ymmv-cli 0.10.0 → 0.11.1

package/README.md

@@ -69,16 +69,21 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 
 - `NO_COLOR` disables color output (and `FORCE_COLOR=0`/`false` force-disables it).
 - `YMMV_API` points the CLI at a different Worker (development/staging). Bare origin only. That
-  Worker must be deployed with or after this CLI release: `ymmv login` requires the account id the
-  login response carries and refuses (revoking what it minted) otherwise.
+  Worker must be deployed with or after this CLI release: `ymmv login` requires every field the
+  login response carries (the account id, and on a re-login the server's answer to retiring the
+  previous token) and refuses (revoking what it minted) otherwise, `YMMV_TOKEN` needs the
+  server's account lookup, and `ymmv`, `ymmv set`, and `ymmv unset` need the profile lookup they
+  read from before writing.
 - `YMMV_TOKEN` authenticates without a browser (CI and scripts, below). Takes precedence over
   the stored login and is read-only: the CLI never writes, revokes, or deletes it, and
-  `ymmv login` / `ymmv logout` keep acting on the stored login. Viewing (`ymmv <handle>`) also
-  keeps using the stored login for the you-side of a diff. The token is sent to the server
-  `YMMV_API` selects, so set the two together.
-- `YMMV_HANDLE` names the GitHub username `YMMV_TOKEN` belongs to. Required for `ymmv -y` and
-  `ymmv set`/`unset` under an env token (there is no server lookup for it); ignored without
-  `YMMV_TOKEN`.
+  `ymmv login` / `ymmv logout` keep acting on the stored login. The CLI asks the server which
+  account the token belongs to, so every command, including the you-side of a `ymmv <handle>`
+  diff, runs as that account. The token is sent to the server `YMMV_API` selects, so set the
+  two together.
+- `YMMV_HANDLE` is optional. When set, it must name the GitHub username `YMMV_TOKEN` belongs
+  to: if the server reports a different account, `ymmv -y`, `ymmv set`/`unset`, and
+  `ymmv delete` refuse before sending anything, and `ymmv <handle>` shows the profile without
+  a diff. Ignored without `YMMV_TOKEN`.
 - `YMMV_NO_UPDATE_CHECK` disables the startup check for newer releases (the ecosystem-standard
   `NO_UPDATE_NOTIFIER` works too). The check is also off automatically under `CI`, in pipes,
   and in dev builds; it never blocks or fails a command.
@@ -91,7 +96,8 @@ Every profile is open JSON too: `GET https://ymmv.fyi/api/v1/u/<handle>`. Full c
 2. Copy the `token` value from the token file:
    `~/.config/ymmv/token.json` (Linux), `~/Library/Preferences/ymmv/token.json` (macOS),
    `%APPDATA%\ymmv\Config\token.json` (Windows).
-3. Set it as a CI secret named `YMMV_TOKEN`, and set `YMMV_HANDLE` to your GitHub username.
+3. Set it as a CI secret named `YMMV_TOKEN`. Setting `YMMV_HANDLE` to your GitHub username is
+   optional, and makes the job fail if the secret ever holds another account's token.
 4. Run `npx ymmv-cli@latest -y` in the job.
 
 Two things to know:
@@ -100,9 +106,12 @@ Two things to know:
   runs on. Values you already published always win, but curated keys you have never set get the
   CI runner's detected values (its OS, shell, and so on). For targeted updates from CI, prefer
   `ymmv set <key> <value>`.
-- A rejected or revoked `YMMV_TOKEN` fails with an error naming the variable; nothing falls back
-  to an interactive login, and the stored login file on the runner (if any) is left untouched.
-  `ymmv delete` acts on the account the token is bound to, regardless of `YMMV_HANDLE`.
+- A rejected or revoked `YMMV_TOKEN` fails `ymmv -y`, `ymmv set`/`unset`, and `ymmv delete` with
+  an error naming the variable; nothing falls back to an interactive login, and the stored login
+  file on the runner (if any) is left untouched. `ymmv <handle>` still shows the profile, with the
+  reason there is no diff on stderr, and exits 0.
+  `ymmv delete` acts on the account the token is bound to and names that account's page when
+  it asks for confirmation.
