sfora-cli 0.7.0 → 0.9.0

package/dist/cli.js

@@ -10,9 +10,10 @@ import * as readline from "node:readline";
 import { spawn } from "node:child_process";
 import { readFile as readLocalFile } from "node:fs/promises";
 import { basename } from "node:path";
-import { createSforaShell, SforaApiClient } from "./index.js";
+import { createSforaShell, createLocalShell, SforaApiClient } from "./index.js";
+import { LocalWorkspace, initWorkspace, findWorkspace, migrateWorkspaceStages, } from "./local/workspace.js";
 import { runMcpServer } from "./mcp-server.js";
-import { readConfig, writeConfig, resolveSettings, DEFAULT_URL, } from "./config.js";
+import { readConfig, writeConfig, resolveSettings, upsertProfile, effectiveProfiles, DEFAULT_URL, } from "./config.js";
 const colors = {
     reset: "\x1b[0m",
     bold: "\x1b[1m",
@@ -24,7 +25,7 @@ const colors = {
     red: "\x1b[31m",
 };
 function parseArgs(argv) {
-    const args = { rest: [], cwd: "/", mcp: false, help: false, draft: false, json: false };
+    const args = { rest: [], cwd: "/", mcp: false, help: false, draft: false, json: false, local: false, cloud: false };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         if (a === "--mcp")
@@ -53,6 +54,10 @@ function parseArgs(argv) {
             args.bot = a.slice("--bot=".length);
         else if (a.startsWith("--agent="))
             args.bot = a.slice("--agent=".length);
+        else if (a === "--as")
+            args.as = argv[++i];
+        else if (a.startsWith("--as="))
+            args.as = a.slice("--as=".length);
         else if (a === "--web")
             args.web = argv[++i];
         else if (a.startsWith("--web="))
@@ -69,6 +74,10 @@ function parseArgs(argv) {
             args.draft = true;
         else if (a === "--json")
             args.json = true;
+        else if (a === "--local")
+            args.local = true;
+        else if (a === "--cloud")
+            args.cloud = true;
         else if (!a.startsWith("-")) {
             if (!args.command)
                 args.command = a;
@@ -80,11 +89,15 @@ function parseArgs(argv) {
 }
 const HELP = `sfora — the CLI for your sfora workspace
 
-Get started:
-  sfora login                         Authorize as you (saves your key)
+Get started (no account needed):
+  sfora init --local                  Create a .sfora/ workspace in this repo —
+                                      tasks/posts/docs as plain markdown files,
+                                      versioned with your code
+  sfora login                         Authorize with sfora cloud (saves your key)
   sfora login --bot <name>            Authorize as a named bot (its own key)
 
-Run as a bot: add --bot <name> to any command (default identity is you).
+Inside a .sfora/ repo the CLI works on the local files; pass --cloud (or
+--org/--url) to target sfora cloud instead. Run as a bot: add --bot <name>.
 
 Push markdown straight to sfora:
   sfora post <file.md> [--project <slug>] [--draft]   Publish (or draft) a post
@@ -115,6 +128,7 @@ Browse & read:
 Agents & config:
   sfora --mcp [--org <slug>]          Run as an MCP server (for agents)
   sfora mcp-config                    Print an MCP config snippet to paste
+  sfora contexts                      List saved deployment+org keys (● = active)
   sfora init                          Save URL + API key + org manually
 
 Config resolution: flags > env (SFORA_API_KEY / SFORA_URL / SFORA_ORG) >
@@ -173,8 +187,13 @@ async function runInit(args) {
         process.exitCode = 1;
         return;
     }
-    const path = await writeConfig({ url, apiKey: key, org: org || cfg.org });
-    console.log(`${colors.green}✓${colors.reset} Saved ${path}`);
+    const { cfg: next, key: profile } = upsertProfile(cfg, {
+        url,
+        org: org || cfg.org,
+        apiKey: key,
+    });
+    const path = await writeConfig(next);
+    console.log(`${colors.green}✓${colors.reset} Saved ${path} ${colors.dim}(${profile})${colors.reset}`);
 }
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function openBrowser(url) {
@@ -237,17 +256,27 @@ async function runLogin(args, baseUrl) {
         }
         if (data.status === "approved" && data.apiKey) {
             const cfg = await readConfig();
-            const next = { ...cfg, url: base };
+            let next;
             if (args.bot) {
                 // Save under the bot's slot; keep the user's personal key intact.
