confluence-cli 1.25.1 → 1.27.0

package/.claude/skills/confluence/SKILL.md

@@ -25,6 +25,18 @@ confluence --version   # verify install
 | `CONFLUENCE_AUTH_TYPE` | `basic` or `bearer` | `basic` |
 | `CONFLUENCE_EMAIL` | Email address (basic auth only) | `user@company.com` |
 | `CONFLUENCE_API_TOKEN` | API token or personal access token | `ATATT3x...` |
+| `CONFLUENCE_PROFILE` | Named profile to use (optional) | `staging` |
+| `CONFLUENCE_READ_ONLY` | Block all write operations when `true` | `true` |
+
+**Global `--profile` flag (use a named profile for any command):**
+
+```sh
+confluence --profile <name> <command>
+```
+
+Config resolution works in two stages:
+- **Direct env config:** If both `CONFLUENCE_DOMAIN` and `CONFLUENCE_API_TOKEN` are set, they are used directly and the config file / profiles are not consulted.
+- **Profile-based config:** Otherwise, a profile is selected in this order: `--profile` flag > `CONFLUENCE_PROFILE` env > `activeProfile` in config > `default`.
 
 **Non-interactive init (good for CI/CD scripts):**
 
@@ -52,6 +64,27 @@ export CONFLUENCE_EMAIL="user@company.com"
 export CONFLUENCE_API_TOKEN="your-scoped-token"
 ```
 
+**Read-only mode (recommended for AI agents):**
+
+Prevents all write operations (create, update, delete, move, etc.) at the profile level. Useful when giving an AI agent access to Confluence for reading only.
+
+```sh
+# Via profile flag
+confluence profile add agent --domain "company.atlassian.net" --token "xxx" --read-only
+
+# Via environment variable (overrides config file)
+export CONFLUENCE_READ_ONLY=true
+```
+
+When read-only mode is active, any write command exits with an error:
+```
+Error: This profile is in read-only mode. Write operations are not allowed.
+```
+
+`profile list` shows read-only profiles with a `[read-only]` badge.
+
+---
+
 ## Page ID Resolution
 
 Most commands accept `<pageId>` — a numeric ID or any of the supported URL formats below.
@@ -91,10 +124,14 @@ confluence read "https://company.atlassian.net/wiki/spaces/MYSPACE/pages/1234567
 Initialize configuration. Saves credentials to `~/.confluence-cli/config.json`.
 