 
 ## License
 

package/dist/cli.js

@@ -257,6 +257,34 @@ function diff(mine, theirs) {
   };
 }
 
+// ../shared/dist/display-url.js
+var PARSER_STRIPS = /[\t\n\r]/g;
+var HTTP_RE = /^https?:[/\\]*([^/?#\\]*)([/?#\\][\s\S]*)?$/i;
+function trimC0(s) {
+  let start = 0;
+  let end = s.length;
+  while (start < end && s.charCodeAt(start) <= 32)
+    start++;
+  while (end > start && s.charCodeAt(end - 1) <= 32)
+    end--;
+  return s.slice(start, end);
+}
+function displayUrl(value) {
+  const raw = value.trim();
+  const input = trimC0(raw.replace(PARSER_STRIPS, ""));
+  const m = HTTP_RE.exec(input);
+  if (!m)
+    return raw;
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    return raw;
+  }
+  const prefix = url.protocol === "http:" ? "http://" : "";
+  return `${prefix}${url.host}${m[2] ?? ""}`;
+}
+
 // ../shared/dist/github.js
 var GITHUB_CLIENT_ID = "Ov23liMoD29eizQcN1KZ";
 function isGithubId(x) {
@@ -410,12 +438,10 @@ function colorEnabled() {
 }
 var OSC = `${ESC}]`;
 var ST = `${ESC}\\`;
-function displayUrl(value) {
-  return value.trim().replace(/^https:\/\/(?=.)/i, "");
-}
 var HTTP_URL_RE = /^https?:\/\/\S+$/i;
 function isHttpUrl(value) {
-  return HTTP_URL_RE.test(value.trim());
+  const t = value.trim();
+  return HTTP_URL_RE.test(t) && URL.canParse(t);
 }
 var NO_OSC8_TERMS = /* @__PURE__ */ new Set(["linux", "dumb"]);
 function link(url, color, term = process.env.TERM, label) {
@@ -684,19 +710,34 @@ async function bodyJson(res) {
     return null;
   }
 }
+var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (invalid or revoked).";
+var ENV_TOKEN_REJECTED_MINT_AGAIN = `${ENV_TOKEN_REJECTED} Mint a new one with \`ymmv login\` on an interactive machine and update YMMV_TOKEN.`;
+function parseIdentity(data) {
+  if (typeof data !== "object" || data === null) return null;
+  const { handle: rawHandle, github_id: id } = data;
+  const handle = rawHandle === null ? null : typeof rawHandle === "string" ? sanitizeValue(rawHandle) : void 0;
+  if (handle === void 0 || handle !== null && !isValidHandle(handle) || !isGithubId(id)) {
+    return null;
+  }
+  return { github_id: id, handle };
+}
+function serverBehindHint() {
+  return process.env.YMMV_API ? "Point YMMV_API at an up-to-date server." : "The server is behind this CLI release; try again later.";
+}
 var MintRejected = class extends Error {
   constructor(msg) {
     super(msg);
     this.name = "MintRejected";
   }
 };
-async function mintYmmvToken(accessToken) {
+async function mintYmmvToken(accessToken, revoke) {
   const res = await safeFetch(
     `${BASE}/api/v1/auth/token`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ access_token: accessToken }),
+      // JSON.stringify drops an undefined `revoke`: no key on the wire when there is nothing to retire.
+      body: JSON.stringify({ access_token: accessToken, revoke }),
       // Never follow a redirect: a 30x must fail (the existing `!res.ok` guard rejects the resulting
       // opaqueredirect), not re-POST the GitHub access_token to the redirect target or read a
       // redirected 200 as a successful mint. Mirrors publish/delete in api.ts.
