JSON.stringify({ ...current, account: alias }, null, 2),
-    { mode: 384 }
-  );
-  return overridePath;
-}
-function readToken() {
-  const envTok = process.env.SECHROOM_TOKEN;
-  if (envTok) return { accessToken: envTok };
-  return readAccount(resolveAccountAlias());
+  writeFileSync(TOKEN_FILE, JSON.stringify(tok, null, 2), { mode: 384 });
 }
 function clearToken() {
-  const alias = resolveAccountAlias();
-  return removeAccount(alias) ? `${ACCOUNTS_FILE} (account "${alias}")` : void 0;
+  if (!existsSync(TOKEN_FILE)) return void 0;
+  rmSync(TOKEN_FILE);
+  return TOKEN_FILE;
 }
 function clearPersisted() {
   if (!existsSync(CONFIG_FILE)) return void 0;
@@ -161,14 +95,11 @@ function readLocalConfig() {
     tenant: merged.tenant,
     workspaceId: merged.workspaceId,
     defaultProjectId: merged.defaultProjectId,
-    workspaces: merged.workspaces,
-    account: merged.account,
-    path: existsSync(baselinePath) ? baselinePath : overridePath,
-    home
+    path: existsSync(baselinePath) ? baselinePath : overridePath
   };
 }
-function writeLocalConfig(patch, opts) {
-  const home = (opts?.here ? process.cwd() : findConfigHome()) ?? process.cwd();
+function writeLocalConfig(patch) {
+  const home = findConfigHome() ?? process.cwd();
   const baselinePath = join(home, BASELINE_CONFIG_NAME);
   const overridePath = join(home, OVERRIDE_CONFIG_NAME);
   const current = readJsonConfig(baselinePath) ?? {};
@@ -186,30 +117,6 @@ function committedBindingPath(dir) {
   const p = join(dir, BASELINE_CONFIG_NAME);
   return existsSync(p) ? p : void 0;
 }
-function selectWorkspaceBinding(local, explicitName) {
-  const bindings = local.workspaces ?? [];
-  if (explicitName) {
-    const hit = bindings.find((b) => b.name === explicitName);
-    if (!hit)
-      throw new Error(
-        `No workspace binding named "${explicitName}" in ${local.home ?? "this repo"}'s .sechroom.json` + (bindings.length > 0 ? ` (have: ${bindings.map((b) => b.name).join(", ")})` : "") + ". Add one with `sechroom workspace bind`."
-      );
-    return hit;
-  }
-  if (!local.home || bindings.length === 0) return void 0;
-  const rel = process.cwd().startsWith(local.home) ? process.cwd().slice(local.home.length).replace(/^[/\\]/, "") : "";
-  const norm = (p) => p.replace(/\/\*\*$/, "").replace(/[/\\]+$/, "");
-  let best;
-  for (const b of bindings) {
-    for (const raw of b.paths ?? []) {
-      const prefix = norm(raw);
-      if (prefix.length === 0) continue;
-      const matches = rel === prefix || rel.startsWith(prefix + "/");
-      if (matches && (!best || prefix.length > best.len)) best = { binding: b, len: prefix.length };
-    }
-  }
-  return best?.binding;
-}
 function resolveConfig(flags) {
   const local = readLocalConfig();
   const persisted = readPersisted();
@@ -220,11 +127,9 @@ function resolveConfig(flags) {
       "No tenant set. The Sechroom API rejects untenanted requests (HTTP 400). Pass --tenant <id>, set SECHROOM_TENANT, run `sechroom config set tenant <id>`, or `sechroom config set --local tenant <id>` for this directory."
