@skillcdn/console 0.1.18 → 0.1.20

package/dist/cli/cli.js

@@ -8,7 +8,8 @@ import { fillRules, RULES_PATH, RULES_TITLE } from "../rules.js";
 import { hostOfLogin, } from "../schemas.js";
 import { COLOR_NAMES, GOAL_STATES, PERSON_ROLES, PROJECT_ROLES, PROJECT_VISIBILITIES, PROVIDER_KEYS, TASK_PRIORITIES, TASK_STATES, } from "../vocabulary.js";
 import { loadWebRoot, WebRootError } from "../web.js";
-import { formatAnswer, formatCategoryLine, formatComment, formatDecision, formatDecisionLine, formatDocument, formatDocuments, formatGoal, formatGoalLine, formatListingLine, formatMemberLine, formatMore, formatOptions, formatPersonLine, formatPersonWork, formatProject, formatProjectLine, formatRules, formatRun, formatRunLine, formatSkills, formatTask, formatTaskLine, formatVersion, formatVersionLine, formatWork, } from "./format.js";
+import { CredentialsError, EMPTY_CREDENTIALS, loginsAt, resolveLogin, withLogin, withoutLogin, } from "./credentials.js";
+import { formatAnswer, formatCategoryLine, formatComment, formatDecision, formatDecisionLine, formatDocument, formatDocuments, formatGoal, formatGoalLine, formatListingLine, formatMemberLine, formatMore, formatOptions, formatPersonLine, formatPersonWork, formatProject, formatProjectLine, formatRules, formatRun, formatRunLine, formatSkillFile, formatSkillLoad, formatSkills, formatTask, formatTaskLine, formatVersion, formatVersionLine, formatWork, } from "./format.js";
 import { COMMAND_HELP, helpFor, usage } from "./help.js";
 import { describeInstall, updateCommandFor } from "./install.js";
 import { createServeHandler, DEFAULT_SERVE_PORT } from "./serve.js";
@@ -53,6 +54,7 @@ const misuse = (message) => new CliExit(EXIT.usage, message);
 const GLOBAL_OPTIONS = {
     json: { type: "boolean" },
     url: { type: "string" },
+    account: { type: "string" },
     project: { type: "string" },
 };
 function parse(args, options, allowPositionals = true) {
@@ -81,20 +83,80 @@ const texts = (values, name) => {
     return typeof value === "string" ? [value] : [];
 };
 const NO_PROJECT = "Say which project: --project <key>, CONSOLE_PROJECT in the environment, or console use <key> once in this directory. console projects lists the projects you may work in.";
-/** The console and the token to talk to it with: the flags, the environment, then what login kept. */
+/** What the command keeps, or nothing; a file that cannot be read stops the command, and is never written over. */
+async function loadCredentials(io) {
+    try {
+        return await io.store.load();
+    }
+    catch (error) {
+        if (error instanceof CredentialsError) {
+            throw failed(`${error.message} Move it away, then sign in again: console login --url <the console's origin>`);
+        }
+        throw error;
+    }
+}
+/** The console a directory is bound to, as an origin, when it names one. */
+function directoryOrigin(settings) {
+    if (settings?.url === undefined) {
+        return undefined;
+    }
+    try {
+        return originOf(settings.url);
+    }
+    catch {
+        throw failed(`.skillcdn-console.json names a console that is not an origin: ${settings.url}`);
+    }
+}
+/** Why no console could be talked to, for the person who reads it. */
+function wordsOf(failure) {
+    switch (failure.reason) {
+        case "nothing":
+            return "Not signed in. A person signs the command in: console login --url <the console's origin>";
+        case "environment_half":
+            return `Both CONSOLE_URL and CONSOLE_TOKEN are needed in the environment, and only ${failure.have} is set: set both, or neither.`;
+        case "no_login": {
+            const whom = failure.account === undefined ? "" : ` as ${failure.account}`;
+            const where = failure.source === "directory"
+                ? `This directory works at ${failure.url}${whom}, where nobody is signed in here`
+                : `Nobody is signed in here at ${failure.url}${whom}`;
+            return `${where}: console login --url ${failure.url}. console logins lists the consoles signed in.`;
+        }
+        case "ambiguous":
+            return `Several accounts are signed in at ${failure.url} (${failure.accounts.join(", ")}): say which with --account <login>, or bind this directory to one with console use <key> --account <login>.`;
+    }
+}
+/**
+ * The console a command talks to, and with what (ADR-0027): the address from the flag, the
+ * environment, the directory or the default login, in that order, and then the token kept for
+ * that address and no other. A token never travels to a console it was not made at.
