@mutagent/cli 0.1.358 → 0.1.360

package/dist/bin/cli.js

@@ -16519,6 +16519,187 @@ function writeSecureFile(path, contents) {
 var SECURE_FILE_MODE = 384;
 var init_secure_file = () => {};
 
+// src/lib/sdk-debug.ts
+function isDebugEnabled(env = process.env) {
+  return TRUTHY.has((env.MUTAGENT_DEBUG ?? "").trim().toLowerCase());
+}
+function redactValue(value2, depth = 0) {
+  if (depth > 32)
+    return REDACTED;
+  if (Array.isArray(value2))
+    return value2.map((item) => redactValue(item, depth + 1));
+  if (value2 === null || typeof value2 !== "object")
+    return value2;
+  const out = {};
+  for (const [name, field] of Object.entries(value2)) {
+    if (/^credentialfields$/i.test(name) && field !== null && typeof field === "object") {
+      out[name] = Object.fromEntries(Object.keys(field).map((key) => [key, REDACTED]));
+    } else if (isSensitiveFieldName(name) && field !== null && field !== undefined) {
+      out[name] = REDACTED;
+    } else {
+      out[name] = redactValue(field, depth + 1);
+    }
+  }
+  return out;
+}
+function redactText(text, secrets) {
+  const header = HEADER_LINE.exec(text);
+  let out = header?.[1] && SENSITIVE_HEADER.test(header[1]) ? `${header[1]}: ${REDACTED}` : text;
+  out = out.replace(JSON_STRING_FIELD, (match, name, sep5) => isSensitiveFieldName(name) ? `"${name}"${sep5}"${REDACTED}"` : match);
+  out = out.replace(AUTH_SCHEME, `$1 ${REDACTED}`);
+  return scrubSecrets(out, secrets);
+}
+function format(arg, secrets) {
+  if (typeof arg === "string")
+    return redactText(arg, secrets);
+  if (arg !== null && typeof arg === "object") {
+    let json;
+    try {
+      json = JSON.stringify(redactValue(arg), null, 2);
+    } catch {
+      json = undefined;
+    }
+    return redactText(json ?? "<unserialisable>", secrets);
+  }
+  return redactText(String(arg), secrets);
+}
+function createSdkDebugLogger(opts = {}) {
+  if (!isDebugEnabled(opts.env ?? process.env))
+    return SILENT;
+  const write = opts.write ?? ((chunk) => {
+    process.stderr.write(chunk);
+  });
+  const secrets = opts.secrets ?? (() => []);
+  let depth = 0;
+  const emit = (text) => {
+    const pad = "  ".repeat(depth);
+    write(`${text.split(`
+`).map((line) => pad + line).join(`
+`)}
+`);
+  };
+  return {
+    group(label) {
+      if (label !== undefined)
+        emit(redactText(label, secrets()));
+      depth += 1;
+    },
+    groupEnd() {
+      depth = Math.max(0, depth - 1);
+    },
+    log(message, ...args) {
+      emit([message, ...args].map((arg) => format(arg, secrets())).join(" "));
+    }
+  };
+}
+var TRUTHY, SENSITIVE_HEADER, HEADER_LINE, JSON_STRING_FIELD, AUTH_SCHEME, SILENT;
+var init_sdk_debug = __esm(() => {
+  init_secret_scrub();
+  TRUTHY = new Set(["1", "true", "yes"]);
+  SENSITIVE_HEADER = /^(x-api-key|authorization|proxy-authorization|cookie|set-cookie|x-[\w-]*(?:key|token|secret|auth)[\w-]*)$/i;
+  HEADER_LINE = /^([A-Za-z0-9-]+):\s(.*)$/s;
+  JSON_STRING_FIELD = /"((?:[^"\\]|\\.)*)"(\s*:\s*)"(?:[^"\\]|\\.)*"/g;
+  AUTH_SCHEME = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
+  SILENT = {
+    group: () => {
+      return;
+    },
+    groupEnd: () => {
+      return;
+    },
+    log: () => {
+      return;
+    }
+  };
+});
+
+// src/lib/organization-scope.ts
+function isWellFormedOrganizationId(id) {
+  return ORGANIZATION_ID_PATTERN.test(id);
+}
+function isOrganizationScopeMismatch(status, body) {
+  if (status !== 403)
+    return false;
+  return body.toLowerCase().includes("organization scope mismatch");
+}
+async function lookupOrganizations(apiKey, endpoint) {
+  try {
+    const response = await fetch(`${endpoint}/api/organizations`, {
+      headers: { "x-api-key": apiKey }
+    });
+    if (!response.ok)
+      return [];
+    const data = await response.json();
+    return data.data ?? [];
+  } catch {
+    return [];
+  }
+}
+async function fetchOrganizations(apiKey, endpoint) {
+  return lookupOrganizations(apiKey, endpoint);
+}
+async function assertUsableOrganizationId(id, lookup) {
+  const orgs = lookup.apiKey ? await lookup.fetchOrganizations(lookup.apiKey, lookup.endpoint).catch(() => []) : [];
+  if (orgs.length === 0) {
+    if (isWellFormedOrganizationId(id))
+      return;
+    throw new MutagentError("INVALID_ORGANIZATION_ID", `"${id}" is not an organization id.`, `Organization ids look like org_xxxxxxxxxxxxxxxxxxxxx.