 ```sh
-confluence init [--domain <domain>] [--api-path <path>] [--auth-type basic|bearer] [--email <email>] [--token <token>]
+confluence init [--domain <domain>] [--api-path <path>] [--auth-type basic|bearer] [--email <email>] [--token <token>] [--read-only]
 ```
 
-All flags are optional; omitting any flag triggers an interactive prompt for that field. Provide all flags to run fully non-interactive.
+All flags are optional; omitting any flag triggers an interactive prompt for that field. Provide all flags to run fully non-interactive. Use the global `--profile` flag to save to a named profile:
+
+```sh
+confluence --profile staging init --domain "staging.example.com" --auth-type bearer --token "your-token"
+```
 
 ---
 
@@ -520,6 +557,60 @@ confluence copy-tree 123456789 987654321 --exclude "Draft*,Archive*"
 
 ---
 
+### `profile list`
+
+List all configuration profiles with the active profile marked.
+
+```sh
+confluence profile list
+```
+
+---
+
+### `profile use <name>`
+
+Switch the active configuration profile.
+
+```sh
+confluence profile use <name>
+```
+
+```sh
+confluence profile use staging
+```
+
+---
+
+### `profile add <name>`
+
+Add a new configuration profile. Supports the same options as `init` (interactive, non-interactive, or hybrid).
+
+```sh
+confluence profile add <name> [--domain <domain>] [--api-path <path>] [--auth-type basic|bearer] [--email <email>] [--token <token>] [--protocol http|https] [--read-only]
+```
+
+Profile names may contain letters, numbers, hyphens, and underscores only.
+
+```sh
+confluence profile add staging --domain "staging.example.com" --auth-type bearer --token "xyz"
+```
+
+---
+
+### `profile remove <name>`
+
+Remove a configuration profile (prompts for confirmation). Cannot remove the only remaining profile.
+
+```sh
+confluence profile remove <name>
+```
+
+```sh
+confluence profile remove staging
+```
+
+---
+
 ### `stats`
 
 Show local usage statistics.
@@ -614,6 +705,8 @@ confluence search "release notes" --limit 20
 - **ANSI color codes**: stdout may contain ANSI escape sequences. Pipe through `| cat` or use `NO_COLOR=1` if your downstream tool doesn't handle them.
 - **Page ID vs URL**: when you have a Confluence URL, extract `?pageId=<number>` and pass the number. Do not pass pretty/display URLs — they are not supported.
 - **Cross-space moves**: `confluence move` only works within the same space. Moving across spaces is not supported.
+- **Multiple instances**: Use `--profile <name>` or `CONFLUENCE_PROFILE` env var to target different Confluence instances without reconfiguring.
+- **Read-only mode**: Set `CONFLUENCE_READ_ONLY=true` or use `--read-only` when creating profiles to prevent accidental writes. This is enforced at the CLI level — all write commands will be blocked.
 
 ## Error Patterns
 
@@ -624,3 +717,6 @@ confluence search "release notes" --limit 20
 | 400 on inline comment creation | Editor metadata required | Use `--location footer` or reply to existing inline comment with `--parent` |
 | `File not found: <path>` | `--file` path doesn't exist | Check the path before calling the command |
 | `At least one of --title, --file, or --content must be provided` | `update` called with no content options | Provide at least one of the required options |
+| `Profile "<name>" not found!` | Specified profile doesn't exist | Run `confluence profile list` to see available profiles |
+| `Cannot delete the only remaining profile.` | Tried to remove the last profile | Add another profile before removing |
+| `This profile is in read-only mode` | Write command used with a read-only profile | Use a writable profile or remove `readOnly` from config |

package/README.md

@@ -16,6 +16,8 @@ A powerful command-line interface for Atlassian Confluence that allows you to re
 - 💬 **Comments** - List, create, and delete page comments (footer or inline)
 - 📦 **Export** - Save a page and its attachments to a local folder
 - 🛠️ **Edit workflow** - Export page content for editing and re-import
+- 🔀 **Profiles** - Manage multiple Confluence instances with named configuration profiles
+- 🔒 **Read-only mode** - Profile-level write protection for safe AI agent usage
 - 🔧 **Easy setup** - Simple configuration with environment variables or interactive setup
 
 ## Installation
@@ -115,6 +117,15 @@ confluence init \
   --token "your-scoped-token"
 ```
 
+**Named profile** (save to a specific profile):
+```bash
+confluence --profile staging init \
+  --domain "staging.example.com" \
+  --api-path "/rest/api" \
+  --auth-type "bearer" \
+  --token "your-personal-access-token"
+```
+
 **Hybrid mode** (some fields provided, rest via prompts):
 ```bash
 # Domain and token provided, will prompt for auth method and email
@@ -130,6 +141,7 @@ confluence init --email "user@example.com" --token "your-api-token"
 - `-a, --auth-type <type>` - Authentication type: `basic` or `bearer`
 - `-e, --email <email>` - Email or username for basic authentication
 - `-t, --token <token>` - API token or password
+- `--read-only` - Enable read-only mode (blocks all write operations)
 
 ⚠️ **Security note:** While flags work, storing tokens in shell history is risky. Prefer environment variables (Option 3) for production environments.
 
@@ -141,6 +153,8 @@ export CONFLUENCE_EMAIL="your.email@example.com"  # required for basic auth (ali
 export CONFLUENCE_API_PATH="/wiki/rest/api"         # Cloud default; use /rest/api for Server/DC
 # Optional: set to 'bearer' for self-hosted/Data Center instances
 export CONFLUENCE_AUTH_TYPE="basic"
+# Optional: select a named profile (overridden by --profile flag)
+export CONFLUENCE_PROFILE="default"
 ```
 
 **Scoped API token** (recommended for agents):
@@ -154,6 +168,12 @@ export CONFLUENCE_API_TOKEN="your-scoped-token"
 
 `CONFLUENCE_API_PATH` defaults to `/wiki/rest/api` for Atlassian Cloud domains and `/rest/api` otherwise. Override it when your site lives under a custom reverse proxy or on-premises path. `CONFLUENCE_AUTH_TYPE` defaults to `basic` when an email is present and falls back to `bearer` otherwise.
 
