foldrun 0.4.0 → 0.5.0

package/bin/foldrun.mjs

@@ -15,9 +15,11 @@
 //   foldrun secrets <verb>  set / ls / rm — the vault, from the terminal
 //   foldrun deploy [dir]    push a workspace into an installation
 //   foldrun invoke <flow>   start a flow on a running platform
+//   foldrun source <verb>   ls / cat / put / mv / rm one workspace file on a platform
 //   foldrun open  [page]    the dashboard for this workspace
 //   foldrun login           sign this machine in from the browser
 //   foldrun whoami          who the platform thinks this terminal is
+//   foldrun accounts        every account signed in here; `use <name>` switches
 //   foldrun keys  <verb>    ls / create / revoke — the account's API keys
 //
 // `check` is the one to run in CI: it catches the mistakes that otherwise only
@@ -49,12 +51,15 @@ const HELP = `foldrun — agents are just folders
   foldrun connect NAME      OAuth sign-in from the terminal, stored as an auto-refreshing secret
   foldrun deploy [dir]      push a workspace into an installation
   foldrun invoke <flow>     start a flow on a running platform (--to <workspace>)
+  foldrun source <verb>     the files on a platform, one at a time: ls, cat <path>, put <path>, mv, rm (--to <workspace>)
   foldrun open [page]       the dashboard for this workspace, in the browser
 
 Signing in
   foldrun login             sign this machine in from the browser (--token <key> to skip it)
   foldrun logout            forget this machine's key, and revoke it where allowed
   foldrun whoami            who you are on the platform: account, role, workspaces
+  foldrun accounts          every account signed in on this machine, and which one is active
+  foldrun use <name>        act as one of them from here on
   foldrun keys ls           the account's API keys — also create <label>, revoke <id>
   foldrun --help
 
@@ -64,6 +69,8 @@ Options
   --task "<text>"           the instruction for a manual run
   --follow                  logs: keep tailing a live run (with --url: on the platform)
   --value "<text>"          secrets set: skip the prompt (careful with shell history)
+  --file <path>             source put: the local file to send (default: stdin)
+  --message "<why>"         source put: recorded on the file's revision
   --account                 secrets: account scope instead of the workspace's
   --wait                    invoke: hold on and print the result
   --watch                   invoke: follow the run's trace here as it happens
@@ -84,6 +91,7 @@ Platform options (deploy, invoke, secrets, logs, keys)
   --data <dir>              the installation's data directory
   --url <url>               a running platform (or FOLDRUN_URL, or where you last signed in)
   --token <key>             API key for --url (or FOLDRUN_TOKEN, or the one from foldrun login)
+  --profile <name>          act as one stored account for this command (see foldrun accounts)
   --local                   deploy: into the installation on this machine, even when signed in
   --commit <sha>            deploy: record which commit this is
   --dry-run                 deploy: check and report, change nothing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "foldrun",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Agents are just folders. Write them, check them, run them — on your machine.",
   "license": "Apache-2.0",
   "type": "module",
@@ -20,7 +20,7 @@
   ],
   "scripts": {
     "e2e": "FOLDRUN_E2E=1 FOLDRUN_DATA=$(mktemp -d /tmp/foldrun-e2e-XXXXXX) node --test --test-timeout=300000 tests/e2e.test.ts",
-    "test": "FOLDRUN_DATA=$(mktemp -d /tmp/foldrun-test-XXXXXX) node --test tests/cli-secrets.test.ts tests/cli-check-library.test.ts tests/cli-connect.test.ts",
+    "test": "FOLDRUN_DATA=$(mktemp -d /tmp/foldrun-test-XXXXXX) node --test tests/cli-secrets.test.ts tests/cli-check-library.test.ts tests/cli-connect.test.ts tests/cli-accounts.test.ts",
     "release": "node scripts/release.mjs"
   },
   "repository": {

package/src/commands.mjs

@@ -5,7 +5,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { credentialFor, defaultPlatform, saveCredential, removeCredential, readCredentials, normaliseUrl } from "./credentials.mjs";
+import { credentialFor, defaultPlatform, saveCredential, removeCredential, readCredentials, normaliseUrl, profileByName, currentProfile, useProfile, listProfiles } from "./credentials.mjs";
 
 const c = {
   dim: (s) => `\x1b[2m${s}\x1b[0m`,
@@ -689,18 +689,16 @@ function bundleDirs(workspace, kind) {
 