+` + "Log in so the id can be checked against your account: mutagent auth login --browser");
+  }
+  if (orgs.some((org) => org.id === id))
+    return;
+  throw new MutagentError("UNKNOWN_ORGANIZATION", `"${id}" is not an organization this API key can access.`, `Available: ${orgs.map((org) => org.id).join(", ")}
+` + "A stored organization that does not match the key makes every request fail with 403.");
+}
+function createOrgScopeRecoveringFetcher(hooks) {
+  let recoveryUsed = false;
+  async function recover() {
+    if (recoveryUsed)
+      return;
+    recoveryUsed = true;
+    const stale = hooks.currentOrganization();
+    if (!stale)
+      return;
+    hooks.adoptOrganization(undefined);
+    hooks.forgetStoredOrganization?.();
+    const orgs = await lookupOrganizations(hooks.apiKey, hooks.endpoint);
+    const resolved = orgs[0]?.id;
+    if (!resolved || resolved === stale)
+      return;
+    hooks.adoptOrganization(resolved);
+    if (isDebugEnabled()) {
+      process.stderr.write(`[mutagent] Stored organization was rejected by the API; re-resolved and retried once.
+`);
+    }
+    return resolved;
+  }
+  return async function fetchWithOrgRecovery(input, init) {
+    const retryTemplate = input instanceof Request ? input.clone() : undefined;
+    const response = init == null ? await fetch(input) : await fetch(input, init);
+    if (response.status !== 403)
+      return response;
+    const body = await response.clone().text().catch(() => "");
+    if (!isOrganizationScopeMismatch(response.status, body))
+      return response;
+    const resolved = await recover();
+    if (!resolved)
+      return response;
+    if (retryTemplate) {
+      retryTemplate.headers.set("x-organization-id", resolved);
+      return fetch(retryTemplate);
+    }
+    const headers = new Headers(init?.headers);
+    headers.set("x-organization-id", resolved);
+    return fetch(input, { ...init, headers });
+  };
+}
+var ORGANIZATION_ID_PATTERN;
+var init_organization_scope = __esm(() => {
+  init_errors();
+  init_sdk_debug();
+  ORGANIZATION_ID_PATTERN = /^org_[A-Za-z0-9_-]{8,}$/;
+});
+
 // src/lib/config.ts
 import { cosmiconfigSync } from "cosmiconfig";
 import { z } from "zod";
@@ -16625,6 +16806,10 @@ function setDefaultWorkspace(workspaceId, source2 = "user") {
   writeSecureFile(CREDENTIALS_FILE, JSON.stringify(updated, null, 2));
 }
 function setDefaultOrganization(organizationId) {
+  if (!isWellFormedOrganizationId(organizationId)) {
+    throw new MutagentError("INVALID_ORGANIZATION_ID", `"${organizationId}" is not an organization id.`, `Organization ids look like org_xxxxxxxxxxxxxxxxxxxxx.
