@sechroom/cli 2026.6.29-rc.692f8a8f → 2026.6.30-rc.3b1b16ff

package/dist/index.js

@@ -16,6 +16,8 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync } from "fs";
 var CONFIG_DIR = join(homedir(), ".config", "sechroom");
 var CONFIG_FILE = join(CONFIG_DIR, "config.json");
 var TOKEN_FILE = join(CONFIG_DIR, "token.json");
+var ACCOUNTS_FILE = join(CONFIG_DIR, "accounts.json");
+var DEFAULT_ACCOUNT = "default";
 var STATE_DIR_NAME = ".sechroom";
 var BASELINE_CONFIG_NAME = ".sechroom.json";
 var OVERRIDE_CONFIG_NAME = join(STATE_DIR_NAME, "config.json");
@@ -44,23 +46,87 @@ function writeDcrClientId(baseUrl, clientId) {
   const p = readPersisted();
   writePersisted({ clientIds: { ...p.clientIds ?? {}, [baseUrl]: clientId } });
 }
-function readToken() {
-  const envTok = process.env.SECHROOM_TOKEN;
-  if (envTok) return { accessToken: envTok };
+function readAccountsFile() {
   try {
-    return JSON.parse(readFileSync(TOKEN_FILE, "utf8"));
+    const parsed = JSON.parse(readFileSync(ACCOUNTS_FILE, "utf8"));
+    if (parsed && typeof parsed === "object" && parsed.accounts) return parsed;
+  } catch {
+  }
+  try {
+    const legacy = JSON.parse(readFileSync(TOKEN_FILE, "utf8"));
+    if (legacy?.accessToken) {
+      const migrated = {
+        accounts: {
+          [DEFAULT_ACCOUNT]: { ...legacy, baseUrl: readPersisted().baseUrl ?? DEFAULT_BASE_URL }
+        },
+        default: DEFAULT_ACCOUNT
+      };
+      writeAccountsFile(migrated);
+      rmSync(TOKEN_FILE, { force: true });
+      return migrated;
+    }
   } catch {
-    return null;
   }
+  return { accounts: {} };
 }
-function writeToken(tok) {
+function writeAccountsFile(file) {
   ensureDir();
-  writeFileSync(TOKEN_FILE, JSON.stringify(tok, null, 2), { mode: 384 });
+  writeFileSync(ACCOUNTS_FILE, JSON.stringify(file, null, 2), { mode: 384 });
+}
+function readAccount(alias) {
+  return readAccountsFile().accounts[alias] ?? null;
+}
+function writeAccount(alias, entry) {
+  const file = readAccountsFile();
+  file.accounts[alias] = entry;
+  if (!file.default) file.default = alias;
+  writeAccountsFile(file);
+}
+function removeAccount(alias) {
+  const file = readAccountsFile();
+  if (!(alias in file.accounts)) return false;
+  delete file.accounts[alias];
+  if (file.default === alias) file.default = Object.keys(file.accounts)[0];
+  writeAccountsFile(file);
+  return true;
+}
+function listAccounts() {
+  const file = readAccountsFile();
+  return Object.entries(file.accounts).map(([alias, entry]) => ({
+    alias,
+    entry,
+    isDefault: file.default === alias
+  }));
+}
+function setDefaultAccount(alias) {
+  const file = readAccountsFile();
+  if (!(alias in file.accounts)) throw new Error(`No account "${alias}". Run \`sechroom login --account ${alias}\` first.`);
+  file.default = alias;
+  writeAccountsFile(file);
+}
+function resolveAccountAlias(flagAccount) {
+  return flagAccount ?? process.env.SECHROOM_ACCOUNT ?? readLocalConfig().account ?? readAccountsFile().default ?? DEFAULT_ACCOUNT;
+}
+function writeLocalAccount(alias) {
+  const home = findConfigHome() ?? process.cwd();
+  const overridePath = join(home, OVERRIDE_CONFIG_NAME);
+  mkdirSync(dirname(overridePath), { recursive: true });
+  const current = readJsonConfig(overridePath) ?? {};
+  writeFileSync(
+    overridePath,
+    JSON.stringify({ ...current, account: alias }, null, 2),
+    { mode: 384 }
+  );
+  return overridePath;
+}
+function readToken() {
+  const envTok = process.env.SECHROOM_TOKEN;
+  if (envTok) return { accessToken: envTok };
+  return readAccount(resolveAccountAlias());
 }
 function clearToken() {
-  if (!existsSync(TOKEN_FILE)) return void 0;
-  rmSync(TOKEN_FILE);
-  return TOKEN_FILE;
+  const alias = resolveAccountAlias();
+  return removeAccount(alias) ? `${ACCOUNTS_FILE} (account "${alias}")` : void 0;
 }
 function clearPersisted() {
   if (!existsSync(CONFIG_FILE)) return void 0;
@@ -95,6 +161,7 @@ function readLocalConfig() {
     tenant: merged.tenant,
     workspaceId: merged.workspaceId,
     defaultProjectId: merged.defaultProjectId,
+    account: merged.account,
     path: existsSync(baselinePath) ? baselinePath : overridePath
   };
 }