 // ---------------------------------------------------------------- run
 
-/**
- * Credentials come from ANTHROPIC_API_KEY or, more often on a laptop, from an
- * existing Claude Code login. Requiring the key outright would lock out anyone
- * already authenticated — a bad first run for the most likely user.
- */
+// An API key, and only that. A claude.ai login on this machine is not a
+// credential foldrun may run on: Anthropic does not allow products built on
+// its Agent SDK to use claude.ai subscriptions, so the CLI neither looks
+// for one nor suggests it. An agent that names its own `provider:` needs
+// no Anthropic key at all — that is checked where the agent is read.
 function assertCredentials() {
   if (process.env.ANTHROPIC_API_KEY || process.env.ANTHROPIC_AUTH_TOKEN) return;
-  const home = process.env.HOME ?? "";
-  if (home && fs.existsSync(path.join(home, ".claude"))) return; // Claude Code login
   throw new Error(
-    "no credentials — set ANTHROPIC_API_KEY, or log in with Claude Code.\n" +
-      "  `foldrun check` works without either.",
+    "no credentials — set ANTHROPIC_API_KEY (an API key from console.anthropic.com),\n" +
+      "  or give the agent its own `provider:`. `foldrun check` works without either.",
   );
 }
 
@@ -1066,12 +1064,32 @@ function promptVisible(question) {
 // should not shadow the credentials file with nothing.
 const env = (name) => process.env[name] || undefined;
 
-const remoteUrl = (flags) => flags.url ?? env("FOLDRUN_URL") ?? defaultPlatform() ?? undefined;
+/** The profile a command acts as: --profile by name, else the one whose URL
+ *  was asked for, else the current one. */
+function chosenProfile(flags) {
+  if (typeof flags.profile === "string") {
+    const p = profileByName(flags.profile);
+    if (!p) {
+      const names = listProfiles().map((x) => x.name);
+      throw new Error(`no profile called "${flags.profile}"${names.length ? ` — try ${names.join(", ")}` : " — sign in with `foldrun login`"}`);
+    }
+    return p;
+  }
+  const url = flags.url ?? env("FOLDRUN_URL");
+  if (url) return credentialFor(url);
+  return currentProfile();
+}
+
+const remoteUrl = (flags) =>
+  (typeof flags.profile === "string" ? chosenProfile(flags)?.url : undefined) ??
+  flags.url ?? env("FOLDRUN_URL") ?? defaultPlatform() ?? undefined;
 
 const NOT_SIGNED_IN = "not signed in — run `foldrun login`, or set FOLDRUN_TOKEN / pass --token";
 
 function tokenFor(url, flags) {
-  const token = flags.token ?? env("FOLDRUN_TOKEN") ?? credentialFor(url)?.token;
+  // --token and the environment win, always: a CI job with a key in the
+  // environment must never read a file, whatever is stored in it.
+  const token = flags.token ?? env("FOLDRUN_TOKEN") ?? chosenProfile(flags)?.token ?? credentialFor(url)?.token;
   if (!token) throw new Error(NOT_SIGNED_IN);
   return token;
 }
@@ -1608,8 +1626,9 @@ async function login(flags) {
     // Verify before storing: a wrong key stored is a wrong key on every
     // later command, each failing one step further from the cause.
     const me = await remoteCall(url, { token: flags.token }, "/api/me");
-    saveCredential(url, { token: flags.token, email: me.actor.email ?? null, account: me.account, role: me.role });
-    console.log(`\n  ${c.green("✓")} signed in to ${c.bold(url)} as ${me.actor.email ?? me.actor.label ?? "an API key"} ${c.dim(`(${me.account}, ${me.role})`)}\n`);
+    const name = saveCredential(url, { token: flags.token, email: me.actor.email ?? null, account: me.account, role: me.role }, { name: typeof flags.profile === "string" ? flags.profile : undefined });
+    console.log(`\n  ${c.green("✓")} signed in to ${c.bold(url)} as ${me.actor.email ?? me.actor.label ?? "an API key"} ${c.dim(`(${me.account}, ${me.role})`)}`);
+    console.log(`  ${c.dim(`stored as the account "${name}" — \`foldrun accounts\` lists them, \`foldrun use ${name}\` switches`)}\n`);
     return 0;
   }
 
