@trusty-squire/mcp 1.1.13-rc.8 → 1.1.13

package/dist/install/cli.js

@@ -1,4 +1,11 @@
-// Setup CLI — connect / settings / logout / login subcommands.
+// Setup CLI — connect / settings / logout subcommands.
+//
+// `connect` is the ONE onboarding AND re-auth pathway. There is no separate
+// `login` command: it ran its Google OAuth through a CDP-attached Chrome,
+// which Google's "secure browser" check rejects (STATE.md 2026-07-20), and a
+// second command that could seed a provider session independently of the
+// account claim is exactly how an install ended up "connected" with no live
+// Google session.
 //
 //   npx @trusty-squire/mcp connect --target=claude-code
 //     Issues a machine token, then opens the trustysquire install-
@@ -8,19 +15,18 @@
 //           the user's account, and
 //       (b) the bot's Chrome profile gains a provider session it can
 //           ride on future signups (Resend, Postmark, etc.).
-//     One Google login, both jobs done.
+//     One Google login, both jobs done — and connect only reports success
+//     once it has re-probed the profile and seen that session LIVE.
 //
-//   npx @trusty-squire/mcp login [--provider=google|github]
-//     Add an additional provider session to the bot's profile. If you
-//     signed in to install with Google but want the bot to also sign
-//     you up via GitHub-only services, run this.
+//   npx @trusty-squire/mcp connect --force-relogin[=google|github]
+//     Re-auth. Clears the selected provider (or the whole profile) and
+//     re-runs the same ceremony. This replaces `login --provider=…`.
 //
 //   npx @trusty-squire/mcp logout
 //
 // Flags:
 //   --target=<agent>     skip auto-detection
 //   --api-base=<url>     override the API base URL
-//   --provider=google|github   choose provider for `login`
 //   --skip-browser       don't launch the bot's Chrome; just print the
 //                        confirm URL and expect the user to open it in
 //                        their own browser (CI / scripted installs)
@@ -38,9 +44,9 @@ import { installInitiate, installPoll, issueMachineToken } from "../api-client.j
 import { openSessionStorage } from "../session.js";
 import { AGENTS, detectInstalledAgents, writeClaudeCodePermissions, } from "./agents.js";
 import { detectAsn } from "../bot/index.js";
-import { detectActiveProviderSessions, ensureOAuthSession, openInstallConfirmInBotChrome, profileHasProviderCookies, } from "../bot/google-login.js";
-import { isOAuthProviderId } from "../bot/oauth-providers.js";
-import { clearAllProviderMarkers, clearBrowserProfile, clearProviderCookies, clearProviderLoggedIn, loggedInProviders, markProviderLoggedIn, } from "../bot/login-state.js";
+import { detectActiveProviderSessions, openInstallConfirmInBotChrome, } from "../bot/google-login.js";
+import {} from "../bot/oauth-providers.js";
+import { clearBrowserProfile, clearProviderCookies } from "../bot/login-state.js";
 import { CHROME_PROFILE_DIR, PROFILE_BUSY_MESSAGE, ProfileBusyError, profilePathIdentity, withProfileOperationGuard, } from "../bot/profile.js";
 import { VERSION } from "../version.js";
 import { ensureLatestVersion } from "./version-check.js";
@@ -60,16 +66,22 @@ function parseArgs(argv) {
     if (command === "install") {
         rejectDeprecatedCli("`install` has been removed. Use `npx @trusty-squire/mcp connect`.");
     }
+    if (command === "login") {
+        // ONE pathway. `login` seeded a provider session independently of the
+        // account claim (so an install could look connected with no live Google
+        // session) and drove Google's OAuth through CDP, which Google rejects.
+        rejectDeprecatedCli("`login` has been removed. Use `npx @trusty-squire/mcp connect` — " +
+            "add `--force-relogin=google` or `--force-relogin=github` to refresh one provider session.");
+    }
     let target;
     let apiBase = DEFAULT_API_BASE;
     let noRegistry = false;
     let registryConfigured = false;
-    let providerArg;
-    let profileDir;
     let skipBrowser = false;
     let forceRelogin = false;
     let forceReloginProvider;
     let noInteractive = false;
+    let account;
     for (const arg of argv) {
         if (arg.startsWith("--target=")) {
             const t = arg.slice("--target=".length);
@@ -96,12 +108,21 @@ function parseArgs(argv) {
             rejectDeprecatedCli("`--registry` has been removed because the managed registry is enabled by default.");
         }
         else if (arg.startsWith("--provider=")) {
-            const p = arg.slice("--provider=".length);
-            if (p === "google" || p === "github")
-                providerArg = p;
+            rejectDeprecatedCli("`--provider` has been removed with `login`. Use `connect --force-relogin=google|github`.");
+        }
+        else if (arg.startsWith("--account=")) {
+            // An empty value must not fall through to "the most recent account":
+            // silently clearing a different account than the one named is the
+            // silent-destruction class this whole change removes.