@@ -129,7 +196,8 @@ function resolveConfig(flags) {
   }
   const workspaceId = process.env.SECHROOM_WORKSPACE ?? local.workspaceId ?? persisted.workspaceId ?? void 0;
   const defaultProjectId = local.defaultProjectId ?? persisted.defaultProjectId ?? void 0;
-  return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, workspaceId, defaultProjectId, clientId: persisted.clientId };
+  const account = resolveAccountAlias(flags.account);
+  return { baseUrl: baseUrl.replace(/\/$/, ""), tenant, account, workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 function describeConfig(flags) {
   const local = readLocalConfig();
@@ -245,14 +313,25 @@ async function exchange(meta, clientId, code, verifier, redirectUri) {
     })
   });
   if (!res.ok) throw new Error(`Token exchange failed (${res.status}): ${await res.text()}`);
-  persistTokenResponse(await res.json());
+  return await res.json();
+}
+function decodeEmail(accessToken) {
+  try {
+    const payload = accessToken.split(".")[1];
+    if (!payload) return void 0;
+    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    return typeof claims.email === "string" ? claims.email : void 0;
+  } catch {
+    return void 0;
+  }
 }
-function persistTokenResponse(json) {
-  const tok = json;
-  writeToken({
+function persistTokenResponse(account, baseUrl, tok) {
+  writeAccount(account, {
+    baseUrl,
     accessToken: tok.access_token,
     refreshToken: tok.refresh_token,
-    expiresAt: tok.expires_in ? Date.now() + tok.expires_in * 1e3 : void 0
+    expiresAt: tok.expires_in ? Date.now() + tok.expires_in * 1e3 : void 0,
+    email: decodeEmail(tok.access_token)
   });
 }
 async function login(cfg) {
@@ -276,14 +355,25 @@ ${authUrl}
 `);
   await open(authUrl.toString());
   const code = await loopback.code;
-  await exchange(meta, clientId, code, verifier, loopback.redirectUri);
-  process.stderr.write("Signed in. Token cached.\n");
+  const tok = await exchange(meta, clientId, code, verifier, loopback.redirectUri);
+  persistTokenResponse(cfg.account, cfg.baseUrl, tok);
+  const email = decodeEmail(tok.access_token);
+  process.stderr.write(`Signed in${email ? ` as ${email}` : ""} (account "${cfg.account}"). Token cached.
+`);
 }
 async function requireToken(cfg) {
   if (process.env.SECHROOM_TOKEN) return process.env.SECHROOM_TOKEN;
-  const cached = readToken();
+  const cached = readAccount(cfg.account);
   if (!cached?.accessToken) {
-    throw new Error("Not signed in. Run `sechroom login` (or set SECHROOM_TOKEN for headless use).");
+    throw new Error(
+      `Not signed in (account "${cfg.account}"). Run \`sechroom login --account ${cfg.account}\` (or set SECHROOM_TOKEN for headless use).`
+    );
+  }
+  if (cached.baseUrl !== cfg.baseUrl) {
+    const matching = listAccounts().filter((a) => a.entry.baseUrl === cfg.baseUrl).map((a) => a.alias);
+    throw new Error(
+      `Account "${cfg.account}" is signed in to ${cached.baseUrl}, but this call targets ${cfg.baseUrl}. ` + (matching.length > 0 ? `Use --account ${matching[0]} (signed in there)` + (matching.length > 1 ? ` \u2014 or one of: ${matching.join(", ")}` : "") + ", or " : "") + `run \`sechroom login --account ${cfg.account}\` against it.`
+    );
   }
   const nearExpiry = cached.expiresAt !== void 0 && Date.now() > cached.expiresAt - 6e4;
   if (nearExpiry && cached.refreshToken) {
@@ -297,10 +387,10 @@ async function requireToken(cfg) {
       })
     });
     if (res.ok) {
-      persistTokenResponse(await res.json());
-      return readToken().accessToken;
+      persistTokenResponse(cfg.account, cfg.baseUrl, await res.json());
+      return readAccount(cfg.account).accessToken;
     }
-    throw new Error("Session expired and refresh failed. Run `sechroom login` again.");
+    throw new Error(`Session expired and refresh failed. Run \`sechroom login --account ${cfg.account}\` again.`);
   }
   return cached.accessToken;
 }
@@ -545,6 +635,62 @@ function fail(error) {
   process.exit(1);
 }
 
+// src/commands/accounts.ts
+function registerAccounts(program2) {
+  const accounts = program2.command("accounts").description("Manage signed-in identities (multi-account)");
+  accounts.addHelpText(