@@ -1649,9 +1668,9 @@ async function login(flags) {
       // `minted`: this key exists because of this login, so logout may end
       // it. A key stored with --token was made elsewhere and may be in use
       // elsewhere; logout only forgets it.
-      saveCredential(url, { token: poll.token, email: poll.email, account: poll.account, role: poll.role, minted: true });
+      const name = saveCredential(url, { token: poll.token, email: poll.email, account: poll.account, role: poll.role, minted: true }, { name: typeof flags.profile === "string" ? flags.profile : undefined });
       console.log(`\n  ${c.green("✓")} signed in to ${c.bold(url)} as ${poll.email} ${c.dim(`(${poll.account}, ${poll.role})`)}\n`);
-      console.log(`  ${c.dim("Stored in ~/.foldrun/credentials.json. `foldrun whoami` shows it; `foldrun logout` removes it.")}\n`);
+      console.log(`  ${c.dim(`Stored as the account "${name}" in ~/.foldrun/credentials.json. \`foldrun accounts\` lists every account signed in here; \`foldrun use ${name}\` switches.`)}\n`);
       return 0;
     }
   }
@@ -1666,16 +1685,15 @@ async function login(flags) {
  * be in use elsewhere.
  */
 async function logout(flags) {
-  const url = remoteUrl(flags);
-  if (!url) {
-    console.log(`\n  ${c.dim("not signed in anywhere")}\n`);
-    return 0;
-  }
-  const entry = credentialFor(url);
+  // One account, not one machine: --profile names which, else the one this
+  // shell is acting as. Signing out of a customer must not sign you out of
+  // the other three.
+  const entry = chosenProfile(flags);
   if (!entry) {
-    console.log(`\n  ${c.dim(`not signed in to ${url}`)}\n`);
+    console.log(`\n  ${c.dim("not signed in anywhere")}\n`);
     return 0;
   }
+  const url = entry.url;
   let revoked = false;
   if (entry.minted) {
     try {
@@ -1688,9 +1706,11 @@ async function logout(flags) {
       // Not allowed, or unreachable. The local copy still goes.
     }
   }
-  removeCredential(url);
+  removeCredential(entry.name ?? url);
   const note = revoked ? "" : entry.minted ? "  (the key is forgotten here; revoke it on Settings → API keys to be sure)" : "  (the key is forgotten here, not revoked — it was not made by `foldrun login`)";
-  console.log(`\n  ${c.green("✓")} signed out of ${c.bold(url)}${c.dim(note)}\n`);
+  console.log(`\n  ${c.green("✓")} signed out of ${c.bold(entry.name ?? url)} ${c.dim(`(${entry.account} · ${url})`)}${c.dim(note)}`);
+  const left = listProfiles();
+  console.log(left.length ? `  ${c.dim(`still signed in as: ${left.map((p) => p.name).join(", ")}`)}\n` : "");
   return 0;
 }
 
@@ -1705,8 +1725,11 @@ async function whoami(flags) {
   console.log(`  account     ${me.account}${me.owner ? c.dim(`  (owner ${me.owner})`) : ""}`);
   console.log(`  role        ${me.role}`);
   console.log(`  workspaces  ${me.workspaces === null ? "all" : me.workspaces.join(", ") || "none"}`);
-  const source = flags.token ? "--token" : env("FOLDRUN_TOKEN") ? "FOLDRUN_TOKEN" : "~/.foldrun/credentials.json";
-  console.log(`  ${c.dim(`credential from ${source}`)}\n`);
+  const profile = flags.token || env("FOLDRUN_TOKEN") ? null : chosenProfile(flags);
+  const source = flags.token ? "--token" : env("FOLDRUN_TOKEN") ? "FOLDRUN_TOKEN" : `~/.foldrun/credentials.json as "${profile?.name ?? "?"}"`;
+  console.log(`  ${c.dim(`credential from ${source}`)}`);
+  const others = listProfiles().filter((p) => p.name !== profile?.name);
+  console.log(others.length ? `  ${c.dim(`also signed in as: ${others.map((p) => p.name).join(", ")} — \`foldrun accounts\``)}\n` : "\n");
   return 0;
 }
 
