@thinremote/thinr-cli 1.3.0 → 1.3.2

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## [1.3.2] - 2026-09-24
+
+### Fixed
+
+- Device properties and device status now honour the `user` argument.
+  `thinr_property_get`, `thinr_property_set` and the playbook `property`
+  actions accepted it but addressed the active profile's own account, the
+  same gap fixed for resources in 1.3.1.
+
+### Changed
+
+- Account-scoped API paths are built in one place (`lib/paths.js`): the
+  `/v{1,2,3}/users/{account}` prefixes and the device prefix, all resolving
+  the account through a single `resolveUser`. Five modules carried private
+  copies of the same three lines and four more interpolated the account by
+  hand. A test fails the build if any module starts doing that again, which
+  is what keeps the account from being silently dropped: omitting it
+  produces a URL that works against your own account and only breaks when
+  acting on behalf of another.
+- Not-found errors from properties and status name the account they looked
+  in, matching the resource helpers.
+
+## [1.3.1] - 2026-09-24
+
+### Fixed
+
+- Device resources now honour the `user` argument, so an admin acting on
+  another account reaches that account's devices. `thinr_resource_list`,
+  `thinr_resource_call` and the `thinr_script_*` tools accepted the
+  argument but addressed the active profile's own account, which answered
+  "Device not found"; playbook `resource` and script actions had the same
+  gap. Not-found errors now name the account they looked in.
+
 ## [1.3.0] - 2026-09-13
 
 ### Added

package/lib/alarms.js

@@ -1,10 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
-
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
+import { v1 } from './paths.js';
 
 // Backend enums (see backend/src/thinger/features/alarms/alarm_rule.hpp).
 // Exported so the dashboard can render labels/colors without re-deriving
@@ -114,7 +110,6 @@ export async function getAlarmInstances({
     sort,
     order,
 } = {}) {
-    const apiUser = resolveUser(user);
     const params = new URLSearchParams();
     params.set('count', String(count));
     params.set('index', String(index));
@@ -124,9 +119,7 @@ export async function getAlarmInstances({
     appendMulti(params, 'state', state);
     appendMulti(params, 'severity', severity);
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/instances?${params.toString()}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/instances?${params.toString()}`);
         return Array.isArray(res.data) ? res.data : [];
     } catch (e) {
         throw apiError(e);
@@ -137,9 +130,8 @@ export async function getAlarmInstances({
 // server seeds zeros for every known state so consumers can render a
 // stable layout without null-checks.
 export async function getAlarmInstanceStats({ user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.get(`/v1/users/${apiUser}/alarms/instances/stats`);
+        const res = await api.get(`${v1(user)}/alarms/instances/stats`);
         return res.data || {};
     } catch (e) {
         throw apiError(e);
@@ -147,11 +139,8 @@ export async function getAlarmInstanceStats({ user = null } = {}) {
 }
 
 export async function getAlarmInstance(instance, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/instances/${encodeURIComponent(instance)}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/instances/${encodeURIComponent(instance)}`);
         return res.data;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm instance not found: ${instance}` });
@@ -162,10 +151,9 @@ export async function getAlarmInstance(instance, { user = null } = {}) {
 // (see UPDATE_SCHEMA in alarms_instances.cpp): name, description, state,
 // annotation, reactivation. Anything else is rejected.
 export async function updateAlarmInstance(instance, body, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
         const res = await api.put(
-            `/v1/users/${apiUser}/alarms/instances/${encodeURIComponent(instance)}`,
+            `${v1(user)}/alarms/instances/${encodeURIComponent(instance)}`,
             body,
         );
         return res.data;
@@ -175,11 +163,8 @@ export async function updateAlarmInstance(instance, body, { user = null } = {})
 }
 
 export async function deleteAlarmInstance(instance, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        await api.delete(
-            `/v1/users/${apiUser}/alarms/instances/${encodeURIComponent(instance)}`,
-        );
+        await api.delete(`${v1(user)}/alarms/instances/${encodeURIComponent(instance)}`);
         return true;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm instance not found: ${instance}` });
@@ -187,14 +172,11 @@ export async function deleteAlarmInstance(instance, { user = null } = {}) {
 }
 
 export async function getAlarmRules({ user = null, count = 200, index = 0 } = {}) {
-    const apiUser = resolveUser(user);
     const params = new URLSearchParams();
     params.set('count', String(count));
     params.set('index', String(index));
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/rules?${params.toString()}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/rules?${params.toString()}`);
         return Array.isArray(res.data) ? res.data : [];
     } catch (e) {
         throw apiError(e);
@@ -202,11 +184,8 @@ export async function getAlarmRules({ user = null, count = 200, index = 0 } = {}
 }
 
 export async function getAlarmRule(rule, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.get(
-            `/v1/users/${apiUser}/alarms/rules/${encodeURIComponent(rule)}`,
-        );
+        const res = await api.get(`${v1(user)}/alarms/rules/${encodeURIComponent(rule)}`);
         return res.data;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm rule not found: ${rule}` });
@@ -217,9 +196,8 @@ export async function getAlarmRule(rule, { user = null } = {}) {
 // `name`, `enabled` and an optional `config` object — see CREATE_SCHEMA
 // in alarms_rules.cpp for the full shape.
 export async function createAlarmRule(body, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.post(`/v1/users/${apiUser}/alarms/rules`, body);
+        const res = await api.post(`${v1(user)}/alarms/rules`, body);
         return res.data;
     } catch (e) {
         throw apiError(e);
@@ -227,12 +205,8 @@ export async function createAlarmRule(body, { user = null } = {}) {
 }
 