+` + "List the ones you can use with: mutagent auth status");
+  }
   if (!existsSync2(CREDENTIALS_DIR)) {
     mkdirSync(CREDENTIALS_DIR, { recursive: true });
   }
@@ -16640,10 +16825,26 @@ function setDefaultOrganization(organizationId) {
   };
   writeSecureFile(CREDENTIALS_FILE, JSON.stringify(updated, null, 2));
 }
+function clearDefaultOrganization() {
+  if (!existsSync2(CREDENTIALS_FILE))
+    return;
+  let existingCredentials;
+  try {
+    existingCredentials = JSON.parse(readFileSync2(CREDENTIALS_FILE, "utf-8"));
+  } catch {
+    return;
+  }
+  if (!("defaultOrganization" in existingCredentials))
+    return;
+  delete existingCredentials.defaultOrganization;
+  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(existingCredentials, null, 2));
+}
 var configSchema, credentialsSchema, CREDENTIALS_DIR, CREDENTIALS_FILE;
 var init_config = __esm(() => {
   init_secure_file();
   init_known_secrets();
+  init_organization_scope();
+  init_errors();
   configSchema = z.object({
     apiKey: z.string().optional(),
     endpoint: z.string().default("https://api.mutagent.io"),
@@ -16688,100 +16889,6 @@ function buildCreateProviderBody(data) {
   return body;
 }
 
-// src/lib/sdk-debug.ts
-function isDebugEnabled(env = process.env) {
-  return TRUTHY.has((env.MUTAGENT_DEBUG ?? "").trim().toLowerCase());
-}
-function redactValue(value2, depth = 0) {
-  if (depth > 32)
-    return REDACTED;
-  if (Array.isArray(value2))
-    return value2.map((item) => redactValue(item, depth + 1));
-  if (value2 === null || typeof value2 !== "object")
-    return value2;
-  const out = {};
-  for (const [name, field] of Object.entries(value2)) {
-    if (/^credentialfields$/i.test(name) && field !== null && typeof field === "object") {
-      out[name] = Object.fromEntries(Object.keys(field).map((key) => [key, REDACTED]));
-    } else if (isSensitiveFieldName(name) && field !== null && field !== undefined) {
-      out[name] = REDACTED;
-    } else {
-      out[name] = redactValue(field, depth + 1);
-    }
-  }
-  return out;
-}
-function redactText(text, secrets) {
-  const header = HEADER_LINE.exec(text);
-  let out = header?.[1] && SENSITIVE_HEADER.test(header[1]) ? `${header[1]}: ${REDACTED}` : text;
-  out = out.replace(JSON_STRING_FIELD, (match, name, sep5) => isSensitiveFieldName(name) ? `"${name}"${sep5}"${REDACTED}"` : match);
-  out = out.replace(AUTH_SCHEME, `$1 ${REDACTED}`);
-  return scrubSecrets(out, secrets);
-}
-function format(arg, secrets) {
-  if (typeof arg === "string")
-    return redactText(arg, secrets);
-  if (arg !== null && typeof arg === "object") {
-    let json;
-    try {
-      json = JSON.stringify(redactValue(arg), null, 2);
-    } catch {
-      json = undefined;
-    }
-    return redactText(json ?? "<unserialisable>", secrets);
-  }
-  return redactText(String(arg), secrets);
-}
-function createSdkDebugLogger(opts = {}) {
-  if (!isDebugEnabled(opts.env ?? process.env))
-    return SILENT;
-  const write = opts.write ?? ((chunk) => {
-    process.stderr.write(chunk);
-  });
-  const secrets = opts.secrets ?? (() => []);
-  let depth = 0;
-  const emit = (text) => {
-    const pad = "  ".repeat(depth);
-    write(`${text.split(`
-`).map((line) => pad + line).join(`
-`)}
-`);
-  };
-  return {
-    group(label) {
-      if (label !== undefined)
-        emit(redactText(label, secrets()));
-      depth += 1;
-    },
-    groupEnd() {
-      depth = Math.max(0, depth - 1);
-    },
-    log(message, ...args) {
-      emit([message, ...args].map((arg) => format(arg, secrets())).join(" "));
-    }
-  };
-}
-var TRUTHY, SENSITIVE_HEADER, HEADER_LINE, JSON_STRING_FIELD, AUTH_SCHEME, SILENT;