+            const value = arg.slice("--account=".length).trim();
+            if (value.length === 0) {
+                console.error("--account requires an account id (e.g. --account=01ABC...)");
+                process.exit(64);
+            }
+            account = value;
         }
         else if (arg.startsWith("--profile-dir=")) {
-            profileDir = arg.slice("--profile-dir=".length);
+            rejectDeprecatedCli("`--profile-dir` has been removed with `login`. `connect` always uses the bot's Chrome profile.");
         }
         else if (arg === "--skip-browser") {
             skipBrowser = true;
@@ -137,10 +158,12 @@ function parseArgs(argv) {
     };
     if (target !== undefined)
         args.target = target;
-    if (providerArg !== undefined)
-        args.providerArg = providerArg;
-    if (profileDir !== undefined && profileDir.length > 0)
-        args.profileDir = profileDir;
+    if (account !== undefined) {
+        if (account.length === 0) {
+            rejectDeprecatedCli("`--account` requires a non-empty account ID.");
+        }
+        args.account = account;
+    }
     return args;
 }
 function rejectDeprecatedCli(message) {
@@ -262,10 +285,7 @@ export async function runCli(argv) {
             await connect(args);
             return;
         case "logout":
-            await logout();
-            return;
-        case "login":
-            await login(args);
+            await logout(args);
             return;
         case "settings":
             await settings(args);
@@ -284,13 +304,11 @@ export async function runCli(argv) {
 // the install — the bot just won't have the Tier-3 solver. Runs after pairing,
 // so the session carries a usable agent_session_token. Clears args.twoCaptchaKey
 // on success so the secret doesn't linger in memory longer than needed.
-async function maybeStoreTwoCaptchaKey(args) {
+async function maybeStoreTwoCaptchaKey(args, session) {
     const key = args.twoCaptchaKey?.trim();
     if (key === undefined || key.length === 0)
         return;
-    const storage = await openSessionStorage();
-    const session = await storage.read();
-    if (session?.agent_session_token === undefined) {
+    if (session.agent_session_token === undefined) {
         ui.warn("Couldn't vault the 2Captcha key — no active session yet. Re-run connect to retry.");
         return;
     }
@@ -337,7 +355,7 @@ async function settings(args) {
         const picker = await runSettingsSetup({
             ...(args.target !== undefined ? { initialTarget: args.target } : {}),
             initialRegistryEnabled: session.consent_skillify_telemetry === true,
-            initialConsentOperatorInboxOtp: session.consent_operator_inbox_otp === true,
+            initialConsentOperatorInboxOtp: session.consent_operator_inbox_otp !== false,
         });
         args.target = picker.target;
         args.noRegistry = !picker.registryEnabled;
@@ -354,6 +372,9 @@ async function settings(args) {
         if (args.registryConfigured !== true) {
             args.noRegistry = session.consent_skillify_telemetry !== true;
         }
+        if (args.consentOperatorInboxOtp === undefined) {
+            args.consentOperatorInboxOtp = session.consent_operator_inbox_otp !== false;
+        }
     }
     const target = await resolveTarget(args.target);
     const agent = AGENTS[target];
@@ -361,11 +382,11 @@ async function settings(args) {
         ...session,
         saved_at: new Date().toISOString(),
         consent_skillify_telemetry: !args.noRegistry,
-        consent_operator_inbox_otp: args.consentOperatorInboxOtp === true,
+        consent_operator_inbox_otp: args.consentOperatorInboxOtp !== false,
     };
     await storage.write(updated);
-    await writeAgentConfig(target, agent, args);
-    await maybeStoreTwoCaptchaKey(args);
+    await writeAgentConfig(target, agent, args, updated);
+    await maybeStoreTwoCaptchaKey(args, updated);
     ui.success(`${agent.display_name} settings saved.`);
 }
 async function connect(args) {
@@ -426,15 +447,18 @@ async function connectWithProfileGuard(args, profileDir) {
     // browser confirm. Pass --force-relogin to bypass (e.g. to switch Google).
     if (!args.forceRelogin) {
         const preflight = await checkAlreadyProvisioned();
-        if (preflight !== null) {
+        if (preflight.kind !== "ceremony") {
             ui.divider();
             await hydrateArgsFromStoredPreferences(args);
             await ensureConsentRecorded(consentFromArgs(args), args.advancedConfigured === true);
-            await writeAgentConfig(target, agent, args);
-            await maybeStoreTwoCaptchaKey(args);
-            ui.success(`Already connected (${preflight.providers.join(" + ")}). ` +
-                `${agent.display_name} config refreshed.`);
-            printProviderState(preflight.providers);
+            if (preflight.kind === "unverified") {
+                await writeAgentConfig(target, agent, args, preflight.session);
+                await maybeStoreTwoCaptchaKey(args, preflight.session);
+                ui.warn(preflightUnverifiedMessage(preflight.detail));
+                ui.hint(`Close any other Trusty Squire session and re-run ` +
+                    `${ui.code("npx @trusty-squire/mcp connect --force-relogin")} to verify it.`);
+                return;
+            }
             // Backfill connected_providers from the bot-side marker on
             // pre-rc.5 sessions, so the preflight cache is current.
             for (const p of preflight.providers)
@@ -443,36 +467,31 @@ async function connectWithProfileGuard(args, profileDir) {
             // valid + bound, but if the bot's GitHub session validated DEAD, proactively
             // offer to reconnect it — a dead GitHub session is exactly why people re-run
             // connect (GitHub-OAuth signups fail). Skippable; non-interactive notices.
-            if (!preflight.providers.includes("github")) {
-                await offerGithubReloginIfDead(args, target, agent);
+            // Saying yes falls THROUGH into the same ceremony below rather than
+            // branching into a second sign-in command.