 export async function updateAlarmRule(rule, body, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        const res = await api.put(
-            `/v1/users/${apiUser}/alarms/rules/${encodeURIComponent(rule)}`,
-            body,
-        );
+        const res = await api.put(`${v1(user)}/alarms/rules/${encodeURIComponent(rule)}`, body);
         return res.data;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm rule not found: ${rule}` });
@@ -240,11 +214,8 @@ export async function updateAlarmRule(rule, body, { user = null } = {}) {
 }
 
 export async function deleteAlarmRule(rule, { user = null } = {}) {
-    const apiUser = resolveUser(user);
     try {
-        await api.delete(
-            `/v1/users/${apiUser}/alarms/rules/${encodeURIComponent(rule)}`,
-        );
+        await api.delete(`${v1(user)}/alarms/rules/${encodeURIComponent(rule)}`);
         return true;
     } catch (e) {
         throw apiError(e, { notFound: `Alarm rule not found: ${rule}` });

package/lib/auth.js

@@ -7,6 +7,7 @@ import { label, success, warning, error as errorStyle, info } from './format.js'
 
 import api, { setBaseURL } from './api.js';
 import { OAUTH, TIMEOUTS } from './constants.js';
+import { v1 } from './paths.js';
 
 const OAUTH_CLIENT_ID = OAUTH.CLIENT_ID;
 const OAUTH_DEVICE_CODE_TIMEOUT_MS = TIMEOUTS.OAUTH_DEVICE_CODE_MS;
@@ -89,14 +90,14 @@ async function authenticateWithUserPass() {
         // Replace any existing token with a fresh permanent one
         spinner.text = 'Preparing user token...';
         try {
-            await api.delete(`/v1/users/${username}/tokens/ThinRemote`);
+            await api.delete(`${v1(username)}/tokens/ThinRemote`);
         } catch (error) {
             if (error.response && error.response.status !== 404) throw error;
         }
 
         spinner.text = 'Creating new user token...';
         const createTokenResponse = await api.post(
-            `/v1/users/${username}/tokens`,
+            `${v1(username)}/tokens`,
             {
                 enabled: true,
                 allow: { '*': { '*': '*' } },
@@ -234,7 +235,7 @@ export async function deleteToken() {
         const spinner = ora('Deleting user token...').start();
 
         try {
-            await api.delete(`/v1/users/${config.username}/tokens/ThinRemote`);
+            await api.delete(`${v1(config.username)}/tokens/ThinRemote`);
             spinner.succeed('Token deleted successfully');
         } catch (error) {
             if (error.response && error.response.status === 404) {

package/lib/bucket.js

@@ -1,10 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
-
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
+import { v2, v3 } from './paths.js';
 
 /**
  * Query an arbitrary time-series bucket declared in a product profile.
@@ -60,7 +56,6 @@ export async function getBucketData({
     group_by,
 } = {}) {
     if (!bucket) throw new Error('bucket is required');
-    const apiUser = resolveUser(user);
     const params = { items, sort };
     if (minutes) {
         params.min_ts = Date.now() - minutes * 60 * 1000;
@@ -75,8 +70,8 @@ export async function getBucketData({
     if (fields) params.fields = fields;
 
     const url = device
-        ? `/v3/users/${apiUser}/devices/${device}/buckets/${bucket}/data`
-        : `/v2/users/${apiUser}/buckets/${bucket}/data`;
+        ? `${v3(user)}/devices/${device}/buckets/${bucket}/data`
+        : `${v2(user)}/buckets/${bucket}/data`;
 
     try {
         const res = await api.get(url, { params });

package/lib/command-stream.js

@@ -2,6 +2,7 @@
 import WebSocket from 'ws';
 import { randomUUID } from 'crypto';
 import { TIMEOUTS } from './constants.js';
+import { device } from './paths.js';
 
 /**
  * One-shot execution of a shell command on a device over the IOTMP
@@ -79,7 +80,7 @@ export class CommandStream {
         const { server, apiUser, deviceId, cmd, timeout } = this.opts;
         const params = new URLSearchParams({ cmd });
         if (timeout && timeout > 0) params.set('timeout', String(timeout));
-        return `wss://${server}/v3/users/${apiUser}/devices/${deviceId}/resources/${this.resource}?${params}`;
+        return `wss://${server}${device(apiUser, deviceId)}/resources/${this.resource}?${params}`;
     }
 
     _openSocket() {

package/lib/config.js

@@ -164,6 +164,15 @@ export function readConfig() {
  * via classifyError. Replaces the same boilerplate that used to live
  * at the top of every helper in lib/.
  */
+/**
+ * The account an API call is addressed to: an explicit one when acting on
+ * behalf of another account, the active profile's own otherwise. Single
+ * source of truth — every path in lib/paths.js goes through it.
+ */
+export function resolveUser(user) {
+    return user || requireConfig().username;
+}
+
 export function requireConfig() {
     const config = readConfig();
     if (!config.token || !config.server || !config.username) {

package/lib/console.js

@@ -3,6 +3,7 @@ import { requireConfig } from './config.js';
 import { ensureFreshToken } from './auth.js';
 import api from './api.js';
 import { warning, error as errorStyle } from './format.js';
+import { device } from './paths.js';
 