-var init_sdk_debug = __esm(() => {
-  init_secret_scrub();
-  TRUTHY = new Set(["1", "true", "yes"]);
-  SENSITIVE_HEADER = /^(x-api-key|authorization|proxy-authorization|cookie|set-cookie|x-[\w-]*(?:key|token|secret|auth)[\w-]*)$/i;
-  HEADER_LINE = /^([A-Za-z0-9-]+):\s(.*)$/s;
-  JSON_STRING_FIELD = /"((?:[^"\\]|\\.)*)"(\s*:\s*)"(?:[^"\\]|\\.)*"/g;
-  AUTH_SCHEME = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+/=-]+/gi;
-  SILENT = {
-    group: () => {
-      return;
-    },
-    groupEnd: () => {
-      return;
-    },
-    log: () => {
-      return;
-    }
-  };
-});
-
 // src/lib/sdk-mappers.ts
 import { LlmProviderType as SDKProviderEnum } from "@mutagent/sdk/models";
 function isProviderType(value2) {
@@ -16889,6 +16996,7 @@ class SDKClientWrapper {
   organizationId;
   workspaceResolution = "none";
   debugSecrets = new Set;
+  recoveringFetch;
   constructor(opts) {
     this.apiKey = opts.apiKey;
     this.endpoint = opts.serverURL ?? "http://localhost:3003";
@@ -16897,7 +17005,16 @@ class SDKClientWrapper {
     if (opts.workspaceId && opts.workspaceSource === "user") {
       this.workspaceResolution = "configured";
     }
-    const httpClient = new HTTPClient;
+    this.recoveringFetch = createOrgScopeRecoveringFetcher({
+      apiKey: this.apiKey,
+      endpoint: this.endpoint,
+      currentOrganization: () => this.organizationId,
+      adoptOrganization: (id) => {
+        this.organizationId = id;
+      },
+      forgetStoredOrganization: opts.clearStoredOrganization
+    });
+    const httpClient = new HTTPClient({ fetcher: this.recoveringFetch });
     httpClient.addHook("beforeRequest", (req) => {
       if (this.workspaceId)
         req.headers.set("x-workspace-id", this.workspaceId);
@@ -16962,7 +17079,7 @@ class SDKClientWrapper {
       tenancyHeaders["x-workspace-id"] = this.workspaceId;
     if (this.organizationId)
       tenancyHeaders["x-organization-id"] = this.organizationId;
-    const response = await fetch(`${this.endpoint}${path}`, {
+    const response = await this.recoveringFetch(`${this.endpoint}${path}`, {
       ...options,
       headers: {
         "x-api-key": this.apiKey,
@@ -17274,7 +17391,8 @@ async function getSDKClient() {
       serverURL: config.endpoint,
       workspaceId: config.defaultWorkspace,
       organizationId: config.defaultOrganization,
-      workspaceSource: config.defaultWorkspaceSource
+      workspaceSource: config.defaultWorkspaceSource,
+      clearStoredOrganization: clearDefaultOrganization
     });
     await sdkClient.ensureContext().catch((err) => {
       if (isDebugEnabled()) {
@@ -17299,19 +17417,6 @@ async function validateApiKey(apiKey, endpoint) {
     return false;
   }
 }
-async function fetchOrganizations(apiKey, endpoint) {
-  try {
-    const response = await fetch(`${endpoint}/api/organizations`, {
-      headers: { "x-api-key": apiKey }
-    });
-    if (!response.ok)
-      return [];
-    const data = await response.json();
-    return data.data ?? [];
-  } catch {
-    return [];
-  }
-}
 async function fetchWorkspaces(apiKey, endpoint, orgId) {
   try {
     const response = await fetch(`${endpoint}/api/workspaces`, {
@@ -17329,9 +17434,11 @@ var sdkClient = null;
 var init_sdk_client = __esm(() => {
   init_errors();
   init_config();
+  init_organization_scope();
   init_sdk_debug();
   init_known_secrets();
   init_sdk_mappers();
+  init_organization_scope();
 });
 
 // src/lib/agent/sdk.ts
@@ -19047,6 +19154,7 @@ import { Command as Command4 } from "commander";
 import chalk6 from "chalk";
 init_errors();
 init_sdk_client();
+init_organization_scope();
 var VALID_CONFIG_KEYS = ["apiKey", "endpoint", "format", "timeout", "defaultWorkspace", "defaultOrganization"];