@@ -731,22 +772,57 @@ async function mintYmmvToken(accessToken) {
     throw new Error(`login failed: ${res.status} ${wireText(slug)}`.trim());
   }
   const data = await bodyJson(res);
-  const unexpected = `Unexpected response from ${BASE}. Nothing was saved; run \`ymmv login\` again.`;
+  const unexpected = `Unexpected response from ${BASE}. Nothing was saved` + (revoke === void 0 ? "" : " (the previous login on this machine may have been signed out)") + "; run `ymmv login` again.";
   if (!data) throw new Error(unexpected);
   const token = typeof data.token === "string" && data.token.length > 0 ? data.token : null;
-  const handle = data.handle === null ? null : typeof data.handle === "string" ? sanitizeValue(data.handle) : void 0;
-  if (token === null || handle === void 0 || handle !== null && !isValidHandle(handle) || !isGithubId(data.github_id)) {
+  const identity = parseIdentity(data);
+  const revoked = typeof data.revoked === "boolean" ? data.revoked : void 0;
+  const behind = token !== null && identity !== null && revoke !== void 0 && revoked === void 0 ? `${BASE} did not retire the previous login. ${serverBehindHint()} Nothing was saved; to log in anyway, run \`ymmv logout\` first.` : null;
+  if (token === null || identity === null || behind !== null) {
     let revokeFailed = false;
     if (token !== null) {
       await revokeYmmvToken(token, AbortSignal.timeout(REVOKE_CAP_MS)).catch(() => {
         revokeFailed = true;
       });
     }
+    const refusal = behind ?? unexpected;
     throw new MintRejected(
-      revokeFailed ? `${unexpected} The login the server minted could not be revoked.` : unexpected
+      revokeFailed ? `${refusal} The login the server minted could not be revoked.` : refusal
     );
   }
-  return { token, handle, github_id: data.github_id };
+  return { token, ...identity };
+}
+function missingRouteError(missing) {
+  return new Error(`${BASE} has no ${missing}. ${serverBehindHint()}`);
+}
+async function fetchWhoami(token) {
+  const res = await safeFetch(
+    `${BASE}/api/v1/auth/whoami`,
+    {
+      headers: { authorization: `Bearer ${token}` },
+      // Never follow a redirect: the bearer must not travel to a redirect target, and a 30x→200
+      // must not read as a verified identity. Same guard as mint, logout, publish, and delete.
+      redirect: "manual"
+    },
+    BASE
+  );
+  if (!res.ok) {
+    if (res.status === 401) throw new Error(ENV_TOKEN_REJECTED_MINT_AGAIN);
+    if (res.status === 404) {
+      throw missingRouteError("identity lookup for YMMV_TOKEN");
+    }
+    throw new Error(
+      withRetryHint(
+        await serverMessage(res) ?? (res.status === 429 ? "rate limited, too many requests" : `The server couldn't look up your token (${res.status}). Try again shortly.`),
+        res
+      )
+    );
+  }
+  const identity = parseIdentity(await bodyJson(res));
+  if (!identity) {
+    throw new Error(`Unexpected response from ${BASE}. Check YMMV_API, or try again shortly.`);
+  }
+  return identity;
 }
 async function revokeYmmvToken(token, signal) {
   const res = await safeFetch(
@@ -954,6 +1030,9 @@ async function pollForToken(dc, deps = {}) {
   }
   throw new Error("Device code expired. Run `ymmv login` again.");
 }
+function retirable(cred) {
+  return cred != null && cred.base === BASE && cred.token.trim() !== "";
+}
 async function login(deps = {}) {
   if (!process.stdin.isTTY) {
     throw new Error(
@@ -986,18 +1065,23 @@ ${c.faint}waiting for GitHub approval\u2026 (Ctrl+C to cancel)${c.reset}`
     )
   );
   const accessToken = await pollForToken(dc, deps);
-  const minted = await mintYmmvToken(accessToken);
-  const replaced = await peekCredential();
+  const before = await peekCredential();
+  const revoke = retirable(before) ? before.token : void 0;
+  const minted = await mintYmmvToken(accessToken, revoke);
+  const after = await peekCredential();
   try {
     await saveToken(minted);
   } catch (e) {
     await revokeYmmvToken(minted.token).catch(() => {
+      console.error(
+        message(`${c.faint}(the login the server minted could not be revoked)${c.reset}`)
+      );
     });
     throw e;
   }
-  if (replaced && replaced.base === BASE && replaced.token !== minted.token) {
+  if (retirable(after) && after.token !== revoke && after.token !== minted.token) {
     try {
-      await revokeYmmvToken(replaced.token);
+      await revokeYmmvToken(after.token);
     } catch {
       console.error(message(`${c.faint}(couldn't revoke the previous session's token)${c.reset}`));
     }
@@ -1016,8 +1100,20 @@ var PublishRefusal = class extends Error {
     this.name = "PublishRefusal";
   }
 };
-var ENV_TOKEN_REJECTED = "The server rejected the token in YMMV_TOKEN (revoked or expired).";
+var ProfileChanged = class extends PublishRefusal {
+  constructor() {
+    super("Your profile changed since this command read it. Re-run the command.");
+    this.name = "ProfileChanged";
+  }
+};
 var NOT_PERSISTED = "Login did not persist a token. Run `ymmv login`.";
+function assertVerified(cred) {
+  if (cred.source === "env" && cred.github_id === null) {
+    throw new PublishRefusal(
+      "Internal error: the YMMV_TOKEN credential was not verified. This is a ymmv-cli bug; please report it at https://github.com/ymmv-fyi/ymmv/issues."