 /**
  * Creates a WebSocket connection to a device terminal. Returns a
@@ -14,9 +15,10 @@ import { warning, error as errorStyle } from './format.js';
  * never calls process.exit.
  *
  * @param {string} deviceId - The ID of the device to connect to
+ * @param {string} [user] - Account that owns the device (defaults to the active profile)
  * @returns {Promise<number>} Exit code (0 on clean close)
  */
-export async function connectToDeviceConsole(deviceId) {
+export async function connectToDeviceConsole(deviceId, user) {
     const config = requireConfig();
 
     // WS handshakes lack the refresh-on-401 retry that api.js gives
@@ -25,7 +27,7 @@ export async function connectToDeviceConsole(deviceId) {
     const token = (await ensureFreshToken()) || config.token;
 
     const sessionId = createUUID();
-    const wsUrl = `wss://${config.server}/v3/users/${config.username}/devices/${deviceId}/resources/$terminal/${sessionId}?raw=1`;
+    const wsUrl = `wss://${config.server}${device(user, deviceId)}/resources/$terminal/${sessionId}?raw=1`;
     const ws = new WebSocket(wsUrl, {
         headers: { Authorization: `Bearer ${token}` },
     });
@@ -46,7 +48,7 @@ export async function connectToDeviceConsole(deviceId) {
     return new Promise((resolve, reject) => {
         ws.on('open', () => {
             updateTerminalSize(
-                config,
+                user,
                 deviceId,
                 sessionId,
                 process.stdout.columns,
@@ -55,7 +57,7 @@ export async function connectToDeviceConsole(deviceId) {
 
             process.stdout.on('resize', () => {
                 updateTerminalSize(
-                    config,
+                    user,
                     deviceId,
                     sessionId,
                     process.stdout.columns,
@@ -130,15 +132,15 @@ export async function connectToDeviceConsole(deviceId) {
 
 /**
  * Update terminal size on remote device
- * @param {Object} config - Configuration object
+ * @param {string|undefined} user - Account that owns the device
  * @param {string} deviceId - Device ID
  * @param {string} sessionId - Session ID
  * @param {number} cols - Number of columns
  * @param {number} rows - Number of rows
  */
-async function updateTerminalSize(config, deviceId, sessionId, cols, rows) {
+async function updateTerminalSize(user, deviceId, sessionId, cols, rows) {
     try {
-        const url = `/v3/users/${config.username}/devices/${deviceId}/resources/$terminal/${sessionId}/params`;
+        const url = `${device(user, deviceId)}/resources/$terminal/${sessionId}/params`;
 
         await api.post(url, {
             size: {

package/lib/dashboard/event-stream.js

@@ -3,6 +3,7 @@ import WebSocket from 'ws';
 import { readConfig } from '../config.js';
 import { refreshToken } from '../auth.js';
 import { debugCount, debugLog } from '../debug-log.js';
+import { v2 } from '../paths.js';
 
 // Single shared websocket to /v2/users/{user}/events. Both fleet
 // monitoring and product metrics live on the same endpoint with the
@@ -99,14 +100,18 @@ class EventStream {
         // background; await it here so the next attempt uses the fresh
         // token instead of racing the HTTP interceptor's refresh.
         if (this._refreshing) {
-            try { await this._refreshing; } catch { /* fall through; readConfig may still have a usable token */ }
+            try {
+                await this._refreshing;
+            } catch {
+                /* fall through; readConfig may still have a usable token */
+            }
         }
         if (this.disposed) return;
         const config = readConfig();
         if (!config?.server || !config?.token || !config?.username) return;
-        const url = `wss://${config.server}/v2/users/${config.username}/events?authorization=${config.token}`;
+        const url = `wss://${config.server}${v2(config.username)}/events?authorization=${config.token}`;
         debugLog('ws:events', 'connecting', {
-            endpoint: `wss://${config.server}/v2/users/${config.username}/events`,
+            endpoint: `wss://${config.server}${v2(config.username)}/events`,
             pending_subs: this.subs.size,
         });
         const ws = new WebSocket(url);
@@ -132,7 +137,9 @@ class EventStream {
             // fully resubscribed socket — they can rely on new events landing.
             if (isReconnect) {
                 for (const h of this.reconnectHandlers) {
-                    try { h(); } catch (err) {
+                    try {
+                        h();
+                    } catch (err) {
                         debugLog('ws:events', 'reconnect-handler-error', {
                             error: err?.message || String(err),
                         });

package/lib/device-api.js

@@ -1,9 +1,10 @@
 import api from './api.js';
-import { requireConfig } from './config.js';
+import { requireConfig, resolveUser } from './config.js';
 import { BYTES, TIMEOUTS } from './constants.js';
 import { CommandStream } from './command-stream.js';
 import { ensureFreshToken, refreshToken } from './auth.js';
 import { Readable } from 'node:stream';
+import { device } from './paths.js';
 
