fix: simplify remote handling to be profile centric

Author: marcus-pousette

docs/github-import-flow.html

@@ -124,7 +124,7 @@ <h2>Remote Helper Details</h2>
         </tr>
         <tr>
           <td>Set PowerSync remote</td>
-          <td><code>git remote add powersync powergit::https://...</code></td>
+          <td><code>git remote add powersync powergit::/org/repo</code></td>
           <td>Helper swizzles Git transport, wrapping PowerSync APIs.</td>
           <td>N/A (configuration step)</td>
         </tr>

docs/supabase.md

@@ -37,15 +37,15 @@ When you need the daemon + browser to share a Supabase-issued token (useful for
 pnpm --filter @powersync-community/powergit login
 ```
 
-The CLI prints a device code and a verification URL (`POWERSYNC_DAEMON_DEVICE_URL`, default `http://localhost:5783/auth`). Open it, sign in, and the token is stored under `~/.powergit`.
+The CLI prints a device code and a verification URL (`POWERSYNC_DAEMON_DEVICE_URL`, default `http://localhost:5783/auth`). Open it, sign in, and the token is stored under `~/.powergit/daemon/<profile>/`.
 
 ### CLI live tests (optional)
 
 When you have the local PowerSync + Supabase stack running (for example via `pnpm dev:stack` or your own Docker Compose deployment), you can run an additional Vitest suite that exercises `powergit sync` against the live services. Provide the connection details through environment variables so the test can discover the stack:
 
 | Variable | Purpose |
 | --- | --- |
-| `POWERGIT_TEST_REMOTE_URL` | PowerSync remote URL (e.g. `powergit::https://localhost:8080/orgs/acme/repos/infra`). *Required to enable the test.* |
+| `POWERGIT_TEST_REMOTE_URL` | Powergit remote URL (e.g. `powergit::/acme/infra`, `powergit::staging/acme/infra`, or `powergit::local-dev/acme/infra`). *Required to enable the test.* |
 | `POWERGIT_TEST_REMOTE_NAME` | Git remote name to target (defaults to `powersync`). |
 | `POWERGIT_TEST_SUPABASE_URL` | Supabase REST URL (used for password login). |
 | `POWERGIT_TEST_SUPABASE_EMAIL` | Supabase user email used for HS256 login. |

packages/apps/explorer/tests/e2e/live-cli.spec.ts

@@ -6,7 +6,7 @@ import { spawnSync } from 'node:child_process'
 import type { Page } from '@playwright/test'
 import { test, expect } from './diagnostics'
 import { BASE_URL } from '../../playwright.config'
-import { parsePowerSyncUrl } from '@powersync-community/powergit-core'
+import { resolvePowergitRemote } from '@powersync-community/powergit-core/node'
 import { loadProfileEnvironment } from '../../../../cli/src/profile-env.js'
 
 const WAIT_TIMEOUT_MS = Number.parseInt(process.env.POWERSYNC_E2E_WAIT_MS ?? '300000', 10)
@@ -265,7 +265,7 @@ describeLive('CLI-seeded repo (live PowerSync)', () => {
     daemonBaseUrl = normalizeBaseUrl(requireEnv('POWERSYNC_DAEMON_URL'))
 
     const remoteUrl = requireEnv('POWERGIT_TEST_REMOTE_URL')
-    const parsed = parsePowerSyncUrl(remoteUrl)
+    const parsed = resolvePowergitRemote(remoteUrl)
     orgId = parsed.org
     repoId = parsed.repo
 

packages/apps/explorer/tests/e2e/setup/live-stack.setup.ts

@@ -205,7 +205,6 @@ async function runDeviceLoginFlow(): Promise<void> {
 async function loginDaemonIfNeeded(): Promise<void> {
   const daemonUrl =
     process.env.POWERSYNC_DAEMON_URL ??
-    process.env.POWERSYNC_DAEMON_ENDPOINT ??
     'http://127.0.0.1:5030'
   const daemonBase = daemonUrl.replace(/\/+$/, '')
   const status = await fetch(`${daemonBase}/auth/status`)

packages/cli/README.md

@@ -71,9 +71,9 @@ git remote -v
 > **Why `powergit::`?**
 > Git uses the prefix before `::` to pick a remote helper binary named `git-remote-<prefix>`. We ship `git-remote-powergit`, so the URL must start with `powergit::`.
 
-### Shorthand remote URLs (profiles/aliases)
+### Shorthand remote URLs (profiles)
 
-`powergit::/<org>/<repo>` uses the default profile (production out of the box). To target another stack, create a profile alias that bundles **both** the PowerSync and Supabase endpoints, then reference that alias in the remote URL:
+`powergit::/<org>/<repo>` uses the default profile (production out of the box). To target another stack, create a profile that bundles **both** the PowerSync and Supabase endpoints, then reference that profile in the remote URL:
 