     );
   }
-  const binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
-  const workspaceId = process.env.SECHROOM_WORKSPACE ?? binding?.workspaceId ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const defaultProjectId = (binding ? binding.defaultProjectId : void 0) ?? local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
-  const account = resolveAccountAlias(flags.account);
-  return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, account, workspaceId, defaultProjectId, clientId: persisted.clientId };
+  const workspaceId = process.env.SECHROOM_WORKSPACE ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
+  const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
+  return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 function describeConfig(flags) {
   const local = readLocalConfig();
@@ -239,17 +144,10 @@ function describeConfig(flags) {
     return { value: void 0, source: "unset" };
   };
   const baseUrl = pick(flags.baseUrl, process.env.SECHROOM_BASE_URL, local.baseUrl, g.baseUrl, DEFAULT_BASE_URL);
-  let binding;
-  try {
-    binding = selectWorkspaceBinding(local, flags.binding ?? process.env.SECHROOM_BINDING);
-  } catch {
-    binding = void 0;
-  }
-  const workspaceId = process.env.SECHROOM_WORKSPACE ? { value: process.env.SECHROOM_WORKSPACE, source: "env" } : binding ? { value: binding.workspaceId, source: `binding "${binding.name}"${localTag !== "local" ? ` (${local.path})` : ""}` } : pick(void 0, void 0, local.workspaceId, g.workspaceId);
   return {
     baseUrl: { value: baseUrl.value, source: baseUrl.source },
     tenant: pick(flags.tenant, process.env.SECHROOM_TENANT, local.tenant, g.tenant),
-    workspaceId,
+    workspaceId: pick(void 0, process.env.SECHROOM_WORKSPACE, local.workspaceId, g.workspaceId),
     localPath: local.path
   };
 }
@@ -347,25 +245,14 @@ async function exchange(meta, clientId, code, verifier, redirectUri) {
     })
   });
   if (!res.ok) throw new Error(`Token exchange failed (${res.status}): ${await res.text()}`);
-  return await res.json();
+  persistTokenResponse(await res.json());
 }
-function decodeEmail(accessToken) {
-  try {
-    const payload = accessToken.split(".")[1];
-    if (!payload) return void 0;
-    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    return typeof claims.email === "string" ? claims.email : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function persistTokenResponse(account, baseUrl, tok) {
-  writeAccount(account, {
-    baseUrl,
+function persistTokenResponse(json) {
+  const tok = json;
+  writeToken({
     accessToken: tok.access_token,
     refreshToken: tok.refresh_token,
-    expiresAt: tok.expires_in ? Date.now() + tok.expires_in * 1e3 : void 0,
-    email: decodeEmail(tok.access_token)
+    expiresAt: tok.expires_in ? Date.now() + tok.expires_in * 1e3 : void 0
   });
 }
 async function login(cfg) {
@@ -389,25 +276,14 @@ ${authUrl}
 `);
   await open(authUrl.toString());
   const code = await loopback.code;
-  const tok = await exchange(meta, clientId, code, verifier, loopback.redirectUri);
-  persistTokenResponse(cfg.account, cfg.baseUrl, tok);
-  const email = decodeEmail(tok.access_token);
-  process.stderr.write(`Signed in${email ? ` as ${email}` : ""} (account "${cfg.account}"). Token cached.
-`);
+  await exchange(meta, clientId, code, verifier, loopback.redirectUri);
+  process.stderr.write("Signed in. Token cached.\n");
 }
 async function requireToken(cfg) {
   if (process.env.SECHROOM_TOKEN) return process.env.SECHROOM_TOKEN;
-  const cached = readAccount(cfg.account);
+  const cached = readToken();
   if (!cached?.accessToken) {
-    throw new Error(
-      `Not signed in (account "${cfg.account}"). Run \`sechroom login --account ${cfg.account}\` (or set SECHROOM_TOKEN for headless use).`
-    );
-  }
-  if (cached.baseUrl !== cfg.baseUrl) {
-    const matching = listAccounts().filter((a) => a.entry.baseUrl === cfg.baseUrl).map((a) => a.alias);
-    throw new Error(
-      `Account "${cfg.account}" is signed in to ${cached.baseUrl}, but this call targets ${cfg.baseUrl}. ` + (matching.length > 0 ? `Use --account ${matching[0]} (signed in there)` + (matching.length > 1 ? ` \u2014 or one of: ${matching.join(", ")}` : "") + ", or " : "") + `run \`sechroom login --account ${cfg.account}\` against it.`
-    );
+    throw new Error("Not signed in. Run `sechroom login` (or set SECHROOM_TOKEN for headless use).");
   }
   const nearExpiry = cached.expiresAt !== void 0 && Date.now() > cached.expiresAt - 6e4;
   if (nearExpiry && cached.refreshToken) {
@@ -421,10 +297,10 @@ async function requireToken(cfg) {
       })
     });
     if (res.ok) {
-      persistTokenResponse(cfg.account, cfg.baseUrl, await res.json());
-      return readAccount(cfg.account).accessToken;
+      persistTokenResponse(await res.json());
+      return readToken().accessToken;
     }
-    throw new Error(`Session expired and refresh failed. Run \`sechroom login --account ${cfg.account}\` again.`);
