From bdd077a858464074b9fe460778cdbe00ef7ea6b1 Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Fri, 12 Jun 2026 16:00:53 +0000
Subject: [PATCH] fix: improvements

---
 nuxt.config.ts | 1 +
 public/favicon.ico | 0 
 app/pages/dashboard.vue | 286 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------------------------------------------------------
 app/pages/index.vue | 23 +++++++++++++++--------
 server/utils/require-session.ts | 2 --
 server/utils/resolve-handle.ts | 24 ++++++++++++++++++++++++
 server/utils/server-session.ts | 103 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--------------
 server/utils/splice.ts | 2 --
 server/utils/sync-push.ts | 2 --
 server/utils/sync-ref.ts | 2 +-
 test/unit/server-session.spec.ts | 36 +++++++++++++++++++++++++++++++++++-
 server/api/atproto/callback.get.ts | 29 +++++++++++++++++++++++------
 server/api/me/accounts.get.ts | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 server/api/me/logout.post.ts | 7 +++----
 server/api/me/switch.post.ts | 17 +++++++++++++++++
 server/utils/git-wire/receive-pack.ts | 2 --
 server/utils/git-wire/refs.ts | 4 +---
 17 file(s) changed, 494 insertion(s)(+), 99 deletion(s)(-)

diff --git a/nuxt.config.ts b/nuxt.config.ts
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -42,6 +42,7 @@
   app: {
     head: {
       htmlAttrs: { lang: 'en' },
+      title: 'synchub.to',
       link: [
         { rel: 'icon', type: 'image/svg+xml', href: '/favicon.svg' },
         { rel: 'alternate icon', href: '/favicon.ico' },
diff --git a/public/favicon.ico b/public/favicon.ico
deleted file mode 100644
--- a/public/favicon.ico
+++ /dev/null
diff --git a/app/pages/dashboard.vue b/app/pages/dashboard.vue
--- a/app/pages/dashboard.vue
+++ b/app/pages/dashboard.vue
@@ -1,6 +1,9 @@
 <script setup lang="ts">
 import { ref } from 'vue'
+import type { AccountsPayload } from '~~/server/api/me/accounts.get'
 import type { DashboardPayload, DashboardRepo } from '~~/server/api/me/dashboard.get'
+
+const installUrl = 'https://github.com/apps/synchub-to/installations/new'
 
 definePageMeta({
   middleware: ['authenticated'],
@@ -12,6 +15,49 @@
 })
 
 const { data, refresh, error } = await useFetch<DashboardPayload>('/api/me/dashboard')
+const { data: accountsData, refresh: refreshAccounts } = await useFetch<AccountsPayload>('/api/me/accounts')
+
+const switcher = useTemplateRef<HTMLDetailsElement>('switcher')
+const switcherOpen = ref(false)
+
+onMounted(() => {
+  const onPointerDown = (e: PointerEvent) => {
+    if (switcherOpen.value && switcher.value && !switcher.value.contains(e.target as Node)) {
+      switcherOpen.value = false
+    }
+  }
+  document.addEventListener('pointerdown', onPointerDown)
+  onBeforeUnmount(() => document.removeEventListener('pointerdown', onPointerDown))
+})
+
+const activeAccount = computed(() =>
+  accountsData.value?.accounts.find(a => a.active) ?? null,
+)
+const otherAccounts = computed(() =>
+  accountsData.value?.accounts.filter(a => !a.active) ?? [],
+)
+
+function accountLabel(account: { handle: string | null, accountLogin: string | null, did: string }) {
+  if (account.handle) return `@${account.handle}`
+  if (account.accountLogin) return account.accountLogin
+  return account.did
+}
+
+async function switchTo(did: string) {
+  switcherOpen.value = false
+  pendingAction.value = `switch:${did}`
+  try {
+    await postAction('/api/me/switch', { did })
+    await Promise.all([refresh(), refreshAccounts()])
+    flash.value = null
+  }
+  catch {
+    flash.value = 'Error: could not switch account.'
+  }
+  finally {
+    pendingAction.value = null
+  }
+}
 
 const flash = ref<string | null>(null)
 const flashIsError = computed(() => flash.value?.startsWith('Error:') ?? false)
@@ -50,8 +96,14 @@
 // `$fetch` blows up TS' pattern matcher with "excessive stack depth". Posting
 // a no-body request through native `fetch` and parsing the JSON manually
 // sidesteps that. Same-origin, so cookies are sent automatically.
-async function postAction(url: string): Promise<unknown> {
-  const response = await fetch(url, { method: 'POST', credentials: 'same-origin' })
+async function postAction(url: string, payload?: unknown): Promise<unknown> {
+  const response = await fetch(url, {
+    method: 'POST',
+    credentials: 'same-origin',
+    ...(payload === undefined
+      ? {}
+      : { headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload) }),
+  })
   if (!response.ok) {
     let statusMessage = response.statusText
     try {
@@ -72,7 +124,7 @@
   return runAction(
     actionKey('resync', repo.id),
     () => postAction(`/api/repos/${repo.id}/resync`),
-    `Queued resync for ${repo.githubFullName}.`,
+    `queued resync for ${repo.githubFullName}.`,
   )
 }
 
