[brtkwr]

Context

PLAT-1314 specifies an environment-variable context override for headless scripts. twoctl currently requires a flag on every invocation or a change to the shared saved context.

Changes

• Select the invocation context using --context, then --env, then non-empty TWOCTL_CONTEXT, then the saved current context.
• Honor that selection for API requests, auth commands, and dry runs without rewriting the saved context.
• Resolve the registered URL during credential-free dry runs instead of inferring the wrong host when no key is stored.
• Add regressions for precedence, request URL/key selection, auth targeting, dry-run behavior, unchanged saved selection, and the --url explicit-key boundary.

Scope / Non-goals

This is one coherent PLAT-1314 context-selection feature. It starts from main after merged PR #7 and does not depend on open retry-controls PR #6. OS-keychain storage and configuration mutation commands retain their existing behavior.

Validation

On exact head 817cfb2c43b2ce1c34f92e2f13a752231602f188, CI run 40854811107 passed both jobs:

• build: go build ./..., all tests through make test-cover, and the 80% coverage gate passed. Total coverage: 81.0%.
• lint: formatting, vet, ineffassign, spelling, complexity, and golint passed.
• No tests run locally. Local formatting and git diff --check passed.

Ticket

Refs PLAT-1314.

✨ via Codex session

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T10:07:48.740382Z	817cfb2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Puvendhan]

LGTM. TWOCTL_CONTEXT sits after --context and --env and never writes the saved context. pickContext uses it for the auth commands. The dry-run placeholder key only lets URL resolution run without a keychain read, and it is not sent. Needs a rebase after #6, or the other way round.