+    );
+  }
+}
 async function rateLimitMessage(res) {
   return withRetryHint(await serverMessage(res) ?? "rate limited, too many requests", res);
 }
@@ -1032,20 +1128,35 @@ async function loginOrRefuse() {
   if (!fresh) throw new PublishRefusal(NOT_PERSISTED);
   return fresh;
 }
+async function verifyEnvCredential(cred) {
+  const identity = await fetchWhoami(cred.token);
+  const claimed = cred.handle;
+  if (claimed !== null && claimed.toLowerCase() !== identity.handle?.toLowerCase()) {
+    const shown = `YMMV_HANDLE is "${sanitizeValue(claimed)}"`;
+    throw new Error(
+      identity.handle === null ? `${shown} but the YMMV_TOKEN account has no handle bound.` : `${shown} but YMMV_TOKEN belongs to "${identity.handle}". Fix or unset YMMV_HANDLE.`
+    );
+  }
+  return { ...cred, handle: identity.handle, github_id: identity.github_id };
+}
 async function ensureLogin() {
   const existing = await loadCredential();
-  if (existing) return existing;
+  if (existing) return existing.source === "env" ? verifyEnvCredential(existing) : existing;
   await login();
   const fresh = await loadCredential();
   if (!fresh) throw new Error(NOT_PERSISTED);
   return fresh;
 }
-async function publishProfile(profile, expected) {
+async function publishProfile(profile, expected, opts = {}) {
   const send = (c) => safeFetch(
     `${BASE}/api/v1/profile`,
     {
       method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${c.token}` },
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${c.token}`,
+        ...opts.ifMatch ? { "if-match": opts.ifMatch } : {}
+      },
       // Send the login-bound handle, never a caller-guessed one — the official client never claims
       // a handle it doesn't own.
       body: JSON.stringify({ ...profile, handle: c.handle ?? profile.handle }),
@@ -1054,11 +1165,13 @@ async function publishProfile(profile, expected) {
     },
     BASE
   );
-  let cred = await loadCredential();
+  assertVerified(expected);
+  let cred = expected.source === "env" ? expected : await loadCredential();
   if (!cred) {
     console.log(message("Not logged in. Logging in to publish."));
     cred = await loginOrRefuse();
   }
+  assertVerified(cred);
   const idDrifted = expected.source === "file" && (expected.github_id === null ? cred.github_id !== null : cred.github_id !== expected.github_id);
   if ((cred.handle ?? "").toLowerCase() !== profile.handle.toLowerCase() || idDrifted) {
     throw new PublishRefusal(
@@ -1069,7 +1182,11 @@ async function publishProfile(profile, expected) {
   if (res.status === 401 || res.status === 409) {
     if (cred.source === "env") {
       throw new PublishRefusal(
-        res.status === 401 ? `${ENV_TOKEN_REJECTED} Mint a new one with \`ymmv login\` on an interactive machine and update YMMV_TOKEN.` : "The server no longer accepts this handle for the YMMV_TOKEN account. Update YMMV_HANDLE, or mint a fresh token with `ymmv login`."
+        res.status === 401 ? ENV_TOKEN_REJECTED_MINT_AGAIN : (
+          // The handle came from whoami moments ago, so a 409 means the bind changed in between
+          // (a re-login on another machine after a GitHub rename). A fresh run looks it up again.
+          "The server no longer accepts this handle for the YMMV_TOKEN account. Re-run the command."
+        )
       );
     }
     const was401 = res.status === 401;
@@ -1117,6 +1234,7 @@ async function publishProfile(profile, expected) {
       );
     }
   }
+  if (res.status === 412) throw new ProfileChanged();
   if (res.status === 429) throw new Error(await rateLimitMessage(res));
   if (!res.ok) {
     const raw = await wireBody(res);
@@ -1142,7 +1260,42 @@ async function fetchProfileJson(handle) {
   }
   return parseProfile(await res.json());
 }
+var HEADER_SAFE_TAG = /^[!#-~]{1,128}$/;
+async function fetchOwnProfile(cred) {
+  assertVerified(cred);
+  const res = await safeFetch(
+    `${BASE}/api/v1/profile`,
+    {
+      headers: { authorization: `Bearer ${cred.token}` },
+      // Never follow a redirect: the bearer must not travel to a redirect target, and a 30x→200
+      // must not read as a profile. Same guard as whoami, mint, logout, publish, and delete.