+    throw new Error("Session expired and refresh failed. Run `sechroom login` again.");
   }
   return cached.accessToken;
 }
@@ -669,62 +545,6 @@ function fail(error) {
   process.exit(1);
 }
 
-// src/commands/accounts.ts
-function registerAccounts(program2) {
-  const accounts = program2.command("accounts").description("Manage signed-in identities (multi-account)");
-  accounts.addHelpText(
-    "after",
-    `
-Examples:
-  $ sechroom login --account work               sign in a second identity under the "work" alias
-  $ sechroom accounts list                      see every signed-in identity + which is active here
-  $ sechroom accounts use work                  make "work" the machine default
-  $ sechroom accounts use work --local          pin "work" for THIS directory only (gitignored)
-  $ sechroom logout --account work              sign the "work" identity out`
-  );
-  accounts.command("list").description("List signed-in accounts (alias, email, server, expiry)").action((_opts, cmd) => {
-    const active2 = resolveAccountAlias(cmd.optsWithGlobals().account);
-    const rows = listAccounts().map(({ alias, entry, isDefault }) => ({
-      alias,
-      email: entry.email,
-      baseUrl: entry.baseUrl,
-      expiresAt: entry.expiresAt ? new Date(entry.expiresAt).toISOString() : void 0,
-      isDefault,
-      isActiveHere: alias === active2
-    }));
-    if (cmd.optsWithGlobals().json) return emit({ accounts: rows, active: active2 }, true);
-    if (rows.length === 0) {
-      console.log(style.dim("No accounts signed in. Run `sechroom login` (optionally --account <alias>)."));
-      return;
-    }
-    for (const r of rows) {
-      const markers = [r.isActiveHere ? style.green("active") : "", r.isDefault ? style.dim("default") : ""].filter(Boolean).join(" ");
-      console.log(
-        `${r.alias.padEnd(16)} ${(r.email ?? "\u2014").padEnd(28)} ${r.baseUrl} ${markers}`
-      );
-    }
-  });
-  accounts.command("use <alias>").description("Select the account used for calls (machine default, or --local for this directory)").option("--local", "pin for this directory only (gitignored .sechroom/config.json)").action((alias, opts, cmd) => {
-    const json = cmd.optsWithGlobals().json;
-    if (opts.local) {
-      const path = writeLocalAccount(alias);
-      if (json) return emit({ account: alias, scope: "local", path }, true);
-      console.log(style.green(`Account "${alias}" pinned for this directory (${path}).`));
-      return;
-    }
-    setDefaultAccount(alias);
-    if (json) return emit({ account: alias, scope: "global" }, true);
-    console.log(style.green(`Account "${alias}" is now the machine default.`));
-  });
-  accounts.command("remove <alias>").description("Forget an account's cached token (local removal \u2014 does not revoke at the server)").action((alias, _opts, cmd) => {
-    const removed = removeAccount(alias);
-    if (cmd.optsWithGlobals().json) return emit({ removed: removed ? [alias] : [] }, true);
-    console.log(
-      removed ? style.green(`Account "${alias}" removed.`) : style.dim(`No account "${alias}".`)
-    );
-  });
-}
-
 // src/commands/memory.ts
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
@@ -1202,26 +1022,6 @@ Examples:
 // src/commands/workspace.ts
 function registerWorkspace(program2) {
   const workspace = program2.command("workspace").description("Create, browse, and manage workspaces");
-  workspace.command("bind <workspaceId>").description("Bind a workspace to this repo (.sechroom.json). With --name it becomes a NAMED v3 binding (multi-workspace); --paths scopes it to subtrees.").option("--name <name>", "binding name (enables multi-workspace; selectable via --binding / path match)").option("--paths <csv>", "comma-separated directory prefixes (relative to the repo root) this binding covers, e.g. frontend,docs").option("--default-project <id>", "informational default project for this binding").option("--here", "write the binding file at THIS directory even when a parent already carries one").action((workspaceId, opts, cmd) => {
-    const json = cmd.optsWithGlobals().json;
-    if (!opts.name) {
-      const path2 = writeLocalConfig({ workspaceId, ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {} }, { here: Boolean(opts.here) });
-      if (json) return emit({ workspaceId, path: path2 }, true);
-      console.log(style.green(`Workspace ${workspaceId} bound (${path2}).`));
-      return;
-    }
-    const local = readLocalConfig();
-    const bindings = (local.workspaces ?? []).filter((b) => b.name !== opts.name);
-    bindings.push({
-      name: opts.name,
-      workspaceId,
-      ...opts.defaultProject ? { defaultProjectId: opts.defaultProject } : {},
-      ...opts.paths ? { paths: String(opts.paths).split(",").map((p) => p.trim()).filter(Boolean) } : {}
-    });
-    const path = writeLocalConfig({ workspaces: bindings }, { here: Boolean(opts.here) });