+            const reconnectGithub = !preflight.providers.includes("github") && (await offerGithubReloginIfDead(args));
+            if (!reconnectGithub) {
+                await writeAgentConfig(target, agent, args, preflight.session);
+                await maybeStoreTwoCaptchaKey(args, preflight.session);
+                ui.success(`Already connected (${preflight.providers.join(" + ")}). ` +
+                    `${agent.display_name} config refreshed.`);
+                printProviderState(preflight.providers);
+                ui.hint(`Pass ${ui.code("--force-relogin")} to switch accounts or to refresh a ` +
+                    `stale/expired session (this "connected" check reads cached cookies, ` +
+                    `which can outlive the real session).`);
+                return;
             }
-            ui.hint(`Pass ${ui.code("--force-relogin")} to switch accounts or to refresh a ` +
-                `stale/expired session (this "connected" check reads cached cookies, ` +
-                `which can outlive the real session).`);
-            return;
+            args.forceRelogin = true;
+            args.forceReloginProvider = "github";
         }
     }
     console.warn("");
     console.warn("Opening the Trusty Squire install page in a browser. " +
         "The page walks you through signing in with Google and (optionally) GitHub.");
-    // If the preflight keeps missing a valid session, connect re-opens this page
-    // every run. The usual cause on a headless box is an ephemeral OS keychain
-    // that doesn't persist the session between logins — point people at the
-    // durable file backend so they don't loop.
-    if ((await openSessionStorage()).backendName() === "keytar") {
-        ui.hint(`If ${ui.code("connect")} re-opens this page on every run, your OS keychain may not be ` +
-            `persisting the session. Set ${ui.code("TRUSTY_SQUIRE_SESSION_FILE=1")} (globally) to use a durable session file.`);
-    }
     // --force-relogin means "redo the OAuth dance from scratch". The scoped
     // form clears only one provider; bare --force-relogin is the full-profile
     // account-switch escape hatch.
     if (args.forceRelogin) {
-        if (args.forceReloginProvider !== undefined) {
-            clearProviderLoggedIn(args.forceReloginProvider, profileDir);
-        }
-        else {
-            clearAllProviderMarkers(profileDir);
-        }
         let cookiesCleared;
         if (args.forceReloginProvider !== undefined) {
             cookiesCleared = await clearProviderCookies(profileDir, args.forceReloginProvider);
@@ -487,21 +506,6 @@ async function connectWithProfileGuard(args, profileDir) {
             process.exit(1);
         }
     }
-    // Connect session validation: a SCOPED force-relogin=github on an
-    // already-bound account is a GitHub-only login — Google's gate is already
-    // satisfied (the account is bound + its session is what we'd re-bind), so we
-    // must NOT drag the Google-first account-binding confirm page into it. Route
-    // straight to the provider-scoped login (the `login --provider=github` path):
-    // it opens a GitHub-only login (account chooser, since cookies were cleared
-    // above), never touching Google. Falls through to the full confirm flow only
-    // when the account isn't bound yet (nothing to skip) or the scope is google
-    // (which can re-bind the account and so needs the claim).
-    if (args.forceReloginProvider === "github" && (await checkAlreadyBound())) {
-        const ok = await reloginGithubOnly(args, target, agent, { writeConfig: true });
-        if (ok)
-            return;
-        process.exit(1);
-    }
     const consent = consentFromArgs(args);
     // Detect egress class so the asn rides along in the install payload
     // (API uses it to correlate captcha failures with network class).
@@ -528,9 +532,9 @@ async function connectWithProfileGuard(args, profileDir) {
     if (asn !== null) {
         printAsnWarning(asn);
     }
-    // Browser confirm: bind this machine + seed the bot's Chrome.
+    // Browser confirm: bind this machine in the bot's real Chrome profile.
     // The user signs into trustysquire from inside the bot's persistent
-    // Chrome profile (with display, or noVNC on a headless box). That
+    // Chrome profile on a visible display. That
     // single sign-in does TWO things at once: trustysquire claims the
     // install (sets agent_session_token), AND the provider session
     // lands in the bot's Chrome profile so future OAuth-based signups
@@ -544,7 +548,6 @@ async function connectWithProfileGuard(args, profileDir) {
     };
     const session = await runInstallClaim(args.apiBase, target, baseSession, args.skipBrowser, {
         applyServerPrefs: !wantInteractive,
-        ...connectCompletionOptions(args),
     });
     if (session === null) {
         ui.fail(`Install didn't complete — browser confirm never finished. ` +
@@ -553,56 +556,40 @@ async function connectWithProfileGuard(args, profileDir) {
     }
     const storage = await openSessionStorage();
     await storage.write(session);
-    ui.success(`Session saved (${storage.backendName()})`);
+    ui.success(`Session saved (${storage.path})`);
     args.noRegistry = session.consent_skillify_telemetry !== true;
-    args.consentOperatorInboxOtp = session.consent_operator_inbox_otp === true;
-    // 0.8.1 — the bot's persistent profile may have a stale provider
-    // marker from a previous install (the marker is sticky on disk).
-    // The install confirm above only seeded one provider (whichever
-    // OAuth button the user clicked on trustysquire.com), so trusting
-    // the marker would make the step-2 secondary-provider prompt
-    // short-circuit incorrectly. Probe live cookies + rewrite the
-    // marker so loggedInProviders() returns ground truth.
+    args.consentOperatorInboxOtp = session.consent_operator_inbox_otp !== false;
+    // Probe the real profile. Cookie/session state is the source of truth; no
+    // persisted provider marker is allowed to outlive the session it describes.
+    // This probe is also the SUCCESS GATE: the machine claim alone proves the
+    // account plumbing, not that the bot can wear the user's identity at a third-
+    // party site. `null` means the probe itself failed, which is not a pass.
