mirror of
https://github.com/hanzoai/cli.git
synced 2026-10-30 15:00:27 +00:00
zeekay
7188da8a81
hanzo.id answers an authorize request from the browser's latest session unless told otherwise, so a person holding several identities landed on whichever account the browser signed in last, and that account became active in place of the one they had. A second sign-in left hanzo/z expired behind hanzo/grundysolomun7 that way. Holding more than one identity, `auth login` now sends prompt=select_account, and hanzo.id shows the accounts signed in on that browser beside "Use another account". `--account` names the account instead (login_hint: an address as given, a held owner/name by its token's subject), and `--choose` shows the chooser regardless. An owner/name in an org with its own client signs in through that client. The account the person chose becomes active. One hanzo.id answered with on its own is filed beside the active identity, never in its place, and the output says which identity the terminal goes on as. `auth list` shows each identity's address, and a spent session's "sign in again" names the identity with --account. The loopback page is static and the port closes when the command returns. The detached account-menu process that held it for three minutes is gone, and with it a second way to switch identity and a remove that promoted whichever identity was left: `auth use` is the one way. `auth logout` ends the browser's issuer session through OIDC RP-Initiated Logout, via hanzo-cli's registered loopback on whatever port it binds, so the next sign-in asks again. It names the client by client_id and sends no id_token_hint: IAM ends every session the browser holds either way, and a hint would write a signed identity assertion into browser history. With no browser or terminal it prints the link.