+ */
 async function open(io, values) {
-    const stored = await io.store.load();
-    const url = text(values, "url") ?? io.env.CONSOLE_URL ?? stored?.url;
-    const token = io.env.CONSOLE_TOKEN ?? stored?.token;
-    if (url === undefined || token === undefined) {
-        throw failed("Not signed in. A person signs the command in: console login --url <the console's origin>");
+    const directory = await io.directory.load();
+    const flag = text(values, "url");
+    const envUrl = io.env.CONSOLE_URL;
+    const credentials = await loadCredentials(io);
+    const resolved = resolveLogin({
+        flagUrl: flag === undefined ? undefined : originOf(flag),
+        flagAccount: text(values, "account"),
+        envUrl: envUrl === undefined ? undefined : originOf(envUrl),
+        envToken: io.env.CONSOLE_TOKEN,
+        directoryUrl: directoryOrigin(directory),
+        directoryAccount: directory?.account,
+        credentials,
+    });
+    if (!resolved.ok) {
+        throw failed(wordsOf(resolved));
     }
+    const { url, token } = resolved;
     const client = clientOf(io, url, token);
-    const projectKey = async () => text(values, "project") ?? io.env.CONSOLE_PROJECT ?? (await io.directory.load())?.project;
+    const projectKey = async () => text(values, "project") ?? io.env.CONSOLE_PROJECT ?? directory?.project;
     return {
         client,
         url,
         token,
+        account: resolved.account,
+        via: resolved.via,
+        credentials,
         json: on(values, "json"),
         projectKey,
         async project() {
@@ -134,6 +196,8 @@ async function bodyOf(io, values, given) {
     }
     return given === "-" ? io.readStdin() : given;
 }
+/** The hosts a token may travel to in the clear: this machine, and no other. */
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
 function originOf(value) {
     const url = URL.canParse(value) ? new URL(value) : undefined;
     if (url === undefined ||
@@ -143,6 +207,10 @@ function originOf(value) {
         url.hash !== "") {
         throw misuse(`Not an origin: ${value}. Say the console's address without a path, such as https://console.example.com`);
     }
+    // A token travels over https; in the clear only to this machine, where a console is run for development.
+    if (url.protocol === "http:" && !LOOPBACK_HOSTS.has(url.hostname)) {
+        throw misuse(`Not a safe origin: ${value}. A token travels over https only; http is for a console on this machine (localhost).`);
+    }
     return url.origin;
 }
 function stateOf(value) {
@@ -327,31 +395,44 @@ async function settle(io, session, project, decision, seconds, shown = false) {
     }
     return outcome.answer === null ? EXIT.waiting : EXIT.ok;
 }
-/** Checks a token against the console, keeps it with the address, and says who it is. */
-async function keep(io, url, token, agent) {
+/**
+ * Checks a token against the console, keeps it as the login at that console for that account,
+ * and says who it is. A token the login replaces is given up at the console on the way.
