@tokenoftrust/cli 1.4.0-rc.0 → 1.4.0-rc.1

package/README.md

@@ -46,18 +46,24 @@ The same `tot` does the right thing wherever you run it (walks up like `git`):
 - Not signed in? On a terminal, `tot start` / `tot checkout` **offer to sign you in right there** and continue in-flow — no "run `tot login`, then re-run".
 - The old operator env-triple (`TOT_API_KEY` / `TOT_SECRET_KEY` / `TOT_APP_DOMAIN`) **no longer signs the CLI in** — tot-mcp went OAuth-first on 2026-07-23. If those vars are set, `tot` prints a one-line advisory and uses your `tot login` session anyway; it never reads them for auth.
 
-### Multiple identities at once (`TOT_PROFILE`)
+### Optional: multiple identities at once (`TOT_PROFILE`)
 
-One credential file = one active identity, so a plain `tot login` replaces the previous session. To keep **different identities live in different terminals** — e.g. a staff `@tokenoftrust.com` sign-in in one shell and a plain developer identity in another — set a profile per shell:
+**Most people never set this** — the single default session is all you need, and a plain `tot login` just replaces it. Reach for a profile only when you want **more than one identity live at the same time**: a staff `@tokenoftrust.com` sign-in alongside a plain developer one, or many parallel test identities. Set it per shell and each gets its own credential file under `~/.tot` (the renderer cache and everything else stay shared):
 
 ```
-# terminal A
-export TOT_PROFILE=staff && tot login
-# terminal B
-export TOT_PROFILE=dev   && tot login
+# terminal A                     # terminal B
+export TOT_PROFILE=staff         export TOT_PROFILE=dev
+tot login                        tot login
 ```
 
-Each profile gets its own `~/.tot/credentials.<profile>.json` (the renderer cache and everything else stay shared). Unset → the default session, unchanged. `tot whoami` shows the active profile.
+The value is an **opaque label** — any string works, so it's easy to script parallel identities:
+
+```
+export TOT_PROFILE=$(uuidgen)    # a fresh isolated identity per terminal / test worker
+tot login
+```
+
+A clean short name (`staff`, `dev`, `test-7`) becomes a readable `credentials.<name>.json`; any other value (symbols, uppercase, long) is hashed to a stable `credentials.h<hash>.json` — so an arbitrary id never collides or escapes `~/.tot`. Unset → the default session, unchanged. `tot whoami` shows the active profile.
 
 ## Design notes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "1.4.0-rc.0",
+  "version": "1.4.0-rc.1",
   "description": "Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/token-store.mjs

@@ -30,36 +30,59 @@
  *
  * `TOT_HOME` overrides the home dir (used by tests to point at a temp dir).
  *
- * PROFILES (`TOT_PROFILE`): single-plane auth means one active identity per
- * credential file, so to keep DIFFERENT identities live at once — e.g. a staff
- * `@tokenoftrust.com` sign-in in one terminal and a plain developer identity in
- * another — export a profile per shell (`export TOT_PROFILE=staff` / `=dev`).
- * Each profile gets its OWN `credentials.<profile>.json` under the same `~/.tot`
- * (the renderer cache, last-tenant, etc. stay shared — only the identity splits).
- * Unset → the default `credentials.json`, so existing sessions are untouched.
+ * PROFILES (`TOT_PROFILE`) — OPTIONAL, for parallel work. Almost every developer
+ * leaves this UNSET and uses the single default `credentials.json` — that path is
+ * unchanged and is the norm. It exists only when you want MORE THAN ONE identity
+ * live at once (a staff `@tokenoftrust.com` sign-in and a plain developer one, or
+ * many parallel test identities): export a profile per shell and each gets its OWN
+ * credential file under the same `~/.tot` (the renderer cache, last-tenant, etc.
+ * stay shared — only the identity splits). The value is an OPAQUE label — any
+ * string works, so `export TOT_PROFILE=$(uuidgen)` per terminal/test is fine:
+ *   - a clean short token (`staff`, `dev`, `test-7`) is used verbatim for a
+ *     readable `credentials.<profile>.json`;
+ *   - any other value (symbols, uppercase, long) is HASHED to a stable, safe
+ *     `credentials.h<hash>.json` — so an arbitrary opaque id can never collide
+ *     with another or escape `~/.tot`, while `tot whoami` still shows what you set.
  */
 import {
   readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, existsSync, rmSync,
 } from "node:fs";
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import { join, dirname } from "node:path";
 
+/** A short token safe to drop straight into a filename (readable profiles). */
+const CLEAN_PROFILE_RE = /^[a-z0-9_-]{1,64}$/;
+
 /**
- * The active credential profile from `TOT_PROFILE`, sanitized to a safe filename
- * token (`[a-z0-9_-]`, lowercased, ≤64 chars), or null for the default
- * (unnamespaced) session. Sanitizing — not just trusting the value — keeps a
- * stray `/` or `..` from ever escaping the `~/.tot` dir.
+ * The active profile's DISPLAY label — the raw `TOT_PROFILE`, trimmed — or null
+ * when unset. This is what `tot whoami` shows; it is NOT the filename (see
+ * profileSlug, which makes any value filesystem-safe).
  */
 export function activeProfile(env = process.env) {
-  const safe = String(env.TOT_PROFILE || "").trim().toLowerCase().replace(/[^a-z0-9_-]/g, "").slice(0, 64);
-  return safe || null;
+  return String(env.TOT_PROFILE || "").trim() || null;
+}
+
+/**
+ * The active profile's safe filename token, or null for the default session. A
+ * clean short label passes through verbatim (readable files); ANY other opaque
+ * value is hashed — collision-resistant and incapable of a `/` or `..` path
+ * escape, so `TOT_PROFILE` can be a literally arbitrary identifier. Hashing the
+ * RAW value (not a stripped form) keeps distinct tokens distinct.
+ */
+export function profileSlug(env = process.env) {
+  const raw = String(env.TOT_PROFILE || "").trim();
+  if (!raw) return null;
+  const lower = raw.toLowerCase();
+  if (CLEAN_PROFILE_RE.test(lower)) return lower;
+  return `h${createHash("sha256").update(raw).digest("hex").slice(0, 16)}`;
 }
 
 /** Absolute path to the credential file for this environment (+ TOT_PROFILE). */
 export function defaultCredentialsPath(env = process.env) {
   const home = env.TOT_HOME || homedir();
-  const profile = activeProfile(env);
-  return join(home, ".tot", profile ? `credentials.${profile}.json` : "credentials.json");
+  const slug = profileSlug(env);
+  return join(home, ".tot", slug ? `credentials.${slug}.json` : "credentials.json");
 }
 
 /**