@songsid/agend 2.1.6-beta.6 → 2.1.6-beta.8

package/dist/ui/settings.html

@@ -49,7 +49,7 @@
   button.danger:hover { background: #fef2f2; }
   button.sm { padding: 4px 9px; font-size: 12px; }
   label { display: block; font-size: 12px; font-weight: 500; color: var(--muted); margin: 10px 0 4px; }
-  input[type=text], input[type=number], select { width: 100%; font-family: inherit; font-size: 13px; padding: 8px 10px; border: 1px solid var(--border); border-radius: var(--radius-sm); background: #fff; color: var(--fg); }
+  input[type=text], input[type=password], input[type=number], select { width: 100%; font-family: inherit; font-size: 13px; padding: 8px 10px; border: 1px solid var(--border); border-radius: var(--radius-sm); background: #fff; color: var(--fg); }
   input:focus, select:focus { outline: 2px solid #bfdbfe; border-color: var(--accent); }
   .edit { padding: 14px 16px; background: #fff; border-top: 1px solid var(--border); }
   .grid2 { display: grid; grid-template-columns: 1fr 1fr; gap: 10px; }
@@ -193,6 +193,7 @@
     <div class="sec-head"><h2>🔌 Connections &amp; Bots</h2><div class="grow"></div><button class="sm" id="newBotBtn" data-i18n="add">+ Add</button></div>
     <div id="newBot"></div>
     <div class="card" id="bots"></div>
+    <div class="card" id="providerSecrets" style="margin-top:12px"></div>
   </section>
 
   <section>
@@ -417,7 +418,7 @@
   }
 
   // ── State ──
-  const state = { schema: { impacts: {}, order: ["now", "instance", "fleet"] }, fleet: {}, classic: {}, classicStatus: {}, classicLive: {}, live: {}, fleetUp: false, advFmt: "yaml", advEdit: false, collapsedGroups: new Set(), version: "", newAgentOpen: false, newBotOpen: false, pending: new Map() };
+  const state = { schema: { impacts: {}, order: ["now", "instance", "fleet"] }, fleet: {}, classic: {}, classicStatus: {}, classicLive: {}, live: {}, connections: [], providerSecrets: [], fleetUp: false, advFmt: "yaml", advEdit: false, collapsedGroups: new Set(), version: "", newAgentOpen: false, newBotOpen: false, pending: new Map() };
   const channels = () => state.fleet.channels || (state.fleet.channel ? [state.fleet.channel] : []);
   const channelIds = () => channels().map(c => c.id || c.type).filter(Boolean);
   const chLabel = (i) => i === 0 ? "primary" : "persona";
@@ -707,8 +708,10 @@
       catch (error) { result = { ok: false, body: { error: error.message } }; }
       if (!result?.ok) {
         showBanner(`${change.label}: ${result?.body?.error || t("applyFailed")}`, true);
+        change.cleanup?.();
         button.disabled = false; return;
       }
+      change.cleanup?.();
       state.pending.delete(key); updatePendingBar();
     }
     // The key is generated here, before the first attempt, and reused by every
@@ -1156,6 +1159,7 @@
             ? (ch.access.allowed_users).slice(0, 3).join(", ") + ((ch.access.allowed_users).length > 3 ? ` +${(ch.access.allowed_users).length - 3}` : "")
             : t("noAllowedUsers")),
         el("span", { class: "spacer" }),
+        el("span", { class: "tag", title: "secret status" }, state.connections.find(c => (c.id || c.type) === (ch.id || ch.type))?.token_present ? "Token configured" : "Token missing"),
         el("span", { style: `color:${state.fleetUp ? "var(--green)" : "var(--red)"};font-size:13px` }, state.fleetUp ? "Connected" : "Problem"),
         el("button", { class: "sm ghost", onclick: () => {
           const form = botEditForm(ch, i);
@@ -1166,6 +1170,125 @@
     });
   }
 