-                next.bots = {
-                    ...cfg.bots,
-                    [args.bot]: { apiKey: data.apiKey, org: data.orgSlug ?? undefined },
+                next = {
+                    ...cfg,
+                    url: base,
+                    bots: {
+                        ...cfg.bots,
+                        [args.bot]: { apiKey: data.apiKey, org: data.orgSlug ?? undefined },
+                    },
                 };
             }
             else {
-                next.apiKey = data.apiKey;
-                next.org = data.orgSlug ?? cfg.org;
+                // Add/update this deployment+org as its own profile instead of
+                // overwriting one shared key — so logging in here never invalidates the
+                // key you hold for another deployment.
+                next = upsertProfile(cfg, {
+                    url: base,
+                    org: data.orgSlug ?? undefined,
+                    apiKey: data.apiKey,
+                }).cfg;
             }
             const path = await writeConfig(next);
             console.log(`\n${colors.green}✓${colors.reset} Logged in as ${data.name ?? "you"}${data.orgSlug ? ` ${colors.dim}(${data.orgSlug})${colors.reset}` : ""}${args.bot ? ` ${colors.dim}[bot: ${args.bot}]${colors.reset}` : ""} — saved ${path}`);
@@ -279,6 +308,37 @@ function printMcpConfig(s) {
     };
     process.stdout.write(`${JSON.stringify(snippet, null, 2)}\n`);
 }
+// `sfora contexts` — list the deployment+org identities saved in the config and
+// mark the one the current flags/env resolve to. Local-only (no network), so
+// you can always see which key you're about to use.
+function printContexts(cfg, resolved) {
+    const mask = (k) => k ? `${k.slice(0, 12)}…` : `${colors.dim}(no key)${colors.reset}`;
+    const entries = Object.entries(effectiveProfiles(cfg));
+    if (entries.length === 0) {
+        console.log(`${colors.dim}No saved contexts. Run \`sfora login\`.${colors.reset}`);
+    }
+    else {
+        console.log(`${colors.bold}Contexts${colors.reset} ${colors.dim}(~/.sfora/config.json)${colors.reset}`);
+        for (const [key, p] of entries) {
+            const isResolved = resolved.apiKey != null && p.apiKey === resolved.apiKey;
+            const isActive = key === cfg.activeProfile;
+            const marker = isResolved
+                ? `${colors.green}●${colors.reset}`
+                : isActive
+                    ? `${colors.cyan}○${colors.reset}`
+                    : " ";
+            console.log(`  ${marker} ${key.padEnd(28)} ${colors.dim}${p.url}${p.org ? ` · ${p.org}` : ""} · ${mask(p.apiKey)}${colors.reset}`);
+        }
+    }
+    const bots = Object.entries(cfg.bots ?? {});
+    if (bots.length) {
+        console.log(`${colors.bold}Bots${colors.reset}`);
+        for (const [name, b] of bots) {
+            console.log(`  ${colors.dim}${name.padEnd(28)} ${b.org ?? ""} · ${mask(b.apiKey)}${colors.reset}`);
+        }
+    }
+    console.log(`\n${colors.dim}Resolved now → ${resolved.url}${resolved.org ? ` (org: ${resolved.org})` : ""} ${colors.green}●${colors.reset}${colors.dim} = active key${colors.reset}`);
+}
 // ─── Structured verbs (post / task / doc / ls / cat / projects) ──
 // These talk to the workspace over the same /v1/fs the app + agents use, so the
 // CLI is a real product interface — not a generic shell.
@@ -484,7 +544,8 @@ async function runVerb(args, fs, client) {
             .catch(() => []);
         if (cols.length === 0)
             throw new Error(`no board columns in ${project}`);
-        let col = cols[0];
+        // Default to "To do" (02-todo) — new work is up for grabs, not in triage.
+        let col = cols.find((c) => c.replace(/^\d+-/, "") === "todo") ?? cols[0];
         if (args.column) {
             const want = args.column
                 .toLowerCase()
@@ -497,6 +558,115 @@ async function runVerb(args, fs, client) {
         return;
     }
 }
+// ─── Local mode (a .sfora/ directory — no server, no account) ─────
+const LOCAL_ONLY_HINT = "cloud command — run it with --cloud (after `sfora login`), or outside the .sfora/ repo";
+async function runLocalVerb(args, root) {
+    // One Flow: silently reshape a legacy board onto the four fixed stage dirs on
+    // open (idempotent — a no-op once the board is canonical).