+ */
+async function keep(io, url, token, agent, asDefault) {
     const me = await clientOf(io, url, token).me();
     const person = me.person;
     if (person === null) {
         throw failed("The console does not know this token. Make one on your Agents page and try again.");
     }
-    const kept = await io.store.save({ url, token });
-    io.stdout(`${agent === undefined ? "Signed in" : `Connected as "${agent}"`} to ${me.workspace.name} at ${url} as ${person.login} (${person.role}). The token is kept in ${kept}.\nNext, say which project this directory works in: console use <key> (console projects lists them).\n`);
+    const credentials = (await loadCredentials(io)) ?? EMPTY_CREDENTIALS;
+    const replaced = loginsAt(credentials, url).find((login) => login.account === person.login);
+    if (replaced !== undefined && replaced.token !== token) {
+        await clientOf(io, url, replaced.token)
+            .giveUpToken()
+            .catch(() => undefined);
+    }
+    const next = withLogin(credentials, { url, account: person.login, token, agent, since: new Date(io.now()).toISOString() }, { default: asDefault });
+    const kept = await io.store.save(next);
+    const standing = next.default === url ? ", the default console here" : "";
+    io.stdout(`${agent === undefined ? "Signed in" : `Connected as "${agent}"`} to ${me.workspace.name} at ${url} as ${person.login} (${person.role})${standing}. The token is kept in ${kept}.\nNext, say which project this directory works in: console use <key> (console projects lists them).\n`);
     return EXIT.ok;
 }
 const login = async (args, io) => {
-    const { values } = parse(args, { "token-stdin": { type: "boolean" }, agent: { type: "string" } }, false);
-    const stored = await io.store.load();
-    const wanted = text(values, "url") ?? io.env.CONSOLE_URL ?? stored?.url;
+    const { values } = parse(args, { "token-stdin": { type: "boolean" }, agent: { type: "string" }, default: { type: "boolean" } }, false);
+    const credentials = await loadCredentials(io);
+    const wanted = text(values, "url") ?? io.env.CONSOLE_URL ?? credentials?.default;
     if (wanted === undefined) {
         throw misuse("Say where the console is: console login --url https://console.example.com");
     }
     const url = originOf(wanted);
+    const asDefault = on(values, "default");
     if (on(values, "token-stdin")) {
         const token = (await io.readStdin()).trim();
         if (token.length === 0) {
             throw failed("No token was given.");
         }
-        return keep(io, url, token);
+        return keep(io, url, token, undefined, asDefault);
     }
     // A connection (ADR-0011): a code a person approves on the console's own pages, and the token
     // handed over here once, never shown.
@@ -375,38 +456,94 @@ const login = async (args, io) => {
             throw error;
         }
         if (claim.status === "connected") {
-            return keep(io, url, claim.secret, claim.token.name);
+            return keep(io, url, claim.secret, claim.token.name, asDefault);
         }
     }
 };
 const logout = async (args, io) => {
-    parse(args, {}, false);
-    const stored = await io.store.load();
-    const url = io.env.CONSOLE_URL ?? stored?.url;
-    const token = io.env.CONSOLE_TOKEN ?? stored?.token;
-    if (url === undefined || token === undefined) {
+    const { values } = parse(args, {}, false);
+    const credentials = await loadCredentials(io);
+    const directory = await io.directory.load();
+    const envNote = () => {
+        if (io.env.CONSOLE_TOKEN !== undefined) {
+            io.stdout("CONSOLE_TOKEN in the environment still holds a token: unset it.\n");
+        }
+    };
+    if (credentials === undefined || credentials.logins.length === 0) {
         io.stdout("Not signed in here: nothing to forget.\n");
+        envNote();
         return EXIT.ok;
     }
+    // Which login: the console the flag names, else the directory's, else the default, else the
+    // one console signed in to; and the account the same way, where the console has several.
+    const consoles = [...new Set(credentials.logins.map((login) => login.url))];
+    const flag = text(values, "url");
+    const url = flag === undefined
+        ? (directoryOrigin(directory) ??
+            credentials.default ??
+            (consoles.length === 1 ? consoles[0] : undefined))
+        : originOf(flag);
+    if (url === undefined) {
+        throw failed(`Several consoles are signed in here; say which: console logout --url <origin>. console logins lists them.`);
+    }
+    const account = text(values, "account") ?? directory?.account;
+    const at = loginsAt(credentials, url);
+    const chosen = account === undefined ? at : at.filter((login) => login.account === account);
+    const [login] = chosen;
+    if (login === undefined) {
+        throw failed(`Nobody is signed in here at ${url}${account === undefined ? "" : ` as ${account}`}: nothing to forget. console logins lists the consoles signed in.`);
+    }
+    if (chosen.length > 1) {
+        throw failed(`Several accounts are signed in at ${url} (${chosen.map((kept) => kept.account ?? "?").join(", ")}); say which: console logout --url ${url} --account <login>`);
+    }
     // The token is given up at the console first, so that it is good for nothing from now on;
     // one the console no longer knows is gone already. A console out of reach leaves it to the
     // Agents page, and the person is told so.