+  // Provider API keys use a separate registry endpoint. Unsupported providers
+  // are intentionally rendered without an input: a key that cannot be
+  // positively verified must never be accepted as an "unverified" write.
+  function providerSecretInputAllowed(spec) { return spec?.verifier === "available"; }
+  function renderProviderSecrets() {
+    const host = $("providerSecrets"); if (!host) return;
+    host.innerHTML = "";
+    const rows = Array.isArray(state.providerSecrets) ? state.providerSecrets : [];
+    if (!rows.length) { host.className = "card empty"; host.textContent = "No provider API-key verifiers available."; return; }
+    host.className = "card";
+    rows.forEach(spec => {
+      const row = el("div", { class: "item" });
+      const feedback = el("div", { class: "feedback" });
+      const present = spec.token_present ? "Key configured" : "Not configured";
+      if (!providerSecretInputAllowed(spec)) {
+        row.append(el("div", { class: "item-row" }, el("span", { class: "name" }, spec.display_name), el("span", { class: "tag" }, "Unsupported verifier")), el("div", { class: "hint" }, "This provider cannot be safely verified here; no key input is offered."));
+        host.append(row); return;
+      }
+      const input = el("input", { type: "password", autocomplete: "new-password", placeholder: present });
+      const button = el("button", { class: "sm primary" }, "Verify & apply");
+      button.onclick = async () => {
+        const secret = input.value;
+        if (!secret) { feedback.className = "feedback error"; feedback.textContent = "Enter a key first."; return; }
+        button.disabled = true; feedback.className = "feedback"; feedback.textContent = "Verifying…";
+        const key = crypto.randomUUID ? crypto.randomUUID() : `provider-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+        try {
+          const verified = await api(`/api/settings/secrets/${encodeURIComponent(spec.id)}/verify`, { method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify({ secret, idempotency_key: key }) });
+          if (!verified.ok) { feedback.className = "feedback error"; feedback.textContent = `✗ ${verified.body?.error || "verification failed"}`; return; }
+          feedback.textContent = "Applying…";
+          let result = await api(`/api/settings/secrets/${encodeURIComponent(spec.id)}/apply`, { method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify({ verification_id: verified.body?.verification_id, idempotency_key: key }) });
+          let body = result.body || {};
+          for (let n = 0; result.ok && body.job_id && body.result === "applying" && n < 60; n++) {
+            await new Promise(resolve => setTimeout(resolve, 250));
+            const status = await api(`/api/settings/secrets/${encodeURIComponent(spec.id)}/apply/${encodeURIComponent(body.job_id)}`);
+            if (status.ok) body = status.body || body;
+          }
+          const labels = { applied_next_use: "✓ Saved — new processes will use it", reloaded: "✓ Applied", rolled_back: "↩ Rolled back", rollback_failed: "✗ Rollback failed" };
+          const ok = body.result === "applied_next_use" || body.result === "reloaded";
+          feedback.className = `feedback ${ok ? "" : "error"}`;
+          feedback.textContent = labels[body.result] || `✗ ${body.error || "Apply failed"}`;
+          if (ok) { input.value = ""; await reload(); }
+        } finally { input.value = ""; button.disabled = false; }
+      };
+      row.append(el("div", { class: "item-row" }, el("span", { class: "name" }, spec.display_name), el("span", { class: "tag" }, present), el("span", { class: "spacer" }, input), button), feedback);
+      host.append(row);
+    });
+  }
+
+  // Secret rotation is staged through the same Apply bar as every other
+  // Settings mutation. The token is held only in this short-lived closure and
+  // is cleared by the caller after the request settles; it never enters
+  // localStorage, the URL, a label, or the staged change's display text.
+  async function applyConnectionSecret(connectionId, secret, feedback) {
+    const key = crypto.randomUUID ? crypto.randomUUID() : `secret-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    feedback.className = "feedback"; feedback.textContent = "Verifying…";
+    const verified = await api(`/api/settings/connections/${encodeURIComponent(connectionId)}/secret/verify`, {
+      method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify({ secret, idempotency_key: key }),
+    });
+    if (!verified.ok) { feedback.className = "feedback error"; feedback.textContent = `✗ ${verified.body?.error || "verification failed"}`; return verified; }
+    feedback.textContent = "Applying…";
+    const applied = await api(`/api/settings/connections/${encodeURIComponent(connectionId)}/secret/apply`, {
+      method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify({ verification_id: verified.body?.verification_id, idempotency_key: key }),
+    });
+    if (!applied.ok && applied.status !== 409) { feedback.className = "feedback error"; feedback.textContent = `✗ ${applied.body?.error || "apply failed"}`; return applied; }
+    let result = applied.body || {};
+    if (result.job_id && result.result === "applying") {
+      for (let n = 0; n < 60; n++) {
+        await new Promise(resolve => setTimeout(resolve, 250));
+        const status = await api(`/api/settings/connections/${encodeURIComponent(connectionId)}/secret/apply/${encodeURIComponent(result.job_id)}`);
+        if (status.ok) { result = status.body || result; if (result.result !== "applying") break; }
+      }
+    }
+    const labels = { applying: "…Still applying — check status", applied: "✓ Applied", restart_required: "↻ Saved — restart required", rolled_back: "↩ Rolled back", rollback_failed: "✗ Rollback failed" };
+    feedback.className = `feedback ${result.result === "applied" || result.result === "restart_required" ? "" : "error"}`;
+    feedback.textContent = labels[result.result] || "✗ Unknown apply result";
+    return { ok: result.result === "applied" || result.result === "restart_required", status: result.result === "applied" ? 200 : 409, body: result };
+  }
+
+  // Binding changes use a separate verified challenge. They never go through
+  // PUT /fleet/channels: the provider probe proves the target first, and the
+  // apply job updates only group/general coordinates after the replacement
+  // adapter is ready.
+  async function verifyAndApplyConnectionBinding(connectionId, groupId, generalChannelId, feedback) {
+    const key = crypto.randomUUID ? crypto.randomUUID() : `binding-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+    const binding = { group_id: String(groupId).trim(), general_channel_id: String(generalChannelId || "").trim() || null };
+    feedback.className = "feedback"; feedback.textContent = "Verifying target…";