 // Directory endpoints on the agent expect a trailing slash so it can
 // distinguish "list this directory" from "read a file with this name".
@@ -16,9 +17,10 @@ const withLeadingSlash = (p) => (p.startsWith('/') ? p : `/${p}`);
 
 export function createDeviceAPI(deviceId, options = {}) {
     const config = requireConfig();
-    const apiUser = options.user || config.username;
-    const resourcePath = `/v3/users/${apiUser}/devices/${deviceId}/resources`;
-    const filesPath = `/v3/users/${apiUser}/devices/${deviceId}/files`;
+    const apiUser = resolveUser(options.user);
+    const base = device(apiUser, deviceId);
+    const resourcePath = `${base}/resources`;
+    const filesPath = `${base}/files`;
 
     async function callResource(resource, payload = null, opts = {}) {
         const url = `${resourcePath}/${resource}`;

package/lib/devices.js

@@ -1,10 +1,8 @@
-import { requireConfig } from './config.js';
 import api from './api.js';
 import { apiError } from './errors.js';
+import { v1 } from './paths.js';
 
 export async function getDevices(filter, user = null) {
-    const config = requireConfig();
-    const apiUser = user || config.username;
     let devices = [];
 
     let queryParametersString = '';
@@ -14,7 +12,7 @@ export async function getDevices(filter, user = null) {
 
     try {
         const count = 50;
-        const url = `/v1/users/${apiUser}/devices?count=${count}&${queryParametersString}`;
+        const url = `${v1(user)}/devices?count=${count}&${queryParametersString}`;
         let index = 0;
         let res_length = 0;
 
@@ -37,10 +35,8 @@ export async function getDevices(filter, user = null) {
 // connection state…). For device-side data — system_info, monitoring —
 // hit the agent resources directly instead.
 export async function getDevice(deviceId, user = null) {
-    const config = requireConfig();
-    const apiUser = user || config.username;
     try {
-        const response = await api.get(`/v1/users/${apiUser}/devices/${deviceId}`);
+        const response = await api.get(`${v1(user)}/devices/${deviceId}`);
         return response.data || {};
     } catch (error) {
         throw apiError(error, { notFound: `Device not found: ${deviceId}` });
@@ -50,10 +46,8 @@ export async function getDevice(deviceId, user = null) {
 // Idempotent: returns true if the device record was removed, false if it
 // was already absent. Other failures (auth, network) propagate as apiError.
 export async function deleteDevice(deviceId, user = null) {
-    const config = requireConfig();
-    const apiUser = user || config.username;
     try {
-        await api.delete(`/v1/users/${apiUser}/devices/${deviceId}`);
+        await api.delete(`${v1(user)}/devices/${deviceId}`);
         return true;
     } catch (error) {
         if (error.response?.status === 404) return false;

package/lib/mcp/tools-properties.js

@@ -7,13 +7,13 @@ async function toolPropertyGet(args) {
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
     if (args.property) {
-        const value = await getDeviceProperty(device, args.property);
+        const value = await getDeviceProperty(device, args.property, args.user);
         return {
             content: [{ type: 'text', text: JSON.stringify(value, null, 2) }],
             isError: false,
         };
     }
-    const list = await getDeviceProperties(device);
+    const list = await getDeviceProperties(device, args.user);
     const names = Array.isArray(list) ? list.map((p) => p.property).filter(Boolean) : [];
     return {
         content: [{ type: 'text', text: names.length ? names.join('\n') : '(no properties)' }],
@@ -27,7 +27,7 @@ async function toolPropertySet(args) {
         throw inputError('No device specified. Use thinr_devices to list available devices.');
     if (!args.property) throw inputError('property is required');
     if (args.value === undefined) throw inputError('value is required');
-    const saved = await setDeviceProperty(device, args.property, args.value);
+    const saved = await setDeviceProperty(device, args.property, args.value, args.user);
     return {
         content: [
             {

package/lib/mcp/tools-resources.js

@@ -6,7 +6,7 @@ async function toolResourceList(args) {
     const device = args.device;
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
-    const entries = await listDeviceResourcesWithSchemas(device);
+    const entries = await listDeviceResourcesWithSchemas(device, { user: args.user });
     const fnLabel = (f) =>
         ({ 1: 'no params', 2: 'input', 3: 'output', 4: 'input/output' })[f] || 'unknown';
     const lines = entries.map((e) => {
@@ -26,7 +26,9 @@ async function toolResourceCall(args) {
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
     if (!args.resource) throw inputError('resource is required');
-    const result = await callDeviceResource(device, args.resource, args.inputs);
+    const result = await callDeviceResource(device, args.resource, args.inputs, {
+        user: args.user,
+    });
     return {
         content: [
             {

package/lib/mcp/tools-scripts.js

@@ -7,7 +7,7 @@ async function toolScriptList(args) {
     const device = args.device;
     if (!device)
         throw inputError('No device specified. Use thinr_devices to list available devices.');
-    const info = await readDeviceResource(device, '$scripts/info');
+    const info = await readDeviceResource(device, '$scripts/info', { user: args.user });
     const scripts = Array.isArray(info?.scripts) ? info.scripts : [];
     const header = `Scripts directory: ${info?.path || '(unknown)'}\n${scripts.length} script(s) registered:`;
     const entries = scripts.map((s) => {
@@ -33,7 +33,7 @@ async function toolScriptWrite(args) {
 
     const { api: deviceApi } = getAPI(device, args.user);
 
-    const info = await readDeviceResource(device, '$scripts/info');
+    const info = await readDeviceResource(device, '$scripts/info', { user: args.user });
     const baseDir = info?.path;
     if (!baseDir)
         throw new Error('Agent did not return a scripts directory (is $scripts/info supported?)');
@@ -52,7 +52,7 @@ async function toolScriptWrite(args) {
         throw new Error(`chmod +x failed: ${chmod.stderr || `exit ${chmod.retcode}`}`);
     }
 
