From bdd077a858464074b9fe460778cdbe00ef7ea6b1 Mon Sep 17 00:00:00 2001
From: Daniel Roe <daniel@roe.dev>
Date: Fri, 12 Jun 2026 17:00:53 +0100
Subject: [PATCH] fix: improvements

---
 app/pages/dashboard.vue               | 274 +++++++++++++++++++++-----
 app/pages/index.vue                   |  23 ++-
 nuxt.config.ts                        |   1 +
 public/favicon.ico                    | Bin 4286 -> 0 bytes
 server/api/atproto/callback.get.ts    |  29 ++-
 server/api/me/accounts.get.ts         |  53 +++++
 server/api/me/logout.post.ts          |   7 +-
 server/api/me/switch.post.ts          |  17 ++
 server/utils/git-wire/receive-pack.ts |   2 -
 server/utils/git-wire/refs.ts         |   4 +-
 server/utils/require-session.ts       |   2 -
 server/utils/resolve-handle.ts        |  24 +++
 server/utils/server-session.ts        | 101 ++++++++--
 server/utils/splice.ts                |   2 -
 server/utils/sync-push.ts             |   2 -
 server/utils/sync-ref.ts              |   2 +-
 test/unit/server-session.spec.ts      |  36 +++-
 17 files changed, 487 insertions(+), 92 deletions(-)
 delete mode 100644 public/favicon.ico
 create mode 100644 server/api/me/accounts.get.ts
 create mode 100644 server/api/me/switch.post.ts
 delete mode 100644 server/utils/require-session.ts
 create mode 100644 server/utils/resolve-handle.ts

diff --git a/app/pages/dashboard.vue b/app/pages/dashboard.vue
index 1885f70..ebb9ef8 100644
--- a/app/pages/dashboard.vue
+++ b/app/pages/dashboard.vue
@@ -1,7 +1,10 @@
 <script setup lang="ts">
 import { ref } from 'vue'
+import type { AccountsPayload } from '~~/server/api/me/accounts.get'
 import type { DashboardPayload, DashboardRepo } from '~~/server/api/me/dashboard.get'
 
+const installUrl = 'https://github.com/apps/synchub-to/installations/new'
+
 definePageMeta({
   middleware: ['authenticated'],
 })
@@ -12,6 +15,49 @@ useSeoMeta({
 })
 
 const { data, refresh, error } = await useFetch<DashboardPayload>('/api/me/dashboard')
+const { data: accountsData, refresh: refreshAccounts } = await useFetch<AccountsPayload>('/api/me/accounts')
+
+const switcher = useTemplateRef<HTMLDetailsElement>('switcher')
+const switcherOpen = ref(false)
+
+onMounted(() => {
+  const onPointerDown = (e: PointerEvent) => {
+    if (switcherOpen.value && switcher.value && !switcher.value.contains(e.target as Node)) {
+      switcherOpen.value = false
+    }
+  }
+  document.addEventListener('pointerdown', onPointerDown)
+  onBeforeUnmount(() => document.removeEventListener('pointerdown', onPointerDown))
+})
+
+const activeAccount = computed(() =>
+  accountsData.value?.accounts.find(a => a.active) ?? null,
+)
+const otherAccounts = computed(() =>
+  accountsData.value?.accounts.filter(a => !a.active) ?? [],
+)
+
+function accountLabel(account: { handle: string | null, accountLogin: string | null, did: string }) {
+  if (account.handle) return `@${account.handle}`
+  if (account.accountLogin) return account.accountLogin
+  return account.did
+}
+
+async function switchTo(did: string) {
+  switcherOpen.value = false
+  pendingAction.value = `switch:${did}`
+  try {
+    await postAction('/api/me/switch', { did })
+    await Promise.all([refresh(), refreshAccounts()])
+    flash.value = null
+  }
+  catch {
+    flash.value = 'Error: could not switch account.'
+  }
+  finally {
+    pendingAction.value = null
+  }
+}
 
 const flash = ref<string | null>(null)
 const flashIsError = computed(() => flash.value?.startsWith('Error:') ?? false)
@@ -50,8 +96,14 @@ async function runAction(key: string, fn: () => Promise<unknown>, successMessage
 // `$fetch` blows up TS' pattern matcher with "excessive stack depth". Posting
 // a no-body request through native `fetch` and parsing the JSON manually
 // sidesteps that. Same-origin, so cookies are sent automatically.
-async function postAction(url: string): Promise<unknown> {
-  const response = await fetch(url, { method: 'POST', credentials: 'same-origin' })
+async function postAction(url: string, payload?: unknown): Promise<unknown> {
+  const response = await fetch(url, {
+    method: 'POST',
+    credentials: 'same-origin',
+    ...(payload === undefined
+      ? {}
+      : { headers: { 'content-type': 'application/json' }, body: JSON.stringify(payload) }),
+  })
   if (!response.ok) {
     let statusMessage = response.statusText
     try {
@@ -72,7 +124,7 @@ function resync(repo: DashboardRepo) {
   return runAction(
     actionKey('resync', repo.id),
     () => postAction(`/api/repos/${repo.id}/resync`),
-    `Queued resync for ${repo.githubFullName}.`,
+    `queued resync for ${repo.githubFullName}.`,
   )
 }
 
@@ -80,7 +132,7 @@ function disable(repo: DashboardRepo) {
   return runAction(
     actionKey('disable', repo.id),
     () => postAction(`/api/repos/${repo.id}/disable`),
-    `Disabled sync for ${repo.githubFullName}.`,
+    `disabled sync for ${repo.githubFullName}.`,
   )
 }
 