@@ -80,7 +132,7 @@
   return runAction(
     actionKey('disable', repo.id),
     () => postAction(`/api/repos/${repo.id}/disable`),
-    `Disabled sync for ${repo.githubFullName}.`,
+    `disabled sync for ${repo.githubFullName}.`,
   )
 }
 
@@ -88,7 +140,7 @@
   return runAction(
     actionKey('enable', repo.id),
     () => postAction(`/api/repos/${repo.id}/enable`),
-    `Re-enabled sync for ${repo.githubFullName}.`,
+    `re-enabled sync for ${repo.githubFullName}.`,
   )
 }
 
@@ -96,19 +148,27 @@
   return runAction(
     'rotate-key',
     () => postAction('/api/me/rotate-key'),
-    'Queued SSH key rotation.',
+    'queued SSH key rotation.',
   )
 }
 
 async function logout() {
+  switcherOpen.value = false
   pendingAction.value = 'logout'
   try {
-    await postAction('/api/me/logout')
-    await navigateTo('/')
+    const result = await postAction('/api/me/logout') as { remaining: number }
+    if (result.remaining > 0) {
+      await Promise.all([refresh(), refreshAccounts()])
+      flash.value = null
+      pendingAction.value = null
+    }
+    else {
+      await navigateTo('/')
+    }
   }
   catch {
     pendingAction.value = null
-    flash.value = 'Error: could not sign out.'
+    flash.value = 'error: could not sign out.'
   }
 }
 
@@ -137,7 +197,46 @@
   <div class="page">
     <a class="skip-link" href="#main">skip to main content</a>
     <header class="nav-term">
-      <nav class="nav-term__line" aria-label="primary"><span class="prompt" aria-hidden="true">&gt;</span> <a class="nav-term__mark" href="/dashboard" aria-label="synchub.to dashboard"><SynchubMark :wordmark="true" :size="18" /></a> <button type="button" class="nav-term__logout" :disabled="pendingAction !== null" :aria-busy="pendingAction === 'logout'" @click="logout">{{ pendingAction === 'logout' ? 'logging out…' : '--logout' }}</button></nav>
+      <nav class="nav-term__line" aria-label="primary">
+        <span class="prompt" aria-hidden="true">&gt;</span>
+        <a class="nav-term__mark" href="/dashboard"><SynchubMark :wordmark="true" :size="18" /></a>
+        <details ref="switcher" class="switcher" :open="switcherOpen" @toggle="switcherOpen = ($event.target as HTMLDetailsElement).open">
+          <summary class="switcher__summary">
+            <span class="switcher__active">{{ activeAccount ? accountLabel(activeAccount) : 'account' }}</span>
+            <span class="switcher__caret" aria-hidden="true">▾</span>
+          </summary>
+          <div class="switcher__menu">
+            <p v-if="activeAccount" class="switcher__current">
+              <span class="switcher__handle">{{ accountLabel(activeAccount) }}</span>
+              <span v-if="activeAccount.accountLogin" class="switcher__org">{{ activeAccount.accountLogin }}</span>
+            </p>
+            <template v-if="otherAccounts.length">
+              <p class="switcher__label">switch to</p>
+              <button
+                v-for="account in otherAccounts"
+                :key="account.did"
+                type="button"
+                class="switcher__item"
+                :disabled="pendingAction !== null"
+                @click="switchTo(account.did)"
+              >
+                <span class="switcher__handle">{{ accountLabel(account) }}</span>
+                <span v-if="account.accountLogin" class="switcher__org">{{ account.accountLogin }}</span>
+              </button>
+            </template>
+            <a class="switcher__item switcher__add" :href="installUrl">+ add account</a>
+            <button
+              type="button"
+              class="switcher__item switcher__logout"
+              :disabled="pendingAction !== null"
+              :aria-busy="pendingAction === 'logout'"
+              @click="logout"
+            >
+              {{ pendingAction === 'logout' ? 'logging out…' : 'log out' }}
+            </button>
+          </div>
+        </details>
+      </nav>
     </header>
 