+**Read-only mode** (recommended for AI agents):
+```bash
+export CONFLUENCE_READ_ONLY=true
+```
+When set, all write operations (`create`, `update`, `delete`, etc.) are blocked at the CLI level. The environment variable overrides the profile's `readOnly` setting.
+
 ### Getting Your API Token
 
 **Atlassian Cloud:**
@@ -434,6 +454,52 @@ vim ./page-to-edit.xml
 confluence update 123456789 --file ./page-to-edit.xml --format storage
 ```
 
+### Profile Management
+```bash
+# List all profiles and see which is active
+confluence profile list
+
+# Switch the active profile
+confluence profile use staging
+
+# Add a new profile interactively
+confluence profile add staging
+
+# Add a new profile non-interactively
+confluence profile add staging --domain "staging.example.com" --auth-type bearer --token "xyz"
+
+# Add a read-only profile (blocks all write operations)
+confluence profile add agent --domain "company.atlassian.net" --auth-type basic --email "bot@example.com" --token "xyz" --read-only
+
+# Remove a profile
+confluence profile remove staging
+
+# Use a specific profile for a single command
+confluence --profile staging spaces
+```
+
+### Read-Only Mode
+
+Read-only mode blocks all write operations at the CLI level, making it safe to hand the tool to AI agents (Claude Code, Copilot, etc.) without risking accidental edits.
+
+**Enable via profile:**
+```bash
+# During init
+confluence init --read-only
+
+# When adding a profile
+confluence profile add agent --domain "company.atlassian.net" --token "xyz" --read-only
+```
+
+**Enable via environment variable:**
+```bash
+export CONFLUENCE_READ_ONLY=true   # overrides profile setting
+```
+
+When read-only mode is active, any write command (`create`, `create-child`, `update`, `delete`, `move`, `edit`, `comment`, `attachment-upload`, `attachment-delete`, `property-set`, `property-delete`, `comment-delete`, `copy-tree`) exits with code 1 and prints an error message.
+
+`confluence profile list` shows a `[read-only]` badge next to protected profiles.
+
 ### View Usage Statistics
 ```bash
 confluence stats
@@ -443,7 +509,7 @@ confluence stats
 
 | Command | Description | Options |
 |---|---|---|
-| `init` | Initialize CLI configuration | |
+| `init` | Initialize CLI configuration | `--read-only` |
 | `read <pageId_or_url>` | Read page content | `--format <html\|text\|markdown>` |
 | `info <pageId_or_url>` | Get page information | |
 | `search <query>` | Search for pages | `--limit <number>` |
@@ -468,8 +534,14 @@ confluence stats
 | `property-set <pageId_or_url> <key>` | Set a content property (create or update) | `--value <json>`, `--file <path>`, `--format <text\|json>` |
 | `property-delete <pageId_or_url> <key>` | Delete a content property by key | `--yes` |
 | `export <pageId_or_url>` | Export a page to a directory with its attachments | `--format <html\|text\|markdown>`, `--dest <directory>`, `--file <filename>`, `--attachments-dir <name>`, `--pattern <glob>`, `--referenced-only`, `--skip-attachments` |
+| `profile list` | List all configuration profiles | |
+| `profile use <name>` | Set the active configuration profile | |
+| `profile add <name>` | Add a new configuration profile | `-d, --domain`, `-p, --api-path`, `-a, --auth-type`, `-e, --email`, `-t, --token`, `--protocol`, `--read-only` |
+| `profile remove <name>` | Remove a configuration profile | |
 | `stats` | View your usage statistics | |
 
+**Global option:** `--profile <name>` — Use a specific profile for any command (overrides `CONFLUENCE_PROFILE` env var and active profile).
+
 ## Examples
 
 ```bash
@@ -503,6 +575,11 @@ confluence attachment-delete 123456789 998877 --yes
 
 # View usage statistics
 confluence stats
+
+# Profile management
+confluence profile list
+confluence profile use staging
+confluence --profile staging spaces
 ```
 
 ## Development

package/bin/confluence.js

@@ -4,7 +4,7 @@ const { program } = require('commander');
 const chalk = require('chalk');
 const inquirer = require('inquirer');
 const ConfluenceClient = require('../lib/confluence-client');
-const { getConfig, initConfig } = require('../lib/config');
+const { getConfig, initConfig, listProfiles, setActiveProfile, deleteProfile, isValidProfileName } = require('../lib/config');
 const Analytics = require('../lib/analytics');
 const pkg = require('../package.json');
 