@@ -88,7 +140,7 @@ function enable(repo: DashboardRepo) {
   return runAction(
     actionKey('enable', repo.id),
     () => postAction(`/api/repos/${repo.id}/enable`),
-    `Re-enabled sync for ${repo.githubFullName}.`,
+    `re-enabled sync for ${repo.githubFullName}.`,
   )
 }
 
@@ -96,19 +148,27 @@ function rotateKey() {
   return runAction(
     'rotate-key',
     () => postAction('/api/me/rotate-key'),
-    'Queued SSH key rotation.',
+    'queued SSH key rotation.',
   )
 }
 
 async function logout() {
+  switcherOpen.value = false
   pendingAction.value = 'logout'
   try {
-    await postAction('/api/me/logout')
-    await navigateTo('/')
+    const result = await postAction('/api/me/logout') as { remaining: number }
+    if (result.remaining > 0) {
+      await Promise.all([refresh(), refreshAccounts()])
+      flash.value = null
+      pendingAction.value = null
+    }
+    else {
+      await navigateTo('/')
+    }
   }
   catch {
     pendingAction.value = null
-    flash.value = 'Error: could not sign out.'
+    flash.value = 'error: could not sign out.'
   }
 }
 
@@ -137,7 +197,46 @@ function fmtDate(iso: string | null): string {
   <div class="page">
     <a class="skip-link" href="#main">skip to main content</a>
     <header class="nav-term">
-      <nav class="nav-term__line" aria-label="primary"><span class="prompt" aria-hidden="true">&gt;</span> <a class="nav-term__mark" href="/dashboard" aria-label="synchub.to dashboard"><SynchubMark :wordmark="true" :size="18" /></a> <button type="button" class="nav-term__logout" :disabled="pendingAction !== null" :aria-busy="pendingAction === 'logout'" @click="logout">{{ pendingAction === 'logout' ? 'logging out…' : '--logout' }}</button></nav>
+      <nav class="nav-term__line" aria-label="primary">
+        <span class="prompt" aria-hidden="true">&gt;</span>
+        <a class="nav-term__mark" href="/dashboard"><SynchubMark :wordmark="true" :size="18" /></a>
+        <details ref="switcher" class="switcher" :open="switcherOpen" @toggle="switcherOpen = ($event.target as HTMLDetailsElement).open">
+          <summary class="switcher__summary">
+            <span class="switcher__active">{{ activeAccount ? accountLabel(activeAccount) : 'account' }}</span>
+            <span class="switcher__caret" aria-hidden="true">▾</span>
+          </summary>
+          <div class="switcher__menu">
+            <p v-if="activeAccount" class="switcher__current">
+              <span class="switcher__handle">{{ accountLabel(activeAccount) }}</span>
+              <span v-if="activeAccount.accountLogin" class="switcher__org">{{ activeAccount.accountLogin }}</span>
+            </p>
+            <template v-if="otherAccounts.length">
+              <p class="switcher__label">switch to</p>
+              <button
+                v-for="account in otherAccounts"
+                :key="account.did"
+                type="button"
+                class="switcher__item"
+                :disabled="pendingAction !== null"
+                @click="switchTo(account.did)"
+              >
+                <span class="switcher__handle">{{ accountLabel(account) }}</span>
+                <span v-if="account.accountLogin" class="switcher__org">{{ account.accountLogin }}</span>
+              </button>
+            </template>
+            <a class="switcher__item switcher__add" :href="installUrl">+ add account</a>
+            <button
+              type="button"
+              class="switcher__item switcher__logout"
+              :disabled="pendingAction !== null"
+              :aria-busy="pendingAction === 'logout'"
+              @click="logout"
+            >
+              {{ pendingAction === 'logout' ? 'logging out…' : 'log out' }}
+            </button>
+          </div>
+        </details>
+      </nav>
     </header>
 
     <div id="main" class="intro">
@@ -155,31 +254,26 @@ function fmtDate(iso: string | null): string {
       <section class="card">
         <h2>identity</h2>
         <dl>
-          <dt>tangled DID</dt>
-          <dd><code>{{ data.did }}</code></dd>
-          <template v-if="data.handle">
-            <dt>handle</dt>
-            <dd>@{{ data.handle }}</dd>
-          </template>
+          <dt>tangled</dt>
+          <dd>
+            <span v-if="data.handle">@{{ data.handle }}</span>
+            <code class="did" :class="{ 'did--secondary': data.handle }">{{ data.did }}</code>
+          </dd>
           <template v-if="data.installation">
-            <dt>GitHub installation</dt>
+            <dt>GitHub</dt>
             <dd>
               {{ data.installation.accountLogin }}
-              <span class="muted">({{ data.installation.accountType }}, install #{{ data.installation.id }})</span>
+              <span class="muted">({{ data.installation.accountType.toLowerCase() }}, install #{{ data.installation.id }})</span>
               <span v-if="data.installation.suspendedAt" class="badge badge-error">suspended</span>
             </dd>
           </template>
           <template v-else>
-            <dt>GitHub installation</dt>
+            <dt>GitHub</dt>
             <dd class="muted">
               no matching install row
             </dd>
           </template>
         </dl>
-        <p class="muted small">
-          connected to <strong>{{ data.installation?.accountLogin ?? 'this account' }}</strong>.
-          <a href="https://github.com/apps/synchub-to/installations/new">connect a different installation?</a>
-        </p>
       </section>
 