     <div id="main" class="intro">
@@ -155,31 +254,26 @@
       <section class="card">
         <h2>identity</h2>
         <dl>
-          <dt>tangled DID</dt>
-          <dd><code>{{ data.did }}</code></dd>
-          <template v-if="data.handle">
-            <dt>handle</dt>
-            <dd>@{{ data.handle }}</dd>
-          </template>
+          <dt>tangled</dt>
+          <dd>
+            <span v-if="data.handle">@{{ data.handle }}</span>
+            <code class="did" :class="{ 'did--secondary': data.handle }">{{ data.did }}</code>
+          </dd>
           <template v-if="data.installation">
-            <dt>GitHub installation</dt>
+            <dt>GitHub</dt>
             <dd>
               {{ data.installation.accountLogin }}
-              <span class="muted">({{ data.installation.accountType }}, install #{{ data.installation.id }})</span>
+              <span class="muted">({{ data.installation.accountType.toLowerCase() }}, install #{{ data.installation.id }})</span>
               <span v-if="data.installation.suspendedAt" class="badge badge-error">suspended</span>
             </dd>
           </template>
           <template v-else>
-            <dt>GitHub installation</dt>
+            <dt>GitHub</dt>
             <dd class="muted">
               no matching install row
             </dd>
           </template>
         </dl>
-        <p class="muted small">
-          connected to <strong>{{ data.installation?.accountLogin ?? 'this account' }}</strong>.
-          <a href="https://github.com/apps/synchub-to/installations/new">connect a different installation?</a>
-        </p>
       </section>
 
       <section class="card">
@@ -199,7 +293,7 @@
           :aria-busy="pendingAction === 'rotate-key'"
           @click="rotateKey"
         >
-          {{ pendingAction === 'rotate-key' ? 'Rotating…' : 'Rotate SSH key' }}
+          {{ pendingAction === 'rotate-key' ? 'rotating…' : 'rotate SSH key' }}
         </button>
       </section>
 
@@ -213,8 +307,8 @@
             <div class="repo__main">
               <div class="repo__head">
                 <a class="repo__name" :href="`https://github.com/${repo.githubFullName}`" rel="noopener noreferrer">{{ repo.githubFullName }}</a>
-                <span class="badge" :class="`badge-${repo.status}`">{{ repo.status }}</span>
                 <span v-if="repo.disabledAt" class="badge badge-disabled">disabled</span>
+                <span v-else class="badge" :class="`badge-${repo.status}`">{{ repo.status }}</span>
               </div>
               <dl class="repo__meta">
                 <div class="repo__meta-item">
@@ -242,7 +336,7 @@
                 :aria-busy="pendingAction === actionKey('resync', repo.id)"
                 @click="resync(repo)"
               >
-                {{ pendingAction === actionKey('resync', repo.id) ? 'Resyncing…' : 'Resync' }}
+                {{ pendingAction === actionKey('resync', repo.id) ? 'resyncing…' : 'resync' }}
               </button>
               <button
                 v-if="repo.disabledAt"
@@ -251,7 +345,7 @@
                 :aria-busy="pendingAction === actionKey('enable', repo.id)"
                 @click="enable(repo)"
               >
-                {{ pendingAction === actionKey('enable', repo.id) ? 'Enabling…' : 'Enable' }}
+                {{ pendingAction === actionKey('enable', repo.id) ? 'enabling…' : 'enable' }}
               </button>
               <button
                 v-else
@@ -260,7 +354,7 @@
                 :aria-busy="pendingAction === actionKey('disable', repo.id)"
                 @click="disable(repo)"
               >
-                {{ pendingAction === actionKey('disable', repo.id) ? 'Disabling…' : 'Disable' }}
+                {{ pendingAction === actionKey('disable', repo.id) ? 'disabling…' : 'disable' }}
               </button>
             </div>
           </li>
@@ -310,43 +404,115 @@
   margin-right: 1.2ch;
 }
 
-.nav-term__args {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.9ch;
-  list-style: none;
-  margin: 0;
-  padding: 0;
-}
-
-.nav-term__args a {
-  display: inline-flex;
-  align-items: center;
-  min-height: 44px;
-  color: var(--color-muted);
-  text-decoration: underline;
-  text-underline-offset: 2px;
-  white-space: nowrap;
-}
-
-.nav-term__args a:hover { color: var(--color-ink); }
-
-.nav-term__logout {
+.switcher {
   margin-left: auto;
+  position: relative;
+}
+
+.switcher__summary {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5ch;
+  min-height: 44px;
   padding: 0.2rem 0.7rem;
   border: var(--rule-hair) solid var(--color-rule-interactive);
   border-radius: var(--radius-sm);
-  background: transparent;
   color: var(--color-muted);
   font-family: var(--font-mono);
   font-size: var(--text-sm);
   white-space: nowrap;
   cursor: pointer;
+  list-style: none;
   transition: border-color var(--dur-micro) var(--ease-out), color var(--dur-micro) var(--ease-out);
 }
 