+    const reshaped = await migrateWorkspaceStages(root);
+    if (reshaped.migrated) {
+        console.error(`${colors.dim}· reshaped board to the four stages (triage · to do · in progress · done); moved ${reshaped.moved} task${reshaped.moved === 1 ? "" : "s"}${colors.reset}`);
+    }
+    const ws = new LocalWorkspace(root);
+    const { fs } = createLocalShell(root);
+    const ok = (msg) => console.log(`${colors.green}✓${colors.reset} ${msg}`);
+    const emitJson = (v) => console.log(JSON.stringify(v, null, 2));
+    switch (args.command) {
+        case "ls": {
+            const entries = await fs.readdir(args.rest[0] ?? "/");
+            if (args.json)
+                return emitJson(entries);
+            console.log(entries.join("\n"));
+            return;
+        }
+        case "cat": {
+            if (!args.rest[0])
+                throw new Error("usage: sfora cat <path>");
+            process.stdout.write(await fs.readFile(args.rest[0], "utf8"));
+            return;
+        }
+        case "tasks": {
+            const tasks = await ws.listTasks(args.column);
+            if (args.json)
+                return emitJson(tasks);
+            const columns = await ws.listColumns();
+            for (const col of args.column ? [] : columns) {
+                const inCol = tasks.filter((t) => t.column === col);
+                console.log(`${colors.bold}${col.replace(/^\d+-/, "")}${colors.reset} ${colors.dim}(${inCol.length})${colors.reset}`);
+                for (const t of inCol) {
+                    const dot = t.status === "closed" ? colors.green : colors.cyan;
+                    console.log(`  ${dot}●${colors.reset} ${colors.dim}#${t.number ?? "?"}${colors.reset} ${t.title}`);
+                }
+                if (inCol.length === 0)
+                    console.log(`  ${colors.dim}(empty)${colors.reset}`);
+            }
+            if (args.column) {
+                for (const t of tasks)
+                    console.log(`${colors.dim}#${t.number ?? "?"}${colors.reset} ${t.title}`);
+            }
+            return;
+        }
+        case "posts": {
+            const files = await ws.listPosts(args.draft ? "drafts" : "posts");
+            if (args.json)
+                return emitJson(files);
+            console.log(files.length ? files.join("\n") : `${colors.dim}(no posts)${colors.reset}`);
+            return;
+        }
+        case "me":
+        case "whoami": {
+            if (args.json)
+                return emitJson({ mode: "local", workspace: root });
+            console.log(`local workspace ${colors.dim}· ${root}${colors.reset}`);
+            return;
+        }
+        case "task":
+        case "post":
+        case "doc": {
+            const file = args.rest[0];
+            if (!file)
+                throw new Error(`usage: sfora ${args.command} <file.md>`);
+            const md = await readLocalFile(file, "utf8");
+            if (args.command === "task") {
+                const r = await ws.writeTask(md, { column: args.column });
+                ok(`Task #${r.number} created in ${r.column} · ${r.filename}`);
+            }
+            else if (args.command === "post") {
+                const r = await ws.writePost(md, { draft: args.draft });
+                ok(`${args.draft ? "Drafted" : "Posted"} · ${r.filename}`);
+            }
+            else {
+                const r = await ws.writeDoc(md);
+                ok(`Doc saved · ${r.filename}`);
+            }
+            return;
+        }
+        default:
+            throw new Error(`'${args.command}' is a ${LOCAL_ONLY_HINT}`);
+    }
+}
+const LOCAL_SHELL_HELP = `${colors.bold}sfora shell${colors.reset} ${colors.dim}— local workspace (.sfora/), plain files on disk${colors.reset}
+
+Standard tools work on the real files:
+  ls   cat   grep   find   head   tail   wc   sed   awk   echo   mv   cd   pwd
+
+${colors.dim}Where things live${colors.reset}
+  /board/<NN-stage>/NNNN-<slug>.md  tasks — four fixed columns: 01-triage /
+                                    02-todo / 03-in-progress / 04-done. mv
+                                    between them moves a task; mv into 04-done
+                                    marks it done.