-    const reloaded = await callDeviceResource(device, '$scripts/reload', {});
+    const reloaded = await callDeviceResource(device, '$scripts/reload', {}, { user: args.user });
     // The agent registers resources by the file's stem, so "battery.sh"
     // becomes scripts/battery. Match the same way to echo back the schema.
     const registeredName = args.name.replace(/\.[^./]+$/, '');
@@ -82,7 +82,7 @@ async function toolScriptDelete(args) {
     if (!args.name) throw inputError('name is required');
 
     const { api: deviceApi } = getAPI(device, args.user);
-    const info = await readDeviceResource(device, '$scripts/info');
+    const info = await readDeviceResource(device, '$scripts/info', { user: args.user });
     const baseDir = info?.path;
     if (!baseDir)
         throw new Error('Agent did not return a scripts directory (is $scripts/info supported?)');
@@ -93,7 +93,7 @@ async function toolScriptDelete(args) {
     const scriptPath = `${baseDir}/${args.name}`;
 
     await deviceApi.delete(scriptPath, false);
-    const reloaded = await callDeviceResource(device, '$scripts/reload', {});
+    const reloaded = await callDeviceResource(device, '$scripts/reload', {}, { user: args.user });
     const remaining = Array.isArray(reloaded?.scripts) ? reloaded.scripts.length : 0;
     return {
         content: [

package/lib/monitoring.js

@@ -1,10 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
-
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
+import { v2, v3 } from './paths.js';
 
 /**
  * Query the monitoring bucket. When `device` is provided, scopes to
@@ -55,7 +51,6 @@ export async function getMonitoringData({
     fields,
     group_by,
 } = {}) {
-    const apiUser = resolveUser(user);
     const params = { items, sort };
     if (minutes) {
         params.min_ts = Date.now() - minutes * 60 * 1000;
@@ -80,13 +75,12 @@ export async function getMonitoringData({
             .split(',')
             .map((s) => s.trim())
             .includes('device');
-        params.fields =
-            !device && !effectiveGroupBy && !hasDevice ? `device,${fields}` : fields;
+        params.fields = !device && !effectiveGroupBy && !hasDevice ? `device,${fields}` : fields;
     }
 
     const url = device
-        ? `/v3/users/${apiUser}/devices/${device}/buckets/monitoring/data`
-        : `/v2/users/${apiUser}/buckets/monitoring/data`;
+        ? `${v3(user)}/devices/${device}/buckets/monitoring/data`
+        : `${v2(user)}/buckets/monitoring/data`;
 
     try {
         const res = await api.get(url, { params });

package/lib/paths.js

@@ -0,0 +1,32 @@
+// @ts-check
+import { resolveUser } from './config.js';
+
+/**
+ * Account-scoped base paths, one per API version.
+ *
+ * Every endpoint the CLI talks to hangs off `/v{N}/users/{account}`, and
+ * the account is the part that is easy to get wrong: leaving it out still
+ * produces a valid URL, one that works against your own account and fails
+ * only when acting on behalf of another — with a "not found" that points
+ * nowhere near the real problem. Building the prefix in one place keeps
+ * the account in the signature, where it is visible, and `tests/paths.test.js`
+ * fails the build if a module starts hand-rolling these again.
+ *
+ * Pass `user` to address another account; omit it for the active profile.
+ */
+export function v1(user) {
+    return `/v1/users/${resolveUser(user)}`;
+}
+
+export function v2(user) {
+    return `/v2/users/${resolveUser(user)}`;
+}
+
+export function v3(user) {
+    return `/v3/users/${resolveUser(user)}`;
+}
+
+/** `/v3/users/{account}/devices/{deviceId}` — the most common prefix. */
+export function device(user, deviceId) {
+    return `${v3(user)}/devices/${deviceId}`;
+}

package/lib/playbook/actions.js

@@ -30,7 +30,10 @@ const MAX_CAPTURED_STREAM_BYTES = 32 * 1024;
 
 function capStream(s) {
     if (typeof s !== 'string' || s.length <= MAX_CAPTURED_STREAM_BYTES) return s;
-    return s.slice(0, MAX_CAPTURED_STREAM_BYTES) + `\n…[truncated, ${s.length - MAX_CAPTURED_STREAM_BYTES} more bytes]`;
+    return (
+        s.slice(0, MAX_CAPTURED_STREAM_BYTES) +
+        `\n…[truncated, ${s.length - MAX_CAPTURED_STREAM_BYTES} more bytes]`
+    );
 }
 
 /** @type {Record<string, (ctx: any, params: any) => Promise<string | { summary: string, stdout?: string, stderr?: string, exitCode?: number }>>} */
@@ -123,16 +126,21 @@ export const HANDLERS = {
     },
 
     async property_set(ctx, params) {
-        await setDeviceProperty(ctx.deviceId, params.property, params.value);
+        await setDeviceProperty(ctx.deviceId, params.property, params.value, ctx.user);
         return `set ${params.property}`;
     },
 
     async resource(ctx, params) {
-        const result = await callDeviceResource(ctx.deviceId, params.resource, params.inputs || null);
+        const result = await callDeviceResource(
+            ctx.deviceId,
+            params.resource,
+            params.inputs || null,
+            {
+                user: ctx.user,
+            },
+        );
         const summary =
-            typeof result === 'string'
-                ? result.slice(0, 40)
-                : JSON.stringify(result).slice(0, 40);
+            typeof result === 'string' ? result.slice(0, 40) : JSON.stringify(result).slice(0, 40);
         return `resource ${params.resource} → ${summary}`;
     },
 