+    let providers = null;
     try {
-        const actual = await ui.withSpinner({
+        providers = await ui.withSpinner({
             start: "Checking provider sessions",
             done: "Provider sessions checked",
-            fail: () => "Provider session check failed (continuing)",
+            fail: () => "Provider session check failed",
             // validate=true: confirm each session is LIVE (not just cookie-present),
             // so a dead-but-present GitHub session isn't shown as connected.
             task: () => detectActiveProviderSessions(),
         });
-        if (actual !== null) {
-            clearAllProviderMarkers();
-            for (const p of actual)
-                markProviderLoggedIn(p);
-        }
     }
     catch (err) {
-        // Best-effort: a probe failure (rare — playwright launch should
-        // succeed if the install confirm just opened Chrome there) just
-        // leaves the marker as-is. The downstream secondary prompt's
-        // logic still has the maybeOfferSecondaryProvider escape hatch
-        // (yes/no prompt with the default-yes), so the user can still
-        // reach GitHub even if we mis-identified the live state.
-        //
-        // Surface the reason on stderr so this never recurs invisibly: the
-        // empty catch once hid a launch error (probe missing channel:"chrome",
-        // reaching for an absent bundled Chromium) behind the bare "(continuing)"
-        // ✗ for months, while the stale marker still printed "connected".
         console.error(`[connect] provider-session probe failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    // Backfill connected_providers from the (now-fresh) bot-side marker.
-    const providers = loggedInProviders();
-    for (const p of providers)
+    // Persist the current live probe only as connect UX data.
+    for (const p of providers ?? [])
         await recordConnectedProvider(p);
-    printProviderState(providers);
-    await writeAgentConfig(target, agent, args);
-    await maybeStoreTwoCaptchaKey(args);
-    if (args.skipBrowser) {
-        ui.panel(`--skip-browser was set, so the bot's Chrome didn't observe your sign-in.\n` +
-            `Before your first OAuth signup, run:\n` +
-            `  ${ui.code("npx @trusty-squire/mcp login [--provider=google|github]")}`, { title: "Heads up", color: "yellow" });
+    printProviderState(providers ?? []);
+    // Config + key land either way: the session is real and re-running connect
+    // must be able to pick up from here. Only the SUCCESS claim is gated.
+    await writeAgentConfig(target, agent, args, session);
+    await maybeStoreTwoCaptchaKey(args, session);
+    const complete = decideConnectComplete(providers, args.forceReloginProvider);
+    if (!complete.ok) {
+        ui.fail(connectIncompleteMessage(complete.reason, args.skipBrowser));
+        process.exit(1);
     }
     // Visual consistency: when the picker was running, close with
     // clack's `outro` so the bookends match. The flag-driven path keeps
@@ -626,10 +613,10 @@ async function hydrateArgsFromStoredPreferences(args) {
         if (session === null)
             return;
         args.noRegistry = session.consent_skillify_telemetry !== true;
-        args.consentOperatorInboxOtp = session.consent_operator_inbox_otp === true;
+        args.consentOperatorInboxOtp = session.consent_operator_inbox_otp !== false;
     }
     catch {
-        // Best-effort. Missing preferences fall back to the privacy-safe defaults.
+        // Best-effort. Missing inbox preference uses the default-on setting.
     }
 }
 function printProviderState(providers) {
@@ -641,16 +628,17 @@ function printProviderState(providers) {
 //
 // Default path (`skipBrowser=false`): opens the trustysquire confirm
 // URL in the bot's OWN persistent Chrome profile. The user signs in
-// once — that single sign-in claims the install AND seeds the bot's
+// once — that single sign-in claims the install and establishes the bot's
 // profile with a provider session for future OAuth signups. The
 // pollUntilClaimed callback closes the Chrome window as soon as the
 // API flips the install to claimed.
 //
 // Fallback (`skipBrowser=true`): prints the URL, attempts a best-
 // effort `open()` to the user's default browser, polls the API for
-// claim. The bot's Chrome never starts, so the bot won't have a
-// provider session afterwards — the user must run `mcp login` before
-// their first OAuth signup. This path is for CI / scripted installs.
+// claim. If that ceremony leaves no live provider session in the bot's Chrome,
+// connect's success gate reports the install as incomplete rather than claiming
+// an OAuth-capable install. This path is for CI / scripted installs that only
+// need the config written.
 // True when the local session + bot profile already carry everything
 // connect would establish. Returns the list of confirmed provider sessions, or
 // null when anything's missing. Best-effort: any read/probe error returns null
@@ -698,6 +686,70 @@ export function decideProvisioned(session, tokenValid, providers) {
         return null;
     return { providers };
 }
+export function decideConnectPreflight(session, tokenValid, providers) {
+    if (session === null ||
+        session.machine_token === undefined ||
+        session.agent_session_token === undefined ||
+        session.account_id === undefined) {
+        return { kind: "ceremony" };
+    }
+    // Deliberately precede probe-null: an expired agent token must re-pair, not
+    // silently refresh config into an install that 401s on every MCP call.
+    // Do not flip this ordering.
+    if (!tokenValid)
+        return { kind: "ceremony" };
+    if (providers === null)
+        return { kind: "unverified" };
+    const provisioned = decideProvisioned(session, tokenValid, providers);
+    return provisioned === null
+        ? { kind: "ceremony" }
+        : { kind: "provisioned", providers: provisioned.providers };
+}
+// Pure SUCCESS GATE for a connect run that went through the ceremony. The
+// machine claim is not the product: an install is only connected when the
+// bot's Chrome profile holds a session it can wear at third-party sites, and
+// the only thing that proves it is the post-ceremony LIVE probe. `providers`
+// is null when that probe failed, which fails closed — an unverifiable session
+// must never be reported as connected (that is how connect used to print
+// "Squire on duty" over an install with no Google session at all).