+    const verified = await api(`/api/settings/connections/${encodeURIComponent(connectionId)}/binding/verify`, {
+      method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify({ ...binding, idempotency_key: key }),
+    });
+    if (!verified.ok) { feedback.className = "feedback error"; feedback.textContent = `✗ ${verified.body?.error || "binding verification failed"}`; return verified; }
+    const probe = verified.body?.probe || {};
+    const target = [probe.group_name || binding.group_id, probe.channel_name || probe.channel_id].filter(Boolean).join(" / ");
+    const perms = [probe.can_view ? "view" : null, probe.can_send ? "send" : null, probe.can_manage_topics ? "topics" : null].filter(Boolean).join(", ");
+    feedback.textContent = `✓ Verified ${target}${perms ? ` (${perms})` : ""}`;
+    if (!window.confirm(`Rebind this connection to ${target || binding.group_id}?`)) {
+      feedback.textContent = "Verified; not applied.";
+      return { ok: false, status: 409, body: { result: "verified" } };
+    }
+    feedback.textContent = "Applying binding…";
+    const applied = await api(`/api/settings/connections/${encodeURIComponent(connectionId)}/binding/apply`, {
+      method: "POST", headers: { "Idempotency-Key": key }, body: JSON.stringify({ verification_id: verified.body?.verification_id, idempotency_key: key }),
+    });
+    if (!applied.ok && applied.status !== 409) { feedback.className = "feedback error"; feedback.textContent = `✗ ${applied.body?.error || "binding apply failed"}`; return applied; }
+    let result = applied.body || {};
+    if (result.job_id && result.result === "applying") {
+      for (let n = 0; n < 60; n++) {
+        await new Promise(resolve => setTimeout(resolve, 250));
+        const status = await api(`/api/settings/connections/${encodeURIComponent(connectionId)}/binding/apply/${encodeURIComponent(result.job_id)}`);
+        if (status.ok) { result = status.body || result; if (result.result !== "applying") break; }
+      }
+    }
+    const labels = { applied: "✓ Binding applied", rolled_back: "↩ Binding rolled back", rollback_failed: "✗ Binding rollback failed", applying: "…Still applying — check status" };
+    const ok = result.result === "applied";
+    feedback.className = `feedback ${ok ? "" : "error"}`;
+    feedback.textContent = labels[result.result] || "✗ Unknown binding result";
+    if (ok) await reload();
+    return { ok, status: ok ? 200 : 409, body: result };
+  }
+
   function botEditForm(ch, i) {
     ch.access = ch.access || { mode: "locked", allowed_users: [] };
     ch.access.allowed_users = ch.access.allowed_users || [];
@@ -1175,18 +1298,54 @@
     const fMode = select(ch.access.mode || "locked", ["open", "locked", "pairing"]);
     const users = [...ch.access.allowed_users];
     const accessFeedback = el("div", { class: "feedback" });
+    const tokenInput = el("input", { type: "password", autocomplete: "new-password", placeholder: "Paste a new bot token to rotate it" });
+    const secretFeedback = el("div", { class: "feedback" });
+    const bindingFeedback = el("div", { class: "feedback" });
+    const fGroup = el("input", { type: "text", value: ch.group_id != null ? String(ch.group_id) : "", autocomplete: "off" });
+    const fGeneral = el("input", { type: "text", value: ch.options?.general_channel_id != null ? String(ch.options.general_channel_id) : "", autocomplete: "off", placeholder: type === "discord" ? "General channel id (optional)" : "Forum topic id (optional)" });
+    const bindingVerify = el("button", { class: "sm primary", onclick: async () => {
+      if (!fGroup.value.trim()) { bindingFeedback.className = "feedback error"; bindingFeedback.textContent = "✗ group/guild id required"; return; }
+      await verifyAndApplyConnectionBinding(connectionId, fGroup.value, fGeneral.value, bindingFeedback);
+    } }, "Verify new binding → Confirm rebind");
+    const connectionId = ch.id || ch.type || chLabel(i);
+    let pendingSecret = "";
+    const stageSecret = () => {
+      const secret = tokenInput.value;
+      if (!secret) { secretFeedback.className = "feedback error"; secretFeedback.textContent = "✗ token required"; return; }
+      pendingSecret = secret;
+      tokenInput.value = "";
+      stageChange(`secret:${connectionId}`, {
+        // Secret rotation is an immediate adapter operation. Use the server's
+        // published impact ordering rather than duplicating an impact literal
+        // in this page (hot/cold parity guards reject such copies).
+        label: `Rotate ${type} token`, impact: state.schema.order[0],
+        apply: async () => {
+          const value = pendingSecret; pendingSecret = "";
+          try { return await applyConnectionSecret(connectionId, value, secretFeedback); }
+          finally { pendingSecret = ""; }
+        },
+        cleanup: () => { pendingSecret = ""; },
+      });
+      secretFeedback.className = "feedback"; secretFeedback.textContent = "Queued — click Apply changes.";
+    };
     const validateAccess = () => setValidation(fMode, accessFeedback, "", fMode.value === "locked" && users.length === 0 ? t("accessLockedEmpty") : "");
     fMode.addEventListener("change", validateAccess);
     box.append(
       el("div", { class: "grid2" },
         el("div", {}, el("label", {}, t("accessMode"), impact("fleet.channel.access.mode")), fMode, accessFeedback),
         el("div", {}, el("label", {}, t("allowedUsers"), impact("fleet.channel.access.allowed_users")), chipList(users, validateAccess, "user id"))),
-      // Only the field that platform actually has, the way quickstart asks.
       el("div", { class: "field" },
         el("label", {}, type === "discord" ? t("guildIdField") : t("groupIdField"), impact("fleet.channels")),
-        el("div", { class: "sub" }, ch.group_id ? String(ch.group_id) : t("notSet"))),
+        fGroup,
+        el("label", {}, type === "discord" ? "General channel id" : "Forum topic id"), fGeneral,
+        el("div", { class: "hint" }, "The target is checked with the existing bot token before any binding is changed."),
+        el("div", { class: "actions" }, bindingVerify, bindingFeedback)),
       drawer(t("advancedSection"),
         el("div", { class: "field" }, el("label", {}, t("tokenEnv")), el("div", { class: "sub" }, ch.bot_token_env || "(no token env)")),
+        el("div", { class: "field" },
+          el("label", {}, "Bot token (never stored in the browser)"), tokenInput,
+          el("div", { class: "hint" }, "The token is verified by AgEnD, then applied by replacing the running adapter. It is never echoed."),
+          el("div", { class: "actions" }, el("button", { class: "sm primary", onclick: stageSecret }, "Verify & apply token"), secretFeedback)),
         el("div", { class: "actions" },
           el("button", { class: "sm danger", onclick: () => { closeModal(); delBot(i); } }, t("deleteBot")))),
     );
@@ -1639,7 +1798,7 @@
   }
 