       <section class="card">
@@ -199,7 +293,7 @@ function fmtDate(iso: string | null): string {
           :aria-busy="pendingAction === 'rotate-key'"
           @click="rotateKey"
         >
-          {{ pendingAction === 'rotate-key' ? 'Rotating…' : 'Rotate SSH key' }}
+          {{ pendingAction === 'rotate-key' ? 'rotating…' : 'rotate SSH key' }}
         </button>
       </section>
 
@@ -213,8 +307,8 @@ function fmtDate(iso: string | null): string {
             <div class="repo__main">
               <div class="repo__head">
                 <a class="repo__name" :href="`https://github.com/${repo.githubFullName}`" rel="noopener noreferrer">{{ repo.githubFullName }}</a>
-                <span class="badge" :class="`badge-${repo.status}`">{{ repo.status }}</span>
                 <span v-if="repo.disabledAt" class="badge badge-disabled">disabled</span>
+                <span v-else class="badge" :class="`badge-${repo.status}`">{{ repo.status }}</span>
               </div>
               <dl class="repo__meta">
                 <div class="repo__meta-item">
@@ -242,7 +336,7 @@ function fmtDate(iso: string | null): string {
                 :aria-busy="pendingAction === actionKey('resync', repo.id)"
                 @click="resync(repo)"
               >
-                {{ pendingAction === actionKey('resync', repo.id) ? 'Resyncing…' : 'Resync' }}
+                {{ pendingAction === actionKey('resync', repo.id) ? 'resyncing…' : 'resync' }}
               </button>
               <button
                 v-if="repo.disabledAt"
@@ -251,7 +345,7 @@ function fmtDate(iso: string | null): string {
                 :aria-busy="pendingAction === actionKey('enable', repo.id)"
                 @click="enable(repo)"
               >
-                {{ pendingAction === actionKey('enable', repo.id) ? 'Enabling…' : 'Enable' }}
+                {{ pendingAction === actionKey('enable', repo.id) ? 'enabling…' : 'enable' }}
               </button>
               <button
                 v-else
@@ -260,7 +354,7 @@ function fmtDate(iso: string | null): string {
                 :aria-busy="pendingAction === actionKey('disable', repo.id)"
                 @click="disable(repo)"
               >
-                {{ pendingAction === actionKey('disable', repo.id) ? 'Disabling…' : 'Disable' }}
+                {{ pendingAction === actionKey('disable', repo.id) ? 'disabling…' : 'disable' }}
               </button>
             </div>
           </li>
@@ -310,43 +404,115 @@ function fmtDate(iso: string | null): string {
   margin-right: 1.2ch;
 }
 
-.nav-term__args {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.9ch;
-  list-style: none;
-  margin: 0;
-  padding: 0;
+.switcher {
+  margin-left: auto;
+  position: relative;
 }
 
-.nav-term__args a {
+.switcher__summary {
   display: inline-flex;
   align-items: center;
+  gap: 0.5ch;
   min-height: 44px;
+  padding: 0.2rem 0.7rem;
+  border: var(--rule-hair) solid var(--color-rule-interactive);
+  border-radius: var(--radius-sm);
   color: var(--color-muted);
-  text-decoration: underline;
-  text-underline-offset: 2px;
+  font-family: var(--font-mono);
+  font-size: var(--text-sm);
   white-space: nowrap;
+  cursor: pointer;
+  list-style: none;
+  transition: border-color var(--dur-micro) var(--ease-out), color var(--dur-micro) var(--ease-out);
 }
 
-.nav-term__args a:hover { color: var(--color-ink); }
+.switcher__summary::-webkit-details-marker { display: none; }
+.switcher__summary:hover { border-color: var(--color-accent); color: var(--color-ink); }
+.switcher[open] .switcher__summary { border-color: var(--color-accent); color: var(--color-ink); }
+.switcher[open] .switcher__caret { transform: rotate(180deg); }
 
-.nav-term__logout {
-  margin-left: auto;
-  padding: 0.2rem 0.7rem;
-  border: var(--rule-hair) solid var(--color-rule-interactive);
+.switcher__caret {
+  display: inline-block;
+  color: var(--color-neutral);
+  transition: transform var(--dur-micro) var(--ease-out);
+}
+
+.switcher__menu {
+  position: absolute;
+  right: 0;
+  top: calc(100% + var(--space-2xs));
+  z-index: var(--z-overlay);
+  min-width: 13rem;
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  padding: var(--space-2xs);
+  background: var(--color-paper-3);
+  border: var(--rule-hair) solid var(--color-rule);
+  border-radius: var(--radius-md);
+}
+
+.switcher__current {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  margin: 0;
+  padding: var(--space-xs) var(--space-sm);
+}
+
+.switcher__label {
+  margin: var(--space-2xs) 0 0;
+  padding: 0 var(--space-sm);
+  font-size: var(--text-xs);
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--color-neutral);
+}
+
+.switcher__handle {
+  font-family: var(--font-mono);
+  color: var(--color-ink);
+}
+
+.switcher__org {
+  font-size: var(--text-xs);
+  color: var(--color-neutral);
+}
+
+.switcher__item {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+  align-items: start;
+  width: 100%;
+  min-height: 44px;
+  justify-content: center;
+  padding: var(--space-xs) var(--space-sm);
+  border: 0;
   border-radius: var(--radius-sm);
   background: transparent;
   color: var(--color-muted);
-  font-family: var(--font-mono);
+  font: inherit;
   font-size: var(--text-sm);
+  text-align: left;
+  text-decoration: none;
   white-space: nowrap;
   cursor: pointer;
-  transition: border-color var(--dur-micro) var(--ease-out), color var(--dur-micro) var(--ease-out);
+  transition: background-color var(--dur-micro) var(--ease-out);
 }
 