+export function decideConnectComplete(providers, requestedProvider) {
+    if (providers === null)
+        return { ok: false, reason: "probe_failed" };
+    if (!providers.includes("google"))
+        return { ok: false, reason: "no_google_session" };
+    // A scoped --force-relogin=<provider> is an explicit ask; silently landing
+    // only Google would report success for work the user didn't get.
+    if (requestedProvider !== undefined && !providers.includes(requestedProvider)) {
+        return { ok: false, reason: "requested_provider_missing" };
+    }
+    return { ok: true };
+}
+export function connectIncompleteMessage(reason, skipBrowser) {
+    const retry = "npx @trusty-squire/mcp connect --force-relogin";
+    const skipBrowserNote = skipBrowser
+        ? " --skip-browser signs you in outside the bot's Chrome, so its profile never " +
+            "gains the session; re-run connect without it on a machine with a display " +
+            "(headless hosts get a noVNC URL)."
+        : "";
+    switch (reason) {
+        case "probe_failed":
+            return (`This machine is bound to your account, but I couldn't verify a live Google session ` +
+                `in the bot's Chrome profile, so I won't call this connected. ` +
+                `Close any other Trusty Squire session and re-run ${retry}.`);
+        case "no_google_session":
+            return (`This machine is bound to your account, but the bot's Chrome profile has no live ` +
+                `Google session, so the operator cannot act as you.${skipBrowserNote} ` +
+                `Re-run ${retry}.`);
+        case "requested_provider_missing":
+            return (`This machine is connected, but the provider sign-in you asked to refresh didn't ` +
+                `complete. Re-run ${retry}=github and finish the GitHub step in the browser.`);
+    }
+}
+export function preflightUnverifiedMessage(detail) {
+    return (`This machine is bound to your account, but I couldn't verify a live provider session ` +
+        `in the bot's Chrome profile (${detail}), so I won't call this connected. ` +
+        `Your agent config was refreshed.`);
+}
 async function checkAlreadyProvisioned() {
     try {
         const storage = await openSessionStorage();
@@ -708,7 +760,7 @@ async function checkAlreadyProvisioned() {
             session.machine_token === undefined ||
             session.agent_session_token === undefined ||
             session.account_id === undefined) {
-            return null;
+            return { kind: "ceremony" };
         }
         // Don't short-circuit on a present-but-expired token — re-pair.
         const stillValid = await agentTokenStillValid(session.api_base_url, session.agent_session_token);
@@ -718,81 +770,45 @@ async function checkAlreadyProvisioned() {
         // ability to wear the user's Google identity. validate=true so a dead-but-
         // present GitHub session isn't persisted into connected_providers.
         //
-        // BUT a BUSY profile (another Chromium already using it — a live operate
-        // session, a background heal run, an orphaned Chrome) makes the probe throw.
-        // That must NOT read as "not provisioned": forcing a re-pair (the noVNC
-        // dance) on a transient lock is the connect-loops-forever bug. Fall back to
-        // the session's cached connected_providers instead — a busy profile, if
-        // anything, means the bot IS wearing its browser session.
+        // A busy profile or any other probe failure must not force a re-pair: that
+        // is the connect-loops-forever bug. It also must not become a connected
+        // claim based on cached markers, because only a live probe proves the
+        // provider session. Refresh config with an explicit unverified warning.
         let providers;
         try {
             providers = await detectActiveProviderSessions();
             await syncConnectedProviders(providers);
         }
-        catch {
-            providers = (session.connected_providers ?? []).filter(isOAuthProviderId);
-        }
-        return decideProvisioned(session, stillValid, providers);
-    }
-    catch {
-        return null;
-    }
-}
-// Is the account already BOUND? — a valid session (machine + agent token +
-// account id) whose agent token still validates. Unlike checkAlreadyProvisioned
-// this does NOT require a live Google session: it answers "is the install
-// claimed to an account", which is what a scoped GitHub force-relogin needs to
-// know it can skip the Google-binding confirm page.
-async function checkAlreadyBound() {
-    try {
-        const storage = await openSessionStorage();
-        const session = await storage.read();
-        if (session === null ||
-            session.machine_token === undefined ||
-            session.agent_session_token === undefined ||
-            session.account_id === undefined) {
-            return false;
+        catch (err) {
+            const preflight = decideConnectPreflight(session, stillValid, null);
+            if (preflight.kind === "unverified") {
+                return {
+                    kind: "unverified",
+                    detail: err instanceof Error ? err.message : String(err),
+                    session,
+                };
+            }
+            return preflight;
         }
-        return await agentTokenStillValid(session.api_base_url, session.agent_session_token);
+        const preflight = decideConnectPreflight(session, stillValid, providers);
+        return preflight.kind === "provisioned" ? { ...preflight, session } : preflight;
     }
     catch {
-        return false;
-    }
-}
-// A GitHub-only login in the bot's profile (the provider-scoped path) — clears
-// the GitHub session and opens a fresh GitHub login (account chooser). Used by
-// `--force-relogin=github` and by the proactive prompt when connect detects a
-// dead GitHub session. Returns true on success.
-async function reloginGithubOnly(args, target, agent, opts) {
-    ui.heading("Sign in to GitHub");
-    clearProviderLoggedIn("github");
-    const result = await ensureOAuthSession({
-        provider: "github",
-        apiBaseUrl: args.apiBase,
-        forceOpen: true,
-    });
-    if (result.status === "logged_in" || result.status === "already_valid") {
-        await recordConnectedProvider("github");
-        if (opts.writeConfig)
-            await writeAgentConfig(target, agent, args);
-        ui.success("Signed in to GitHub. The bot is ready.");
-        return true;
+        return { kind: "ceremony" };
     }
-    ui.fail(result.status === "timeout"
-        ? "GitHub sign-in timed out."