 ```bash
 powergit profile set staging \
@@ -87,7 +87,7 @@ powergit profile set staging --set supabase.serviceRoleKey=<service-role-key>
 git remote add powersync powergit::staging/<org>/<repo>
 ```
 
-Supabase credentials are **not** part of the remote URL. They live in the profile/env and are used only for login/auth, so prefer aliases when you need a non-prod or custom stack.
+Supabase config (URL/anon key) and your login session are **not** part of the remote URL. Keep them in the profile/env (and never put a `supabase.serviceRoleKey` in a Git remote).
 
 ### Choose a different remote name
 
@@ -105,7 +105,7 @@ Before running commands that talk to PowerSync (push/fetch or `powergit sync`),
 powergit login
 ```
 
-`powergit login` uses Supabase credentials from your profile or environment (`SUPABASE_URL`, `SUPABASE_ANON_KEY`, `SUPABASE_EMAIL`, `SUPABASE_PASSWORD`). The resulting Supabase JWT is cached under `~/.powergit/session.json` and automatically reused by the CLI.
+`powergit login` uses Supabase credentials from your profile or environment (`SUPABASE_URL`, `SUPABASE_ANON_KEY`, `SUPABASE_EMAIL`, `SUPABASE_PASSWORD`). The resulting Supabase JWT is cached per profile under `~/.powergit/daemon/<profile>/session.json` and automatically reused by the daemon.
 
 Need to stash a token manually (for CI or when you already have one)?
 

packages/cli/src/auth/session.ts

@@ -10,6 +10,22 @@ export interface StoredCredentials {
   obtainedAt?: string
 }
 
+function sanitizeProfileKey(value: string): string {
+  const trimmed = value.trim()
+  if (!trimmed) return 'default'
+  return trimmed.replace(/[^a-zA-Z0-9._-]+/g, '-')
+}
+
+function resolveProfileNameFromEnv(): string {
+  const candidate =
+    process.env.POWERGIT_PROFILE ??
+    process.env.STACK_PROFILE ??
+    process.env.POWERGIT_ACTIVE_PROFILE ??
+    'prod'
+  const trimmed = String(candidate ?? '').trim()
+  return trimmed.length > 0 ? trimmed : 'prod'
+}
+
 function resolvePowergitHome(): string {
   const override = process.env.POWERGIT_HOME
   if (override && override.trim().length > 0) {
@@ -20,7 +36,8 @@ function resolvePowergitHome(): string {
 
 function getSessionPath(customPath?: string): string {
   if (customPath) return resolve(customPath)
-  return resolve(resolvePowergitHome(), 'session.json')
+  const profileKey = sanitizeProfileKey(resolveProfileNameFromEnv())
+  return resolve(resolvePowergitHome(), 'daemon', profileKey, 'session.json')
 }
 
 async function ensureDirectory(path: string) {

packages/cli/src/bin.ts

@@ -452,8 +452,7 @@ async function runLogoutCommand(args: LogoutCommandArgs) {
 }
 