+  /posts/YYYY-MM-DD-<slug>.md       posts
+  /docs/<slug>.md                   docs
+
+${colors.dim}Try${colors.reset}
+  ls /board/02-todo
+  grep -ri todo /board
+  echo "# Fix login" > /board/02-todo/fix-login.md
+  mv /board/02-todo/0003-*.md /board/04-done/
+
+Everything is git-versioned with your repo. ${colors.dim}Connect a team later with${colors.reset} ${colors.cyan}sfora login${colors.reset}.
+Type ${colors.cyan}exit${colors.reset} to quit.
+`;
 async function main() {
     const args = parseArgs(process.argv.slice(2));
     if (args.help) {
@@ -504,6 +674,13 @@ async function main() {
         return;
     }
     if (args.command === "init") {
+        if (args.local) {
+            const root = await initWorkspace(process.cwd());
+            console.log(`${colors.green}✓${colors.reset} Local workspace ready · ${root}`);
+            console.log(`${colors.dim}Tasks, posts, and docs live there as plain markdown — versioned with your repo.\n` +
+                `Try: sfora task plan.md · sfora tasks · sfora (shell). Connect a team later with sfora login.${colors.reset}`);
+            return;
+        }
         await runInit(args);
         return;
     }
@@ -514,10 +691,51 @@ async function main() {
         printMcpConfig(settings);
         return;
     }
+    if (args.command === "contexts") {
+        printContexts(cfg, settings);
+        return;
+    }
     if (args.command === "login") {
         await runLogin(args, baseUrl);
         return;
     }
+    // Local mode — a .sfora/ workspace in (an ancestor of) cwd wins, unless the
+    // user explicitly targets the cloud (--cloud / --url / --org / --key / --bot).
+    const cloudIntent = args.cloud || !!args.url || !!args.org || !!args.key || !!args.bot;
+    const localRoot = cloudIntent
+        ? undefined
+        : await findWorkspace(process.cwd());
+    if (args.local && !localRoot) {
+        process.stderr.write(`${colors.red}error:${colors.reset} no .sfora/ workspace found — run \`sfora init --local\` first.\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (localRoot) {
+        if (args.command && VERBS.has(args.command)) {
+            try {
+                await runLocalVerb(args, localRoot);
+            }
+            catch (e) {
+                process.stderr.write(`${colors.red}error:${colors.reset} ${e instanceof Error ? e.message : String(e)}\n`);
+                process.exitCode = 1;
+            }
+            return;
+        }
+        if (args.mcp) {
+            await runMcpServer({
+                baseUrl,
+                apiKey: apiKey ?? "",
+                org: settings.org ?? "",
+                localRoot,
+            });
+            return;
+        }
+        const { bash, fs } = createLocalShell(localRoot, args.cwd);
+        console.log(`${colors.cyan}${colors.bold}sfora${colors.reset} ${colors.dim}— local workspace · ${localRoot}${colors.reset}`);
+        console.log(`${colors.dim}Plain markdown files, versioned with your repo. Try: ls /board · ${colors.reset}${colors.cyan}help${colors.reset}${colors.dim} for commands · ${colors.reset}${colors.cyan}exit${colors.reset}${colors.dim} to quit${colors.reset}\n`);
+        await runShell(bash, fs, LOCAL_SHELL_HELP, args.cwd);
+        return;
+    }
     if (!apiKey) {
         process.stderr.write(args.bot
             ? `${colors.red}error:${colors.reset} no key for bot '${args.bot}'. Run \`sfora login --bot ${args.bot}\`.\n`
@@ -532,13 +750,21 @@ async function main() {
             baseUrl,
             apiKey,
             org: settings.org ?? "",
+            actAs: args.as,
         });
-        const client = new SforaApiClient({ baseUrl, apiKey });
+        const client = new SforaApiClient({ baseUrl, apiKey, actAs: args.as });
         try {
             await runVerb(args, fs, client);
         }
         catch (e) {
-            process.stderr.write(`${colors.red}error:${colors.reset} ${e instanceof Error ? e.message : String(e)}\n`);
+            const msg = e instanceof Error ? e.message : String(e);
+            // A 401 surfaces as EACCES once SforaFs maps it to an errno — translate it
+            // back into an actionable hint instead of a cryptic permission error.
