[manthis]

ELI5

Orca can keep several accounts per AI coding agent (two Claude subscriptions, a work and a personal Codex, several Antigravity Google accounts…), but from the terminal you could only switch OpenCode and Devin. For everything else you had to click in the app — impossible on a headless host or from a script. This PR makes orca account select (and orca account rm) work for every agent that has saved accounts.

What Changed

Before: orca account select / rm accepted only --agent opencode|devin, took only an id, and orca account list showed Claude/Codex accounts by email only (no id to pass, no Antigravity block).

After:

orca account list
# Managed Claude accounts (2):
#   system  System default
#   b975…  me@work.example (active)
#   1bfb…  me@perso.example
# … Codex, OpenCode, Devin, and Antigravity when the host can read it

orca account select --agent claude      --account me@perso.example   # id, email or system
orca account select --agent codex       --account system
orca account select --agent opencode    --account perso              # id or label
orca account select --agent antigravity --account me@gmail.example   # id, email or subject
orca account rm     --agent codex       --account old@example.com
orca account list   --agent claude                                   # one provider

Mechanism — CLI only, no runtime or wire change. One provider table in the new src/cli/handlers/account-selection.ts maps each agent to the runtime methods the status-bar switcher and Settings already use:

Agent	list	select	rm
claude	accounts.list	accounts.selectClaude	accounts.removeClaude
codex	accounts.list	accounts.selectCodex / selectCodexForTarget (WSL bridge)	accounts.removeCodex
opencode, devin	accounts.listData	accounts.selectData	accounts.removeData
antigravity	accounts.antigravityList	accounts.antigravitySelect	accounts.antigravityRemove

--account resolution is shared: exact id first, then a case-insensitive email / label / subject, or system for the provider's own sign-in.

• A name matching several accounts (one email signed into two organizations) is refused with their ids instead of guessing which subscription to bill or delete. An unknown account is refused before any mutation.
• system is refused for Antigravity (its vault has no system default), for Claude from the WSL bridge (selectClaude has no target and would reset the Windows host — same guard as feat(cli): select the Claude or Codex account from orca account select #26870), and always for rm (system credentials are never removed).
• --agent is required for select/rm, and a valueless --agent/--account is rejected rather than defaulted.
• Capability gates are kept: OpenCode/Devin still check accounts.managed-data-profiles.v1, Antigravity checks accounts.antigravity-native.v1. In the full account list, an older host — or one that advertises the capability but has no native credential adapter (Linux today) — simply omits the Antigravity block; account list --agent antigravity still reports why.
• Help, root help and docs/site/content/docs/cli/reference.mdx updated. mutateDataAccount is replaced by the shared path.

Why

The runtime has exposed account switching over RPC for every one of these providers for a while; only the CLI surface was missing, so headless hosts (orca serve) and coordinating agents that create workspaces with orca worktree create --agent … could not choose which subscription they run on.

This builds on the design of #26870 (Claude/Codex only, by @pawel-kotowski — id/email resolution, ambiguity refusal, WSL guards), which is currently conflicting with main, and extends it to every provider with saved accounts, as requested in #29227 for Antigravity. Happy to coordinate if you prefer to land #26870 first.

Not done here: Grok, Cursor, Gemini, Kimi, Z.ai/GLM, MiniMax and Copilot have a single native login or API key in Orca, so there is nothing to select. A per-workspace --account on worktree create is a natural follow-up once per-account Claude folders (#26801) land.

Linked Issue

Fixes #26875
Fixes #29227

Visual Proof

N/A — CLI-only change; output examples above.

Testing

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

• New src/cli/handlers/account-selection.test.ts (37 tests): every provider × select/rm hits the right RPC with the right params, and nothing else mutates; email/label/subject resolution ignoring case; ambiguous and unknown accounts refused without mutation; system mapping and refusals; Codex selectCodexForTarget and Antigravity target from the WSL bridge; missing capabilities; valueless flags; list --agent, the Antigravity block, an older host, and a host whose Antigravity listing throws; formatter output.

• Updated expectations in account.test.ts and specs/account.test.ts.

• pnpm tc:cli clean, oxlint clean, check:code-quality:changed → 0 new findings; src/cli/handlers + src/cli/specs: 641 tests pass.

• src/cli/runtime/launch*.test.ts (28 tests) fail on this Linux box identically on unmodified main (they spawn /opt/orca/orca-ide); unrelated to this change.

• Real run on Linux (Orca 1.4.230 runtime, two saved Claude accounts), with the CLI built from this branch: account list shows ids and the system row; select --agent claude --account MAXIME@… switched the active account (case-insensitive), --account system switched back; unknown account, rm --account system, and --agent gemini were refused with exit 1. On this host the runtime advertises Antigravity but cannot list it ("Linux Secret Service needs a verified adapter"), which surfaced the full-list fallback above. Not tested on macOS/Windows/WSL by hand; those paths are covered by unit tests.