@@ -158,7 +166,7 @@ export const HANDLERS = {
         if (!/^[A-Za-z0-9._-]+$/.test(params.name)) {
             throw new Error(`invalid script name "${params.name}"`);
         }
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         const path = `${baseDir}/${params.name}`;
@@ -168,7 +176,7 @@ export const HANDLERS = {
             TIMEOUTS.SCRIPT_CHMOD_SECONDS,
         );
         if (chmod.retcode !== 0) throw new Error(`chmod failed: ${chmod.stderr || chmod.retcode}`);
-        await callDeviceResource(ctx.deviceId, '$scripts/reload', {});
+        await callDeviceResource(ctx.deviceId, '$scripts/reload', {}, { user: ctx.user });
         return `installed ${params.name}`;
     },
 
@@ -176,11 +184,11 @@ export const HANDLERS = {
         if (!/^[A-Za-z0-9._-]+$/.test(params.name)) {
             throw new Error(`invalid script name "${params.name}"`);
         }
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         await ctx.api.delete(`${baseDir}/${params.name}`, false);
-        await callDeviceResource(ctx.deviceId, '$scripts/reload', {});
+        await callDeviceResource(ctx.deviceId, '$scripts/reload', {}, { user: ctx.user });
         return `removed ${params.name}`;
     },
 };
@@ -221,10 +229,16 @@ export const CHECKERS = {
         try {
             const info = await ctx.api.info(params.source);
             const size = info?.size ?? '?';
-            return { status: 'changed', summary: `would pull ${params.source} (${size} bytes) → ${params.destination}` };
+            return {
+                status: 'changed',
+                summary: `would pull ${params.source} (${size} bytes) → ${params.destination}`,
+            };
         } catch (err) {
             if (err?.response?.status === 404) {
-                return { status: 'changed', summary: `source ${params.source} not found on device` };
+                return {
+                    status: 'changed',
+                    summary: `source ${params.source} not found on device`,
+                };
             }
             throw err;
         }
@@ -236,7 +250,7 @@ export const CHECKERS = {
         }
         const content = resolveWriteContent(params, ctx.baseDir);
         const localHash = sha256Hex(content);
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         const remotePath = `${baseDir}/${params.name}`;
@@ -261,7 +275,7 @@ export const CHECKERS = {
     async property_set(ctx, params) {
         let current;
         try {
-            current = await getDeviceProperty(ctx.deviceId, params.property);
+            current = await getDeviceProperty(ctx.deviceId, params.property, ctx.user);
         } catch (err) {
             if (err?.code === 'not_found') {
                 return { status: 'changed', summary: `create property ${params.property}` };
@@ -342,7 +356,8 @@ export const CHECKERS = {
         const upToDate = result?.status === 'up_to_date';
         return {
             status: upToDate ? 'unchanged' : 'changed',
-            summary: `update ${params.op}: ${result?.status || 'unknown'}` +
+            summary:
+                `update ${params.op}: ${result?.status || 'unknown'}` +
                 (result?.latest ? ` (latest=${result.latest})` : ''),
         };
     },
@@ -351,7 +366,7 @@ export const CHECKERS = {
         if (!/^[A-Za-z0-9._-]+$/.test(params.name)) {
             throw new Error(`invalid script name "${params.name}"`);
         }
-        const info = await readDeviceResource(ctx.deviceId, '$scripts/info');
+        const info = await readDeviceResource(ctx.deviceId, '$scripts/info', { user: ctx.user });
         const baseDir = info?.path;
         if (!baseDir) throw new Error('agent did not return a scripts directory');
         try {
@@ -396,7 +411,10 @@ async function hashCheck(api, path, contentBuffer) {
             return { status: 'changed', summary: `create ${path} (${contentBuffer.length} bytes)` };
         }
         if (err?.response?.status === 400) {
-            return { status: 'changed', summary: `${path} is not a regular file — would overwrite` };
+            return {
+                status: 'changed',
+                summary: `${path} is not a regular file — would overwrite`,
+            };
         }
         if (err?.response?.status === 405 || err?.response?.status === 501) {
             return { status: 'unknown', summary: 'agent lacks $fs/hash — cannot predict' };

package/lib/product.js

@@ -1,6 +1,5 @@
 import api from './api.js';
 import { apiError, inputError } from './errors.js';
-import { requireConfig } from './config.js';
 import {
     storageExists,
     createStorage,
@@ -12,6 +11,7 @@ import {
     deleteStorageFile,
 } from './storage.js';
 import { parsePlaybook } from './playbook/loader.js';
+import { v1 } from './paths.js';
 
 /**
  * Helpers for ThinRemote products and the product-script workflow.
@@ -28,14 +28,6 @@ import { parsePlaybook } from './playbook/loader.js';
  * sequence.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-
 // ─── Low-level: products ─────────────────────────────────────────────
 
 export async function getProducts(user) {

package/lib/profile.js

@@ -1,7 +1,7 @@
 // @ts-check
 import api from './api.js';
 import { apiError, inputError } from './errors.js';
-import { requireConfig } from './config.js';
+import { v1 } from './paths.js';
 
 /**
  * Helpers for product *profile* configuration.
@@ -68,14 +68,6 @@ import { requireConfig } from './config.js';
  * device code change.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-
 // ─── Listener config validators ──────────────────────────────────────
 //
 // Each `data.source` shape (for buckets/properties) and each request

package/lib/property.js

@@ -1,28 +1,23 @@
-import { requireConfig } from './config.js';
+import { resolveUser } from './config.js';
+import { device } from './paths.js';
 import api from './api.js';
 import { apiError } from './errors.js';
 import { info, success } from './format.js';
 