+            const authExpired = e?.status === 401 ||
+                /EACCES|permission denied|invalid api key|unauthorized/i.test(msg);
+            process.stderr.write(`${colors.red}error:${colors.reset} ${authExpired
+                ? `your key is invalid or expired — run \`sfora login\`${args.bot ? ` --bot ${args.bot}` : ""}`
+                : msg}\n`);
             process.exitCode = 1;
         }
         return;
@@ -555,14 +781,10 @@ async function main() {
     }
     const org = settings.org;
     const { bash, fs } = createSforaShell({ baseUrl, apiKey, org, cwd: args.cwd });
-    // Shell state threaded across exec() calls — just-bash does not persist cwd/env
-    // between separate exec()s, so we carry them forward ourselves.
-    let cwd = args.cwd;
-    let env;
     // Pre-flight: confirm auth + connectivity and greet with the resolved identity.
     let identity = "";
     try {
-        identity = (await bash.exec("cat /me/api-key", { cwd, env })).stdout.trim();
+        identity = (await bash.exec("cat /me/api-key", { cwd: args.cwd })).stdout.trim();
     }
     catch {
         identity = "";
@@ -579,6 +801,13 @@ async function main() {
         console.log(`${colors.yellow}warning:${colors.reset} could not reach ${baseUrl} or authenticate — commands may fail.`);
     }
     console.log(`${colors.dim}Try: ls /projects · cat /inbox/mentions.md · ${colors.reset}${colors.cyan}help${colors.reset}${colors.dim} for commands · ${colors.reset}${colors.cyan}exit${colors.reset}${colors.dim} to quit${colors.reset}\n`);
+    await runShell(bash, fs, SHELL_HELP, args.cwd);
+}
+async function runShell(bash, fs, helpText, initialCwd) {
+    // Shell state threaded across exec() calls — just-bash does not persist cwd/env
+    // between separate exec()s, so we carry them forward ourselves.
+    let cwd = initialCwd;
+    let env;
     // Iterate stdin as an async iterable. This pattern serializes lines even
     // when stdin is piped (buffered) — the `for await` body completes before the
     // next line is consumed, and EOF naturally falls through to process exit
@@ -643,7 +872,7 @@ async function main() {
             break;
         // Show sfora's own help instead of just-bash's builtin help banner.
         if (line === "help" || line === "?" || line.startsWith("help ")) {
-            process.stdout.write(SHELL_HELP);
+            process.stdout.write(helpText);
             if (isTty)
                 process.stdout.write(promptText());
             continue;

package/dist/config.d.ts

@@ -1,3 +1,8 @@
+export interface SforaProfile {
+    url: string;
+    org?: string;
+    apiKey?: string;
+}
 export interface SforaConfig {
     url?: string;
     apiKey?: string;
@@ -6,6 +11,8 @@ export interface SforaConfig {
         apiKey?: string;
         org?: string;
     }>;
+    profiles?: Record<string, SforaProfile>;
+    activeProfile?: string;
 }
 export declare const CONFIG_PATH: string;
 export declare const DEFAULT_URL = "https://www.sfora.ai";
@@ -16,6 +23,17 @@ export interface ResolvedSettings {
     apiKey: string | undefined;
     org: string | undefined;
 }
+export declare function normalizeHost(url: string): string;
+export declare function profileKey(url: string, org?: string): string;
+export declare function effectiveProfiles(cfg: SforaConfig): Record<string, SforaProfile>;
+export declare function upsertProfile(cfg: SforaConfig, identity: {
+    url: string;
+    org?: string;
+    apiKey: string;
+}): {
+    cfg: SforaConfig;
+    key: string;
+};
 export declare function resolveSettings(flags: {
     url?: string;
     apiKey?: string;

package/dist/config.js

@@ -2,6 +2,12 @@
  * Persisted CLI config at ~/.sfora/config.json so you don't pass
  * SFORA_API_KEY / SFORA_URL on every invocation. Resolution precedence:
  * explicit flags > environment > config file > built-in default.