-        : `GitHub sign-in failed: ${result.detail ?? "unknown error"}`);
-    return false;
 }
 // Connect short-circuited (Google valid + bound) but the bot's GitHub session
 // validated DEAD. GitHub is optional, but a dead session is exactly why a user
 // re-runs connect (GitHub-OAuth signups were failing), so PROACTIVELY offer to
-// fix it rather than just noticing. Skippable; non-interactive falls back to a
-// notice so scripted installs never block.
-async function offerGithubReloginIfDead(args, target, agent) {
+// fix it rather than just noticing. Returns true when the caller should fall
+// through into the normal ceremony with a GitHub-scoped relogin — there is one
+// sign-in pathway, so "yes" continues this run rather than starting a second
+// command. Skippable; non-interactive notices so scripted installs never block.
+async function offerGithubReloginIfDead(args) {
     const reconnectHint = `run ${ui.code("npx @trusty-squire/mcp connect --force-relogin=github")} when a service needs GitHub`;
     if (process.stdout.isTTY !== true || args.noInteractive) {
         ui.hint(`GitHub session is not active — ${reconnectHint}.`);
-        return;
+        return false;
     }
     const answer = await confirm({
         message: "Your GitHub session looks dead (GitHub-only signups will fail). Reconnect GitHub now?",
@@ -800,14 +816,11 @@ async function offerGithubReloginIfDead(args, target, agent) {
     });
     if (isCancel(answer) || answer !== true) {
         ui.hint(`Skipped GitHub — ${reconnectHint}.`);
-        return;
+        return false;
     }
-    await reloginGithubOnly(args, target, agent, { writeConfig: false });
+    return true;
 }
 async function syncConnectedProviders(providers) {
-    clearAllProviderMarkers();
-    for (const p of providers)
-        markProviderLoggedIn(p);
     try {
         const storage = await openSessionStorage();
         const session = await storage.read();
@@ -821,13 +834,13 @@ async function syncConnectedProviders(providers) {
     }
     catch {
         // Best-effort — marker/session drift only affects fast-path UX. The next
-        // connect/login/provision probe can repair it.
+        // connect or provision probe can repair it.
     }
 }
 // Persist `provider` into session.connected_providers (idempotent).
-// Called after a successful ensureOAuthSession so the install
-// preflight on the next run can read both providers off the session
-// file without having to load the bot's profile-dir marker.
+// Called after a successful live provider probe so the install preflight on the
+// next run can read both providers from the session file without loading a
+// profile-dir marker.
 async function recordConnectedProvider(provider) {
     try {
         const storage = await openSessionStorage();
@@ -855,7 +868,7 @@ async function recordConnectedProvider(provider) {
 function consentFromArgs(args) {
     return {
         skillifyTelemetry: !args.noRegistry,
-        operatorInboxOtp: args.consentOperatorInboxOtp === true,
+        operatorInboxOtp: args.consentOperatorInboxOtp !== false,
     };
 }
 async function ensureConsentRecorded(consent, overwrite) {
@@ -877,21 +890,28 @@ async function ensureConsentRecorded(consent, overwrite) {
         });
     }
     catch {
-        // Best-effort. If we can't persist consent, runtime treats missing
-        // fields as not approved.
+        // Best-effort. Missing preferences use the runtime default (inbox reads on).
     }
 }
 // Writes the host agent's MCP config — extracted so both the normal
 // install path and the preflight-already-provisioned shortcut share
 // one implementation.
-async function writeAgentConfig(target, agent, args) {
+async function writeAgentConfig(target, agent, args, session) {
     // Tokens themselves are NOT in the env — the MCP server reads them
-    // from session storage (keychain / file), which keeps them out of
+    // from the account's 0600 JSON session file, which keeps them out of
     // any child-process listing or shell history.
     const launch = resolveServerLaunch();
     const env = {
         TRUSTY_SQUIRE_AGENT_IDENTITY: target,
     };
+    // Which account this host agent's server serves. Sessions are stored one per
+    // account, so pinning it here is what keeps an ALREADY-RUNNING server on the
+    // account it was launched for after someone connects a different one: the old
+    // process keeps its launch env, the new config names the new account.
+    const boundAccount = session.account_id;
+    if (boundAccount !== undefined && boundAccount.length > 0) {
+        env.TRUSTY_SQUIRE_ACCOUNT_ID = boundAccount;
+    }
     // Skill registry URL. The endpoint is not user-configurable; Advanced setup
     // controls whether it is written at all. Registry participation is also the
     // user's consent to contribute successful non-personal signup recipes.
@@ -920,32 +940,12 @@ async function writeAgentConfig(target, agent, args) {
             "(no shared skill replay).");
     }
 }
-// First-time setup stays open after the account claim so the user can finish
-// optional setup. A forced re-login has no remaining onboarding contract — but
-// the account claim (agent token) is NOT the end of the interactive sign-in.
-// The API flips to `claimed` the moment the OAuth identity lands, which on a
-// cold profile is BEFORE the provider's browser session is fully seeded (Google
-// can still be mid-flow with a second cold-profile challenge). Tearing down on
-// the bare claim killed the noVNC out from under that challenge — the "two
-// number picks with a red-close between them" bug. So force-relogin now waits
-// for the requested provider's post-clear cookie presence before it closes;
-// neither an explicit terminal page nor another provider can substitute. The
-// deadline still bounds the wait.
