Summary
Replace the public per-invocation --ref <service>/<profile> selector with one inherited global --profile <name> selector in both gro and grw. This is a breaking CLI change: --ref must be rejected as unknown. Keep credential refs internal and preserve environment-over-config precedence, init guidance, and set-credential migration safety without saving one-shot profile selection to config.
Acceptance criteria
gro mail search "hello" --profile rstockbower, gro set-credential --profile rstockbower ..., and gro init --profile rstockbower use google-readonly/rstockbower.grw --profile <name> qualifies the name with its own registered default service.- Bare profile names use the existing credstore validation rules and fail before keyring or API access.
- Selection flows through the existing keychain override, retaining precedence:
--profile > <SERVICE>_CREDENTIAL_REF > config credential_ref.
init reports the qualified target and uses --profile in guidance without changing the active config.set-credential uses the inherited selector and keeps migration behavior centralized in keychain.Open().- Public help/docs and ref-source labels say
--profile; internal credential refs, config fields, environment overrides, and JSON ref fields remain unchanged.
- Set
version.txt to 2.0 and update stale local release documentation.
- Cover both binary identities, validation, inherited command-tree behavior, init guidance, set-credential targeting, and rejection of public
--ref in tests/checks.
Summary
Replace the public per-invocation
--ref <service>/<profile>selector with one inherited global--profile <name>selector in bothgroandgrw. This is a breaking CLI change:--refmust be rejected as unknown. Keep credential refs internal and preserve environment-over-config precedence, init guidance, and set-credential migration safety without saving one-shot profile selection to config.Acceptance criteria
gro mail search "hello" --profile rstockbower,gro set-credential --profile rstockbower ..., andgro init --profile rstockbowerusegoogle-readonly/rstockbower.grw --profile <name>qualifies the name with its own registered default service.--profile><SERVICE>_CREDENTIAL_REF> configcredential_ref.initreports the qualified target and uses--profilein guidance without changing the active config.set-credentialuses the inherited selector and keeps migration behavior centralized inkeychain.Open().--profile; internal credential refs, config fields, environment overrides, and JSON ref fields remain unchanged.version.txtto2.0and update stale local release documentation.--refin tests/checks.