 function createConfigCommand() {
   const config = new Command4("config").description("Manage CLI configuration").addHelpText("after", `
@@ -19123,15 +19231,26 @@ Examples:
   ${chalk6.dim("$")} mutagent config set org <org-id>
 
 ${chalk6.dim("Persists organization ID for org-scoped API keys.")}
-    `).action((id) => {
+${chalk6.dim("The ID is checked against your account first — a stored organization the")}
+${chalk6.dim("API key does not own makes every later command fail with 403.")}
+    `).action(async (id) => {
     const isJson = getJsonFlag(config);
     const output = new OutputFormatter(isJson ? "json" : "table");
-    setDefaultOrganization(id);
-    resetSDKClient();
-    if (isJson) {
-      output.output({ success: true, defaultOrganization: id });
-    } else {
-      output.success(`Default organization set to ${id}`);
+    try {
+      await assertUsableOrganizationId(id, {
+        apiKey: getApiKey(),
+        endpoint: loadConfig().endpoint ?? "https://api.mutagent.io",
+        fetchOrganizations
+      });
+      setDefaultOrganization(id);
+      resetSDKClient();
+      if (isJson) {
+        output.output({ success: true, defaultOrganization: id });
+      } else {
+        output.success(`Default organization set to ${id}`);
+      }
+    } catch (error3) {
+      handleError(error3, isJson);
     }
   });
   config.addCommand(set2);
@@ -29237,4 +29356,4 @@ if (isAgentInvocation(rawArgs)) {
   program.parse(argvForCommander, { from: "user" });
 }
 
-//# debugId=EBAEE05DDF8C12AA64756E2164756E21
+//# debugId=76A898BDAFE9975F64756E2164756E21

package/dist/index.js

@@ -255,152 +255,6 @@ var init_known_secrets = __esm(() => {
   known = new Set;
 });
 
-// src/lib/config.ts
-import { cosmiconfigSync } from "cosmiconfig";
-import { z } from "zod";
-import { homedir } from "os";
-import { join } from "path";
-import { existsSync, readFileSync, mkdirSync } from "fs";
-function parseJsonSafe(content, schema) {
-  try {
-    const parsed = JSON.parse(content);
-    return schema.parse(parsed);
-  } catch {
-    return null;
-  }
-}
-function loadConfig() {
-  const explorer = cosmiconfigSync("mutagent");
-  const result = explorer.search();
-  const rcConfig = result?.config;
-  let credentials = null;
-  if (existsSync(CREDENTIALS_FILE)) {
-    credentials = parseJsonSafe(readFileSync(CREDENTIALS_FILE, "utf-8"), credentialsSchema);
-  }
-  const merged = {
-    providers: {},
-    environment: "production",
-    ...rcConfig,
-    ...credentials,
-    apiKey: process.env.MUTAGENT_API_KEY ?? credentials?.apiKey ?? rcConfig?.apiKey,
-    endpoint: process.env.MUTAGENT_ENDPOINT ?? credentials?.endpoint ?? rcConfig?.endpoint,
-    defaultWorkspace: process.env.MUTAGENT_WORKSPACE_ID ?? credentials?.defaultWorkspace ?? rcConfig?.defaultWorkspace,
-    defaultWorkspaceSource: process.env.MUTAGENT_WORKSPACE_ID ? "user" : credentials?.defaultWorkspace ? credentials.defaultWorkspaceSource ?? "login-inferred" : rcConfig?.defaultWorkspace ? "login-inferred" : undefined,
-    defaultOrganization: credentials?.defaultOrganization ?? rcConfig?.defaultOrganization
-  };
-  return configSchema.parse(merged);
-}
-function saveCredentials(apiKey, endpoint) {
-  if (!existsSync(CREDENTIALS_DIR)) {
-    mkdirSync(CREDENTIALS_DIR, { recursive: true });
-  }
-  const config = loadConfig();
-  const credentials = {
-    apiKey,
-    endpoint: endpoint ?? config.endpoint
-  };
-  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2));
-}
-function saveFullCredentials(creds) {
-  if (!existsSync(CREDENTIALS_DIR)) {
-    mkdirSync(CREDENTIALS_DIR, { recursive: true });
-  }
