blowhorn profile

blowhorn profile: auth, current, delete, get, list, set, status, switch.

The blowhorn profile commands. Each one's --help prints the same text.

blowhorn profile auth

Refresh authentication/session state for one or more platforms.

Supported platforms and authentication mechanisms:

linkedin - Persistent browser session. Automated login via LI_USERNAME / LI_PASSWORD in profile config.yaml, with fallback to manual browser entry.

x - Persistent browser session. Automated login via X_USERNAME / X_PASSWORD in profile config.yaml, with fallback to manual browser entry.

reddit - Persistent browser session. Automated login via RDDT_USERNAME / RDDT_PASSWORD in profile config.yaml, with fallback to manual browser entry.

slack - Hybrid: session credentials (xoxc token + d cookie) captured through the run's browser driver (the extension by default), saved to the profile's Slack credential in the store (never config.yaml), and reused for direct API calls. No Slack app install required. Use --workspace <host> to capture a new workspace; omit it to refresh every workspace listed under 'slack_workspaces' in that credential. Use --mode paste for the legacy OAuth-token flow.

bluesky - No browser. Logs in to Bluesky with a handle and app password -- the same login every post makes -- and stores the pair only when Bluesky accepts it, so a refused credential is never saved. For one named profile in a terminal it asks for both (the stored handle is the default; a blank app password keeps the stored one); --handle and --app-password-stdin supply them without a prompt. Otherwise the stored pair is logged in with and nothing is written.

Use --profile all to refresh every local profile after applying any --exclude filters.

With --headless the browser still opens, as a background window (Chrome is never run headless); only automated credential login is attempted and the manual browser fallback is skipped.

blowhorn profile auth [OPTIONS]

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile auth --platform x --profile lee
$ blowhorn profile auth --all --profile lee
$ blowhorn profile auth --platform slack --profile lee --workspace mesheryio.slack.com
$ blowhorn profile auth --platform slack --profile lee --mode paste
$ blowhorn profile auth --platform linkedin --profile all --headless
$ blowhorn profile auth --platform bluesky --profile lee
$ blowhorn profile auth --platform linkedin --profile kate --headed --json

Output: json with --json, text otherwise.

blowhorn profile current

Show the active profile after resolving CLI, env, and config defaults.

blowhorn profile current [OPTIONS]

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile current
$ blowhorn profile current --config ~/.blowhorn.yaml

Output: text.

blowhorn profile delete

Retire a profile by moving data/profiles/<name> -- config.yaml, data/ and every saved browser session -- to data/profiles/.trash/<name>-<timestamp>. Nothing is ever removed: the browser sessions are the expensive part of a profile and the move keeps them recoverable. The profile's row in the store's profiles is retired first (soft-deleted, so --profile all stops reaching it); a profile the store never listed just moves. Needs the store: unreachable is exit 3 and nothing moves. Requires --yes; --dry-run shows what would move and where.

blowhorn profile delete [OPTIONS] name

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile delete sam --dry-run
$ blowhorn profile delete sam --yes --json

Output: json with --json, text otherwise.

blowhorn profile get

Print one profile's settings with every secret masked: its config.yaml, with the GitHub keys (GH_*) read from its credential in the store. Keys whose names contain PASSWORD, SECRET, TOKEN or COOKIE are rendered as {"set": true} or {"set": false}; their values are never printed, in JSON or in the table. A store that cannot be reached leaves the GitHub keys out and is named on a Credentials: line.

blowhorn profile get [OPTIONS] name

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile get kate
$ blowhorn profile get kate --json

Output: json with --json, text otherwise.

blowhorn profile list

List available local profile directories.

blowhorn profile list [OPTIONS]

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile list

Output: text.

blowhorn profile set

Write KEY=VALUE pairs safely. GitHub keys (GH_TOKEN, GH_USERNAME) are stored in the profile's GitHub credential in the store, where runs read them, and never in the file; a blank value clears a key. Every other key goes into data/profiles/<name>/config.yaml: the file is round-tripped with its key order preserved, rewritten atomically under a file lock, and only the README template keys (plus GH_USERNAME, slack_workspaces and the <WORKSPACE>SLACK* session keys) are accepted unless --allow-unknown is passed. Every refusal comes before anything is written. The output names the keys that changed and never echoes a value. Replacing a credential an API check judges (GH_TOKEN, the Bluesky handle or app password, a Slack token or captured session) sets that platform back to not checked in profile status until the next check, because each such check records which credential it judged. A browser platform's check is about its saved session and stays.