   // ── Load / render ──
-  function renderAll() { renderAgents(); renderClassic(); renderBots(); renderGeneral(); renderAdvanced(); applyStaticI18n(); }
+  function renderAll() { renderAgents(); renderClassic(); renderBots(); renderProviderSecrets(); renderGeneral(); renderAdvanced(); applyStaticI18n(); }
   async function reloadLive() {
     const f = await api("/api/fleet");
     state.fleetUp = f.ok;
@@ -1671,6 +1830,12 @@
     if (!f.ok) { $("banner").style.display = "block"; $("banner").style.background = "#fef2f2"; $("banner").style.color = "var(--red)"; $("banner").textContent = t("configLoadFailed"); return; }
     state.fleet = f.body || {};
     const c = await api("/api/settings/classic"); state.classic = c.body || {};
+    const connections = await api("/api/settings/connections");
+    state.connections = connections.ok && Array.isArray(connections.body) ? connections.body : [];
+    const providerSecrets = await api("/api/settings/provider-secrets");
+    const providerHost = $("providerSecrets");
+    if (providerHost) providerHost.style.display = providerSecrets.ok ? "" : "none";
+    state.providerSecrets = providerSecrets.ok && Array.isArray(providerSecrets.body) ? providerSecrets.body : [];
     await reloadLive();
     renderAll();
   }
@@ -1692,7 +1857,7 @@
   document.addEventListener("keydown", e => { if (e.key === "Escape" && modalState) closeModal(); });
   $("wizardBtn").onclick = () => openWizard();
   $("applyChanges").onclick = applyPendingChanges;
-  $("discardChanges").onclick = async () => { state.pending.clear(); updatePendingBar(); await reload(); };
+  $("discardChanges").onclick = async () => { for (const change of state.pending.values()) change.cleanup?.(); state.pending.clear(); updatePendingBar(); await reload(); };
 