@@ -1762,6 +1785,115 @@ async function keysCmd(positional, flags) {
   throw new Error(`keys: unknown verb "${verb}" — ls, create, revoke`);
 }
 
+/**
+ * `foldrun source` — the files themselves, on the platform, one at a time.
+ *
+ *   source ls [dir]                 the workspace's tree (or one folder of it)
+ *   source cat <path>               one file, to stdout
+ *   source put <path> [--file f]    write a file: from --file, else from stdin
+ *                                   (--message "why" goes on the revision)
+ *   source mv <from> <to>
+ *   source rm <path>
+ *
+ * The same door the dashboard's editor uses, so every write is a revision
+ * with who and why, and the workspace's history shows it. For a whole
+ * tree, `foldrun deploy`; for what agents PRODUCE (storage/), the
+ * dashboard's Storage page — source is what you wrote, storage is what
+ * they wrote.
+ */
+async function sourceCmd(positional, flags) {
+  const [verb, a, b] = positional;
+  const url = remoteUrl(flags);
+  if (!url) throw new Error("source reads a workspace on a platform — pass --url, or `foldrun login` first");
+  const ws = flags.to;
+  if (!ws) throw new Error("which workspace? pass --to <workspace>");
+  const base = `/api/workspaces/${encodeURIComponent(ws)}/source`;
+
+  if (verb === "ls" || verb === "list" || verb === undefined) {
+    const { files } = await remoteCall(url, flags, base);
+    const prefix = a ? a.replace(/\/+$/, "") + "/" : "";
+    const shown = files.filter((f) => !prefix || f.startsWith(prefix));
+    if (!shown.length) {
+      console.log(`\n  ${c.dim(prefix ? `nothing under ${prefix}` : "an empty workspace")}\n`);
+      return 0;
+    }
+    console.log("");
+    for (const f of shown) console.log(`  ${f}`);
+    console.log(`\n  ${c.dim(`${shown.length} file${shown.length === 1 ? "" : "s"} · ${ws} · ${url}`)}\n`);
+    return 0;
+  }
+  if (verb === "cat" || verb === "read" || verb === "get") {
+    if (!a) throw new Error("which file? foldrun source cat flows/daily.md --to <workspace>");
+    const { content } = await remoteCall(url, flags, `${base}?path=${encodeURIComponent(a)}`);
+    process.stdout.write(content.endsWith("\n") ? content : `${content}\n`);
+    return 0;
+  }
+  if (verb === "put" || verb === "write") {
+    if (!a) throw new Error("which file? foldrun source put flows/daily.md --file ./daily.md --to <workspace>");
+    const content = typeof flags.file === "string" ? fs.readFileSync(flags.file, "utf8") : fs.readFileSync(0, "utf8");
+    if (!content.trim()) throw new Error("refusing to write an empty file — `foldrun source rm` is the deliberate way to remove one");
+    const body = { path: a, content, ...(typeof flags.message === "string" ? { message: flags.message } : {}) };
+    await remoteCall(url, flags, base, { method: "PUT", body: JSON.stringify(body) });
+    console.log(`\n  ${c.green("✓")} ${ws}/${a}  ${c.dim(`${content.length} chars · revision recorded${flags.message ? ` · "${flags.message}"` : ""}`)}\n`);
+    return 0;
+  }
+  if (verb === "mv" || verb === "move") {
+    if (!a || !b) throw new Error("foldrun source mv <from> <to> --to <workspace>");