-.nav-term__logout:hover:not(:disabled) { border-color: var(--color-accent); color: var(--color-ink); }
-.nav-term__logout:disabled { opacity: 0.5; cursor: progress; }
+.switcher__summary::-webkit-details-marker { display: none; }
+.switcher__summary:hover { border-color: var(--color-accent); color: var(--color-ink); }
+.switcher[open] .switcher__summary { border-color: var(--color-accent); color: var(--color-ink); }
+.switcher[open] .switcher__caret { transform: rotate(180deg); }
+
+.switcher__caret {
+  display: inline-block;
+  color: var(--color-neutral);
+  transition: transform var(--dur-micro) var(--ease-out);
+}
+
+.switcher__menu {
+  position: absolute;
+  right: 0;
+  top: calc(100% + var(--space-2xs));
+  z-index: var(--z-overlay);
+  min-width: 13rem;
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  padding: var(--space-2xs);
+  background: var(--color-paper-3);
+  border: var(--rule-hair) solid var(--color-rule);
+  border-radius: var(--radius-md);
+}
+
+.switcher__current {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  margin: 0;
+  padding: var(--space-xs) var(--space-sm);
+}
+
+.switcher__label {
+  margin: var(--space-2xs) 0 0;
+  padding: 0 var(--space-sm);
+  font-size: var(--text-xs);
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--color-neutral);
+}
+
+.switcher__handle {
+  font-family: var(--font-mono);
+  color: var(--color-ink);
+}
+
+.switcher__org {
+  font-size: var(--text-xs);
+  color: var(--color-neutral);
+}
+
+.switcher__item {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  align-items: start;
+  width: 100%;
+  min-height: 44px;
+  justify-content: center;
+  padding: var(--space-xs) var(--space-sm);
+  border: 0;
+  border-radius: var(--radius-sm);
+  background: transparent;
+  color: var(--color-muted);
+  font: inherit;
+  font-size: var(--text-sm);
+  text-align: left;
+  text-decoration: none;
+  white-space: nowrap;
+  cursor: pointer;
+  transition: background-color var(--dur-micro) var(--ease-out);
+}
+
+.switcher__item:hover:not(:disabled) { background: var(--color-paper-2); }
+.switcher__item:disabled { opacity: 0.5; cursor: progress; }
+
+.switcher__add {
+  border-top: var(--rule-hair) solid var(--color-rule);
+  border-radius: 0;
+  margin-top: var(--space-2xs);
+  color: var(--color-accent-dim);
+}
+
+.switcher__logout { color: var(--color-muted); }
+.switcher__logout:hover:not(:disabled) { color: var(--color-error); }
 
 .caret {
   display: inline-block;
@@ -393,8 +559,20 @@
 dl {
   display: grid;
   grid-template-columns: max-content minmax(0, 1fr);
+  align-items: baseline;
   gap: var(--space-2xs) var(--space-md);
-  margin: 0 0 var(--space-sm);
+  margin: 0;
+}
+
+.did {
+  word-break: break-all;
+}
+
+.did--secondary {
+  display: block;
+  margin-top: 2px;
+  font-size: var(--text-xs);
+  color: var(--color-neutral);
 }
 
 dt {
diff --git a/app/pages/index.vue b/app/pages/index.vue
--- a/app/pages/index.vue
+++ b/app/pages/index.vue
@@ -22,7 +22,7 @@
   <div class="shell">
     <a class="skip-link" href="#main">skip to main content</a>
     <header class="nav-term">
-      <nav class="nav-term__line" aria-label="primary"><span class="prompt" aria-hidden="true">&gt;</span> <a class="nav-term__mark" href="/" aria-label="synchub.to home"><SynchubMark :wordmark="true" :size="18" /></a> <ul class="nav-term__args"><li><a href="#start">--start</a></li> <li><a href="#signin">--sign-in</a></li></ul><span class="caret" aria-hidden="true">█</span></nav>
+      <nav class="nav-term__line" aria-label="primary"><span class="prompt" aria-hidden="true">&gt;</span> <a class="nav-term__mark" href="/"><SynchubMark :wordmark="true" :size="18" /></a> <ul class="nav-term__args"><li><a href="#start">--start</a></li> <li><a href="#signin">--sign-in</a></li></ul><span class="caret" aria-hidden="true"></span></nav>
     </header>
 
     <main id="main">
@@ -35,7 +35,7 @@
           and tags will stay in sync.
         </p>
 
-        <pre class="session" aria-label="How synchub works"><span class="c"># 1 · install the github app on the repos to mirror</span>
+        <pre class="session" role="img" aria-label="How synchub works"><span class="c"># 1 · install the github app on the repos to mirror</span>
 <span class="p">$</span> gh app install <span class="a">synchub-to</span>
 
 <span class="c"># 2 · connect your tangled identity</span>
@@ -43,7 +43,7 @@
 
 <span class="c"># 3 · push as usual</span>
 <span class="p">$</span> git push origin main
-<span class="ok">✓</span> mirrored alice/widget → tangled.org <span class="dim">(2 refs)</span><span class="caret" aria-hidden="true">█</span></pre>
+<span class="ok">✓</span> mirrored alice/widget → tangled.org <span class="dim">(2 refs)</span><span class="caret" aria-hidden="true"></span></pre>
       </section>
 