-  let existingCredentials = {};
-  if (existsSync(CREDENTIALS_FILE)) {
-    try {
-      existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
-    } catch {}
-  }
-  const existingSource = existingCredentials.defaultWorkspaceSource;
-  const workspaceChanged = creds.workspaceId !== undefined && creds.workspaceId !== existingCredentials.defaultWorkspace;
-  const source = creds.workspaceId === undefined ? existingSource : workspaceChanged ? "login-inferred" : existingSource ?? "login-inferred";
-  const credentials = {
-    ...existingCredentials,
-    apiKey: creds.apiKey,
-    endpoint: creds.endpoint ?? existingCredentials.endpoint ?? "https://api.mutagent.io",
-    defaultWorkspace: creds.workspaceId ?? existingCredentials.defaultWorkspace,
-    defaultWorkspaceSource: source,
-    defaultOrganization: creds.organizationId ?? existingCredentials.defaultOrganization,
-    expiresAt: creds.expiresAt
-  };
-  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2));
-}
-function clearCredentials() {
-  if (existsSync(CREDENTIALS_FILE)) {
-    writeSecureFile(CREDENTIALS_FILE, JSON.stringify({}));
-  }
-}
-function hasCredentials() {
-  if (process.env.MUTAGENT_API_KEY)
-    return true;
-  if (!existsSync(CREDENTIALS_FILE))
-    return false;
-  const credentials = parseJsonSafe(readFileSync(CREDENTIALS_FILE, "utf-8"), credentialsSchema);
-  return credentials?.apiKey !== undefined && credentials.apiKey !== "";
-}
-function getApiKey() {
-  const apiKey = process.env.MUTAGENT_API_KEY ?? loadConfig().apiKey;
-  registerSecret(apiKey);
-  return apiKey;
-}
-function setDefaultWorkspace(workspaceId, source = "user") {
-  if (!existsSync(CREDENTIALS_DIR)) {
-    mkdirSync(CREDENTIALS_DIR, { recursive: true });
-  }
-  let existingCredentials = {};
-  if (existsSync(CREDENTIALS_FILE)) {
-    try {
-      existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
-    } catch {}
-  }
-  const updated = {
-    ...existingCredentials,
-    defaultWorkspace: workspaceId,
-    defaultWorkspaceSource: source
-  };
-  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(updated, null, 2));
-}
-function setDefaultOrganization(organizationId) {
-  if (!existsSync(CREDENTIALS_DIR)) {
-    mkdirSync(CREDENTIALS_DIR, { recursive: true });
-  }
-  let existingCredentials = {};
-  if (existsSync(CREDENTIALS_FILE)) {
-    try {
-      existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
-    } catch {}
-  }
-  const updated = {
-    ...existingCredentials,
-    defaultOrganization: organizationId
-  };
-  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(updated, null, 2));
-}
-var configSchema, credentialsSchema, CREDENTIALS_DIR, CREDENTIALS_FILE;
-var init_config = __esm(() => {
-  init_secure_file();
-  init_known_secrets();
-  configSchema = z.object({
-    apiKey: z.string().optional(),
-    endpoint: z.string().default("https://api.mutagent.io"),
-    format: z.enum(["table", "json"]).default("table"),
-    timeout: z.number().default(30000),
-    defaultWorkspace: z.string().optional(),
-    defaultWorkspaceSource: z.enum(["user", "login-inferred"]).optional(),
-    defaultOrganization: z.string().optional()
-  });
-  credentialsSchema = z.object({
-    apiKey: z.string().optional(),
-    endpoint: z.string().optional(),
-    defaultWorkspace: z.string().optional(),
-    defaultWorkspaceSource: z.enum(["user", "login-inferred"]).optional(),
-    defaultOrganization: z.string().optional(),
-    expiresAt: z.string().optional()
-  }).loose();
-  CREDENTIALS_DIR = join(homedir(), ".config", "mutagent");
-  CREDENTIALS_FILE = join(CREDENTIALS_DIR, "credentials.json");
-});
-
 // src/lib/errors.ts
 function createErrorFromUnknown(error) {