     let gone = true;
     try {
-        await clientOf(io, url, token).giveUpToken();
+        await clientOf(io, url, login.token).giveUpToken();
     }
     catch (error) {
         if (!(error instanceof ApiError && error.code === "auth.required")) {
             gone = false;
         }
     }
-    await io.store.clear();
+    const next = withoutLogin(credentials, url, login.account);
+    if (next.logins.length === 0) {
+        await io.store.clear();
+    }
+    else {
+        await io.store.save(next);
+    }
+    const whom = login.account === undefined ? "" : ` as ${login.account}`;
     io.stdout(gone
-        ? "Signed out: the token is given up at the console and forgotten here.\n"
-        : `Signed out here, but the console at ${url} could not be reached to give the token up: a person removes it on the Agents page.\n`);
-    if (io.env.CONSOLE_TOKEN !== undefined) {
-        io.stdout("CONSOLE_TOKEN in the environment still holds it: unset it.\n");
+        ? `Signed out of ${url}${whom}: the token is given up at the console and forgotten here.\n`
+        : `Signed out of ${url}${whom} here, but the console could not be reached to give the token up: a person removes it on the Agents page.\n`);
+    envNote();
+    return EXIT.ok;
+};
+/** The consoles this machine is signed in to, with the account at each; never a token. */
+const logins = async (args, io) => {
+    const { values } = parse(args, {}, false);
+    const credentials = await loadCredentials(io);
+    const kept = (credentials?.logins ?? []).map((login) => ({
+        url: login.url,
+        account: login.account ?? null,
+        agent: login.agent ?? null,
+        since: login.since ?? null,
+        default: credentials?.default === login.url,
+    }));
+    if (on(values, "json")) {
+        io.stdout(`${JSON.stringify({ default: credentials?.default ?? null, logins: kept }, null, 2)}\n`);
+        return EXIT.ok;
     }
+    if (kept.length === 0) {
+        io.stdout("Not signed in anywhere here: console login --url <the console's origin>\n");
+        return EXIT.ok;
+    }
+    io.stdout(`${kept
+        .map((login) => `${login.url}  ${login.account ?? "(account unknown)"}${login.agent === null ? "" : `  ${login.agent}`}${login.since === null ? "" : `  since ${login.since.slice(0, 10)}`}${login.default ? "  (default)" : ""}`)
+        .join("\n")}\n`);
     return EXIT.ok;
 };
 /** The agent the command runs under, where its environment says so: what a connection is named by default. */
@@ -466,11 +603,25 @@ const projects = async (args, io) => {
 };
 const use = async (args, io) => {
     const { values, positionals } = parse(args, {});
-    const key = theOne(positionals, "Say which project: console use <key>");
+    const key = theOne(positionals, "Say which project: console use <key> [--url <origin>] [--account <login>]");
     const session = await open(io, values);
     const project = await session.client.project(key).get();
-    const kept = await io.directory.save({ project: project.key });
-    answer(io, session, project, () => `Working in ${project.name} (${project.key}) from this directory on: kept in ${kept}, which is meant to be committed. What its people ask of agents: console rules.`);
+    // The directory names the console where that is not the default login here, or when asked,
+    // and the account where the console has several, or when asked; never a token.