       <section id="start" class="panel reveal" style="--i: 1">
@@ -149,13 +149,16 @@
 
 .caret {
   display: inline-block;
-  width: 1ch;
-  color: var(--color-accent);
-  animation: blink 1.05s steps(2) infinite;
+  width: 0.55ch;
+  height: 1em;
+  margin-left: 0.15ch;
+  vertical-align: -0.12em;
+  background: var(--color-accent);
+  animation: blink 1.1s var(--ease-in-out) infinite;
 }
 
-@keyframes blink { 50% { opacity: 0; } }
-@media (prefers-reduced-motion: reduce) { .caret { animation: none; } }
+@keyframes blink { 0%, 45% { opacity: 1; } 55%, 100% { opacity: 0; } }
+@media (prefers-reduced-motion: reduce) { .caret { animation: none; opacity: 1; } }
 
 .hero {
   padding-block: var(--space-2xl) var(--space-xl);
@@ -252,6 +255,10 @@
   padding-inline: 0.75ch 0;
   color: var(--color-accent);
   font-family: var(--font-mono);
+}
+
+.signin input:focus-visible {
+  outline: none;
 }
 
 .signin input {
diff --git a/server/utils/require-session.ts b/server/utils/require-session.ts
deleted file mode 100644
--- a/server/utils/require-session.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export { getSessionData, requireSession, writeSession } from './server-session'
-export type { SynchubSessionData } from './server-session'
diff --git a/server/utils/resolve-handle.ts b/server/utils/resolve-handle.ts
new file mode 100644
--- /dev/null
+++ b/server/utils/resolve-handle.ts
@@ -0,0 +1,24 @@
+import { Agent } from '@atproto/api'
+import type { OAuthSession } from '@atproto/oauth-client-node'
+
+/**
+ * Resolve the human-readable handle for the authenticated DID.
+ *
+ * `com.atproto.repo.describeRepo` returns the handle the PDS has verified
+ * against the DID document, so it's the authoritative answer and needs no
+ * appview access. Best-effort: a handle is a display convenience, so any
+ * failure (network, unverified handle) returns null rather than blocking the
+ * sign-in flow. Strips a leading `@` if the PDS includes one.
+ */
+export async function resolveHandle(oauthSession: OAuthSession): Promise<string | null> {
+  try {
+    const agent = new Agent(oauthSession)
+    const { data } = await agent.com.atproto.repo.describeRepo({ repo: oauthSession.did })
+    const handle = data.handle?.trim().replace(/^@/, '')
+    if (!handle || handle === 'handle.invalid') return null
+    return handle
+  }
+  catch {
+    return null
+  }
+}
diff --git a/server/utils/server-session.ts b/server/utils/server-session.ts
--- a/server/utils/server-session.ts
+++ b/server/utils/server-session.ts
@@ -10,15 +10,23 @@
  * `process.env` directly so the helper is callable outside a request context
  * for tests, mirroring `encryption.ts`.
  *
- * v1 stores `installationId` alongside `did`: a user may have installed the
- * GitHub App on more than one account (personal + an org), but the session
- * pins us to the one they last authenticated against. See the dashboard
- * "Connect a different installation?" link for the workaround.
+ * A user may have connected more than one tangled identity on this device
+ * (e.g. a personal account and an org). The cookie therefore holds a list of
+ * `accounts`, one of which is `active`. `requireSession()` flattens to the
+ * active account so downstream handlers keep working with a single
+ * `{ did, installationId, handle }`. Switching is a device-local convenience:
+ * the OAuth callback appends, `/api/me/switch` flips `active`, logout drops the
+ * active account.
  */
-export interface SynchubSessionData {
+export interface SynchubAccount {
   did: string
   installationId: number
   handle?: string
+}
+
+export interface SynchubSessionData {
+  active: string
+  accounts: SynchubAccount[]
 }
 
 const COOKIE_NAME = 'synchub-session'
@@ -47,19 +55,46 @@
   }
 }
 
-export async function getSessionData(event: H3Event): Promise<SynchubSessionData | null> {
-  const session = await useSession<SynchubSessionData>(event, sessionConfig())
-  const { did, installationId } = session.data
-  if (typeof did !== 'string' || typeof installationId !== 'number') return null
-  return { did, installationId, handle: session.data.handle }
+/**
+ * Normalise raw cookie data into a valid session, or null. Drops malformed
+ * account entries; if `active` doesn't name a surviving account, falls back to
+ * the first. Exported for unit testing the normalisation in isolation.
+ */
+export function readAccounts(data: Partial<SynchubSessionData>): SynchubSessionData | null {
+  if (typeof data.active !== 'string' || !Array.isArray(data.accounts)) return null
+  const accounts = data.accounts.filter(
+    (a): a is SynchubAccount => typeof a?.did === 'string' && typeof a?.installationId === 'number',
+  )
+  if (accounts.length === 0) return null
+  const active = accounts.some(a => a.did === data.active) ? data.active : accounts[0]!.did
+  return { active, accounts }
 }
 