 async function runDaemonStopCommand(args: DaemonStopCommandArgs) {
-  const defaultDaemonUrl =
-    process.env.POWERSYNC_DAEMON_URL ?? process.env.POWERSYNC_DAEMON_ENDPOINT ?? 'http://127.0.0.1:5030'
+  const defaultDaemonUrl = process.env.POWERSYNC_DAEMON_URL ?? 'http://127.0.0.1:5030'
   const baseUrl = normalizeDaemonBaseUrl(args.daemonUrl ?? defaultDaemonUrl)
   const responsive = await isDaemonResponsiveLocal(baseUrl)
   if (!responsive) {
@@ -774,7 +773,7 @@ function buildCli() {
         y
           .positional('url', {
             type: 'string',
-            describe: 'Powergit remote URL (powergit::/org/repo or powergit::https://…)',
+            describe: 'Powergit remote URL (powergit::/org/repo or powergit::<profile>/org/repo)',
           })
           .option('remote', {
             alias: 'r',

packages/cli/src/cli.e2e.test.ts

@@ -7,7 +7,8 @@ import { createRequire } from 'node:module'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { execFile, spawn, spawnSync } from 'node:child_process'
 import { promisify } from 'node:util'
-import { parsePowerSyncUrl, PowerSyncRemoteClient, buildRepoStreamTargets, formatStreamKey } from '@powersync-community/powergit-core'
+import { PowerSyncRemoteClient, buildRepoStreamTargets, formatStreamKey } from '@powersync-community/powergit-core'
+import { resolvePowergitRemote } from '@powersync-community/powergit-core/node'
 import { startStack, stopStack } from '../../../scripts/test-stack-hooks.mjs'
 import { seedDemoRepository } from './index.js'
 import { clearStoredCredentials, loadStoredCredentials, saveStoredCredentials } from './auth/session.js'
@@ -125,7 +126,7 @@ async function runScript(scriptRelativePath: string, extraEnv: NodeJS.ProcessEnv
 }
 
 async function seedLiveStackData(config: LiveStackConfig) {
-  const { org, repo } = parsePowerSyncUrl(config.remoteUrl)
+  const { org, repo } = resolvePowergitRemote(config.remoteUrl)
   await seedDemoRepository({
     remoteUrl: config.remoteUrl,
     remoteName: config.remoteName,
@@ -180,13 +181,13 @@ describe('powergit CLI e2e', () => {
   }
 
   it('adds and updates the default powersync remote', async () => {
-    const firstUrl = 'powergit::https://example.dev/orgs/acme/repos/infra'
+    const firstUrl = 'powergit::/acme/infra'
     const { stdout: addStdout } = await runCli(['remote', 'add', 'powersync', firstUrl])
     expect(addStdout).toContain(`Added PowerSync remote (powersync): ${firstUrl}`)
 
     expect(await getRemoteUrl()).toBe(firstUrl)
 
-    const secondUrl = 'powergit::https://example.dev/orgs/acme/repos/runtime'
+    const secondUrl = 'powergit::/acme/runtime'
     const { stdout: updateStdout } = await runCli(['remote', 'add', 'powersync', secondUrl])
     expect(updateStdout).toContain(`Added PowerSync remote (powersync): ${secondUrl}`)
 
@@ -195,7 +196,7 @@ describe('powergit CLI e2e', () => {
 
   it('respects REMOTE_NAME overrides', async () => {
     const customRemote = 'powersync-upstream'
-    const remoteUrl = 'powergit::https://example.dev/orgs/acme/repos/mobile'
+    const remoteUrl = 'powergit::/acme/mobile'
 
     const { stdout } = await runCli(
       ['remote', 'add', 'powersync', remoteUrl],
@@ -505,7 +506,7 @@ describeLive('powergit sync against live PowerSync stack', () => {
     const remoteName = liveStackConfig.remoteName
     const daemonBaseUrl = process.env.POWERSYNC_DAEMON_URL ?? 'http://127.0.0.1:5030'
     const branchName = `cli-stream-${Date.now().toString(36)}`
-    const { org, repo } = parsePowerSyncUrl(remoteUrl)
+    const { org, repo } = resolvePowergitRemote(remoteUrl)
     const streamTargets = buildRepoStreamTargets(org, repo)
     const streamKeys = streamTargets.map(formatStreamKey)