+    await remoteCall(url, flags, base, { method: "PATCH", body: JSON.stringify({ from: a, to: b }) });
+    console.log(`\n  ${c.green("✓")} ${a} → ${b}\n`);
+    return 0;
+  }
+  if (verb === "rm" || verb === "delete") {
+    if (!a) throw new Error("foldrun source rm <path> --to <workspace>");
+    await remoteCall(url, flags, base, { method: "DELETE", body: JSON.stringify({ path: a }) });
+    console.log(`\n  ${c.green("✓")} removed ${a}\n`);
+    return 0;
+  }
+  throw new Error(`source: unknown verb "${verb}" — ls, cat, put, mv, rm`);
+}
+
+/**
+ * `foldrun accounts` — every account this machine is signed in to, and
+ * which one a bare command talks as. `foldrun use <name>` switches.
+ *
+ * The list is the point: someone looking after four customers on one
+ * platform could see only the last one they signed in as, and had to paste
+ * --token to reach the others.
+ */
+function accountsCmd(positional) {
+  const profiles = listProfiles();
+  if (!profiles.length) {
+    console.log(`\n  ${c.dim("not signed in anywhere — `foldrun login`")}\n`);
+    return 0;
+  }
+  const verb = positional[0];
+  if (verb && verb !== "ls" && verb !== "list") throw new Error(`accounts: unknown verb "${verb}" — it takes none; \`foldrun use <name>\` switches`);
+  const width = Math.max(...profiles.map((p) => p.name.length));
+  console.log("");
+  for (const p of profiles) {
+    const mark = p.current ? c.green("●") : " ";
+    const who = p.email ?? c.dim("api key");
+    console.log(`  ${mark} ${c.bold(p.name.padEnd(width))}  ${p.account}  ${c.dim(`${p.role ?? "?"} · ${who} · ${p.url}`)}`);
+  }
+  console.log(`\n  ${c.dim("● is the one a bare command talks as. `foldrun use <name>` switches; --profile <name> is one command.")}\n`);
+  return 0;
+}
+
+function useCmd(positional) {
+  const name = positional[0];
+  if (!name) {
+    const names = listProfiles().map((p) => p.name);
+    throw new Error(`which account? ${names.length ? names.join(", ") : "none stored — `foldrun login` first"}`);
+  }
+  const p = useProfile(name);
+  if (!p) {
+    const names = listProfiles().map((x) => x.name);
+    throw new Error(`no account called "${name}"${names.length ? ` — try ${names.join(", ")}` : ""}`);
+  }
+  console.log(`\n  ${c.green("✓")} now acting as ${c.bold(p.name)} ${c.dim(`(${p.account}, ${p.role} · ${p.url})`)}\n`);
+  return 0;
+}
+
 export async function run(command, positional, flags, workspace) {
   switch (command) {
     case "login":
@@ -1772,6 +1904,12 @@ export async function run(command, positional, flags, workspace) {
       return whoami(flags);
     case "keys":
       return keysCmd(positional, flags);
+    case "accounts":
+    case "profiles":
+      return accountsCmd(positional);
+    case "use":
+    case "switch":
+      return useCmd(positional);
     case "init":
       return init(workspace, flags.from);
     case "check":
@@ -1794,6 +1932,8 @@ export async function run(command, positional, flags, workspace) {
       return logsCmd(positional, flags);
     case "invoke":
       return invoke(positional[0], flags);
+    case "source":
+      return sourceCmd(positional, flags);
     case "open":
       return openCmd(positional, flags);
     default:

package/src/credentials.mjs

@@ -1,10 +1,20 @@
 // Where `foldrun login` puts what it was given.
 //
-// `~/.foldrun/credentials.json`, 0600, one entry per platform URL, and a
-// `default` naming the one a bare command talks to — the same shape every
-// CLI that signs in keeps, so the person who has used Vercel's or Fly's
-// finds nothing to learn. FOLDRUN_HOME moves the directory, for tests and
-// for machines where HOME is not where things should be kept.
+// `~/.foldrun/credentials.json`, 0600. A PROFILE is one signed-in account on
+// one platform: a name, the URL, the key, and who that key turned out to be.
+// `current` names the one a bare command talks to. The shape every CLI that
+// signs in keeps, so the person who has used Vercel's or Fly's finds nothing
+// to learn. FOLDRUN_HOME moves the directory, for tests and for machines
+// where HOME is not where things should be kept.
+//
+// It was one credential per URL, which is the same thing until somebody
+// looks after more than one customer on the same platform — an agency, a
+// reseller, us. Then a second account on the same host had nowhere to live
+// and every command needed --token pasted in. Profiles are keyed by name,
+// so two accounts on one platform are two profiles.
+//
+// The old shape is still read, and still written for the newest profile on
+// each URL, so a machine that moves between CLI versions keeps working.
 //
 // The value stored is an ordinary API key, minted at approval and listed on
 // Settings → API keys with the machine's name. Nothing here is a second
@@ -24,53 +34,147 @@ export const normaliseUrl = (url) => {
   return `${u.protocol}//${u.host}${u.pathname.replace(/\/+$/, "")}`;
 };
 
-export function readCredentials() {
+function readRaw() {
   try {
     const parsed = JSON.parse(fs.readFileSync(file(), "utf8"));
-    return { default: parsed.default ?? null, platforms: parsed.platforms ?? {} };
+    return {
+      current: parsed.current ?? null,
+      default: parsed.default ?? null,
+      platforms: parsed.platforms ?? {},
+      profiles: parsed.profiles ?? {},
+    };
   } catch {
-    return { default: null, platforms: {} };
+    return { current: null, default: null, platforms: {}, profiles: {} };
+  }
+}
+
+/**
+ * Every profile, with the old per-URL entries folded in under the account
+ * name they carry. Reading migrates; nothing is written until a command
+ * that changes something writes.
+ */
+export function readCredentials() {
+  const raw = readRaw();
+  const profiles = { ...raw.profiles };
+  for (const [url, entry] of Object.entries(raw.platforms)) {
+    if (Object.values(profiles).some((p) => normaliseUrl(p.url) === url && p.token === entry.token)) continue;
+    profiles[nameFor(profiles, entry.account, url)] = { ...entry, url };
+  }
+  const names = Object.keys(profiles);
+  let current = raw.current && profiles[raw.current] ? raw.current : null;
+  if (!current && raw.default) {
+    current = names.find((n) => normaliseUrl(profiles[n].url) === normaliseUrl(raw.default)) ?? null;
   }
+  return { current: current ?? names[0] ?? null, profiles };
+}
+
+/** A name nobody is using: the account, else the account and the host —
+ *  two customers called "acme" on two platforms are two profiles. */
+function nameFor(profiles, account, url) {
+  const base = (account ?? "account").trim() || "account";
+  if (!profiles[base]) return base;
+  const host = new URL(url).host;
+  const withHost = `${base}@${host}`;
+  if (!profiles[withHost]) return withHost;
+  for (let i = 2; ; i++) if (!profiles[`${withHost}-${i}`]) return `${withHost}-${i}`;
 }
 
-function writeCredentials(creds) {
+function write(current, profiles) {
+  // The old shape goes on being written for the newest profile on each URL,
+  // so a machine that moves between CLI versions is not signed out by the
+  // move. It is a mirror, never the source.
+  const platforms = {};
+  for (const p of Object.values(profiles).sort((a, b) => String(a.loggedInAt ?? "").localeCompare(String(b.loggedInAt ?? "")))) {
+    platforms[normaliseUrl(p.url)] = { token: p.token, email: p.email ?? null, account: p.account, role: p.role, ...(p.minted ? { minted: true } : {}), loggedInAt: p.loggedInAt };
+  }
   fs.mkdirSync(credentialsDir(), { recursive: true, mode: 0o700 });
-  fs.writeFileSync(file(), JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
+  fs.writeFileSync(
+    file(),
+    JSON.stringify({ current, default: current && profiles[current] ? normaliseUrl(profiles[current].url) : null, profiles, platforms }, null, 2) + "\n",
+    { mode: 0o600 },
+  );
 }
 