-export async function getDeviceProperties(deviceId) {
-    const config = requireConfig();
-
+export async function getDeviceProperties(deviceId, user) {
     try {
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/properties`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/properties`);
         return response.data;
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${resolveUser(user)})`,
+        });
     }
 }
 
-export async function getDeviceProperty(deviceId, propertyId) {
-    const config = requireConfig();
-
+export async function getDeviceProperty(deviceId, propertyId, user) {
     try {
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/properties/${propertyId}`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/properties/${propertyId}`);
         return response.data.value;
     } catch (error) {
         throw apiError(error, {
@@ -33,17 +28,16 @@ export async function getDeviceProperty(deviceId, propertyId) {
 
 // PUT so the operation is idempotent — missing properties are created,
 // existing ones are overwritten wholesale.
-export async function setDeviceProperty(deviceId, propertyId, value) {
-    const config = requireConfig();
-
+export async function setDeviceProperty(deviceId, propertyId, value, user) {
     try {
-        const response = await api.put(
-            `/v3/users/${config.username}/devices/${deviceId}/properties/${propertyId}`,
-            { value },
-        );
+        const response = await api.put(`${device(user, deviceId)}/properties/${propertyId}`, {
+            value,
+        });
         return response.data;
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${resolveUser(user)})`,
+        });
     }
 }
 
@@ -59,11 +53,7 @@ export function formatDeviceProperties(deviceId, properties) {
 
 export function formatDeviceProperty(deviceId, propertyId, propertyValue) {
     let formattedValue =
-        '\nValue of property ' +
-        info(propertyId) +
-        ' for device ' +
-        info(deviceId) +
-        ':\n';
+        '\nValue of property ' + info(propertyId) + ' for device ' + info(deviceId) + ':\n';
     const flattenedValue = flatten(propertyValue);
     for (const key in flattenedValue) {
         formattedValue += `${key}: ${success(flattenedValue[key])}\n`;

package/lib/resource.js

@@ -1,4 +1,5 @@
-import { requireConfig } from './config.js';
+import { resolveUser } from './config.js';
+import { device } from './paths.js';
 import api from './api.js';
 import { apiError } from './errors.js';
 import { info, warning, hint } from './format.js';
@@ -6,20 +7,20 @@ import { info, warning, hint } from './format.js';
 // Drops internal resources whose keys start with `$`; those belong to
 // the agent's own framework (cmd, fs, scripts…) and shouldn't surface
 // through the user-facing resource list.
-export async function getDeviceResources(deviceId) {
-    const config = requireConfig();
+export async function getDeviceResources(deviceId, options = {}) {
+    const user = resolveUser(options.user);
 
     try {
         // `/resources/api` merges firmware resources with API resources
         // inherited from the product profile, which `/resources` alone omits.
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/api`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/resources/api`);
         return Object.fromEntries(
             Object.entries(response.data).filter(([key]) => !key.startsWith('$')),
         );
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${user})`,
+        });
     }
 }
 
@@ -28,16 +29,14 @@ export async function getDeviceResources(deviceId) {
  * output-only (fn=3) or fn=4 resources when you only want the latest
  * sample, not to trigger the input side.
  */
-export async function readDeviceResource(deviceId, resourceId) {
-    const config = requireConfig();
+export async function readDeviceResource(deviceId, resourceId, options = {}) {
+    const user = resolveUser(options.user);
     try {
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/${resourceId}`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/resources/${resourceId}`);
         return response.data;
     } catch (error) {
         throw apiError(error, {
-            notFound: `Resource not found: ${resourceId} on device ${deviceId}`,
+            notFound: `Resource not found: ${resourceId} on device ${deviceId} (account ${user})`,
         });
     }
 }
@@ -51,32 +50,30 @@ export async function readDeviceResource(deviceId, resourceId) {
  * return `in`; fn=1 may return an empty object. Not every agent/firmware
  * exposes /api — callers should tolerate 404/501.
  */
-export async function getDeviceResourceApi(deviceId, resourceId) {
-    const config = requireConfig();
+export async function getDeviceResourceApi(deviceId, resourceId, options = {}) {
+    const user = resolveUser(options.user);
     try {
-        const response = await api.get(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/${resourceId}/api`,
-        );
+        const response = await api.get(`${device(user, deviceId)}/resources/${resourceId}/api`);
         return response.data;
     } catch (error) {
         throw apiError(error, {
-            notFound: `Resource not found: ${resourceId} on device ${deviceId}`,
+            notFound: `Resource not found: ${resourceId} on device ${deviceId} (account ${user})`,
         });
     }
 }
 
-export async function executeDeviceResource(deviceId, resourceId, inputs) {
-    const config = requireConfig();
+export async function executeDeviceResource(deviceId, resourceId, inputs, options = {}) {
+    const user = resolveUser(options.user);
 
     try {
         const response = await api.post(
-            `/v3/users/${config.username}/devices/${deviceId}/resources/${resourceId}`,
+            `${device(user, deviceId)}/resources/${resourceId}`,
             inputs,
         );
         return response.data;
     } catch (error) {
         throw apiError(error, {
-            notFound: `Resource not found: ${resourceId} on device ${deviceId}`,
+            notFound: `Resource not found: ${resourceId} on device ${deviceId} (account ${user})`,
         });
     }
 }
@@ -87,14 +84,14 @@ export async function executeDeviceResource(deviceId, resourceId, inputs) {
  * the output side of fn=3/4 resources without triggering the input
  * handler. Otherwise POST with the payload.
  */
-export async function callDeviceResource(deviceId, resourceId, inputs) {
+export async function callDeviceResource(deviceId, resourceId, inputs, options = {}) {
     const hasInputs =
         inputs !== undefined &&
         inputs !== null &&
         !(typeof inputs === 'object' && !Array.isArray(inputs) && Object.keys(inputs).length === 0);
     return hasInputs
-        ? executeDeviceResource(deviceId, resourceId, inputs)
-        : readDeviceResource(deviceId, resourceId);
+        ? executeDeviceResource(deviceId, resourceId, inputs, options)
+        : readDeviceResource(deviceId, resourceId, options);
 }
 