@@ -13,10 +13,24 @@ function buildPageUrl(config, path) {
   return `${protocol}://${config.domain}${path}`;
 }
 
+function assertWritable(config) {
+  if (config.readOnly) {
+    console.error(chalk.red('Error: This profile is in read-only mode. Write operations are not allowed.'));
+    console.error(chalk.yellow('Tip: Use "confluence profile add <name>" without --read-only, or set readOnly to false in config.'));
+    process.exit(1);
+  }
+}
+
 program
   .name('confluence')
   .description('CLI tool for Atlassian Confluence')
-  .version(pkg.version);
+  .version(pkg.version)
+  .option('--profile <name>', 'Use a specific configuration profile');
+
+// Helper: resolve profile name from global --profile flag
+function getProfileName() {
+  return program.opts().profile || undefined;
+}
 
 // Init command
 program
@@ -28,8 +42,10 @@ program
   .option('-a, --auth-type <type>', 'Authentication type (basic or bearer)')
   .option('-e, --email <email>', 'Email or username for basic auth')
   .option('-t, --token <token>', 'API token')
+  .option('--read-only', 'Set profile to read-only mode (blocks write operations)')
   .action(async (options) => {
-    await initConfig(options);
+    const profile = getProfileName();
+    await initConfig({ ...options, profile });
   });
 
 // Read command
@@ -40,7 +56,7 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const client = new ConfluenceClient(getConfig());
+      const client = new ConfluenceClient(getConfig(getProfileName()));
       const content = await client.readPage(pageId, options.format);
       console.log(content);
       analytics.track('read', true);
@@ -58,7 +74,7 @@ program
   .action(async (pageId) => {
     const analytics = new Analytics();
     try {
-      const client = new ConfluenceClient(getConfig());
+      const client = new ConfluenceClient(getConfig(getProfileName()));
       const info = await client.getPageInfo(pageId);
       console.log(chalk.blue('Page Information:'));
       console.log(`Title: ${chalk.green(info.title)}`);
@@ -85,7 +101,7 @@ program
   .action(async (query, options) => {
     const analytics = new Analytics();
     try {
-      const client = new ConfluenceClient(getConfig());
+      const client = new ConfluenceClient(getConfig(getProfileName()));
       const results = await client.search(query, parseInt(options.limit), options.cql);
       
       if (results.length === 0) {
@@ -116,7 +132,7 @@ program
   .action(async () => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
       const spaces = await client.getSpaces();
       
@@ -200,9 +216,10 @@ program
   .action(async (title, spaceKey, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
-      
+
       let content = '';
       
       if (options.file) {
@@ -243,9 +260,10 @@ program
   .action(async (title, parentId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
-      
+
       // Get parent page info to get space key
       const parentInfo = await client.getPageInfo(parentId);
       const spaceKey = parentInfo.space.key;
@@ -297,9 +315,10 @@ program
         throw new Error('At least one of --title, --file, or --content must be provided.');
       }
 
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
-      
+
       let content = null; // Use null to indicate no content change
       
       if (options.file) {
@@ -336,7 +355,8 @@ program
   .action(async (pageId, newParentId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
       const result = await client.movePage(pageId, newParentId, options.title);
 
@@ -363,7 +383,8 @@ program
   .action(async (pageIdOrUrl, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
       const pageInfo = await client.getPageInfo(pageIdOrUrl);
 
@@ -406,7 +427,8 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
       const pageData = await client.getPageForEdit(pageId);
       
@@ -443,7 +465,7 @@ program
   .action(async (title, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
       const pageInfo = await client.findPageByTitle(title, options.space);
       
@@ -473,7 +495,7 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
       const maxResults = options.limit ? parseInt(options.limit, 10) : null;
       const pattern = options.pattern ? options.pattern.trim() : null;
@@ -605,7 +627,8 @@ program
 
       const fs = require('fs');
       const path = require('path');
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
 
       const resolvedFiles = files.map((filePath) => ({
@@ -652,7 +675,8 @@ program
   .action(async (pageId, attachmentId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
 
       if (!options.yes) {
@@ -696,7 +720,7 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
 
       const format = (options.format || 'text').toLowerCase();
@@ -766,7 +790,7 @@ program
   .action(async (pageId, key, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
 