-/** Remember a platform; it becomes the default unless one is already set
- *  and the caller says to leave it. */
-export function saveCredential(url, entry, { makeDefault = true } = {}) {
+/**
+ * Remember a signed-in account. A second login to the same URL for the same
+ * ACCOUNT replaces that profile rather than making a near-duplicate; a
+ * different account on the same URL is a new one.
+ */
+export function saveCredential(url, entry, { makeDefault = true, name } = {}) {
   const key = normaliseUrl(url);
-  const creds = readCredentials();
-  creds.platforms[key] = { ...entry, loggedInAt: new Date().toISOString() };
-  if (makeDefault || !creds.default) creds.default = key;
-  writeCredentials(creds);
-  return key;
+  const { current, profiles } = readCredentials();
+  const existing = name ?? Object.keys(profiles).find((n) => normaliseUrl(profiles[n].url) === key && profiles[n].account === entry.account);
+  const profileName = existing ?? nameFor(profiles, entry.account, key);
+  profiles[profileName] = { ...entry, url: key, loggedInAt: new Date().toISOString() };
+  write(makeDefault || !current ? profileName : current, profiles);
+  return profileName;
 }
 
-/** Forget a platform. Returns what was there, for a best-effort revoke. */
-export function removeCredential(url) {
-  const key = normaliseUrl(url);
-  const creds = readCredentials();
-  const gone = creds.platforms[key] ?? null;
-  delete creds.platforms[key];
-  if (creds.default === key) creds.default = Object.keys(creds.platforms)[0] ?? null;
-  writeCredentials(creds);
+/** Forget one. By name, else by URL (the newest there). Returns what was
+ *  stored, for a best-effort revoke. */
+export function removeCredential(urlOrName) {
+  const { current, profiles } = readCredentials();
+  const key = (() => {
+    if (profiles[urlOrName]) return urlOrName;
+    try {
+      const u = normaliseUrl(urlOrName);
+      const here = Object.keys(profiles).filter((n) => normaliseUrl(profiles[n].url) === u);
+      return here.sort((a, b) => String(profiles[a].loggedInAt ?? "").localeCompare(String(profiles[b].loggedInAt ?? ""))).at(-1) ?? null;
+    } catch {
+      return null;
+    }
+  })();
+  if (!key) return null;
+  const gone = profiles[key];
+  delete profiles[key];
+  const names = Object.keys(profiles);
+  write(current === key ? names[0] ?? null : current, profiles);
   return gone;
 }
 
-/** The stored entry for a URL, or null. */
+/** The stored entry for a URL — the newest account signed in there. */
 export function credentialFor(url) {
   if (!url) return null;
   try {
-    return readCredentials().platforms[normaliseUrl(url)] ?? null;
+    const { profiles } = readCredentials();
+    const here = Object.keys(profiles).filter((n) => normaliseUrl(profiles[n].url) === normaliseUrl(url));
+    const newest = here.sort((a, b) => String(profiles[a].loggedInAt ?? "").localeCompare(String(profiles[b].loggedInAt ?? ""))).at(-1);
+    return newest ? { ...profiles[newest], name: newest } : null;
   } catch {
     return null;
   }
 }
 
-/** The platform a bare command talks to: the last one signed in to. */
+/** One profile by name. */
+export function profileByName(name) {
+  if (!name) return null;
+  const { profiles } = readCredentials();
+  return profiles[name] ? { ...profiles[name], name } : null;
+}
+
+/** The profile a bare command talks as. */
+export function currentProfile() {
+  const { current, profiles } = readCredentials();
+  return current && profiles[current] ? { ...profiles[current], name: current } : null;
+}
+
+/** Make one the profile a bare command talks as. */
+export function useProfile(name) {
+  const { profiles } = readCredentials();
+  if (!profiles[name]) return null;
+  write(name, profiles);
+  return { ...profiles[name], name };
+}
+
+/** All of them, newest sign-in last. */
+export function listProfiles() {
+  const { current, profiles } = readCredentials();
+  return Object.entries(profiles)
+    .map(([name, p]) => ({ ...p, name, current: name === current }))
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** The platform a bare command talks to: the current profile's. */
 export function defaultPlatform() {
-  return readCredentials().default;
+  return currentProfile()?.url ?? null;
 }