AI Disclosure

Written with Claude Code (Claude Opus 5.5), reviewed by me.

Review

• Cross-platform: no path or platform logic added; WSL routing reuses getWslAccountTarget.
• SSH/remote: account commands stay host-local (rejectAccountRemoteSelectionFlags unchanged).
• Agents/integrations: provider-specific behaviour lives only in the provider table.
• Performance: one list RPC before each select/rm; accounts.list keeps refreshUsage: false.
• Security: rm stays destructive, never touches system credentials, and refuses ambiguous names.

Agent skill upstream boundary

• Not applicable, or this change copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

No runtime, protocol or mobile change; older runtimes keep working through the existing capability gates.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred) — tc:cli, oxlint, changed-code quality and CLI tests run locally; CI covers the rest

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

The CLI adds account selection and removal for Claude, Codex, OpenCode, Devin, and Antigravity. Account queries resolve by exact ID or case-insensitive name, with errors for ambiguous or unknown matches. Account listing displays saved IDs and can include Antigravity accounts. Provider operations support WSL targeting where specified. Help text, command specifications, tests, and reference documentation cover the expanded behavior.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: 🔵 Low · up to e3d71

A capability-check failure can make orca account list fail even after account data was retrieved. This is a bounded, recoverable CLI availability risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 24 functions across 10 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: adding selection and removal of saved agent accounts to the CLI.
Description check		The description is complete and aligned with the repository template. It explains the user-facing change, implementation, rationale, linked issues, testing, platform considerations, risks, and checkli…
Linked Issues check		The PR meets the coding requirements for [#26875] and [#29227]. It adds CLI listing, selection, and removal for Claude, Codex, OpenCode, Devin, and Antigravity. Account IDs and active state are shown.…
Out of Scope Changes check		The changes stay within the linked issue scope. The handlers, formatter, tests, help text, and CLI reference support account listing, selection, removal, resolution, and provider capability handling. …

Full details: Description check

Explanation

The description is complete and aligned with the repository template. It explains the user-facing change, implementation, rationale, linked issues, testing, platform considerations, risks, and checklist status. It also documents known unrelated Linux test failures and remaining manual-test limits.

Full details: Linked Issues check

Explanation

The PR meets the coding requirements for [#26875] and [#29227]. It adds CLI listing, selection, and removal for Claude, Codex, OpenCode, Devin, and Antigravity. Account IDs and active state are shown. Resolution supports IDs and case-insensitive names, and rejects ambiguous or unknown accounts before mutation. Provider capability gates and WSL routing remain in place. Tests cover provider routing, guards, capabilities, WSL behavior, resolution, and output. The PR documents that selection affects later host launches. Per-account Claude folders and Antigravity account addition are separate or optional issue scope.

Full details: Out of Scope Changes check

Explanation

The changes stay within the linked issue scope. The handlers, formatter, tests, help text, and CLI reference support account listing, selection, removal, resolution, and provider capability handling. Removing mutateDataAccount consolidates the existing data-account path into the shared implementation. No unrelated runtime, protocol, workspace-binding, or provider changes are shown.

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6e0ba0d9-2659-4ee3-823f-cd450eabb403

📥 Commits

Reviewing files that changed from the base of the PR and between 90e99c4 and d0d204d.

📒 Files selected for processing: 12

• docs/site/content/docs/cli/reference.mdx
• src/cli/handlers/account-list-format.ts
• src/cli/handlers/account-selection.test.ts
• src/cli/handlers/account-selection.ts
• src/cli/handlers/account.test.ts
• src/cli/handlers/account.ts
• src/cli/handlers/data-account-commands.ts
• src/cli/help.ts
• src/cli/root-help-text-primary.ts
• src/cli/root-help-text-secondary.ts
• src/cli/specs/account.test.ts
• src/cli/specs/account.ts

💤 Files with no reviewable changes: 1

• src/cli/handlers/data-account-commands.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (1)

🟡 Minor · Contain status.get failures in the optional Antigravity read. · account-selection.ts:148-167

src/cli/handlers/account-selection.ts:148-167
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Contain status.get failures in the optional Antigravity read.

readAntigravityAccountsForList can call status.get after accounts.list succeeds. If that capability probe rejects, the rejection occurs before the optional-list fallback and escapes the account list handler. orca account list then fails instead of returning the Claude, Codex, OpenCode, and Devin results.

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ab7c16e4-5187-486a-a8f5-39cbac8eef86

📥 Commits

Reviewing files that changed from the base of the PR and between d0d204d and e3d71d2.

📒 Files selected for processing: 1

• src/cli/handlers/account-selection.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.