       const format = (options.format || 'text').toLowerCase();
@@ -802,7 +826,8 @@ program
   .action(async (pageId, key, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
 
       if (!options.value && !options.file) {
@@ -858,7 +883,8 @@ program
   .action(async (pageId, key, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
 
       if (!options.yes) {
@@ -904,7 +930,7 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
 
       const format = (options.format || 'text').toLowerCase();
@@ -1059,7 +1085,8 @@ program
     const analytics = new Analytics();
     let location = null;
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
 
       let content = '';
@@ -1173,7 +1200,8 @@ program
   .action(async (commentId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
 
       if (!options.yes) {
@@ -1225,7 +1253,7 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
       const fs = require('fs');
       const path = require('path');
@@ -1591,9 +1619,10 @@ program
   .action(async (sourcePageId, targetParentId, newTitle, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
+      assertWritable(config);
       const client = new ConfluenceClient(config);
-      
+
       // Parse numeric flags with safe fallbacks
       const parsedDepth = parseInt(options.maxDepth, 10);
       const maxDepth = Number.isNaN(parsedDepth) ? 10 : parsedDepth;
@@ -1711,7 +1740,7 @@ program
   .action(async (pageId, options) => {
     const analytics = new Analytics();
     try {
-      const config = getConfig();
+      const config = getConfig(getProfileName());
       const client = new ConfluenceClient(config);
       
       // Extract page ID from URL if needed
@@ -1852,6 +1881,82 @@ function printTree(nodes, config, options, depth = 1) {
   });
 }
 
+// Profile management commands
+const profileCmd = program
+  .command('profile')
+  .description('Manage configuration profiles');
+
+profileCmd
+  .command('list')
+  .description('List all configuration profiles')
+  .action(() => {
+    const { profiles } = listProfiles();
+    if (profiles.length === 0) {
+      console.log(chalk.yellow('No profiles configured. Run "confluence init" to create one.'));
+      return;
+    }
+    console.log(chalk.blue('Configuration profiles:\n'));
+    profiles.forEach(p => {
+      const marker = p.active ? chalk.green(' (active)') : '';
+      const readOnlyBadge = p.readOnly ? chalk.red(' [read-only]') : '';
+      console.log(`  ${p.active ? chalk.green('*') : ' '} ${chalk.cyan(p.name)}${marker}${readOnlyBadge} - ${chalk.gray(p.domain)}`);
+    });
+  });
+
+profileCmd
+  .command('use <name>')
+  .description('Set the active configuration profile')
+  .action((name) => {
+    try {
+      setActiveProfile(name);
+      console.log(chalk.green(`Switched to profile "${name}"`));
+    } catch (error) {
+      console.error(chalk.red('Error:'), error.message);
+      process.exit(1);
+    }
+  });
+
+profileCmd
+  .command('add <name>')
+  .description('Add a new configuration profile interactively')
+  .option('-d, --domain <domain>', 'Confluence domain')
+  .option('--protocol <protocol>', 'Protocol (http or https)')
+  .option('-p, --api-path <path>', 'REST API path')
+  .option('-a, --auth-type <type>', 'Authentication type (basic or bearer)')
+  .option('-e, --email <email>', 'Email or username for basic auth')
+  .option('-t, --token <token>', 'API token')
+  .option('--read-only', 'Set profile to read-only mode (blocks write operations)')
+  .action(async (name, options) => {
+    if (!isValidProfileName(name)) {
+      console.error(chalk.red('Invalid profile name. Use only letters, numbers, hyphens, and underscores.'));
+      process.exit(1);
+    }
+    await initConfig({ ...options, profile: name });
+  });
+
+profileCmd
+  .command('remove <name>')
+  .description('Remove a configuration profile')
+  .action(async (name) => {
+    try {
+      const { confirmed } = await inquirer.prompt([{
+        type: 'confirm',
+        name: 'confirmed',
+        message: `Delete profile "${name}"?`,
+        default: false
+      }]);
+      if (!confirmed) {
+        console.log(chalk.yellow('Cancelled.'));
+        return;
+      }
+      deleteProfile(name);
+      console.log(chalk.green(`Profile "${name}" removed.`));
+    } catch (error) {
+      console.error(chalk.red('Error:'), error.message);
+      process.exit(1);
+    }
+  });
+
 // Exported for testing
 module.exports = {
   program,
@@ -1862,6 +1967,7 @@ module.exports = {
     uniquePathFor,
     exportRecursive,
     sanitizeTitle,
+    assertWritable,
   },
 };
 

package/lib/config.js

@@ -6,12 +6,15 @@ const chalk = require('chalk');
 
 const CONFIG_DIR = path.join(os.homedir(), '.confluence-cli');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+const DEFAULT_PROFILE = 'default';
 
 const AUTH_CHOICES = [
   { name: 'Basic (credentials)', value: 'basic' },
   { name: 'Bearer token', value: 'bearer' }
 ];
 