-.nav-term__logout:hover:not(:disabled) { border-color: var(--color-accent); color: var(--color-ink); }
-.nav-term__logout:disabled { opacity: 0.5; cursor: progress; }
+.switcher__item:hover:not(:disabled) { background: var(--color-paper-2); }
+.switcher__item:disabled { opacity: 0.5; cursor: progress; }
+
+.switcher__add {
+  border-top: var(--rule-hair) solid var(--color-rule);
+  border-radius: 0;
+  margin-top: var(--space-2xs);
+  color: var(--color-accent-dim);
+}
+
+.switcher__logout { color: var(--color-muted); }
+.switcher__logout:hover:not(:disabled) { color: var(--color-error); }
 
 .caret {
   display: inline-block;
@@ -393,8 +559,20 @@ h2 {
 dl {
   display: grid;
   grid-template-columns: max-content minmax(0, 1fr);
+  align-items: baseline;
   gap: var(--space-2xs) var(--space-md);
-  margin: 0 0 var(--space-sm);
+  margin: 0;
+}
+
+.did {
+  word-break: break-all;
+}
+
+.did--secondary {
+  display: block;
+  margin-top: 2px;
+  font-size: var(--text-xs);
+  color: var(--color-neutral);
 }
 
 dt {
diff --git a/app/pages/index.vue b/app/pages/index.vue
index a68588f..321cda4 100644
--- a/app/pages/index.vue
+++ b/app/pages/index.vue
@@ -22,7 +22,7 @@ router.afterEach(() => {
   <div class="shell">
     <a class="skip-link" href="#main">skip to main content</a>
     <header class="nav-term">
-      <nav class="nav-term__line" aria-label="primary"><span class="prompt" aria-hidden="true">&gt;</span> <a class="nav-term__mark" href="/" aria-label="synchub.to home"><SynchubMark :wordmark="true" :size="18" /></a> <ul class="nav-term__args"><li><a href="#start">--start</a></li> <li><a href="#signin">--sign-in</a></li></ul><span class="caret" aria-hidden="true">█</span></nav>
+      <nav class="nav-term__line" aria-label="primary"><span class="prompt" aria-hidden="true">&gt;</span> <a class="nav-term__mark" href="/"><SynchubMark :wordmark="true" :size="18" /></a> <ul class="nav-term__args"><li><a href="#start">--start</a></li> <li><a href="#signin">--sign-in</a></li></ul><span class="caret" aria-hidden="true"></span></nav>
     </header>
 
     <main id="main">
@@ -35,7 +35,7 @@ router.afterEach(() => {
           and tags will stay in sync.
         </p>
 
-        <pre class="session" aria-label="How synchub works"><span class="c"># 1 · install the github app on the repos to mirror</span>
+        <pre class="session" role="img" aria-label="How synchub works"><span class="c"># 1 · install the github app on the repos to mirror</span>
 <span class="p">$</span> gh app install <span class="a">synchub-to</span>
 
 <span class="c"># 2 · connect your tangled identity</span>
@@ -43,7 +43,7 @@ router.afterEach(() => {
 
 <span class="c"># 3 · push as usual</span>
 <span class="p">$</span> git push origin main
-<span class="ok">✓</span> mirrored alice/widget → tangled.org <span class="dim">(2 refs)</span><span class="caret" aria-hidden="true">█</span></pre>
+<span class="ok">✓</span> mirrored alice/widget → tangled.org <span class="dim">(2 refs)</span><span class="caret" aria-hidden="true"></span></pre>
       </section>
 
       <section id="start" class="panel reveal" style="--i: 1">
@@ -149,13 +149,16 @@ router.afterEach(() => {
 
 .caret {
   display: inline-block;
-  width: 1ch;
-  color: var(--color-accent);
-  animation: blink 1.05s steps(2) infinite;
+  width: 0.55ch;
+  height: 1em;
+  margin-left: 0.15ch;
+  vertical-align: -0.12em;
+  background: var(--color-accent);
+  animation: blink 1.1s var(--ease-in-out) infinite;
 }
 
-@keyframes blink { 50% { opacity: 0; } }
-@media (prefers-reduced-motion: reduce) { .caret { animation: none; } }
+@keyframes blink { 0%, 45% { opacity: 1; } 55%, 100% { opacity: 0; } }
+@media (prefers-reduced-motion: reduce) { .caret { animation: none; opacity: 1; } }
 
 .hero {
   padding-block: var(--space-2xl) var(--space-xl);
@@ -254,6 +257,10 @@ router.afterEach(() => {
   font-family: var(--font-mono);
 }
 