-    if (json) return emit({ binding: opts.name, workspaceId, paths: opts.paths ?? null, path }, true);
-    console.log(style.green(`Binding "${opts.name}" \u2192 ${workspaceId} saved (${path}).`));
-  });
   workspace.addHelpText(
     "after",
     `
@@ -3379,7 +3179,7 @@ async function ensureTenant(baseUrl, g, opts) {
   const local = readLocalConfig();
   let tenant = g.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
   if (!tenant) {
-    const client = await makeClient({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: persisted.clientId });
+    const client = await makeClient({ baseUrl, tenant: "", clientId: persisted.clientId });
     const { data, error } = await client.GET("/auth/me/tenants", {});
     if (error) {
       fail(`Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`);
@@ -3414,7 +3214,7 @@ async function ensureTenant(baseUrl, g, opts) {
     }
   }
   const existingWorkspace = local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const wsClient = await makeClient({ baseUrl, tenant, account: resolveAccountAlias(), clientId: persisted.clientId });
+  const wsClient = await makeClient({ baseUrl, tenant, clientId: persisted.clientId });
   const workspaceId = await resolveWorkspaceBinding(wsClient, existingWorkspace, {
     yes: opts.yes,
     json: opts.json,
@@ -3436,7 +3236,7 @@ async function ensureTenant(baseUrl, g, opts) {
   if (opts.persist !== false) {
     const patch = { baseUrl, tenant, ...workspaceId ? { workspaceId } : {} };
     if (storeLocal) {
-      const path = writeLocalConfig(patch, { here: Boolean(opts.here) });
+      const path = writeLocalConfig(patch);
       if (!opts.json) process.stderr.write(`${ok("\u2713")} config saved to ${path} (directory-local)
 `);
     } else {
@@ -3449,7 +3249,7 @@ async function ensureTenant(baseUrl, g, opts) {
 `);
     }
   }
-  return { baseUrl, tenant, account: resolveAccountAlias(), workspaceId, defaultProjectId, clientId: persisted.clientId };
+  return { baseUrl, tenant, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 async function ensureAuth(cfg, yes) {
   if (process.env.SECHROOM_TOKEN) return;
@@ -3606,7 +3406,7 @@ async function runRecurse(cfg, g, opts) {
   summarizeFanout(results, { dryRun });
 }
 function registerOnboard(program2) {
-  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--here", "with --local: write the binding at THIS directory even when a parent already carries one \u2014 binds a subtree (e.g. a monorepo's frontend/) to its own workspace", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
+  program2.command("onboard").description("Guided first-run setup: configure, sign in, set timezone, detect clients, and wire this project").option("--recurse", "orchestration-root mode: onboard every child repo under this dir (auto-discovered, or from ./.sechroom/repos.json) \u2014 refreshes bound repos, prompts a workspace per new one", false).option("--lane <id>", "set the code-lane (substrate source identity) explicitly instead of inferring it; with --recurse it's used for every child repo").option("--design-lane <id>", "set the design-lane explicitly (substrate-authoring identity); with --recurse applies to every child").option("--client <list>", `comma-separated clients (${ALL_CLIENT_KEYS.join(", ")}) or 'all' (default: auto-detected)`).option("--local", "save the binding (tenant + base URL + workspace) to a committed .sechroom.json in this repo instead of the global config", false).option("--workspace <id>", "bind this directory to a workspace (skips the interactive workspace pick)").option("--cli-only", "configure the CLI only \u2014 don't wire any AI client (no MCP config, no agent files)", false).option("--no-mcp", "skip the MCP server config (.mcp.json etc.); still write the agent instruction files").option("--copy", "make a personal copy of the agent instructions you can edit (default: prompt on a TTY, else skip)").option("--dry-run", "walk through without writing files or changing the profile", false).option("--refresh", "re-fetch descriptors and refresh any out-of-date managed blocks (local edits preserved to .proposed)", false).option("--force", "rewrite every managed block, overwriting local edits inside the markers (content outside untouched)", false).option("--check", "report whether anything would change and exit (0 = all current, 1 = stale/drift/absent); writes nothing", false).option("-y, --yes", "non-interactive: accept defaults (system timezone, detected clients, global config, full wire)", false).addHelpText(
     "after",
     `
 Examples:
@@ -3632,13 +3432,13 @@ Examples:
     if (opts.designLane) process.env.SECHROOM_DESIGN_LANE = opts.designLane;
     if (opts.recurse) {
       const baseUrl2 = resolveBaseUrl(g);
-      await ensureAuth({ baseUrl: baseUrl2, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
+      await ensureAuth({ baseUrl: baseUrl2, tenant: "", clientId: readPersisted().clientId }, yes);