+const isValidProfileName = (name) => /^[a-zA-Z0-9_-]+$/.test(name);
+
 const requiredInput = (label) => (input) => {
   if (!input || !input.trim()) {
     return `${label} is required`;
@@ -68,6 +71,47 @@ const normalizeApiPath = (rawValue, domain) => {
   return withoutTrailing || inferApiPath(domain);
 };
 
+// Read config file with backward compatibility for old flat format
+function readConfigFile() {
+  if (!fs.existsSync(CONFIG_FILE)) {
+    return null;
+  }
+
+  try {
+    const raw = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
+
+    // Detect old flat format (has domain at top level, no profiles key)
+    if (raw.domain && !raw.profiles) {
+      const profile = {
+        domain: raw.domain,
+        protocol: raw.protocol,
+        apiPath: raw.apiPath,
+        token: raw.token,
+        authType: raw.authType
+      };
+      if (raw.email) {
+        profile.email = raw.email;
+      }
+      return {
+        activeProfile: DEFAULT_PROFILE,
+        profiles: { [DEFAULT_PROFILE]: profile }
+      };
+    }
+
+    return raw;
+  } catch {
+    return null;
+  }
+}
+
+// Write the full multi-profile config structure
+function saveConfigFile(data) {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  }
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(data, null, 2));
+}
+
 // Helper function to validate CLI-provided options
 const validateCliOptions = (options) => {
   const errors = [];
@@ -115,23 +159,40 @@ const validateCliOptions = (options) => {
 };
 
 // Helper function to save configuration with validation
-const saveConfig = (configData) => {
-  if (!fs.existsSync(CONFIG_DIR)) {
-    fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  }
-
+const saveConfig = (configData, profileName) => {
   const config = {
     domain: configData.domain.trim(),
     protocol: normalizeProtocol(configData.protocol),
     apiPath: normalizeApiPath(configData.apiPath, configData.domain),
     token: configData.token.trim(),
-    authType: configData.authType,
-    email: configData.authType === 'basic' && configData.email ? configData.email.trim() : undefined
+    authType: configData.authType
   };
 
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  if (configData.authType === 'basic' && configData.email) {
+    config.email = configData.email.trim();
+  }
+
+  if (configData.readOnly) {
+    config.readOnly = true;
+  }
+
+  // Read existing config file (or create new structure)
+  const fileData = readConfigFile() || { activeProfile: DEFAULT_PROFILE, profiles: {} };
+
+  const targetProfile = profileName || fileData.activeProfile || DEFAULT_PROFILE;
+  fileData.profiles[targetProfile] = config;
+
+  // If this is the first profile, make it active
+  if (!fileData.activeProfile || !fileData.profiles[fileData.activeProfile]) {
+    fileData.activeProfile = targetProfile;
+  }
+
+  saveConfigFile(fileData);
 
   console.log(chalk.green('✅ Configuration saved successfully!'));
+  if (profileName) {
+    console.log(`Profile: ${chalk.cyan(targetProfile)}`);
+  }
   console.log(`Config file location: ${chalk.gray(CONFIG_FILE)}`);
   console.log(chalk.yellow('\n💡 Tip: You can regenerate this config anytime by running "confluence init"'));
 };
@@ -232,6 +293,16 @@ const promptForMissingValues = async (providedValues) => {
 };
 
 async function initConfig(cliOptions = {}) {
+  const profileName = cliOptions.profile;
+
+  // Validate profile name if provided
+  if (profileName && !isValidProfileName(profileName)) {
+    console.error(chalk.red('❌ Invalid profile name. Use only letters, numbers, hyphens, and underscores.'));
+    process.exit(1);
+  }
+
+  const readOnly = cliOptions.readOnly || false;
+
   // Extract provided values from CLI options
   const providedValues = {
     protocol: cliOptions.protocol,
@@ -248,6 +319,9 @@ async function initConfig(cliOptions = {}) {
   if (!hasCliOptions) {
     // Interactive mode: no CLI options provided
     console.log(chalk.blue('🚀 Confluence CLI Configuration'));
+    if (profileName) {
+      console.log(`Profile: ${chalk.cyan(profileName)}`);
+    }
     console.log('Please provide your Confluence connection details:\n');
 
     const answers = await inquirer.prompt([
@@ -307,7 +381,7 @@ async function initConfig(cliOptions = {}) {
       }
     ]);
 