+ *
+ * The file holds *profiles* — one `{ url, org, apiKey }` context per
+ * deployment+org — so a single config can carry a prod key AND a dev key at
+ * once. `sfora login` adds/updates a profile instead of overwriting one shared
+ * key, which is what used to silently invalidate the other deployment's key and
+ * force constant re-auth.
  */
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -32,21 +38,107 @@ export async function writeConfig(cfg) {
 function pick(...vals) {
     return vals.find((v) => v != null && v !== "");
 }
+// Bare host, lowercased, for comparing/keying deployments regardless of scheme
+// or trailing slash.
+export function normalizeHost(url) {
+    try {
+        return new URL(url).host.toLowerCase();
+    }
+    catch {
+        return url
+            .replace(/^https?:\/\//, "")
+            .replace(/\/+$/, "")
+            .toLowerCase();
+    }
+}
+function sameHost(a, b) {
+    return !!a && !!b && normalizeHost(a) === normalizeHost(b);
+}
+// Stable, human-ish profile name: `host/org` (or just `host` when org-less).
+export function profileKey(url, org) {
+    const host = normalizeHost(url);
+    return org ? `${host}/${org}` : host;
+}
+// All contexts as a map, folding a legacy top-level identity into a synthesized
+// profile so resolution can treat everything uniformly.
+export function effectiveProfiles(cfg) {
+    const out = { ...(cfg.profiles ?? {}) };
+    if (cfg.apiKey) {
+        const url = cfg.url ?? DEFAULT_URL;
+        const key = profileKey(url, cfg.org);
+        if (!out[key])
+            out[key] = { url, org: cfg.org, apiKey: cfg.apiKey };
+    }
+    return out;
+}
+// Add (or replace) a profile for an identity and make it active. Also mirrors
+// the identity onto the legacy top-level fields for back-compat. Returns the
+// next config plus the profile key it was saved under.
+export function upsertProfile(cfg, identity) {
+    const key = profileKey(identity.url, identity.org);
+    // Seed from effectiveProfiles (not raw cfg.profiles) so a first login keeps
+    // any pre-existing legacy top-level identity as its own profile instead of
+    // overwriting it.
+    const profiles = { ...effectiveProfiles(cfg) };
+    profiles[key] = {
+        url: identity.url,
+        org: identity.org,
+        apiKey: identity.apiKey,
+    };
+    const next = {
+        ...cfg,
+        profiles,
+        activeProfile: key,
+        url: identity.url,
+        apiKey: identity.apiKey,
+        org: identity.org ?? cfg.org,
+    };
+    return { cfg: next, key };
+}
 export function resolveSettings(flags, cfg) {
-    const url = pick(flags.url, process.env.SFORA_URL, cfg.url) ?? DEFAULT_URL;
+    // Explicit intent (may be undefined). Used both to override fields and to
+    // select which stored profile to act as.
+    const wantUrl = pick(flags.url, process.env.SFORA_URL);
+    const wantOrg = pick(flags.org, process.env.SFORA_ORG);
     // `--bot <name>`: act as that saved bot. Don't fall back to the user's key /
     // SFORA_API_KEY env, so the identity is never silently the wrong one.
     if (flags.bot) {
         const bot = cfg.bots?.[flags.bot];
         return {
-            url,
+            url: pick(wantUrl, cfg.url) ?? DEFAULT_URL,
             apiKey: pick(flags.apiKey, bot?.apiKey),
             org: pick(flags.org, bot?.org, cfg.org),
         };
     }
+    // Pick the profile that best matches explicit intent, falling back to the
+    // active profile (last login), then the sole profile if there's only one.
+    const profiles = effectiveProfiles(cfg);
+    const list = Object.values(profiles);
+    let prof;
+    if (wantUrl && wantOrg)
+        prof = list.find((p) => sameHost(p.url, wantUrl) && p.org === wantOrg);
+    if (!prof && wantUrl)
+        prof = list.find((p) => sameHost(p.url, wantUrl));
+    if (!prof && wantOrg)
+        prof = list.find((p) => p.org === wantOrg);
+    // Convenience fallbacks (active profile, then the sole profile) apply ONLY
+    // when no explicit target was given. If the user named a url/org that matches
+    // nothing, prof stays undefined so we never substitute a different
+    // deployment's key.
