@levr-one/cli 0.12.4 → 0.12.6

package/dist/{resolve-token-ByZq05Us.js → resolve-token-DKEXT7SA.js}

@@ -1,5 +1,5 @@
-import { getApiUrl, getPatToken, readCredentials } from "./env-CvjMSRd7.js";
-import { isTokenExpired, refreshToken } from "./token-refresh-CJB7Qlxy.js";
+import { classifyToken, isTokenExpired, refreshToken } from "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl, getPatToken, readCredentials } from "./env-DjeRwmZ7.js";
 
 //#region src/auth/resolve-token.ts
 /**
@@ -16,7 +16,8 @@ var CredentialsMismatchError = class extends Error {
 };
 /**
 * Resolve auth token in priority order:
-* 1. LEVR_TOKEN env var (PAT) — long-lived, no refresh
+* 1. LEVR_TOKEN env var — a PAT or an OAuth access token, told apart by
+*    shape (ENG-6068); never refreshed
 * 2. Stored credentials (JWT) — auto-refresh if expired
 * 3. Error — not authenticated
 */
@@ -24,7 +25,8 @@ async function resolveToken() {
 	const pat = getPatToken();
 	if (pat) return {
 		token: pat,
-		type: "pat"
+		type: classifyToken(pat),
+		source: "env"
 	};
 	let creds = readCredentials();
 	if (creds) {
@@ -38,7 +40,8 @@ async function resolveToken() {
 		}
 		return {
 			token: creds.access_token,
-			type: "jwt"
+			type: "jwt",
+			source: "stored"
 		};
 	}
 	throw new Error("Not authenticated. Run 'levr auth login' or set LEVR_TOKEN environment variable.");

package/dist/{resolve-workspace-BbK3uYQc.js → resolve-workspace-D8y7twod.js}

@@ -1,4 +1,4 @@
-import { authGetSitesV1 } from "./sdk-client-B4FMd_Fa.js";
+import { authGetSitesV1 } from "./sdk-client-BgzKzVIR.js";
 import { clearWorkspace, loadWorkspace, saveWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/workspace/resolve-workspace.ts
@@ -40,7 +40,8 @@ async function autoSelectWorkspace() {
 	};
 	return { kind: "none" };
 }
-async function resolveWorkspace(flagValue) {
+async function resolveWorkspace(flagValue, options = {}) {
+	const persist = options.persist ?? true;
 	let sites = null;
 	const getSites = async () => {
 		if (!sites) sites = await fetchSites();
@@ -61,7 +62,7 @@ async function resolveWorkspace(flagValue) {
 			source: "env"
 		};
 	}
-	const cached = loadWorkspace();
+	const cached = persist ? loadWorkspace() : null;
 	if (cached) {
 		if ((await getSites()).some((site) => site.workspace_id === cached)) return {
 			workspaceId: cached,
@@ -73,7 +74,7 @@ async function resolveWorkspace(flagValue) {
 	if (s.length === 0) throw new Error("No workspaces available.");
 	if (s.length === 1) {
 		const single = s[0];
-		saveWorkspace(single.workspace_id);
+		if (persist) saveWorkspace(single.workspace_id);
 		return {
 			workspaceId: single.workspace_id,
 			source: "auto"
@@ -84,6 +85,37 @@ async function resolveWorkspace(flagValue) {
 	const overflow = s.length > maxList ? `\n  ... and ${s.length - maxList} more` : "";
 	throw new Error(`Multiple workspaces. Select one:\n${list}${overflow}\n\nRun: levr workspace select <id>`);
 }
+/**
+* The workspace a command runs in, for whichever credential it holds —
+* [issue:ENG-6068].
+*
+* A JWT is not bound to a workspace, so one is resolved the usual way: the
+* flag, `LEVR_WORKSPACE_ID`, the cached selection, then auto-select, each
+* validated against the sites the account can see.
+*
+* A personal access token IS bound to one workspace, and the server scopes
+* every request by it. An explicit `--workspace-id` or `LEVR_WORKSPACE_ID` is
+* still sent as `Workspace-Id` — the server refuses one that is not the
+* token's — but nothing is looked up or cached, and with neither set the
+* answer is null: the token's own workspace applies. Until ENG-6068 both were
+* silently dropped for every `LEVR_TOKEN`, including an OAuth access token,
+* which was classified as a PAT by where it came from and has no workspace to
+* fall back to. An OAuth token from LEVR_TOKEN is not the login session, so
+* the saved workspace choice is left alone for it (`persist: false`).
+*/
+async function resolveWorkspaceFor(auth, flagValue) {
+	if (auth.type === "jwt") return resolveWorkspace(flagValue, { persist: auth.source !== "env" });
+	if (flagValue) return {
+		workspaceId: flagValue,
+		source: "flag"
+	};
+	const envWs = process.env["LEVR_WORKSPACE_ID"];
+	if (envWs) return {
+		workspaceId: envWs,
+		source: "env"
+	};
+	return null;
+}
 