-    saveConfig(answers);
+    saveConfig({ ...answers, readOnly }, profileName);
     return;
   }
 
@@ -325,8 +399,8 @@ async function initConfig(cliOptions = {}) {
   // Check if all required values are provided for non-interactive mode
   // Non-interactive requires: domain, token, and either authType or email (for inference)
   const hasRequiredValues = Boolean(
-    providedValues.domain && 
-    providedValues.token && 
+    providedValues.domain &&
+    providedValues.token &&
     (providedValues.authType || providedValues.email)
   );
 
@@ -341,7 +415,7 @@ async function initConfig(cliOptions = {}) {
 
       const normalizedAuthType = normalizeAuthType(inferredAuthType, Boolean(providedValues.email));
       const normalizedDomain = providedValues.domain.trim();
-      
+
       // Verify basic auth has email
       if (normalizedAuthType === 'basic' && !providedValues.email) {
         console.error(chalk.red('❌ Email is required for basic authentication'));
@@ -359,10 +433,11 @@ async function initConfig(cliOptions = {}) {
         apiPath: providedValues.apiPath || inferApiPath(normalizedDomain),
         token: providedValues.token,
         authType: normalizedAuthType,
-        email: providedValues.email
+        email: providedValues.email,
+        readOnly
       };
 
-      saveConfig(configData);
+      saveConfig(configData, profileName);
     } catch (error) {
       console.error(chalk.red(`❌ ${error.message}`));
       process.exit(1);
@@ -373,27 +448,31 @@ async function initConfig(cliOptions = {}) {
   // Hybrid mode: some values provided, prompt for the rest
   try {
     console.log(chalk.blue('🚀 Confluence CLI Configuration'));
+    if (profileName) {
+      console.log(`Profile: ${chalk.cyan(profileName)}`);
+    }
     console.log('Completing configuration with interactive prompts:\n');
 
     const mergedValues = await promptForMissingValues(providedValues);
-    
+
     // Normalize auth type
     mergedValues.authType = normalizeAuthType(mergedValues.authType, Boolean(mergedValues.email));
-    
-    saveConfig(mergedValues);
+
+    saveConfig({ ...mergedValues, readOnly }, profileName);
   } catch (error) {
     console.error(chalk.red(`❌ ${error.message}`));
     process.exit(1);
   }
 }
 
-function getConfig() {
+function getConfig(profileName) {
   const envDomain = process.env.CONFLUENCE_DOMAIN || process.env.CONFLUENCE_HOST;
   const envToken = process.env.CONFLUENCE_API_TOKEN || process.env.CONFLUENCE_PASSWORD;
   const envEmail = process.env.CONFLUENCE_EMAIL || process.env.CONFLUENCE_USERNAME;
   const envAuthType = process.env.CONFLUENCE_AUTH_TYPE;
   const envApiPath = process.env.CONFLUENCE_API_PATH;
   const envProtocol = process.env.CONFLUENCE_PROTOCOL;
+  const envReadOnly = process.env.CONFLUENCE_READ_ONLY;
 
   if (envDomain && envToken) {
     const authType = normalizeAuthType(envAuthType, Boolean(envEmail));
@@ -418,19 +497,39 @@ function getConfig() {
       apiPath,
       token: envToken.trim(),
       email: envEmail ? envEmail.trim() : undefined,
-      authType
+      authType,
+      readOnly: envReadOnly === 'true'
     };
   }
 