+    const credentials = session.credentials ?? EMPTY_CREDENTIALS;
+    const pinUrl = text(values, "url") !== undefined ||
+        (session.via === "login" && credentials.default !== session.url);
+    const pinAccount = text(values, "account") !== undefined ||
+        (session.via === "login" && loginsAt(credentials, session.url).length > 1);
+    const kept = await io.directory.save({
+        project: project.key,
+        ...(pinUrl ? { url: session.url } : {}),
+        ...(pinAccount && session.account !== undefined ? { account: session.account } : {}),
+    });
+    const bound = pinUrl
+        ? ` at ${session.url}${pinAccount && session.account !== undefined ? ` as ${session.account}` : ""}`
+        : "";
+    answer(io, session, project, () => `Working in ${project.name} (${project.key})${bound} from this directory on: kept in ${kept}, which is meant to be committed in a private repository and left out of a public one. What its people ask of agents: console rules.`);
     return EXIT.ok;
 };
 const tasks = async (args, io) => {
@@ -478,12 +629,17 @@ const tasks = async (args, io) => {
         state: { type: "string" },
         open: { type: "boolean" },
         mine: { type: "boolean" },
+        unassigned: { type: "boolean" },
         category: { type: "string" },
         goal: { type: "string" },
         due: { type: "string" },
+        archived: { type: "boolean" },
         ...PAGE_OPTIONS,
     }, false);
     const state = stateOf(text(values, "state"));
+    if (on(values, "mine") && on(values, "unassigned")) {
+        throw misuse("Say one: --mine for the tasks assigned to you, or --unassigned for those assigned to nobody");
+    }
     const page = pageOf(values);
     const session = await open(io, values);
     const project = await session.project();
@@ -504,9 +660,11 @@ const tasks = async (args, io) => {
         ...(state === undefined ? {} : { state }),
         ...(on(values, "open") || due === "overdue" ? { open: true } : {}),
         ...(assignee === undefined ? {} : { assignee }),
+        ...(on(values, "unassigned") ? { unassigned: true } : {}),
         ...(text(values, "category") === undefined ? {} : { category: text(values, "category") }),
         ...(text(values, "goal") === undefined ? {} : { goal: text(values, "goal") }),
         ...(dueBy === undefined ? {} : { dueBy }),
+        ...(on(values, "archived") ? { archived: true } : {}),
         ...page,
     });
     answer(io, session, found, () => found.items.length === 0
@@ -545,6 +703,60 @@ const skills = async (args, io) => {
     answer(io, session, found, () => formatSkills(found, io.skillsDir));
     return EXIT.ok;
 };
+/** How many pages of a skill, or of a file, the command follows before it stops: far above what one holds. */
+const MAX_SKILL_PAGES = 64;
+const skill = async (args, io) => {
+    const { values, positionals } = parse(args, { file: { type: "string" } });
+    const path = theOne(positionals, "Say which skill: console skill <path of its SKILL.md> [--file <path>]");
+    const session = await open(io, values);
+    const project = await session.project();
+    const file = text(values, "file");
+    if (file !== undefined) {
+        // The file whole, page after page, as the console reads it from the deployment.
+        const parts = [];
+        let offset;
+        let last;
+        for (let pages = 0; pages < MAX_SKILL_PAGES; pages += 1) {
+            last = await project.skillFile(file, offset === undefined ? {} : { offset });
+            if (last.status !== "ready" || last.file === null) {
+                break;
+            }
+            parts.push(last.file.content);
+            if (last.file.nextOffset === null) {
+                break;
+            }
+            offset = last.file.nextOffset;
+        }
+        if (last === undefined) {
+            throw failed("The file could not be read.");
+        }
+        const read = last;
+        const content = parts.join("");
+        answer(io, session, { ...read, content }, () => formatSkillFile(read, content));
+        return EXIT.ok;
+    }
+    // The skill whole: its pages until complete, the rules first, as load_skill lays them out.