 //#endregion
-export { autoSelectWorkspace, fetchSites, resolveWorkspace };
+export { autoSelectWorkspace, fetchSites, resolveWorkspaceFor };

package/dist/{runHandler-IyPhhiGs.js → runHandler-B-u-0eRk.js}

@@ -1,10 +1,10 @@
 import { executeInspect } from "./inspect-BbL7kDe-.js";
-import { client, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { client, configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
+import { resolveWorkspaceFor } from "./resolve-workspace-D8y7twod.js";
 import { existsSync } from "node:fs";
 import { constants as constants$1 } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -365,6 +365,15 @@ function delay(ms) {
 
 //#endregion
 //#region src/commands/gates/runHandler.ts
+/** The server's own words for a failed SDK call, for an error line. */
+function describeSdkError(error) {
+	if (typeof error === "string") return error.length > 200 ? `${error.slice(0, 200)}…` : error;
+	if (!error || typeof error !== "object") return "request failed";
+	const e = error;
+	const message = Array.isArray(e.message) ? e.message.map(String).join("; ") : typeof e.message === "string" ? e.message : typeof e.error === "string" ? e.error : "";
+	const text = [typeof e.statusCode === "number" ? `HTTP ${e.statusCode}` : "", message].filter(Boolean).join(": ") || "request failed";
+	return text.length > 200 ? `${text.slice(0, 200)}…` : text;
+}
 /** ENG-6070 review R5 M3 — dead gates are named, with their remedy. */
 function printDeadGates(out, dead) {
 	for (const d of dead ?? []) out(`  DEAD ${d.test_name ? `"${d.test_name}"` : d.link_id}${d.required === false ? " (advisory)" : ""}: ${d.reason === "test_deleted" ? "its test was deleted" : "the gate was removed"}${d.remedy ? ` — ${d.remedy}` : ""}`);
@@ -431,13 +440,15 @@ async function gatesRunHandler(flags, issue) {
 	};
 	if (flags.ci) setCiHeaders(null);
 	let workspaceId;
-	if (auth.type === "jwt") try {
-		const ws = await resolveWorkspace(flags["workspace-id"]);
-		workspaceId = ws.workspaceId;
-		client.setConfig({
-			...client.getConfig(),
-			workspaceId: ws.workspaceId
-		});
+	try {
+		const ws = await resolveWorkspaceFor(auth, flags["workspace-id"]);
+		if (ws) {
+			workspaceId = ws.workspaceId;
+			client.setConfig({
+				...client.getConfig(),
+				workspaceId: ws.workspaceId
+			});
+		}
 	} catch (err) {
 		this.logger.error(err instanceof Error ? err.message : "Workspace resolution failed.");
 		this.process.exitCode = 1;
@@ -451,7 +462,8 @@ async function gatesRunHandler(flags, issue) {
 		} });
 		const row = found.data?.data?.[0];
 		if (found.error || !row) {
-			this.logger.error(`Issue ${issue} not found in this workspace.`);
+			const where = workspaceId ? `workspace ${workspaceId}` : "the token's workspace";
+			this.logger.error(found.error ? `Could not look up issue ${issue} in ${where} (${describeSdkError(found.error)}).` : `Issue ${issue} not found in ${where}.`);
 			this.process.exitCode = 1;
 			return;
 		}

package/dist/{sdk-client-B4FMd_Fa.js → sdk-client-BgzKzVIR.js}

@@ -1,4 +1,4 @@
-import { getApiUrl } from "./env-CvjMSRd7.js";
+import { getApiUrl } from "./env-DjeRwmZ7.js";
 