--create makes a new profile in both halves: it resolves EMAIL to the Layer5 Cloud user the profile is bound to, writes the profile's row in the store's profiles, and only then scaffolds data/profiles/<name>/config.yaml from the template plus data/ and browser/. EMAIL is required. --create needs the store: when it cannot be reached the create is refused with exit 3, nothing is written on either side and no directory is scaffolded, because a profile with no row is one no job can select. An email no Layer5 Cloud user holds, or one that several hold, is refused by name; --subject <uuid> names the user directly on those two branches, is refused when it names no live user, and is refused when EMAIL resolves to someone else. A profile is never created without a Layer5 Cloud user: there is no --force. The same email already bound to another profile, or a name held by another user's profile, is refused rather than renamed.

--register adds a profile that exists only under data/profiles/ to the store's profiles: the same resolution and refusals, no scaffold, EMAIL read from config.yaml when not given, and safe to run again.

blowhorn profile set [OPTIONS] name [assignments...]

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile set kate EMAIL=kate@example.com X_USERNAME=katesuttons
$ blowhorn profile set sam --create PROFILE=sam EMAIL=sam@example.com
$ blowhorn profile set sam --create EMAIL=sam@example.com --subject 3f2b1c4d-8a9e-4c6b-9d1e-2a3b4c5d6e7f
$ blowhorn profile set sam --register
$ blowhorn profile set kate GH_TOKEN=ghp_yourtoken --json
$ blowhorn profile set lee slack_workspaces=mesheryio.slack.com,acme.slack.com
$ blowhorn profile set kate CUSTOM_NOTE=migrated --allow-unknown

Output: json with --json, text otherwise.

blowhorn profile status

Report what each local profile is set up for: the platforms it holds an account for (credential key names only -- values are never printed), the browser session directory and its last-modified time, whether another blowhorn process holds its lock, the last recorded session check, and whether the profile is excluded by default. No browser and no platform network by default: accounts are read from config.yaml, and GitHub's from the store, once for every profile. A store that cannot be reached leaves GitHub unknown and is named on a Credentials: line, not fatal, and a check made then skips GitHub and keeps its last recorded result.

--check-sessions runs a read-only probe per configured platform (LinkedIn, X and Reddit open the saved session in a background window and look for the signed-in page; GitHub, Bluesky and Slack call their APIs) and records the result in data/profiles/<name>/data/session_status.json. It never logs in, never types a credential, and reports 'busy' instead of waiting when a session is in use. --check-platform runs that same probe for one platform only and leaves every other platform's recorded result alone; --check-platform github checks the profile's GitHub token in the store against GitHub (the login it signs in as, its scopes and what they lack) with no browser at all. --roster additionally reads the profiles roster from the store to show which platforms each profile has a handle for; a store that cannot be reached is the named cause and exit 3, and a roster that reads empty or cannot be read is reported on a Roster: line, not fatal. --chrome additionally reads this machine's Chrome profile mappings from the store, once, and Chrome's own profile list, and adds a Chrome column: the mapped Chrome profile directory and whether the name and account recorded when it was mapped still match (drift, missing, unknown). A mapping is identity, never permission. A Chrome profile list that cannot be read is reported on a Chrome: line, not fatal.

blowhorn profile status [OPTIONS]

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile status
$ blowhorn profile status --json
$ blowhorn profile status --profile kate,rian --check-sessions --headless
$ blowhorn profile status --profile all --check-sessions --roster --json
$ blowhorn profile status --profile kate --check-platform github --json
$ blowhorn profile status --chrome
$ blowhorn profile status --check-sessions --dry-run

Output: json with --json, text otherwise.

blowhorn profile switch

Set a profile as the default profile in global config.

blowhorn profile switch [OPTIONS] name

Also takes the shared flags: --config, --log-dir, --profile, --exclude, --headless, --chrome-launch, --headed, --dry-run, --verbose.

Examples:

$ blowhorn profile switch james
$ blowhorn profile switch layer5

Output: text.