+      redirect: "manual"
+    },
+    BASE
+  );
+  if (res.status === 401) {
+    throw new Error(
+      cred.source === "env" ? ENV_TOKEN_REJECTED_MINT_AGAIN : "Session expired. Run `ymmv login`, then re-run the command."
+    );
+  }
+  if (res.status === 404) {
+    const { slug } = wireErrorBody(await wireBody(res));
+    if (slug === "not_found") return null;
+    throw missingRouteError("profile lookup");
+  }
+  if (res.status === 429) throw new Error(await rateLimitMessage(res));
+  if (!res.ok) {
+    const raw = await wireBody(res);
+    throw new Error(withRetryHint(`fetch failed: ${res.status} ${wireText(raw)}`, res));
+  }
+  const profile = parseProfile(await res.json());
+  if (!HEADER_SAFE_TAG.test(profile.updated_at)) {
+    throw new Error(`Unexpected response from ${BASE}. Check YMMV_API, or try again shortly.`);
+  }
+  return { profile, etag: `"${profile.updated_at}"` };
+}
 async function deleteProfile(cred) {
+  assertVerified(cred);
   const res = await safeFetch(
     `${BASE}/api/v1/profile`,
     {
@@ -1529,16 +1682,16 @@ function requireHandle(cred) {
   if (cred.handle) return cred.handle;
   console.error(
     message(
-      cred.source === "env" ? "YMMV_TOKEN is set but YMMV_HANDLE is not. Set YMMV_HANDLE to the GitHub username the token belongs to." : "Your GitHub username is a reserved word, so no handle is bound. Rename on GitHub, then run `ymmv login` again."
+      cred.source === "env" ? "The account behind YMMV_TOKEN has no handle bound. Run `ymmv login` on an interactive machine, as the same GitHub account, to rebind it. If that GitHub username is a reserved word, rename on GitHub first." : "Your GitHub username is a reserved word, so no handle is bound. Rename on GitHub, then run `ymmv login` again."
     )
   );
   process.exitCode = 1;
   return null;
 }
-function assertHandleUnchanged(existing, handle) {
+function assertHandleUnchanged(existing, cred, handle) {
   if (existing && existing.handle.toLowerCase() !== handle.toLowerCase()) {
     throw new Error(
-      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". Run \`ymmv login\` to refresh, then retry.`
+      `This login is bound to "${handle}" but your profile now lives at "${sanitizeValue(existing.handle)}". ${cred.source === "env" ? "Re-run the command." : "Run `ymmv login` to refresh, then retry."}`
     );
   }
 }
@@ -1600,11 +1753,13 @@ async function publish(io) {
       return readFileSync(p, "utf8");
     }
   });
-  const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  const own = await fetchOwnProfile(cred);
+  const existing = own?.profile ?? null;
+  assertHandleUnchanged(existing, cred, handle);
   const defaults = buildDefaults(existing, detected);
-  const carried = unknownEntries(existing);
-  const extras = existing?.extras ?? [];
+  let carried = unknownEntries(existing);
+  let extras = existing?.extras ?? [];
+  let ifMatch = own?.etag;
   const color = colorEnabled();
   const site = displayUrl(BASE);
   const showCard = (entries) => {
@@ -1632,6 +1787,15 @@ async function publish(io) {
   };
   let values = defaults;
   const assemble = () => [...entriesFromMap(values), ...carried];
+  const edits = /* @__PURE__ */ new Map();
+  const prompt = async (prompter) => {
+    const before = values;
+    values = await promptEntries(values, prompter);
+    for (const key of CURATED_KEYS) {
+      const after = values.get(key);
+      if (after !== before.get(key)) edits.set(key, after);
+    }
+  };
   if (!io.interactive || !io.prompter || io.yes) {
     const over = [...values].find(([, v]) => v.length > MAX_VALUE);
     if (over) {
@@ -1645,11 +1809,14 @@ async function publish(io) {
     }
     const entries = assemble();
     showCard(entries);
-    printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
+    printPublished(
+      await publishProfile(newProfile(handle, entries, extras), cred, { ifMatch }),
+      color
+    );
     return;
   }
   try {
-    if (!existing) values = await promptEntries(values, io.prompter);
+    if (!existing) await prompt(io.prompter);
     for (; ; ) {
       const entries = assemble();
       showCard(entries);
@@ -1661,9 +1828,37 @@ async function publish(io) {
       );
       if (ans === "y") {
         try {
-          printPublished(await publishProfile(newProfile(handle, entries, extras), cred), color);
+          printPublished(
+            await publishProfile(newProfile(handle, entries, extras), cred, { ifMatch }),
+            color
+          );
           return;
         } catch (e) {
+          if (e instanceof ProfileChanged) {
+            console.error(
+              message(
+                "Your profile changed since this command read it. Reloaded the current version; your answers are kept."