+.signin input:focus-visible {
+  outline: none;
+}
+
 .signin input {
   flex: 1;
   min-width: 14rem;
diff --git a/nuxt.config.ts b/nuxt.config.ts
index 24762ac..9d3f005 100644
--- a/nuxt.config.ts
+++ b/nuxt.config.ts
@@ -42,6 +42,7 @@ export default defineNuxtConfig({
   app: {
     head: {
       htmlAttrs: { lang: 'en' },
+      title: 'synchub.to',
       link: [
         { rel: 'icon', type: 'image/svg+xml', href: '/favicon.svg' },
         { rel: 'alternate icon', href: '/favicon.ico' },
diff --git a/public/favicon.ico b/public/favicon.ico
deleted file mode 100644
index 18993ad91cfd43e03b074dd0b5cc3f37ab38e49c..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 4286
zcmZNyU}RuqP*4ET3Jfa*7#PGD7#K7d7#I{77#JKFAmR)lAi%&N%niXH?kFA&fq@Qz
zhWiW(jdvI(G~H#GPY~Z`C}_A1PSP08ZoJLVKu|xD9Uwa!?lTB9-eK6^bcf+TDHx;&
z<Zfg~G~HrIAjJ%jT97#)noN8j!wq*B?vrfRJ%;rtdTuiuz!r{;w;9f(sDp&redI6z
zxd)qGm{>DfScCiz)&nsM90wqKkj+G9gVo+*xPa^qP`o3n!N&&KhpZQ59!P!DU50*S
zaZp@>#Ia#enrT7}=l3vku&IZMHQZqcK(XUCLqA;ZK7#_9nJD23QwO6l%(}xcA0~&5
z2D!Nr)6D|NYC(QRb|0Z|ZM?;>09if0FaVi_thVVkLjkhgFg98k{Ksb|NDjr!I}BLE
z465!uOf4u4!0bb(8}2h0z|=u$yy4n(m!Tf24xDyDVTf)f$UbB>xXLe>K8$d^!w>+I
zL#MI07o|)9*@bL((;bHO=w_hvq2UGb4<uh=4Ofspbhm=+0+p*EIS_8Vi&AC~l}|wW
zhzVCLeuKLi?1$S71t9mpFenXz%qAA2rA3r*1(|^sukiE*vak6LxJ*SB1L;S}Zy+=9
zVNhBEnT3SmX%Uovki`Fk{Dv(qU}`{Nh0iWra!qJ;11MZUWl7T=1`NM}<j}$l93P-?
z!eu@oaj2PKb3lFpnFaDIhz-M_vJhrY^Ie8~m^h4XxW!-qlP8D97p@@ppqtr*TtD4q
zs7IG4l@ARAto1sscm;`rFsXLoQjaAq{%=C6zi{cJrZ`&K0+l5s<tIwr0*VJv*#^QO
zHl^l`>K_dOzy?DI{Ko<q*bgu;FdkrFV0Zw=><{W6G=H!^*!;u3@!%i%<_CY|*&qDl
zXa7*g#t*_jY#8MK$S}zNkzla@$G}kkk0GJ{Kf{Or{~3P%|KIrk|Nn#k|NlRX#iIZJ
G{{sM%x?{8e

diff --git a/server/api/atproto/callback.get.ts b/server/api/atproto/callback.get.ts
index 600b1f7..663f450 100644
--- a/server/api/atproto/callback.get.ts
+++ b/server/api/atproto/callback.get.ts
@@ -1,7 +1,8 @@
 import { and, eq, ne } from 'drizzle-orm'
 import { userIdentity } from '~~/server/db/schema'
 import { enqueue } from '~~/server/utils/queue'
-import { writeSession } from '~~/server/utils/server-session'
+import { resolveHandle } from '~~/server/utils/resolve-handle'
+import { addAccount } from '~~/server/utils/server-session'
 import { generateAndPublishKey, revokeKeyForInstallationDid } from '~~/server/utils/tangled-pubkey'
 
 export default defineEventHandler(async event => {
@@ -29,6 +30,7 @@ export default defineEventHandler(async event => {
   // would just show a useless page.
 
   let installationId: number | undefined
+  let handle: string | null = null
 
   if (state) {
     const parsed = Number(state)
@@ -63,14 +65,16 @@ export default defineEventHandler(async event => {
         ))
     }
 
+    handle = await resolveHandle(session)
+
     await db.insert(userIdentity).values({
       did: session.did,
-      handle: null,
+      handle,
       installationId,
       updatedAt: new Date(),
     }).onConflictDoUpdate({
       target: userIdentity.did,
-      set: { installationId, updatedAt: new Date() },
+      set: { installationId, handle, updatedAt: new Date() },
     })
 
     // Generate and publish the SSH key inline: it's one ed25519 keygen + one
@@ -86,7 +90,10 @@ export default defineEventHandler(async event => {
   }
   else {
     // Returning sign-in. Look up the installation we previously bound.
-    const rows = await db.select({ installationId: userIdentity.installationId })
+    const rows = await db.select({
+      installationId: userIdentity.installationId,
+      handle: userIdentity.handle,
+    })
       .from(userIdentity)
       .where(eq(userIdentity.did, session.did))
       .limit(1)
@@ -101,10 +108,20 @@ export default defineEventHandler(async event => {
       return
     }
     installationId = rows[0]!.installationId
+
+    // Refresh the handle on sign-in: it can change on the user's PDS between
+    // visits. Fall back to the stored value if resolution fails.
+    handle = await resolveHandle(session) ?? rows[0]!.handle
+    if (handle !== rows[0]!.handle) {
+      await db.update(userIdentity)
+        .set({ handle, updatedAt: new Date() })
+        .where(eq(userIdentity.did, session.did))
+    }
   }
 