-export function shouldCompleteInstallClaim(claimed, completeOnClaim, sessionSeeded, wizardCompleted = false) {
-    if (!claimed)
-        return false;
-    // A forced provider relogin is successful only when its provider-specific
-    // completion evidence arrives. Finish alone is not an override: the user may
-    // skip optional GitHub and still send the normal completion callback.
-    if (completeOnClaim)
-        return sessionSeeded;
-    return wizardCompleted;
-}
-export function connectCompletionOptions(args) {
-    return {
-        completeOnClaim: args.forceRelogin,
-        completionProvider: args.forceReloginProvider ?? "google",
-    };
+// The browser remains open until both the account claim and its explicit Finish
+// callback arrive. The callback is emitted after the visible browser flow
+// completes, so it works for onboarding and forced re-login without inspecting
+// Chrome's on-disk cookie database.
+export function shouldCompleteInstallClaim(claimed, wizardCompleted = false) {
+    return claimed && wizardCompleted;
 }
 // During normal onboarding, claim happens before the browser's Finish step.
 // Keep the terminal message aligned with that two-phase flow.
@@ -963,15 +963,9 @@ async function runInstallClaim(apiBase, target, baseSession, skipBrowser, option
     // check at the call site — bare closure-captured `let` doesn't.
     const state = { value: null };
     // The normal wizard's Finish button invokes the nonce-scoped loopback
-    // callback. First-time onboarding waits for that signal so the user gets a
-    // chance to complete optional setup. Forced re-login instead ends after the
-    // API claim and requested provider seed because no setup remains to wait for.
-    // Plain-login predicate: the connect claim browser runs plain (no CDP — a CDP
-    // attach fails Google's OAuth "secure browser" check). The API delivers the
-    // account claim, the SQLite cookie store proves a forced re-login landed,
-    // and a per-run loopback callback carries the normal wizard's explicit
-    // Finish signal.
-    const pollOnce = async (profileDir, wizardCompleted) => {
+    // callback. Every install path waits for it. Plain login deliberately has no
+    // CDP attach, so this callback is the sole browser-completion authority.
+    const pollOnce = async (wizardCompleted) => {
         let claimedThisPoll = false;
         // Keep state.value warm — the install moves to "claimed" the instant the
         // user finishes signing in.
@@ -991,22 +985,10 @@ async function runInstallClaim(apiBase, target, baseSession, skipBrowser, option
                 return "expired";
             }
         }
-        // Tear down once the account is claimed AND the provider session has
-        // actually seeded — not on the bare claim, which can land while Google is
-        // still writing cookies on a cold profile.
         const claimed = state.value !== null;
-        const sessionSeeded = claimed &&
-            options.completeOnClaim &&
-            profileHasProviderCookies(profileDir, options.completionProvider);
-        // No browser URL to watch in plain mode. Normal onboarding keys off the
-        // explicit loopback Finish callback; forced re-login finishes once its
-        // requested provider session is safely seeded.
-        const tearDown = shouldCompleteInstallClaim(claimed, options.completeOnClaim, sessionSeeded, wizardCompleted);
+        const tearDown = shouldCompleteInstallClaim(claimed, wizardCompleted);
         if (tearDown) {
-            return {
-                status: "claimed",
-                provider: options.completeOnClaim ? options.completionProvider : null,
-            };
+            return { status: "claimed", provider: null };
         }
         if (claimedThisPoll) {
             console.error(chalk.dim(`   ✓ ${claimHeartbeatMessage(true)}`));
@@ -1046,21 +1028,16 @@ async function runInstallClaim(apiBase, target, baseSession, skipBrowser, option
     }
     // Default: run the confirm INSIDE the bot's Chrome. The user signs
     // The wizard page reads provider state from /v1/auth/whoami so no
-    // CLI-side hint is needed. apiBaseUrl threads through to the
-    // headless rig so it can shorten the cloudflared tunnel URL to
-    // `trustysquire.ai/g/<slug>` before printing it in the banner (G15).
+    // CLI-side hint is needed.
     const result = await openInstallConfirmInBotChrome({
         confirmUrl: initiate.confirm_url,
         pollUntilClaimed: pollOnce,
-        apiBaseUrl: apiBase,
         heartbeatMessage: () => claimHeartbeatMessage(state.value !== null),
     });
     // rc.33 — surface the underlying error instead of letting the outer
     // wrapper print a generic "browser confirm step never finished."
-    // Most common case: a fresh headless box without the noVNC stack
-    // (x11vnc/novnc/websockify/cloudflared) — the runHeadlessChrome
-    // requireBinaries() throw already names the missing binaries and
-    // the apt-get install line, but the message was getting swallowed.
+    // Surface the underlying browser-launch error rather than replacing it
+    // with a generic confirmation timeout.
     if (result.status === "error") {
         ui.fail(`Couldn't open the confirm page: ${result.detail ?? "unknown error"}`);
         process.exit(1);
@@ -1087,7 +1064,7 @@ export function applyInstallPreferences(baseSession, preferences, applyServerPre
     return {
         ...baseSession,
         consent_skillify_telemetry: preferences.registry_enabled === true,
-        consent_operator_inbox_otp: preferences.consent_operator_inbox_otp === true,
+        consent_operator_inbox_otp: preferences.consent_operator_inbox_otp !== false,
     };
 }
 async function resolveTarget(explicit) {
@@ -1110,75 +1087,20 @@ async function resolveTarget(explicit) {
     }
     process.exit(2);
 }
-async function logout() {
+// Logs out ONE account — the one most recently connected, or `--account=<id>`.