+              )
+            );
+            const liveCred = cred.source === "env" ? cred : await loadCredential() ?? cred;
+            const fresh = await fetchOwnProfile(liveCred);
+            if (!fresh) {
+              throw new PublishRefusal(
+                "Your profile was deleted since this command read it. Nothing was published. Run `ymmv` again to recreate it."
+              );
+            }
+            assertHandleUnchanged(fresh.profile, cred, handle);
+            const rebased = buildDefaults(fresh.profile, detected);
+            for (const [key, value] of edits) {
+              if (value === void 0) rebased.delete(key);
+              else rebased.set(key, value);
+            }
+            values = rebased;
+            carried = unknownEntries(fresh.profile);
+            extras = fresh.profile.extras;
+            ifMatch = fresh.etag;
+            continue;
+          }
           if (e instanceof PromptAborted || e instanceof PublishRefusal) throw e;
           const ambiguous = e instanceof NetworkError || isTimeoutError(e);
           console.error(
@@ -1679,7 +1874,7 @@ ${ambiguous ? "The publish may not have completed. Your answers are kept." : "No
         console.log(message("Aborted. Nothing published."));
         return;
       }
-      values = await promptEntries(values, io.prompter);
+      await prompt(io.prompter);
     }
   } catch (e) {
     if (e instanceof PromptAborted) {
@@ -1698,7 +1893,26 @@ async function view(handle) {
     console.log(notFound(handle, c, BASE));
     return;
   }
-  const cred = await loadToken();
+  const plainCard = (note, wrap = true) => {
+    console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
+    if (note) {
+      const codes = palette(c);
+      console.error(message(`${codes.faint}${wrap ? `(${note})` : note}${codes.reset}`));
+    }
+  };
+  let cred = await loadCredential();
+  if (cred?.source === "env") {
+    try {
+      cred = await verifyEnvCredential(cred);
+    } catch (e) {
+      plainCard(`No diff: ${displayError(e)}`, false);
+      return;
+    }
+    if (cred.handle === null) {
+      plainCard("no diff: the account behind YMMV_TOKEN has no handle bound");
+      return;
+    }
+  }
   if (cred?.handle) {
     let mineFailed = false;
     const mine = await fetchProfileJson(cred.handle).catch(() => {
@@ -1712,24 +1926,24 @@ async function view(handle) {
       return;
     }
     if (!mine) {
-      console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
       if (mineFailed) {
-        const codes = palette(c);
-        console.error(message(`${codes.faint}(couldn't load your profile to diff)${codes.reset}`));
+        plainCard("couldn't load your profile to diff");
       } else {
+        plainCard();
         console.log(nudge(c));
       }
       return;
     }
   }
-  console.log(renderProfile(theirs, { color: c, site: displayUrl(BASE) }));
+  plainCard();
 }
 async function runSet(target) {
   const cred = await ensureLogin();
   const handle = requireHandle(cred);
   if (!handle) return;
-  const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  const own = await fetchOwnProfile(cred);
+  const existing = own?.profile ?? null;
+  assertHandleUnchanged(existing, cred, handle);
   const { entries, extras } = applySet(existing, target);
   if (target.kind === "extra" && extras.length > MAX_EXTRAS) {
     console.error(
@@ -1740,36 +1954,47 @@ async function runSet(target) {
     process.exitCode = 1;
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras), cred);
+  const res = await publishProfile(newProfile(handle, entries, extras), cred, {
+    ifMatch: own?.etag
+  });
   const line = target.kind === "curated" ? `Set ${KEY_LABELS[target.key]} = ${target.value}.` : `Set extra ${target.label} = ${target.value}.`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
