Centralize multi-profile authentication in the tracing daemon

[Stephen Belanger (Qard)]

Summary

• replace hook-resolved credentials with a non-secret, immutable session route containing optional profile/organization selection, one typed destination, flush mode, and metadata
• resolve an omitted profile through the bt default, then pin the canonical resolved profile for the lifetime of each session
• add a host-facing auth provider whose leases are resolved and refreshed by the long-lived daemon, including concurrent sessions using different profiles
• store only non-secret route selection in hook settings and support invocation-local route overrides while keeping generated hook commands stable
• reconfigure Braintrust sinks safely when credentials rotate, expose actionable auth failures through daemon status, and never persist credentials

Why

Coding agents can report concurrently through different Braintrust profiles. Setup or run selects the intended user/org/destination, but hook processes—including JavaScript plugins—must not read tokens, implement OAuth refresh, access keychains, or duplicate bt auth behavior.

destination is the sole trace target contract. Project logs, experiments, and exported parent spans are represented by the existing typed destination variants; there are no parallel project/parent/root fields.

The embedding bt CLI must implement AuthProvider using its existing non-interactive profile resolver. It should persist the selected non-secret route during setup, or supply an invocation-local route during run. This repository supplies the daemon-side contract and lifecycle; dependent agent PRs send SessionRoute values over RPC.

Validation

• cargo test --manifest-path bt-daemon/Cargo.toml --all-features --locked
• cargo clippy --manifest-path bt-daemon/Cargo.toml --all-targets --all-features --locked -- -D warnings
• git diff --check

Tests cover default and named profile selection, multiple profile/org routes in one daemon, canonical-profile refresh, immutable session routing, typed destinations, remediation status, and journal credential exclusion.

Release impact

No package is published, no marketplace repository is deployed, and no tag or GitHub release is created.