+// Other accounts installed on this machine keep their sessions, and the servers
+// serving them keep working.
+async function logout(args) {
     const storage = await openSessionStorage();
-    await storage.clear();
-    console.warn(`✓ Cleared local session (${storage.backendName()}).`);
-}
-// Establish (or confirm) a provider session in the bot's persistent
-// Chrome profile — the one-time interactive login the OAuth-first
-// signup path needs. With a display this opens a Chrome window;
-// headless, it prints a URL to log in from any browser. Defaults to
-// Google; `login --provider=github` logs the same profile into GitHub.
-// Unlike the login stage inside `install`, this command fails loud on
-// timeout/error — it's the explicit retry path.
-async function login(args) {
-    const profileDir = args.profileDir ?? CHROME_PROFILE_DIR;
-    try {
-        await withProfileOperationGuard(profileDir, () => loginWithProfileGuard(args, profileDir));
-    }
-    catch (err) {
-        if (err instanceof ProfileBusyError) {
-            ui.fail(PROFILE_BUSY_MESSAGE);
-            process.exit(1);
-        }
-        throw err;
-    }
-}
-async function loginWithProfileGuard(args, profileDir) {
-    const provider = args.providerArg ?? args.forceReloginProvider ?? "google";
-    const label = provider === "github" ? "GitHub" : "Google";
-    ui.heading(`Sign in to ${label}`);
-    // --force-relogin wipes this provider's cookies (via forceOpen below),
-    // so drop its marker up front too. Otherwise a stale marker from a
-    // prior successful login survives a re-login that the user abandons or
-    // that times out (e.g. GitHub's 2FA "verify it's you" never finished) —
-    // leaving logged-in-providers.json claiming a session whose auth cookie
-    // (user_session) no longer exists. ensureOAuthSession re-adds the marker
-    // only when it confirms a live cookie, so success still records it.
-    if (args.forceRelogin)
-        clearProviderLoggedIn(provider, profileDir);
-    const result = await ensureOAuthSession({
-        provider,
-        apiBaseUrl: args.apiBase,
-        // --profile-dir pins login to an isolated profile (a secondary
-        // personal Google identity) instead of the shared bot profile.
-        ...(args.profileDir !== undefined ? { profileDir: args.profileDir } : {}),
-        // 0.8.3-rc.1 — --force-relogin now also applies to the bare
-        // `login` command. Without this, a valid cached session
-        // short-circuits the flow and the operator has no way to open
-        // the noVNC URL — even when the actual problem is a service-
-        // side challenge (GitHub's "verify it's you" / Google's device-
-        // prompt drift) that only an interactive browser session can
-        // clear.
-        ...(args.forceRelogin ? { forceOpen: true } : {}),
-    });
-    switch (result.status) {
-        case "already_valid":
-            await recordConnectedProvider(provider);
-            ui.success(`Already signed in to ${label}.`);
-            return;
-        case "logged_in":
-            await recordConnectedProvider(provider);
-            ui.success(`Signed in to ${label}. The bot is ready.`);
-            return;
-        case "timeout":
-            ui.fail(`Sign-in timed out. Retry: ${ui.code("npx @trusty-squire/mcp login")}`);
-            process.exit(1);
-        case "error":
-            ui.fail(`Sign-in failed: ${result.detail ?? "unknown error"}`);
-            process.exit(1);
+    const target = args.account ?? (await storage.currentAccountId());
+    if (target === null || (args.account !== undefined && (await storage.read(target)) === null)) {
+        console.warn("✓ No local session to clear.");
+        return;
     }
+    await storage.clear(target);
+    const remaining = await storage.listAccounts();
+    console.warn(`✓ Cleared local session for account ${target} (${storage.path}).` +
+        (remaining.length > 0 ? ` Still installed: ${remaining.join(", ")}.` : ""));
 }
 function printHelp() {
     ui.heading("Trusty Squire");
@@ -1186,14 +1108,13 @@ function printHelp() {
     console.warn("");
     console.warn(`${chalk.bold("Commands")}`);
     console.warn(`  ${ui.code("connect")}                       set up this machine (default)`);
-    console.warn(`  ${ui.code("login --provider=<p>")}          add a Google or GitHub session`);
     console.warn(`  ${ui.code("settings")}                      edit registry and OTP choices`);
-    console.warn(`  ${ui.code("logout")}                        clear the local session`);
+    console.warn(`  ${ui.code("logout [--account=<id>]")}       clear ONE account's local session`);
     console.warn("");
     console.warn(`${chalk.bold("Flags for connect")}`);
     console.warn(`  --target=<${Object.keys(AGENTS).join("|")}>`);
     console.warn(`  --skip-browser               don't launch a browser (CI mode)`);
-    console.warn(`  --force-relogin[=google|github] switch the bound account or one provider`);
+    console.warn(`  --force-relogin[=google|github] re-sign-in: switch the bound account or refresh one provider`);
     console.warn(`  --no-registry                disable managed registry participation`);
     console.warn(`  --no-interactive             skip the TUI picker (use flag defaults only)`);
     console.warn("");
@@ -1250,5 +1171,5 @@ function printAsnWarning(asn) {
             return;
     }
 }
-export { connect, logout, login, parseArgs, pollForClaim, printAsnWarning, resolveCopiedNpxServerLaunch, resolveServerLaunch, };
+export { connect, logout, parseArgs, pollForClaim, printAsnWarning, resolveCopiedNpxServerLaunch, resolveServerLaunch, };
 //# sourceMappingURL=cli.js.map