 /**
@@ -102,14 +99,14 @@ export async function callDeviceResource(deviceId, resourceId, inputs) {
  * `/api` schema. Returns an array with `{name, fn, in?, out?}` so both
  * the CLI and the MCP can render the same information.
  */
-export async function listDeviceResourcesWithSchemas(deviceId) {
-    const resources = await getDeviceResources(deviceId);
+export async function listDeviceResourcesWithSchemas(deviceId, options = {}) {
+    const resources = await getDeviceResources(deviceId, options);
     const names = Object.keys(resources);
     const entries = await Promise.all(
         names.map(async (name) => {
             const fn = resources[name]?.fn;
             try {
-                const schema = await getDeviceResourceApi(deviceId, name);
+                const schema = await getDeviceResourceApi(deviceId, name, options);
                 return { name, fn, ...schema };
             } catch {
                 return { name, fn };

package/lib/status.js

@@ -1,29 +1,23 @@
-import { requireConfig } from './config.js';
+import { resolveUser } from './config.js';
+import { v1 } from './paths.js';
 import api from './api.js';
 import { apiError } from './errors.js';
-import {
-    formatUptime,
-    colorPct,
-    formatBytes,
-    label,
-    muted,
-    success,
-    error,
-} from './format.js';
+import { formatUptime, colorPct, formatBytes, label, muted, success, error } from './format.js';
 
 /**
  * Get device status
  * @param {string} deviceId - Device ID to check
+ * @param {string} [user] - Account that owns the device (defaults to the active profile)
  * @returns {Promise<Object>} Status information
  */
-export async function getDeviceStatus(deviceId) {
-    const config = requireConfig();
-
+export async function getDeviceStatus(deviceId, user) {
     try {
-        const response = await api.get(`/v1/users/${config.username}/devices/${deviceId}/stats`);
+        const response = await api.get(`${v1(user)}/devices/${deviceId}/stats`);
         return response.data;
     } catch (error) {
-        throw apiError(error, { notFound: `Device not found: ${deviceId}` });
+        throw apiError(error, {
+            notFound: `Device not found: ${deviceId} (account ${resolveUser(user)})`,
+        });
     }
 }
 
@@ -80,17 +74,13 @@ export function formatDeviceStatus(deviceId, status, monitoring = null) {
             const root = monitoring.disk.root;
             const detail =
                 root.available != null && root.total != null
-                    ? muted(
-                          ` (${formatBytes(root.available)} free of ${formatBytes(root.total)})`,
-                      )
+                    ? muted(` (${formatBytes(root.available)} free of ${formatBytes(root.total)})`)
                     : '';
             lines.push(`  Disk:    ${colorPct(root.usage)}${detail}`);
         }
         if (monitoring.load) {
             const l = monitoring.load;
-            const parts = [l['1m'], l['5m'], l['15m']].map((v) =>
-                v != null ? v.toFixed(2) : '—',
-            );
+            const parts = [l['1m'], l['5m'], l['15m']].map((v) => (v != null ? v.toFixed(2) : '—'));
             lines.push(`  Load:    ${parts.join(' · ')}`);
         }
         if (monitoring.uptime != null) {

package/lib/storage.js

@@ -1,6 +1,6 @@
 import api from './api.js';
 import { apiError } from './errors.js';
-import { requireConfig } from './config.js';
+import { v1, v2 } from './paths.js';
 
 /**
  * Helpers for ThinRemote file storages — independent buckets that the
@@ -13,17 +13,6 @@ import { requireConfig } from './config.js';
  * so orchestration code can stay branch-light.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-function v2(user) {
-    return `/v2/users/${resolveUser(user)}`;
-}
-
 export async function getStorage(storageId, user) {
     try {
         const res = await api.get(`${v1(user)}/storages/${storageId}`);

package/lib/tokens.js

@@ -1,7 +1,7 @@
 // @ts-check
 import api from './api.js';
 import { apiError, inputError } from './errors.js';
-import { requireConfig } from './config.js';
+import { v1 } from './paths.js';
 
 /**
  * Helpers for ThinRemote access tokens — both user-level (broad scope,
@@ -60,14 +60,6 @@ import { requireConfig } from './config.js';
  * it.
  */
 
-function resolveUser(user) {
-    return user || requireConfig().username;
-}
-
-function v1(user) {
-    return `/v1/users/${resolveUser(user)}`;
-}
-
 // ─── Duration helpers ───────────────────────────────────────────────
 
 const DURATION_RE = /^(\d+)([smhdwy])$/;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@thinremote/thinr-cli",
-    "version": "1.3.0",
+    "version": "1.3.2",
     "description": "CLI for ThinRemote — remote management for IoT devices, with an MCP server for AI clients",
     "main": "bin/thinr.js",
     "bin": {