-  // Sealed cookie session for the dashboard. Handle resolution is deferred.
-  await writeSession(event, { did: session.did, installationId })
+  // Append this account to the device's session and make it active. A user can
+  // be connected to several handles at once and switch between them locally.
+  await addAccount(event, { did: session.did, installationId, handle: handle ?? undefined })
 
   await sendRedirect(event, '/dashboard', 302)
 })
diff --git a/server/api/me/accounts.get.ts b/server/api/me/accounts.get.ts
new file mode 100644
index 0000000..1c3c26c
--- /dev/null
+++ b/server/api/me/accounts.get.ts
@@ -0,0 +1,53 @@
+import { inArray } from 'drizzle-orm'
+import { installation, userIdentity } from '~~/server/db/schema'
+import { useDb } from '~~/server/utils/db'
+import { getDeviceSession, requireSession } from '~~/server/utils/server-session'
+
+export interface AccountSummary {
+  did: string
+  installationId: number
+  handle: string | null
+  accountLogin: string | null
+  active: boolean
+}
+
+export interface AccountsPayload {
+  active: string
+  accounts: AccountSummary[]
+}
+
+export default defineEventHandler(async (event): Promise<AccountsPayload> => {
+  await requireSession(event)
+  const data = (await getDeviceSession(event))!
+
+  const db = useDb()
+  const dids = data.accounts.map(a => a.did)
+  const installIds = data.accounts.map(a => a.installationId)
+
+  const [identityRows, installRows] = await Promise.all([
+    dids.length > 0
+      ? db.select({ did: userIdentity.did, handle: userIdentity.handle })
+        .from(userIdentity)
+        .where(inArray(userIdentity.did, dids))
+      : Promise.resolve([]),
+    installIds.length > 0
+      ? db.select({ id: installation.id, accountLogin: installation.accountLogin })
+        .from(installation)
+        .where(inArray(installation.id, installIds))
+      : Promise.resolve([]),
+  ])
+
+  const handleByDid = new Map(identityRows.map(r => [r.did, r.handle]))
+  const loginById = new Map(installRows.map(r => [r.id, r.accountLogin]))
+
+  return {
+    active: data.active,
+    accounts: data.accounts.map(a => ({
+      did: a.did,
+      installationId: a.installationId,
+      handle: a.handle ?? handleByDid.get(a.did) ?? null,
+      accountLogin: loginById.get(a.installationId) ?? null,
+      active: a.did === data.active,
+    })),
+  }
+})
diff --git a/server/api/me/logout.post.ts b/server/api/me/logout.post.ts
index 6b35e90..da7dc92 100644
--- a/server/api/me/logout.post.ts
+++ b/server/api/me/logout.post.ts
@@ -1,7 +1,6 @@
-import { sessionConfig } from '~~/server/utils/server-session'
+import { dropActiveAccount } from '~~/server/utils/server-session'
 
 export default defineEventHandler(async event => {
-  const session = await useSession(event, sessionConfig())
-  await session.clear()
-  return { ok: true }
+  const remaining = await dropActiveAccount(event)
+  return { ok: true, remaining }
 })
diff --git a/server/api/me/switch.post.ts b/server/api/me/switch.post.ts
new file mode 100644
index 0000000..cb6232f
--- /dev/null
+++ b/server/api/me/switch.post.ts
@@ -0,0 +1,17 @@
+import { requireSession, switchAccount } from '~~/server/utils/server-session'
+
+export default defineEventHandler(async event => {
+  await requireSession(event)
+  const body = await readBody<{ did?: unknown }>(event)
+  const did = typeof body?.did === 'string' ? body.did : null
+  if (!did) {
+    throw createError({ statusCode: 400, statusMessage: 'missing did' })
+  }
+
+  const switched = await switchAccount(event, did)
+  if (!switched) {
+    throw createError({ statusCode: 404, statusMessage: 'account not signed in on this device' })
+  }
+
+  return { ok: true, active: did }
+})
diff --git a/server/utils/git-wire/receive-pack.ts b/server/utils/git-wire/receive-pack.ts
index 28ac3cc..292ce04 100644
--- a/server/utils/git-wire/receive-pack.ts
+++ b/server/utils/git-wire/receive-pack.ts
@@ -206,5 +206,3 @@ async function pipePack(stdin: NodeJS.WritableStream, packStream: AsyncIterable<
     stdin.on('close', resolve)
   })
 }
-
-export { RemoteRejectedError, ZERO_SHA }
diff --git a/server/utils/git-wire/refs.ts b/server/utils/git-wire/refs.ts
index 9e22fa9..b07e696 100644
--- a/server/utils/git-wire/refs.ts
+++ b/server/utils/git-wire/refs.ts
@@ -1,6 +1,6 @@
 import { lineToString } from './pkt-line'
 
-const ZERO_SHA = '0000000000000000000000000000000000000000'
+export const ZERO_SHA = '0000000000000000000000000000000000000000'
 
 export interface Advertisement {
   /** Ref name -> object SHA (unpeeled). For annotated tags this is the tag object. */
@@ -65,5 +65,3 @@ export function parseAdvertisement(lines: Buffer[]): Advertisement {
 
