@datarails-ai/dr-cli 1.6.127 → 1.6.129

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.127",
+  version: "1.6.129",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.6",
+    "@datarails-ai/dr-appspace-cli": "0.12.7",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-12T20:54:31.824Z";
+var BUILD_TIME = "2026-10-13T11:59:10.262Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -7259,9 +7259,12 @@ async function runFeaturesOrgsList(cfg) {
   if (cfg.orgId <= 0) {
     throw new Error("org id must be positive");
   }
-  const flags = await orgsList(cfg.client, cfg.orgId, {
-    signal: cfg.signal
-  });
+  let flags;
+  try {
+    flags = await orgsList(cfg.client, cfg.orgId, { signal: cfg.signal });
+  } catch (err) {
+    throw orgFlagsError(err, cfg.client, cfg.orgId, false);
+  }
   if (cfg.asJson) {
     writeJSONIndented(cfg.out, flags);
     return;
@@ -7296,11 +7299,22 @@ async function runFeaturesOrgsToggle(cfg) {
     token: cfg.token,
     server: cfg.serverFlag,
     confirmCmd: cfg.confirmCmd,
-    describe: async () => [`org:   ${cfg.orgId}`, `flags: ${flagIds.join(", ")}`],
+    describe: async () => {
+      try {
+        await orgsList(cfg.client, cfg.orgId, { signal: cfg.signal });
+      } catch (err) {
+        throw orgFlagsError(err, cfg.client, cfg.orgId, true);
+      }
+      return [`org:   ${cfg.orgId}`, `flags: ${flagIds.join(", ")}`];
+    },
     execute: async () => {
-      await orgsAddOrRemove(cfg.client, cfg.orgId, flagIds, cfg.verb, {
-        signal: cfg.signal
-      });
+      try {
+        await orgsAddOrRemove(cfg.client, cfg.orgId, flagIds, cfg.verb, {
+          signal: cfg.signal
+        });
+      } catch (err) {
+        throw orgFlagsError(err, cfg.client, cfg.orgId, true);
+      }
       const act = cfg.verb === "addition" ? "enabled" : "disabled";
       const titled = act[0].toUpperCase() + act.slice(1);
       const noun = `flag${plural(flagIds.length)}`;
@@ -7309,6 +7323,25 @@ async function runFeaturesOrgsToggle(cfg) {
     }
   });
 }
+function orgFlagsError(err, client, orgId, write) {
+  const nothingChanged = write ? ", so nothing changed" : "";
+  if (isNotFoundError(err)) {
+    return new Error(
+      `org ${orgId} does not exist, or is not among the organizations ${client.email} can manage (404)${nothingChanged}.`
+    );
+  }
+  if (!isForbiddenError(err)) return err;
+  const head = `the platform refused access to the feature flags of org ${orgId} (403)${nothingChanged}. An org's feature flags are read and changed through the Datarails IT endpoints, which admit only an admin of the Datarails organization or a support user, checked on the account the CLI acts as. `;
+  const session = client.session;
+  if (isImpersonatedSession(session)) {
+    return new Error(
+      head + `This command acted as ${client.email}, impersonated by ${session.impersonatorEmail ?? ""}: the check applies to ${client.email}, not to you. Re-run it with --account ${session.impersonatorEmail ?? ""}.`
+    );
+  }
+  return new Error(
+    head + `${client.email} has neither role, or is blocked. Use the account you change flags with in the web IT console (\`dr whoami\` shows who you are), or ask for the support-user role.`
+  );
+}
 function writeTable2(out, rows) {
   if (rows.length === 0) return;
   const widths = [];

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.127",
+  "cliVersion": "1.6.129",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/reference/admin.md

@@ -692,6 +692,15 @@ targets.
   (both two-step confirm-token flow — flipping flags changes customer-visible
   behavior).
 
+**Run `features …` as the operator, never as a `login-as` identity.** Every
+`features` command except `features list --enriched` admits only an admin of the
+Datarails organization or a support user (`features groups …` only the admin),
+and the server checks the account the command acts as. An impersonated customer
+always gets 403, even when the operator can flip the flag in the web IT console.
+Pass `--account <your own email>`. `features orgs add|remove` read the org's
+flags at the plan step, so an identity that cannot write fails there, before a
+confirm token is issued.
+
 **Know the flag name? Skip the listing entirely.** `--flag` accepts a flag **id
 or name** (repeatable), and the server resolves it — so to enable/disable a flag
 you already know, go straight to `features orgs add <org_id> --flag <name>`. Only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.127",
+  "version": "1.6.129",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.6",
+    "@datarails-ai/dr-appspace-cli": "0.12.7",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",