+    "after",
+    `
+Examples:
+  $ sechroom login --account work               sign in a second identity under the "work" alias
+  $ sechroom accounts list                      see every signed-in identity + which is active here
+  $ sechroom accounts use work                  make "work" the machine default
+  $ sechroom accounts use work --local          pin "work" for THIS directory only (gitignored)
+  $ sechroom logout --account work              sign the "work" identity out`
+  );
+  accounts.command("list").description("List signed-in accounts (alias, email, server, expiry)").action((_opts, cmd) => {
+    const active2 = resolveAccountAlias(cmd.optsWithGlobals().account);
+    const rows = listAccounts().map(({ alias, entry, isDefault }) => ({
+      alias,
+      email: entry.email,
+      baseUrl: entry.baseUrl,
+      expiresAt: entry.expiresAt ? new Date(entry.expiresAt).toISOString() : void 0,
+      isDefault,
+      isActiveHere: alias === active2
+    }));
+    if (cmd.optsWithGlobals().json) return emit({ accounts: rows, active: active2 }, true);
+    if (rows.length === 0) {
+      console.log(style.dim("No accounts signed in. Run `sechroom login` (optionally --account <alias>)."));
+      return;
+    }
+    for (const r of rows) {
+      const markers = [r.isActiveHere ? style.green("active") : "", r.isDefault ? style.dim("default") : ""].filter(Boolean).join(" ");
+      console.log(
+        `${r.alias.padEnd(16)} ${(r.email ?? "\u2014").padEnd(28)} ${r.baseUrl} ${markers}`
+      );
+    }
+  });
+  accounts.command("use <alias>").description("Select the account used for calls (machine default, or --local for this directory)").option("--local", "pin for this directory only (gitignored .sechroom/config.json)").action((alias, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (opts.local) {
+      const path = writeLocalAccount(alias);
+      if (json) return emit({ account: alias, scope: "local", path }, true);
+      console.log(style.green(`Account "${alias}" pinned for this directory (${path}).`));
+      return;
+    }
+    setDefaultAccount(alias);
+    if (json) return emit({ account: alias, scope: "global" }, true);
+    console.log(style.green(`Account "${alias}" is now the machine default.`));
+  });
+  accounts.command("remove <alias>").description("Forget an account's cached token (local removal \u2014 does not revoke at the server)").action((alias, _opts, cmd) => {
+    const removed = removeAccount(alias);
+    if (cmd.optsWithGlobals().json) return emit({ removed: removed ? [alias] : [] }, true);
+    console.log(
+      removed ? style.green(`Account "${alias}" removed.`) : style.dim(`No account "${alias}".`)
+    );
+  });
+}
+
 // src/commands/memory.ts
 function registerMemory(program2) {
   const memory = program2.command("memory").description("Create, read, and search memories");
@@ -3179,7 +3325,7 @@ async function ensureTenant(baseUrl, g, opts) {
   const local = readLocalConfig();
   let tenant = g.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
   if (!tenant) {
-    const client = await makeClient({ baseUrl, tenant: "", clientId: persisted.clientId });
+    const client = await makeClient({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: persisted.clientId });
     const { data, error } = await client.GET("/auth/me/tenants", {});
     if (error) {
       fail(`Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`);
@@ -3214,7 +3360,7 @@ async function ensureTenant(baseUrl, g, opts) {
     }
   }
   const existingWorkspace = local.workspaceId ?? persisted.workspaceId ?? void 0;
-  const wsClient = await makeClient({ baseUrl, tenant, clientId: persisted.clientId });
+  const wsClient = await makeClient({ baseUrl, tenant, account: resolveAccountAlias(), clientId: persisted.clientId });
   const workspaceId = await resolveWorkspaceBinding(wsClient, existingWorkspace, {
     yes: opts.yes,
     json: opts.json,
@@ -3249,7 +3395,7 @@ async function ensureTenant(baseUrl, g, opts) {
 `);
     }
   }
-  return { baseUrl, tenant, workspaceId, defaultProjectId, clientId: persisted.clientId };
+  return { baseUrl, tenant, account: resolveAccountAlias(), workspaceId, defaultProjectId, clientId: persisted.clientId };