+    const pages = [];
+    let cursor;
+    let last;
+    for (let n = 0; n < MAX_SKILL_PAGES; n += 1) {
+        last = await project.skill(path, cursor);
+        if (last.status !== "ready" || last.skill === null) {
+            break;
+        }
+        pages.push(last.skill);
+        if (last.skill.complete || last.skill.nextCursor === null) {
+            break;
+        }
+        cursor = last.skill.nextCursor;
+    }
+    if (last === undefined) {
+        throw failed("The skill could not be read.");
+    }
+    const loaded = last;
+    answer(io, session, { ...loaded, pages }, () => formatSkillLoad(loaded, pages));
+    return EXIT.ok;
+};
 /** A version number given as a flag, or nothing; anything else is not understood. */
 function versionOf(given) {
     if (given === undefined) {
@@ -715,6 +927,36 @@ const editTask = async (args, io) => {
     answer(io, session, changed, () => formatTask(changed));
     return EXIT.ok;
 };
+/** Puts a task away, or every done or dropped task of a goal (ADR-0029); the task by its number or its id. */
+const taskArchive = async (args, io) => {
+    const { values, positionals } = parse(args, { goal: { type: "string" } });
+    const goal = text(values, "goal");
+    if (positionals.length > 1 || (positionals.length === 0) === (goal === undefined)) {
+        throw misuse("Say which: console task archive <number|id>, or console task archive --goal <id> for every done or dropped task of a goal");
+    }
+    const session = await open(io, values);
+    const project = await session.project();
+    if (goal !== undefined) {
+        const { archived } = await project.archiveTasksOfGoal(goal);
+        answer(io, session, { archived }, () => `${archived} ${archived === 1 ? "task" : "tasks"} of the goal put away.`);
+        return EXIT.ok;
+    }
+    const found = await project.task(positionals[0] ?? "");
+    const archived = await project.archiveTask(found.id);
+    answer(io, session, archived, () => formatTaskLine(archived));
+    return EXIT.ok;
+};
+/** Brings a task back from the archive. */
+const taskRestore = async (args, io) => {
+    const { values, positionals } = parse(args, {});
+    const ref = theOne(positionals, "Say which task: console task restore <number|id>");
+    const session = await open(io, values);
+    const project = await session.project();
+    const found = await project.task(ref);
+    const restored = await project.restoreTask(found.id);
+    answer(io, session, restored, () => formatTaskLine(restored));
+    return EXIT.ok;
+};
 const task = async (args, io) => {
     if (args[0] === "new") {
         return newTask(args.slice(1), io);
@@ -722,6 +964,12 @@ const task = async (args, io) => {
     if (args[0] === "edit") {
         return editTask(args.slice(1), io);
     }
+    if (args[0] === "archive") {
+        return taskArchive(args.slice(1), io);
+    }
+    if (args[0] === "restore") {
+        return taskRestore(args.slice(1), io);
+    }
     const { values, positionals } = parse(args, {});
     const ref = theOne(positionals, "Say which task: console task <number|id>");
     const session = await open(io, values);
@@ -1445,6 +1693,31 @@ const editProject = async (args, io) => {
     answer(io, session, changed, () => formatProject(changed));
     return EXIT.ok;
 };
+/** The pack token (ADR-0028): read from standard input and never from an argument, so that no shell keeps it. */
+const projectPackToken = async (args, io) => {
+    const { values, positionals } = parse(args, {
+        stdin: { type: "boolean" },
+        remove: { type: "boolean" },
+    });
+    const key = theOne(positionals, "Say which project: console project pack-token <key> --stdin, or console project pack-token <key> --remove");
+    if (on(values, "stdin") === on(values, "remove")) {
+        throw misuse("Say one of --stdin, which reads the token from standard input, and --remove, which takes it away.");
+    }
+    const session = await open(io, values);
+    const project = session.client.project(key);
+    if (on(values, "remove")) {
+        const changed = await project.removePackToken();
+        answer(io, session, changed, () => formatProject(changed));
+        return EXIT.ok;
+    }
+    const token = (await io.readStdin()).trim();
+    if (token.length === 0) {
+        throw failed("No token was given on standard input.");
+    }
+    const changed = await project.setPackToken({ token });
+    answer(io, session, changed, () => formatProject(changed));
+    return EXIT.ok;
+};
 const projectIcon = async (args, io) => {
     const { values, positionals } = parse(args, { remove: { type: "boolean" } });
     const [key, file] = positionals;
@@ -1474,8 +1747,11 @@ const project = async (args, io) => {
     if (args[0] === "icon") {
         return projectIcon(args.slice(1), io);
     }