 /**
- * Return the current session or throw a 401. Use from any handler that needs
+ * Return all accounts on this device plus the active DID, or null if the
+ * cookie is empty / malformed.
+ */
+export async function getDeviceSession(event: H3Event): Promise<SynchubSessionData | null> {
+  const session = await useSession<SynchubSessionData>(event, sessionConfig())
+  return readAccounts(session.data)
+}
+
+/**
+ * Resolve the active account, flattened to the single-account shape that
+ * handlers expect.
+ */
+export async function getSessionData(event: H3Event): Promise<SynchubAccount | null> {
+  const data = await getDeviceSession(event)
+  if (!data) return null
+  return data.accounts.find(a => a.did === data.active) ?? null
+}
+
+/**
+ * Return the active account or throw a 401. Use from any handler that needs
  * an authenticated user. The thrown error is consumed by Nitro and rendered
  * as `{ statusCode: 401, statusMessage: 'unauthenticated' }`.
  */
-export async function requireSession(event: H3Event): Promise<SynchubSessionData> {
+export async function requireSession(event: H3Event): Promise<SynchubAccount> {
   const data = await getSessionData(event)
   if (!data) {
     throw createError({ statusCode: 401, statusMessage: 'unauthenticated' })
@@ -67,7 +102,47 @@
   return data
 }
 
-export async function writeSession(event: H3Event, data: SynchubSessionData): Promise<void> {
+/**
+ * Add (or refresh) an account on this device and make it active. Dedupes by
+ * DID: re-connecting an existing handle updates its installation binding and
+ * activates it rather than duplicating the entry.
+ */
+export async function addAccount(event: H3Event, account: SynchubAccount): Promise<void> {
   const session = await useSession<SynchubSessionData>(event, sessionConfig())
-  await session.update(data)
+  const existing = readAccounts(session.data)?.accounts ?? []
+  const accounts = [...existing.filter(a => a.did !== account.did), account]
+  await session.update({ active: account.did, accounts })
+}
+
+/**
+ * Switch the active account to `did`. Returns false if the DID isn't present
+ * on this device.
+ */
+export async function switchAccount(event: H3Event, did: string): Promise<boolean> {
+  const session = await useSession<SynchubSessionData>(event, sessionConfig())
+  const data = readAccounts(session.data)
+  if (!data || !data.accounts.some(a => a.did === did)) return false
+  await session.update({ active: did, accounts: data.accounts })
+  return true
+}
+
+/**
+ * Drop the active account. If others remain, the first becomes active and the
+ * cookie is rewritten; otherwise the cookie is cleared. Returns the number of
+ * accounts left signed in.
+ */
+export async function dropActiveAccount(event: H3Event): Promise<number> {
+  const session = await useSession<SynchubSessionData>(event, sessionConfig())
+  const data = readAccounts(session.data)
+  if (!data) {
+    await session.clear()
+    return 0
+  }
+  const remaining = data.accounts.filter(a => a.did !== data.active)
+  if (remaining.length === 0) {
+    await session.clear()
+    return 0
+  }
+  await session.update({ active: remaining[0]!.did, accounts: remaining })
+  return remaining.length
 }
diff --git a/server/utils/splice.ts b/server/utils/splice.ts
--- a/server/utils/splice.ts
+++ b/server/utils/splice.ts
@@ -148,5 +148,3 @@
   await session.push([{ ref, old, next: ZERO_SHA }], null)
   return { status: 'synced' }
 }
-
-export { fetchAdvertisement }
diff --git a/server/utils/sync-push.ts b/server/utils/sync-push.ts
--- a/server/utils/sync-push.ts
+++ b/server/utils/sync-push.ts
@@ -108,5 +108,3 @@
     .set({ status: 'error', lastError: message, updatedAt: new Date() })
     .where(eq(repoMapping.id, mappingId))
 }
-
-export { RemoteRejectedError }
diff --git a/server/utils/sync-ref.ts b/server/utils/sync-ref.ts
--- a/server/utils/sync-ref.ts
+++ b/server/utils/sync-ref.ts
@@ -3,7 +3,7 @@
 import { useDb } from './db'
 import { RemoteRejectedError, WireError } from './git-wire/errors'
 import { installationOctokit } from './github-app'
-import { fetchAdvertisement, spliceDelete, splicePush } from './splice'
+import { spliceDelete, splicePush } from './splice'
 
 export type RefType = 'branch' | 'tag'
 
diff --git a/test/unit/server-session.spec.ts b/test/unit/server-session.spec.ts
--- a/test/unit/server-session.spec.ts
+++ b/test/unit/server-session.spec.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { sessionConfig } from '../../server/utils/server-session'
+import { readAccounts, sessionConfig } from '../../server/utils/server-session'
 