-  if (!fs.existsSync(CONFIG_FILE)) {
+  // Resolve profile: explicit param > CONFLUENCE_PROFILE env var > activeProfile > default
+  const resolvedProfileName = profileName
+    || process.env.CONFLUENCE_PROFILE
+    || null;
+
+  const fileData = readConfigFile();
+
+  if (!fileData) {
     console.error(chalk.red('❌ No configuration found!'));
     console.log(chalk.yellow('Please run "confluence init" to set up your configuration.'));
     console.log(chalk.gray('Or set environment variables: CONFLUENCE_DOMAIN, CONFLUENCE_API_TOKEN (or CONFLUENCE_PASSWORD), CONFLUENCE_EMAIL (or CONFLUENCE_USERNAME), and optionally CONFLUENCE_API_PATH, CONFLUENCE_PROTOCOL.'));
     process.exit(1);
   }
 
+  const targetProfile = resolvedProfileName || fileData.activeProfile || DEFAULT_PROFILE;
+  const storedConfig = fileData.profiles && fileData.profiles[targetProfile];
+
+  if (!storedConfig) {
+    console.error(chalk.red(`❌ Profile "${targetProfile}" not found!`));
+    const available = fileData.profiles ? Object.keys(fileData.profiles) : [];
+    if (available.length > 0) {
+      console.log(chalk.yellow(`Available profiles: ${available.join(', ')}`));
+    }
+    console.log(chalk.yellow('Run "confluence init --profile <name>" to create it, or "confluence profile list" to see available profiles.'));
+    process.exit(1);
+  }
+
   try {
-    const storedConfig = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
     const trimmedDomain = (storedConfig.domain || '').trim();
     const trimmedToken = (storedConfig.token || '').trim();
     const trimmedEmail = storedConfig.email ? storedConfig.email.trim() : undefined;
@@ -457,13 +556,18 @@ function getConfig() {
       process.exit(1);
     }
 
+    const readOnly = envReadOnly !== undefined
+      ? envReadOnly === 'true'
+      : Boolean(storedConfig.readOnly);
+
     return {
       domain: trimmedDomain,
       protocol: normalizeProtocol(storedConfig.protocol),
       apiPath,
       token: trimmedToken,
       email: trimmedEmail,
-      authType
+      authType,
+      readOnly
     };
   } catch (error) {
     console.error(chalk.red('❌ Error reading configuration file:'), error.message);
@@ -472,7 +576,61 @@ function getConfig() {
   }
 }
 
+function listProfiles() {
+  const fileData = readConfigFile();
+  if (!fileData || !fileData.profiles || Object.keys(fileData.profiles).length === 0) {
+    return { activeProfile: null, profiles: [] };
+  }
+  return {
+    activeProfile: fileData.activeProfile,
+    profiles: Object.keys(fileData.profiles).map(name => ({
+      name,
+      active: name === fileData.activeProfile,
+      domain: fileData.profiles[name].domain,
+      readOnly: Boolean(fileData.profiles[name].readOnly)
+    }))
+  };
+}
+
+function setActiveProfile(profileName) {
+  const fileData = readConfigFile();
+  if (!fileData) {
+    throw new Error('No configuration file found. Run "confluence init" first.');
+  }
+  if (!fileData.profiles || !fileData.profiles[profileName]) {
+    const available = fileData.profiles ? Object.keys(fileData.profiles) : [];
+    throw new Error(`Profile "${profileName}" not found. Available: ${available.join(', ')}`);
+  }
+  fileData.activeProfile = profileName;
+  saveConfigFile(fileData);
+}
+
+function deleteProfile(profileName) {
+  const fileData = readConfigFile();
+  if (!fileData) {
+    throw new Error('No configuration file found. Run "confluence init" first.');
+  }
+  if (!fileData.profiles || !fileData.profiles[profileName]) {
+    throw new Error(`Profile "${profileName}" not found.`);
+  }
+  if (Object.keys(fileData.profiles).length === 1) {
+    throw new Error('Cannot delete the only remaining profile.');
+  }
+  delete fileData.profiles[profileName];
+  if (fileData.activeProfile === profileName) {
+    fileData.activeProfile = Object.keys(fileData.profiles)[0];
+  }
+  saveConfigFile(fileData);
+}
+
 module.exports = {
   initConfig,
-  getConfig
+  getConfig,
+  listProfiles,
+  setActiveProfile,
+  deleteProfile,
+  isValidProfileName,
+  CONFIG_DIR,
+  CONFIG_FILE,
+  DEFAULT_PROFILE
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "confluence-cli",
-  "version": "1.25.1",
+  "version": "1.27.0",
   "description": "A command-line interface for Atlassian Confluence with page creation and editing capabilities",
   "main": "index.js",
   "bin": {