   reload();
 })();

package/dist/usage/providers.d.ts

@@ -140,16 +140,18 @@ type UsageProvider = {
     name: string;
     fetch: (storeHome?: string) => Promise<Omit<ProviderUsage, "id" | "name">>;
 };
+type UsageFleetConfig = Parameters<typeof listConfiguredProfiles>[0];
 /**
  * One row per subscription, not one row per backend.
  *
- * A fleet running two kiro logins has two quotas, and a single row could only
- * ever show one of them — or worse, add them together and show a number that is
- * true of neither. Each configured credential profile reads its own store and
- * gets its own row; a backend with no profiles is left exactly as it was, one
- * row reading the shared login.
+ * A fleet running two kiro/codex logins has two quotas, and a single row could
+ * only ever show one of them — or worse, add them together and show a number
+ * that is true of neither. Each effective credential profile reads its own
+ * store and gets its own row; a mixed fleet also keeps one row for effective
+ * legacy shared bindings. Instance-private homes are never scanned: their
+ * auth files point at these same logical sources.
  */
-export declare function providersForConfig(config: Parameters<typeof listConfiguredProfiles>[0], base?: UsageProvider[]): UsageProvider[];
+export declare function providersForConfig(config: UsageFleetConfig, base?: UsageProvider[]): UsageProvider[];
 /** Test seam: a provider that hangs cannot be simulated with real vendors. */
 export declare function setUsageProvidersForTests(providers: UsageProvider[] | null): void;
 /**