   return { refs, peeled, capabilities }
 }
-
-export { ZERO_SHA }
diff --git a/server/utils/require-session.ts b/server/utils/require-session.ts
deleted file mode 100644
index 17c1116..0000000
--- a/server/utils/require-session.ts
+++ /dev/null
@@ -1,2 +0,0 @@
-export { getSessionData, requireSession, writeSession } from './server-session'
-export type { SynchubSessionData } from './server-session'
diff --git a/server/utils/resolve-handle.ts b/server/utils/resolve-handle.ts
new file mode 100644
index 0000000..6932689
--- /dev/null
+++ b/server/utils/resolve-handle.ts
@@ -0,0 +1,24 @@
+import { Agent } from '@atproto/api'
+import type { OAuthSession } from '@atproto/oauth-client-node'
+
+/**
+ * Resolve the human-readable handle for the authenticated DID.
+ *
+ * `com.atproto.repo.describeRepo` returns the handle the PDS has verified
+ * against the DID document, so it's the authoritative answer and needs no
+ * appview access. Best-effort: a handle is a display convenience, so any
+ * failure (network, unverified handle) returns null rather than blocking the
+ * sign-in flow. Strips a leading `@` if the PDS includes one.
+ */
+export async function resolveHandle(oauthSession: OAuthSession): Promise<string | null> {
+  try {
+    const agent = new Agent(oauthSession)
+    const { data } = await agent.com.atproto.repo.describeRepo({ repo: oauthSession.did })
+    const handle = data.handle?.trim().replace(/^@/, '')
+    if (!handle || handle === 'handle.invalid') return null
+    return handle
+  }
+  catch {
+    return null
+  }
+}
diff --git a/server/utils/server-session.ts b/server/utils/server-session.ts
index 76e3aa9..4ca4f74 100644
--- a/server/utils/server-session.ts
+++ b/server/utils/server-session.ts
@@ -10,17 +10,25 @@ import type { H3Event, SessionConfig } from 'h3'
  * `process.env` directly so the helper is callable outside a request context
  * for tests, mirroring `encryption.ts`.
  *
- * v1 stores `installationId` alongside `did`: a user may have installed the
- * GitHub App on more than one account (personal + an org), but the session
- * pins us to the one they last authenticated against. See the dashboard
- * "Connect a different installation?" link for the workaround.
+ * A user may have connected more than one tangled identity on this device
+ * (e.g. a personal account and an org). The cookie therefore holds a list of
+ * `accounts`, one of which is `active`. `requireSession()` flattens to the
+ * active account so downstream handlers keep working with a single
+ * `{ did, installationId, handle }`. Switching is a device-local convenience:
+ * the OAuth callback appends, `/api/me/switch` flips `active`, logout drops the
+ * active account.
  */
-export interface SynchubSessionData {
+export interface SynchubAccount {
   did: string
   installationId: number
   handle?: string
 }
 
+export interface SynchubSessionData {
+  active: string
+  accounts: SynchubAccount[]
+}
+
 const COOKIE_NAME = 'synchub-session'
 const COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30 // 30 days
 
@@ -47,19 +55,46 @@ export function sessionConfig(): SessionConfig {
   }
 }
 
-export async function getSessionData(event: H3Event): Promise<SynchubSessionData | null> {
+/**
+ * Normalise raw cookie data into a valid session, or null. Drops malformed
+ * account entries; if `active` doesn't name a surviving account, falls back to
+ * the first. Exported for unit testing the normalisation in isolation.
+ */
+export function readAccounts(data: Partial<SynchubSessionData>): SynchubSessionData | null {
+  if (typeof data.active !== 'string' || !Array.isArray(data.accounts)) return null
+  const accounts = data.accounts.filter(
+    (a): a is SynchubAccount => typeof a?.did === 'string' && typeof a?.installationId === 'number',
+  )
+  if (accounts.length === 0) return null
+  const active = accounts.some(a => a.did === data.active) ? data.active : accounts[0]!.did
+  return { active, accounts }
+}
+
+/**
+ * Return all accounts on this device plus the active DID, or null if the
+ * cookie is empty / malformed.
+ */
+export async function getDeviceSession(event: H3Event): Promise<SynchubSessionData | null> {
   const session = await useSession<SynchubSessionData>(event, sessionConfig())
-  const { did, installationId } = session.data
-  if (typeof did !== 'string' || typeof installationId !== 'number') return null
-  return { did, installationId, handle: session.data.handle }
+  return readAccounts(session.data)
 }
 
 /**
- * Return the current session or throw a 401. Use from any handler that needs
+ * Resolve the active account, flattened to the single-account shape that
+ * handlers expect.
+ */
+export async function getSessionData(event: H3Event): Promise<SynchubAccount | null> {
+  const data = await getDeviceSession(event)
+  if (!data) return null
+  return data.accounts.find(a => a.did === data.active) ?? null
+}
+
+/**
+ * Return the active account or throw a 401. Use from any handler that needs
  * an authenticated user. The thrown error is consumed by Nitro and rendered
  * as `{ statusCode: 401, statusMessage: 'unauthenticated' }`.
  */
-export async function requireSession(event: H3Event): Promise<SynchubSessionData> {
+export async function requireSession(event: H3Event): Promise<SynchubAccount> {
   const data = await getSessionData(event)
   if (!data) {
     throw createError({ statusCode: 401, statusMessage: 'unauthenticated' })
@@ -67,7 +102,47 @@ export async function requireSession(event: H3Event): Promise<SynchubSessionData
   return data
 }
 