 const ORIGINAL_PASSWORD = process.env.NUXT_SESSION_PASSWORD
 const ORIGINAL_PUBLIC_URL = process.env.NUXT_PUBLIC_URL
@@ -45,5 +45,39 @@
     process.env.NUXT_PUBLIC_URL = 'https://synchub.to'
     const config = sessionConfig()
     expect(config.cookie).toMatchObject({ secure: true })
+  })
+})
+
+describe('server-session: readAccounts', () => {
+  const acct = (did: string, installationId: number) => ({ did, installationId })
+
+  it('returns null for empty or malformed cookie data', () => {
+    expect(readAccounts({})).toBeNull()
+    expect(readAccounts({ active: 'did:plc:1', accounts: [] })).toBeNull()
+    expect(readAccounts({ active: 'did:plc:1' })).toBeNull()
+    // eslint-disable-next-line ts/no-unsafe-type-assertion
+    expect(readAccounts({ active: 'did:plc:1', accounts: 'nope' as unknown as [] })).toBeNull()
+  })
+
+  it('keeps the active did when it names a present account', () => {
+    const result = readAccounts({ active: 'did:plc:2', accounts: [acct('did:plc:1', 1), acct('did:plc:2', 2)] })
+    expect(result).toEqual({ active: 'did:plc:2', accounts: [acct('did:plc:1', 1), acct('did:plc:2', 2)] })
+  })
+
+  it('falls back active to the first account when active is stale', () => {
+    const result = readAccounts({ active: 'did:plc:gone', accounts: [acct('did:plc:1', 1), acct('did:plc:2', 2)] })
+    expect(result?.active).toBe('did:plc:1')
+  })
+
+  it('drops malformed account entries', () => {
+    const accounts = [
+      acct('did:plc:1', 1),
+      // eslint-disable-next-line ts/no-unsafe-type-assertion
+      { did: 'did:plc:2' } as unknown as { did: string, installationId: number },
+      // eslint-disable-next-line ts/no-unsafe-type-assertion
+      { installationId: 3 } as unknown as { did: string, installationId: number },
+    ]
+    const result = readAccounts({ active: 'did:plc:1', accounts })
+    expect(result?.accounts).toEqual([acct('did:plc:1', 1)])
   })
 })
diff --git a/server/api/atproto/callback.get.ts b/server/api/atproto/callback.get.ts
--- a/server/api/atproto/callback.get.ts
+++ b/server/api/atproto/callback.get.ts
@@ -1,7 +1,8 @@
 import { and, eq, ne } from 'drizzle-orm'
 import { userIdentity } from '~~/server/db/schema'
 import { enqueue } from '~~/server/utils/queue'
-import { writeSession } from '~~/server/utils/server-session'
+import { resolveHandle } from '~~/server/utils/resolve-handle'
+import { addAccount } from '~~/server/utils/server-session'
 import { generateAndPublishKey, revokeKeyForInstallationDid } from '~~/server/utils/tangled-pubkey'
 
 export default defineEventHandler(async event => {
@@ -29,6 +30,7 @@
   // would just show a useless page.
 
   let installationId: number | undefined
+  let handle: string | null = null
 
   if (state) {
     const parsed = Number(state)
@@ -63,14 +65,16 @@
         ))
     }
 
+    handle = await resolveHandle(session)
+
     await db.insert(userIdentity).values({
       did: session.did,
-      handle: null,
+      handle,
       installationId,
       updatedAt: new Date(),
     }).onConflictDoUpdate({
       target: userIdentity.did,
-      set: { installationId, updatedAt: new Date() },
+      set: { installationId, handle, updatedAt: new Date() },
     })
 
     // Generate and publish the SSH key inline: it's one ed25519 keygen + one
@@ -86,7 +90,10 @@
   }
   else {
     // Returning sign-in. Look up the installation we previously bound.
-    const rows = await db.select({ installationId: userIdentity.installationId })
+    const rows = await db.select({
+      installationId: userIdentity.installationId,
+      handle: userIdentity.handle,
+    })
       .from(userIdentity)
       .where(eq(userIdentity.did, session.did))
       .limit(1)
@@ -101,10 +108,20 @@
       return
     }
     installationId = rows[0]!.installationId
+
+    // Refresh the handle on sign-in: it can change on the user's PDS between
+    // visits. Fall back to the stored value if resolution fails.
+    handle = await resolveHandle(session) ?? rows[0]!.handle
+    if (handle !== rows[0]!.handle) {
+      await db.update(userIdentity)
+        .set({ handle, updatedAt: new Date() })
+        .where(eq(userIdentity.did, session.did))
+    }
   }
 