       const cfg2 = await ensureTenant(baseUrl2, g, { yes: true, json, persist: false });
       await runRecurse(cfg2, g, { yes, dryRun, json, lane: opts.lane, designLane: opts.designLane });
       return;
     }
     const baseUrl = resolveBaseUrl(g);
-    await ensureAuth({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
+    await ensureAuth({ baseUrl, tenant: "", clientId: readPersisted().clientId }, yes);
     const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local), workspace: opts.workspace, persist: !check });
     const tz = await ensureTimezone(cfg, { yes, dryRun: dryRun || check });
     if (!json && tz.action !== "already-set") {
@@ -4135,23 +3935,9 @@ function removeMaterialisedSkills(dir) {
   return removed;
 }
 function registerReset(program2) {
-  program2.command("logout").description("Sign out \u2014 remove the active account's cached token (--account <alias> for a specific one, --all for every account)").option("--account <alias>", "sign a specific account out").option("--all", "sign every account out").action((opts, cmd) => {
-    const json = cmd.optsWithGlobals().json;
-    if (opts.all) {
-      const removed2 = listAccounts().map((a) => a.alias);
-      for (const alias of removed2) removeAccount(alias);
-      if (json) return emit({ removed: removed2 }, true);
-      console.log(removed2.length > 0 ? style.green(`Signed out ${removed2.length} account(s): ${removed2.join(", ")}.`) : style.dim("Already signed out (no accounts)."));
-      return;
-    }
-    if (opts.account) {
-      const ok2 = removeAccount(opts.account);
-      if (json) return emit({ removed: ok2 ? [opts.account] : [] }, true);
-      console.log(ok2 ? style.green(`Signed out account "${opts.account}".`) : style.dim(`No account "${opts.account}".`));
-      return;
-    }
+  program2.command("logout").description("Sign out \u2014 remove the cached (global) auth token").action((_opts, cmd) => {
     const removed = clearToken();
-    if (json) return emit({ removed: removed ? [removed] : [] }, true);
+    if (cmd.optsWithGlobals().json) return emit({ removed: removed ? [removed] : [] }, true);
     console.log(
       removed ? style.green("Signed out \u2014 auth token removed.") : style.dim("Already signed out (no token).")
     );
@@ -4213,7 +3999,7 @@ function resolveVersion() {
   }
 }
 var program = new Command();
-program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--binding <name>", "Named workspace binding from .sechroom.json `workspaces` (overrides path auto-selection / SECHROOM_BINDING)").option("--json", "Emit compact JSON (for scripts and agents)", false);
+program.name("sechroom").description("Sechroom CLI \u2014 thin generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.").version(resolveVersion()).option("--base-url <url>", "API base URL (overrides config / SECHROOM_BASE_URL)").option("--tenant <tenant>", "Tenant id (required by the API; overrides config / SECHROOM_TENANT)").option("--json", "Emit compact JSON (for scripts and agents)", false);
 program.addHelpText(
   "after",
   `
@@ -4246,12 +4032,11 @@ Examples:
   $ sechroom login                                          sign in to the configured base URL + tenant
   $ sechroom login --base-url https://staging.app.sechroom.ai/api
   $ export SECHROOM_TOKEN=<bearer>                          headless: skip login entirely (CI / agents)`
-).option("--account <alias>", "sign in under a named account alias (multi-account; default: the active alias)").action(async (opts, cmd) => {
+).action(async (_opts, cmd) => {
   const g = cmd.optsWithGlobals();
   const persisted = readPersisted();
   const baseUrl = g.baseUrl ?? process.env.SECHROOM_BASE_URL ?? persisted.baseUrl ?? "https://app.sechroom.ai/api";
-  const account = resolveAccountAlias(opts.account);
-  await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "", account });
+  await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "" });
 });
 var config = program.command("config").description("Manage persisted CLI config");
 config.addHelpText(
@@ -4287,7 +4072,7 @@ config.command("set <key> <value>").description("Set baseUrl | tenant | workspac
 });
 config.command("show").description("Print resolved config + sources (flag > env > local > global > default)").action((_opts, cmd) => {
   const g = cmd.optsWithGlobals();
-  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant, binding: g.binding });
+  const d = describeConfig({ baseUrl: g.baseUrl, tenant: g.tenant });
   if (g.json) {
     process.stdout.write(
       JSON.stringify({
@@ -4308,7 +4093,6 @@ local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
 `
   );
 });
-registerAccounts(program);
 registerMemory(program);
 registerWorklog(program);
 registerLookup(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.28",
+  "version": "2026.6.29-rc.692f8a8f",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",