-export async function writeSession(event: H3Event, data: SynchubSessionData): Promise<void> {
+/**
+ * Add (or refresh) an account on this device and make it active. Dedupes by
+ * DID: re-connecting an existing handle updates its installation binding and
+ * activates it rather than duplicating the entry.
+ */
+export async function addAccount(event: H3Event, account: SynchubAccount): Promise<void> {
+  const session = await useSession<SynchubSessionData>(event, sessionConfig())
+  const existing = readAccounts(session.data)?.accounts ?? []
+  const accounts = [...existing.filter(a => a.did !== account.did), account]
+  await session.update({ active: account.did, accounts })
+}
+
+/**
+ * Switch the active account to `did`. Returns false if the DID isn't present
+ * on this device.
+ */
+export async function switchAccount(event: H3Event, did: string): Promise<boolean> {
+  const session = await useSession<SynchubSessionData>(event, sessionConfig())
+  const data = readAccounts(session.data)
+  if (!data || !data.accounts.some(a => a.did === did)) return false
+  await session.update({ active: did, accounts: data.accounts })
+  return true
+}
+
+/**
+ * Drop the active account. If others remain, the first becomes active and the
+ * cookie is rewritten; otherwise the cookie is cleared. Returns the number of
+ * accounts left signed in.
+ */
+export async function dropActiveAccount(event: H3Event): Promise<number> {
   const session = await useSession<SynchubSessionData>(event, sessionConfig())
-  await session.update(data)
+  const data = readAccounts(session.data)
+  if (!data) {
+    await session.clear()
+    return 0
+  }
+  const remaining = data.accounts.filter(a => a.did !== data.active)
+  if (remaining.length === 0) {
+    await session.clear()
+    return 0
+  }
+  await session.update({ active: remaining[0]!.did, accounts: remaining })
+  return remaining.length
 }
diff --git a/server/utils/splice.ts b/server/utils/splice.ts
index b9cfefd..fea8ec4 100644
--- a/server/utils/splice.ts
+++ b/server/utils/splice.ts
@@ -148,5 +148,3 @@ export async function runSpliceDelete(factory: ReceivePackFactory, ref: string):
   await session.push([{ ref, old, next: ZERO_SHA }], null)
   return { status: 'synced' }
 }
-
-export { fetchAdvertisement }
diff --git a/server/utils/sync-push.ts b/server/utils/sync-push.ts
index dc80df3..faf7c9b 100644
--- a/server/utils/sync-push.ts
+++ b/server/utils/sync-push.ts
@@ -108,5 +108,3 @@ async function markMappingError(mappingId: number, message: string): Promise<voi
     .set({ status: 'error', lastError: message, updatedAt: new Date() })
     .where(eq(repoMapping.id, mappingId))
 }
-
-export { RemoteRejectedError }
diff --git a/server/utils/sync-ref.ts b/server/utils/sync-ref.ts
index 8994342..75cb87a 100644
--- a/server/utils/sync-ref.ts
+++ b/server/utils/sync-ref.ts
@@ -3,7 +3,7 @@ import { repoMapping } from '../db/schema'
 import { useDb } from './db'
 import { RemoteRejectedError, WireError } from './git-wire/errors'
 import { installationOctokit } from './github-app'
-import { fetchAdvertisement, spliceDelete, splicePush } from './splice'
+import { spliceDelete, splicePush } from './splice'
 
 export type RefType = 'branch' | 'tag'
 
diff --git a/test/unit/server-session.spec.ts b/test/unit/server-session.spec.ts
index 7f6b75c..bb13c6a 100644
--- a/test/unit/server-session.spec.ts
+++ b/test/unit/server-session.spec.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { sessionConfig } from '../../server/utils/server-session'
+import { readAccounts, sessionConfig } from '../../server/utils/server-session'
 
 const ORIGINAL_PASSWORD = process.env.NUXT_SESSION_PASSWORD
 const ORIGINAL_PUBLIC_URL = process.env.NUXT_PUBLIC_URL
@@ -47,3 +47,37 @@ describe('server-session: sessionConfig', () => {
     expect(config.cookie).toMatchObject({ secure: true })
   })
 })
+
+describe('server-session: readAccounts', () => {
+  const acct = (did: string, installationId: number) => ({ did, installationId })
+
+  it('returns null for empty or malformed cookie data', () => {
+    expect(readAccounts({})).toBeNull()
+    expect(readAccounts({ active: 'did:plc:1', accounts: [] })).toBeNull()
+    expect(readAccounts({ active: 'did:plc:1' })).toBeNull()
+    // eslint-disable-next-line ts/no-unsafe-type-assertion
+    expect(readAccounts({ active: 'did:plc:1', accounts: 'nope' as unknown as [] })).toBeNull()
+  })
+
+  it('keeps the active did when it names a present account', () => {
+    const result = readAccounts({ active: 'did:plc:2', accounts: [acct('did:plc:1', 1), acct('did:plc:2', 2)] })
+    expect(result).toEqual({ active: 'did:plc:2', accounts: [acct('did:plc:1', 1), acct('did:plc:2', 2)] })
+  })
+
+  it('falls back active to the first account when active is stale', () => {
+    const result = readAccounts({ active: 'did:plc:gone', accounts: [acct('did:plc:1', 1), acct('did:plc:2', 2)] })
+    expect(result?.active).toBe('did:plc:1')
+  })
+
+  it('drops malformed account entries', () => {
+    const accounts = [
+      acct('did:plc:1', 1),
+      // eslint-disable-next-line ts/no-unsafe-type-assertion
+      { did: 'did:plc:2' } as unknown as { did: string, installationId: number },
+      // eslint-disable-next-line ts/no-unsafe-type-assertion
+      { installationId: 3 } as unknown as { did: string, installationId: number },
+    ]
+    const result = readAccounts({ active: 'did:plc:1', accounts })
+    expect(result?.accounts).toEqual([acct('did:plc:1', 1)])
+  })
+})
-- 
knotmirror 0.0.1