-  // Sealed cookie session for the dashboard. Handle resolution is deferred.
-  await writeSession(event, { did: session.did, installationId })
+  // Append this account to the device's session and make it active. A user can
+  // be connected to several handles at once and switch between them locally.
+  await addAccount(event, { did: session.did, installationId, handle: handle ?? undefined })
 
   await sendRedirect(event, '/dashboard', 302)
 })
diff --git a/server/api/me/accounts.get.ts b/server/api/me/accounts.get.ts
new file mode 100644
--- /dev/null
+++ b/server/api/me/accounts.get.ts
@@ -0,0 +1,53 @@
+import { inArray } from 'drizzle-orm'
+import { installation, userIdentity } from '~~/server/db/schema'
+import { useDb } from '~~/server/utils/db'
+import { getDeviceSession, requireSession } from '~~/server/utils/server-session'
+
+export interface AccountSummary {
+  did: string
+  installationId: number
+  handle: string | null
+  accountLogin: string | null
+  active: boolean
+}
+
+export interface AccountsPayload {
+  active: string
+  accounts: AccountSummary[]
+}
+
+export default defineEventHandler(async (event): Promise<AccountsPayload> => {
+  await requireSession(event)
+  const data = (await getDeviceSession(event))!
+
+  const db = useDb()
+  const dids = data.accounts.map(a => a.did)
+  const installIds = data.accounts.map(a => a.installationId)
+
+  const [identityRows, installRows] = await Promise.all([
+    dids.length > 0
+      ? db.select({ did: userIdentity.did, handle: userIdentity.handle })
+        .from(userIdentity)
+        .where(inArray(userIdentity.did, dids))
+      : Promise.resolve([]),
+    installIds.length > 0
+      ? db.select({ id: installation.id, accountLogin: installation.accountLogin })
+        .from(installation)
+        .where(inArray(installation.id, installIds))
+      : Promise.resolve([]),
+  ])
+
+  const handleByDid = new Map(identityRows.map(r => [r.did, r.handle]))
+  const loginById = new Map(installRows.map(r => [r.id, r.accountLogin]))
+
+  return {
+    active: data.active,
+    accounts: data.accounts.map(a => ({
+      did: a.did,
+      installationId: a.installationId,
+      handle: a.handle ?? handleByDid.get(a.did) ?? null,
+      accountLogin: loginById.get(a.installationId) ?? null,
+      active: a.did === data.active,
+    })),
+  }
+})
diff --git a/server/api/me/logout.post.ts b/server/api/me/logout.post.ts
--- a/server/api/me/logout.post.ts
+++ b/server/api/me/logout.post.ts
@@ -1,7 +1,6 @@
-import { sessionConfig } from '~~/server/utils/server-session'
+import { dropActiveAccount } from '~~/server/utils/server-session'
 
 export default defineEventHandler(async event => {
-  const session = await useSession(event, sessionConfig())
-  await session.clear()
-  return { ok: true }
+  const remaining = await dropActiveAccount(event)
+  return { ok: true, remaining }
 })
diff --git a/server/api/me/switch.post.ts b/server/api/me/switch.post.ts
new file mode 100644
--- /dev/null
+++ b/server/api/me/switch.post.ts
@@ -0,0 +1,17 @@
+import { requireSession, switchAccount } from '~~/server/utils/server-session'
+
+export default defineEventHandler(async event => {
+  await requireSession(event)
+  const body = await readBody<{ did?: unknown }>(event)
+  const did = typeof body?.did === 'string' ? body.did : null
+  if (!did) {
+    throw createError({ statusCode: 400, statusMessage: 'missing did' })
+  }
+
+  const switched = await switchAccount(event, did)
+  if (!switched) {
+    throw createError({ statusCode: 404, statusMessage: 'account not signed in on this device' })
+  }
+
+  return { ok: true, active: did }
+})
diff --git a/server/utils/git-wire/receive-pack.ts b/server/utils/git-wire/receive-pack.ts
--- a/server/utils/git-wire/receive-pack.ts
+++ b/server/utils/git-wire/receive-pack.ts
@@ -206,5 +206,3 @@
     stdin.on('close', resolve)
   })
 }
-
-export { RemoteRejectedError, ZERO_SHA }
diff --git a/server/utils/git-wire/refs.ts b/server/utils/git-wire/refs.ts
--- a/server/utils/git-wire/refs.ts
+++ b/server/utils/git-wire/refs.ts
@@ -1,6 +1,6 @@
 import { lineToString } from './pkt-line'
 
-const ZERO_SHA = '0000000000000000000000000000000000000000'
+export const ZERO_SHA = '0000000000000000000000000000000000000000'
 
 export interface Advertisement {
   /** Ref name -> object SHA (unpeeled). For annotated tags this is the tag object. */
@@ -65,5 +65,3 @@
 
   return { refs, peeled, capabilities }
 }
-
-export { ZERO_SHA }

--
tangled.sh