+    if (args[0] === "pack-token") {
+        return projectPackToken(args.slice(1), io);
+    }
     const { values, positionals } = parse(args, {});
-    const key = theOne(positionals, "Say which project: console project <key>; or console project new, edit or icon");
+    const key = theOne(positionals, "Say which project: console project <key>; or console project new, edit, icon or pack-token");
     const session = await open(io, values);
     const found = await session.client.project(key).get();
     answer(io, session, found, () => formatProject(found));
@@ -1491,18 +1767,51 @@ const members = async (args, io) => {
         : found.items.map(formatMemberLine).join("\n"));
     return EXIT.ok;
 };
+/** The keys --project names with commas, each once, or nothing when it names one project or none. */
+function projectKeysOf(value) {
+    if (value === undefined || !value.includes(",")) {
+        return undefined;
+    }
+    const keys = [...new Set(value.split(",").map((key) => key.trim()))].filter((key) => key !== "");
+    if (keys.length === 0) {
+        throw misuse("Say which projects: --project <key>[,<key>...]");
+    }
+    return keys;
+}
 const member = async (args, io) => {
     const [verb, ...rest] = args;
     if (verb === "add") {
         const { values, positionals } = parse(rest, { role: { type: "string" } });
-        const login = theOne(positionals, "Say whom: console member add <login> [--role owner|member]");
+        const login = theOne(positionals, "Say whom: console member add <login> [--role owner|member] [--project <key>[,<key>...]]");
         const role = text(values, "role");
         const session = await open(io, values);
-        const project = await session.project();
-        const added = await project.addMember({
+        const input = {
             personId: (await personOf(session, login)).id,
             ...(role === undefined ? {} : { role: projectRoleOf(role) }),
-        });
+        };
+        // Several projects at once, where --project names them with commas: the person is listed
+        // in each in turn, one listed already is said so, and the rest go on.
+        const keys = projectKeysOf(text(values, "project"));
+        if (keys !== undefined) {
+            const added = [];
+            for (const key of keys) {
+                try {
+                    added.push({ project: key, member: await session.client.project(key).addMember(input) });
+                }
+                catch (error) {
+                    if (!(error instanceof ApiError && error.code === "member.exists")) {
+                        throw error;
+                    }
+                    added.push({ project: key, member: null });
+                }
+            }
+            answer(io, session, added, () => added
+                .map(({ project, member }) => `${project}  ${member === null ? `${login} is listed already` : formatMemberLine(member)}`)
+                .join("\n"));
+            return EXIT.ok;
+        }
+        const project = await session.project();
+        const added = await project.addMember(input);
         answer(io, session, added, () => formatMemberLine(added));
         return EXIT.ok;
     }
@@ -1528,7 +1837,7 @@ const member = async (args, io) => {
         answer(io, session, { removed: found.login }, () => `${found.login} is no longer listed in the project.`);
         return EXIT.ok;
     }
-    throw misuse("Say what to do: console member add <login> [--role owner|member], console member role <login> <owner|member>, or console member remove <login>");
+    throw misuse("Say what to do: console member add <login> [--role owner|member] [--project <key>[,<key>...]], console member role <login> <owner|member>, or console member remove <login>");
 };
 const category = async (args, io) => {
     const [verb, ...rest] = args;
@@ -1577,6 +1886,7 @@ const category = async (args, io) => {
 };
 const COMMANDS = {
     login,
+    logins,
     logout,
     whoami,
     serve,
@@ -1589,6 +1899,7 @@ const COMMANDS = {
     goal,
     categories,
     skills,
+    skill,
     rules,
     people,
     person,
@@ -1628,11 +1939,14 @@ function help(io, name) {
     io.stdout(found);
     return EXIT.ok;
 }
-/** A client of the console at `url`, naming the command on every request (ADR-0025). */
+/**
+ * A client of the console at `url`, naming the command on every request (ADR-0025). A redirect
+ * is not followed: the token goes to the address the command resolved, and nowhere it is sent on to.
+ */
 function clientOf(io, url, token) {
     return createClient({
         baseUrl: url,
-        fetch: io.fetch,
+        fetch: (input, init) => io.fetch(input, { ...init, redirect: "manual" }),
         ...(token === undefined ? {} : { token }),
         ...(io.userAgent === undefined ? {} : { userAgent: io.userAgent }),
     });