+    if (!prof && !wantUrl && !wantOrg) {
+        if (cfg.activeProfile)
+            prof = profiles[cfg.activeProfile];
+        if (!prof && list.length === 1)
+            prof = list[0];
+    }
+    // Note: the legacy top-level identity is already folded into `profiles` by
+    // effectiveProfiles, so we deliberately do NOT fall back to cfg.apiKey here.
+    // If explicit url/org intent matches no profile, apiKey stays undefined and
+    // the CLI asks you to log in — rather than silently sending one deployment's
+    // key to another (the old "Invalid API key" trap).
     return {
-        url,
-        apiKey: pick(flags.apiKey, process.env.SFORA_API_KEY, cfg.apiKey),
-        org: pick(flags.org, process.env.SFORA_ORG, cfg.org),
+        url: pick(flags.url, process.env.SFORA_URL, prof?.url) ?? DEFAULT_URL,
+        apiKey: pick(flags.apiKey, process.env.SFORA_API_KEY, prof?.apiKey),
+        org: pick(flags.org, process.env.SFORA_ORG, prof?.org),
     };
 }

package/dist/config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config.test.js

@@ -0,0 +1,94 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { resolveSettings, upsertProfile, effectiveProfiles, profileKey, DEFAULT_URL, } from "./config.js";
+const DEV_URL = "https://valuable-llama-777.eu-west-1.convex.site";
+// resolveSettings reads SFORA_* env as a fallback — clear them so tests assert
+// the config/flag behavior in isolation.
+beforeEach(() => {
+    delete process.env.SFORA_URL;
+    delete process.env.SFORA_ORG;
+    delete process.env.SFORA_API_KEY;
+});
+describe("legacy migration", () => {
+    it("folds a legacy top-level identity into a profile", () => {
+        const cfg = {
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+        };
+        const profiles = effectiveProfiles(cfg);
+        expect(profiles[profileKey(DEFAULT_URL, "wavyr")]).toEqual({
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+        });
+    });
+    it("resolves the sole legacy identity with no flags", () => {
+        const cfg = {
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+        };
+        expect(resolveSettings({}, cfg)).toEqual({
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+        });
+    });
+});
+describe("no cross-deployment key reuse", () => {
+    it("does NOT send the prod key to an unmatched dev target", () => {
+        const cfg = {
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+        };
+        const r = resolveSettings({ url: DEV_URL, org: "test" }, cfg);
+        expect(r.url).toBe(DEV_URL);
+        expect(r.org).toBe("test");
+        // The whole point: no key rather than the wrong key.
+        expect(r.apiKey).toBeUndefined();
+    });
+});
+describe("profiles coexist (the fix)", () => {
+    it("login to dev does not clobber the prod key; each resolves by intent", () => {
+        let cfg = {
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+        };
+        // Simulate `sfora login` against dev.
+        cfg = upsertProfile(cfg, {
+            url: DEV_URL,
+            org: "test",
+            apiKey: "sfora_ak_dev",
+        }).cfg;
+        // Both keys are retained.
+        const profiles = effectiveProfiles(cfg);
+        expect(Object.keys(profiles)).toHaveLength(2);
+        // Prod still reachable by intent.
+        expect(resolveSettings({ org: "wavyr" }, cfg).apiKey).toBe("sfora_ak_prod");
+        expect(resolveSettings({ url: DEFAULT_URL }, cfg).apiKey).toBe("sfora_ak_prod");
+        // Dev reachable by intent.
+        expect(resolveSettings({ org: "test" }, cfg).apiKey).toBe("sfora_ak_dev");
+        // No intent → the last login (active profile) wins.
+        expect(resolveSettings({}, cfg)).toEqual({
+            url: DEV_URL,
+            org: "test",
+            apiKey: "sfora_ak_dev",
+        });
+    });
+});
+describe("bot identity", () => {
+    it("uses the named bot's key and never the personal fallback", () => {
+        const cfg = {
+            url: DEFAULT_URL,
+            org: "wavyr",
+            apiKey: "sfora_ak_prod",
+            bots: { ci: { apiKey: "sfora_ak_ci", org: "wavyr" } },
+        };
+        const r = resolveSettings({ bot: "ci" }, cfg);
+        expect(r.apiKey).toBe("sfora_ak_ci");
+        const missing = resolveSettings({ bot: "nope" }, cfg);
+        expect(missing.apiKey).toBeUndefined();
+    });
+});