+var PASTE_SAFE_LABEL = /^[\p{L}\p{N} _.+/:-]+$/u;
+function extraHint(existing, label) {
+  const eq = label.indexOf("=");
+  const head = eq > 0 ? label.slice(0, eq).trim() : "";
+  if (!head || !applyUnset(existing, { kind: "extra", label: head }).removed) return "";
+  const shown = PASTE_SAFE_LABEL.test(head) ? head : "Label";
+  return `
+(unset takes just the label: ymmv unset --extra "${shown}")`;
+}
 async function runUnset(target) {
   const cred = await ensureLogin();
   const handle = requireHandle(cred);
   if (!handle) return;
-  const existing = await fetchProfileJson(handle);
-  assertHandleUnchanged(existing, handle);
+  const own = await fetchOwnProfile(cred);
+  const existing = own?.profile ?? null;
+  assertHandleUnchanged(existing, cred, handle);
   if (!existing) {
     console.log(message("No profile yet. Run `ymmv` to publish one."));
     return;
   }
   const { entries, extras, removed } = applyUnset(existing, target);
   if (!removed) {
-    console.log(
-      message(
-        target.kind === "curated" ? `${KEY_LABELS[target.key]} is not set.` : `No extra "${target.label}".`
-      )
-    );
+    const line2 = target.kind === "curated" ? `${KEY_LABELS[target.key]} is not set.` : `No extra "${sanitizeValue(target.label)}".${extraHint(existing, target.label)}`;
+    console.log(message(line2));
     return;
   }
-  const res = await publishProfile(newProfile(handle, entries, extras), cred);
+  const res = await publishProfile(newProfile(handle, entries, extras), cred, {
+    ifMatch: own?.etag
+  });
   const line = target.kind === "curated" ? `Removed ${KEY_LABELS[target.key]} (was "${sanitizeValue(removed.value)}").` : `Removed extra "${sanitizeValue(removed.label)}" (was "${sanitizeValue(removed.value)}").`;
   console.log(message(`${line}${pagePointer(res.handle)}`));
 }
 async function runDelete(io) {
   const cred = await ensureLogin();
-  const target = cred.source === "env" ? "the profile bound to YMMV_TOKEN" : cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : "your profile";
+  const target = cred.handle ? `${displayUrl(BASE)}/${sanitizeValue(cred.handle)}` : cred.source === "env" ? "the profile bound to YMMV_TOKEN" : "your profile";
   if (!io.yes) {
     if (!io.interactive || !io.prompter) {
       console.error(
@@ -1863,12 +2088,7 @@ function parseUnset(rest) {
   if (head === "--extra" || head === "-e") {
     const label = rest.slice(1).join(" ").trim();
     if (!label) return { kind: "error", message: `usage: ${UNSET_EXTRA}` };
-    if (label.includes("=")) {
-      return {
-        kind: "error",
-        message: 'unset takes just the label: ymmv unset --extra "Keyboard"'
-      };
-    }
+    if (label.length > MAX_LABEL) return labelCapError(label);
     return { kind: "unset", target: { kind: "extra", label } };
   }
   if (!head) return { kind: "error", message: UNSET_USAGE };
@@ -2233,7 +2453,9 @@ ${c.faint}Curated keys:${c.reset} editor, os, shell, prompt, terminal, browser,
               font, theme, multiplexer, version-manager, dotfiles, ai-tool`;
 async function logout() {
   const stored = await loadToken();
-  if (!stored) {
+  const leftover = stored ? null : await peekCredential();
+  const token = stored?.token ?? (retirable(leftover) ? leftover.token : null);
+  if (token === null) {
     const otherBase = await peekBase();
     console.log(
       message(
@@ -2244,7 +2466,7 @@ async function logout() {
   }
   let revoked;
   try {
-    revoked = await revokeYmmvToken(stored.token);
+    revoked = await revokeYmmvToken(token);
   } catch (e) {
     console.error(
       message(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ymmv-cli",
-  "version": "0.10.0",
+  "version": "0.11.1",
   "description": "Publish and diff terminal-native developer tool-stack profiles at ymmv.fyi.",
   "type": "module",
   "bin": {