package/dist/usage/providers.js

@@ -23,7 +23,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { getAgendHome } from "../paths.js";
 import { loadFleetConfig } from "../config.js";
-import { credentialHomeSpec, credentialProfileStoreHome, listConfiguredProfiles, } from "../backend/credential-profile.js";
+import { credentialHomeSpec, credentialProfileStoreHome, instanceCredentialProfile, } from "../backend/credential-profile.js";
 import { readKiroAuthTokens } from "../backend/kiro-auth-store.js";
 import { homedir } from "node:os";
 import { getProviderRateLimit } from "./provider-alerts.js";
@@ -1099,27 +1099,101 @@ const DEFAULT_PROVIDERS = [
 /**
  * One row per subscription, not one row per backend.
  *
- * A fleet running two kiro logins has two quotas, and a single row could only
- * ever show one of them — or worse, add them together and show a number that is
- * true of neither. Each configured credential profile reads its own store and
- * gets its own row; a backend with no profiles is left exactly as it was, one
- * row reading the shared login.
+ * A fleet running two kiro/codex logins has two quotas, and a single row could
+ * only ever show one of them — or worse, add them together and show a number
+ * that is true of neither. Each effective credential profile reads its own
+ * store and gets its own row; a mixed fleet also keeps one row for effective
+ * legacy shared bindings. Instance-private homes are never scanned: their
+ * auth files point at these same logical sources.
  */
 export function providersForConfig(config, base = DEFAULT_PROVIDERS) {
     return base.flatMap(provider => {
         const backendName = usageBackendForProviderId(provider.id);
         if (!backendName || !credentialHomeSpec(backendName))
             return [provider];
-        const profiles = listConfiguredProfiles(config, backendName);
+        const profiles = effectiveCredentialProfiles(config, backendName);
         if (profiles.length === 0)
             return [provider];
-        return profiles.map(profile => ({
+        // A fleet can mix profiled and legacy instances.  The old expansion
+        // returned only profile rows whenever *any* profile existed, which hid the
+        // shared subscription from a running legacy instance.  Include the shared
+        // source only when an effective binding actually uses it; active-provider
+        // filtering then removes sources that are stopped or otherwise unused.
+        const rows = [];
+        // Classic channels are stored separately from fleet.yaml and always use
+        // the shared Codex login today.  Keep the shared Codex row available so
+        // active-provider filtering can retain that binding; unlike filesystem
+        // scanning this row is harmless when no classic/shared instance is live.
+        if (provider.id === "codex" || hasEffectiveSharedBinding(config, backendName)) {
+            rows.push({
+                id: provider.id,
+                name: provider.id === "codex" ? `${provider.name} (default)` : provider.name,
+                fetch: () => provider.fetch(),
+            });
+        }
+        rows.push(...profiles.map(profile => ({
             id: `${provider.id}:${profile}`,
             name: `${provider.name} (${profile})`,
             fetch: () => provider.fetch(credentialProfileStoreHome(getAgendHome(), backendName, profile)),
-        }));
+        })));
+        return rows;
     });
 }
+/**
+ * Whether at least one effective fleet binding uses the legacy shared login.
+ *
+ * This deliberately follows effective backend/profile inheritance instead of
+ * looking at directories on disk.  Instance-private Codex homes are config
+ * homes whose auth file points at this same shared/profile source; scanning
+ * them would duplicate one quota and make usage depend on stale instance
+ * directories.  A missing/unknown config keeps the legacy shared row for
+ * backwards compatibility.
+ */
+function hasEffectiveSharedBinding(config, backendName) {
+    if (!config)
+        return true;
+    const defaults = config.defaults;
+    const instances = config.instances ?? {};
+    let sawEffectiveBinding = false;
+    for (const instance of Object.values(instances)) {
+        const backend = instance.backend ?? defaults?.backend;
+        if (backend !== backendName)
+            continue;
+        sawEffectiveBinding = true;
+        if (!instanceCredentialProfile(instance, defaults, backendName))
+            return true;
+    }
+    // A defaults-only fleet has one effective shared binding when the default
+    // backend is this provider and no profile was configured.  With no known
+    // binding at all, preserve the pre-profile shared-provider behaviour.
+    if (!sawEffectiveBinding) {
+        if (defaults?.backend === backendName && !instanceCredentialProfile(undefined, defaults, backendName))
+            return true;
+        return Object.keys(instances).length === 0;
+    }
+    return false;
+}
+/** Profiles on effective bindings only (not dormant backend_options on another backend). */
+function effectiveCredentialProfiles(config, backendName) {
+    if (!config)
+        return [];
+    const found = new Set();
+    const defaults = config.defaults;
+    for (const instance of Object.values(config.instances ?? {})) {
+        const backend = instance.backend ?? defaults?.backend;
+        if (backend !== backendName)
+            continue;
+        const profile = instanceCredentialProfile(instance, defaults, backendName);
+        if (profile)
+            found.add(profile);
+    }
+    if (Object.keys(config.instances ?? {}).length === 0 && defaults?.backend === backendName) {
+        const profile = instanceCredentialProfile(undefined, defaults, backendName);
+        if (profile)
+            found.add(profile);
+    }
+    return [...found].sort();
+}
 /**
  * The fleet configuration, for working out which subscriptions exist.
  *