 }
 async function ensureAuth(cfg, yes) {
   if (process.env.SECHROOM_TOKEN) return;
@@ -3432,13 +3578,13 @@ Examples:
     if (opts.designLane) process.env.SECHROOM_DESIGN_LANE = opts.designLane;
     if (opts.recurse) {
       const baseUrl2 = resolveBaseUrl(g);
-      await ensureAuth({ baseUrl: baseUrl2, tenant: "", clientId: readPersisted().clientId }, yes);
+      await ensureAuth({ baseUrl: baseUrl2, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
       const cfg2 = await ensureTenant(baseUrl2, g, { yes: true, json, persist: false });
       await runRecurse(cfg2, g, { yes, dryRun, json, lane: opts.lane, designLane: opts.designLane });
       return;
     }
     const baseUrl = resolveBaseUrl(g);
-    await ensureAuth({ baseUrl, tenant: "", clientId: readPersisted().clientId }, yes);
+    await ensureAuth({ baseUrl, tenant: "", account: resolveAccountAlias(), clientId: readPersisted().clientId }, yes);
     const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local), workspace: opts.workspace, persist: !check });
     const tz = await ensureTimezone(cfg, { yes, dryRun: dryRun || check });
     if (!json && tz.action !== "already-set") {
@@ -3935,9 +4081,23 @@ function removeMaterialisedSkills(dir) {
   return removed;
 }
 function registerReset(program2) {
-  program2.command("logout").description("Sign out \u2014 remove the cached (global) auth token").action((_opts, cmd) => {
+  program2.command("logout").description("Sign out \u2014 remove the active account's cached token (--account <alias> for a specific one, --all for every account)").option("--account <alias>", "sign a specific account out").option("--all", "sign every account out").action((opts, cmd) => {
+    const json = cmd.optsWithGlobals().json;
+    if (opts.all) {
+      const removed2 = listAccounts().map((a) => a.alias);
+      for (const alias of removed2) removeAccount(alias);
+      if (json) return emit({ removed: removed2 }, true);
+      console.log(removed2.length > 0 ? style.green(`Signed out ${removed2.length} account(s): ${removed2.join(", ")}.`) : style.dim("Already signed out (no accounts)."));
+      return;
+    }
+    if (opts.account) {
+      const ok2 = removeAccount(opts.account);
+      if (json) return emit({ removed: ok2 ? [opts.account] : [] }, true);
+      console.log(ok2 ? style.green(`Signed out account "${opts.account}".`) : style.dim(`No account "${opts.account}".`));
+      return;
+    }
     const removed = clearToken();
-    if (cmd.optsWithGlobals().json) return emit({ removed: removed ? [removed] : [] }, true);
+    if (json) return emit({ removed: removed ? [removed] : [] }, true);
     console.log(
       removed ? style.green("Signed out \u2014 auth token removed.") : style.dim("Already signed out (no token).")
     );
@@ -4032,11 +4192,12 @@ Examples:
   $ sechroom login                                          sign in to the configured base URL + tenant
   $ sechroom login --base-url https://staging.app.sechroom.ai/api
   $ export SECHROOM_TOKEN=<bearer>                          headless: skip login entirely (CI / agents)`
-).action(async (_opts, cmd) => {
+).option("--account <alias>", "sign in under a named account alias (multi-account; default: the active alias)").action(async (opts, cmd) => {
   const g = cmd.optsWithGlobals();
   const persisted = readPersisted();
   const baseUrl = g.baseUrl ?? process.env.SECHROOM_BASE_URL ?? persisted.baseUrl ?? "https://app.sechroom.ai/api";
-  await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "" });
+  const account = resolveAccountAlias(opts.account);
+  await login({ baseUrl: baseUrl.replace(/\/$/, ""), tenant: g.tenant ?? "", account });
 });
 var config = program.command("config").description("Manage persisted CLI config");
 config.addHelpText(
@@ -4093,6 +4254,7 @@ local:  ${d.localPath ?? "(none)"} ${JSON.stringify(readLocalConfig())}
 `
   );
 });
+registerAccounts(program);
 registerMemory(program);
 registerWorklog(program);
 registerLookup(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.29-rc.692f8a8f",
+  "version": "2026.6.30-rc.3b1b16ff",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",