 //#region ../sdk-public/dist/runtime/client.js
 function createInterceptorManager() {

package/dist/{selectHandler-D6cvq60S.js → selectHandler-C0gs-Q70.js}

@@ -1,7 +1,7 @@
-import { authGetSitesV1, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import { saveWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/commands/workspace/selectHandler.ts
@@ -19,6 +19,11 @@ async function selectHandler(_flags, workspaceId) {
 		this.process.exitCode = 1;
 		return;
 	}
+	if (auth.source === "env") {
+		this.logger.error("LEVR_TOKEN is set: a workspace selected here would be saved for your login session, not for that token. Pass --workspace-id or set LEVR_WORKSPACE_ID instead.");
+		this.process.exitCode = 1;
+		return;
+	}
 	configureClient(auth);
 	const result = await authGetSitesV1();
 	if (result.error) {

package/dist/{statusHandler-BQXn93-r.js → statusHandler-Dnnh80ZN.js}

@@ -1,6 +1,6 @@
-import { authGetProfileV1, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import { getApiUrl, getPatToken, readCredentials } from "./env-CvjMSRd7.js";
-import { isTokenExpired } from "./token-refresh-CJB7Qlxy.js";
+import { authGetProfileV1, configureClient } from "./sdk-client-BgzKzVIR.js";
+import { classifyToken, isTokenExpired } from "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl, getPatToken, readCredentials } from "./env-DjeRwmZ7.js";
 import chalk from "chalk";
 
 //#region src/commands/auth/statusHandler.ts
@@ -8,8 +8,10 @@ async function statusHandler() {
 	const apiUrl = getApiUrl();
 	const pat = getPatToken();
 	if (pat) {
-		if (await checkApiReachable(pat, "pat")) {
-			this.process.stdout.write(`${chalk.green("ok")}    Authenticated via LEVR_TOKEN (PAT)\n`);
+		const type = classifyToken(pat);
+		const kind = type === "pat" ? "personal access token" : "OAuth access token";
+		if (await checkApiReachable(pat, type)) {
+			this.process.stdout.write(`${chalk.green("ok")}    Authenticated via LEVR_TOKEN (${kind})\n`);
 			this.process.stdout.write(`  API:  ${apiUrl} (reachable)\n`);
 		} else {
 			this.process.stdout.write(`${chalk.yellow("warn")}  LEVR_TOKEN is set but API is unreachable\n`);

package/dist/{token-refresh-CJB7Qlxy.js → token-refresh-BpFuU4Ij.js}

@@ -1,5 +1,29 @@
-import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./env-CvjMSRd7.js";
+import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./env-DjeRwmZ7.js";
 
+//#region src/auth/token-shape.ts
+/**
+* Classify a bearer token by its SHAPE — [issue:ENG-6068].
+*
+* The server decides how to verify a token by looking at the token, not at
+* where it came from (`isPersonalAccessToken` in the backend's auth
+* middleware): a Levr personal access token starts with `tq_`, and anything
+* else is handed to the JWT verifier. `LEVR_TOKEN` carries either kind — a
+* PAT minted in Settings, or an OAuth access token a device-code login
+* printed for CI — so the CLI must apply the same rule. Until ENG-6068 every
+* `LEVR_TOKEN` was called a PAT, and the JWT-only steps (resolving
+* `--workspace-id` / `LEVR_WORKSPACE_ID`, `levr workspace list|select`) were
+* silently skipped for an OAuth token, which has no workspace of its own.
+*
+* Leaf module on purpose: no imports, so `resolve-token`, the handlers and
+* their tests can all read it without pulling in credentials or the SDK.
+*/
+const PAT_PREFIX = "tq_";
+/** `tq_…` is a personal access token; everything else is treated as a JWT. */
+function classifyToken(token) {
+	return token.startsWith(PAT_PREFIX) ? "pat" : "jwt";
+}
+
+//#endregion
 //#region src/auth/token-refresh.ts
 const REFRESH_BUFFER_MS = 300 * 1e3;
 /**
@@ -45,4 +69,4 @@ async function refreshToken(creds) {
 }
 
 //#endregion
-export { isTokenExpired, refreshToken };
+export { classifyToken, isTokenExpired, refreshToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.12.4",
+  "version": "0.12.6",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",