   if (error instanceof MutagentError) {
@@ -590,29 +444,6 @@ var init_errors = __esm(() => {
   };
 });
 
-// src/lib/provider-request.ts
-function buildCreateProviderBody(data) {
-  const body = {
-    name: data.name,
-    provider: data.provider,
-    isDefault: data.isDefault ?? false
-  };
-  if (data.apiKey)
-    body.apiKey = data.apiKey;
-  if (data.baseUrl)
-    body.baseUrl = data.baseUrl;
-  if (data.hostedFamily)
-    body.hostedFamily = data.hostedFamily;
-  if (data.credentialFields && Object.keys(data.credentialFields).length > 0) {
-    body.credentialFields = data.credentialFields;
-  }
-  if (data.metadata && Object.keys(data.metadata).length > 0)
-    body.metadata = data.metadata;
-  if (data.supportedModels !== undefined)
-    body.supportedModels = data.supportedModels;
-  return body;
-}
-
 // src/lib/sdk-debug.ts
 function isDebugEnabled(env = process.env) {
   return TRUTHY.has((env.MUTAGENT_DEBUG ?? "").trim().toLowerCase());
@@ -707,6 +538,282 @@ var init_sdk_debug = __esm(() => {
   };
 });
 
+// src/lib/organization-scope.ts
+function isWellFormedOrganizationId(id) {
+  return ORGANIZATION_ID_PATTERN.test(id);
+}
+function isOrganizationScopeMismatch(status, body) {
+  if (status !== 403)
+    return false;
+  return body.toLowerCase().includes("organization scope mismatch");
+}
+async function lookupOrganizations(apiKey, endpoint) {
+  try {
+    const response = await fetch(`${endpoint}/api/organizations`, {
+      headers: { "x-api-key": apiKey }
+    });
+    if (!response.ok)
+      return [];
+    const data = await response.json();
+    return data.data ?? [];
+  } catch {
+    return [];
+  }
+}
+async function fetchOrganizations(apiKey, endpoint) {
+  return lookupOrganizations(apiKey, endpoint);
+}
+async function assertUsableOrganizationId(id, lookup) {
+  const orgs = lookup.apiKey ? await lookup.fetchOrganizations(lookup.apiKey, lookup.endpoint).catch(() => []) : [];
+  if (orgs.length === 0) {
+    if (isWellFormedOrganizationId(id))
+      return;
+    throw new MutagentError("INVALID_ORGANIZATION_ID", `"${id}" is not an organization id.`, `Organization ids look like org_xxxxxxxxxxxxxxxxxxxxx.
+` + "Log in so the id can be checked against your account: mutagent auth login --browser");
+  }
+  if (orgs.some((org) => org.id === id))
+    return;
+  throw new MutagentError("UNKNOWN_ORGANIZATION", `"${id}" is not an organization this API key can access.`, `Available: ${orgs.map((org) => org.id).join(", ")}
+` + "A stored organization that does not match the key makes every request fail with 403.");
+}
+function createOrgScopeRecoveringFetcher(hooks) {
+  let recoveryUsed = false;
+  async function recover() {
+    if (recoveryUsed)
+      return;
+    recoveryUsed = true;
+    const stale = hooks.currentOrganization();
+    if (!stale)
+      return;
+    hooks.adoptOrganization(undefined);
+    hooks.forgetStoredOrganization?.();
+    const orgs = await lookupOrganizations(hooks.apiKey, hooks.endpoint);
+    const resolved = orgs[0]?.id;
+    if (!resolved || resolved === stale)
+      return;
+    hooks.adoptOrganization(resolved);
+    if (isDebugEnabled()) {
+      process.stderr.write(`[mutagent] Stored organization was rejected by the API; re-resolved and retried once.
+`);
+    }
+    return resolved;
+  }
+  return async function fetchWithOrgRecovery(input, init) {
+    const retryTemplate = input instanceof Request ? input.clone() : undefined;
+    const response = init == null ? await fetch(input) : await fetch(input, init);
+    if (response.status !== 403)
+      return response;
+    const body = await response.clone().text().catch(() => "");
+    if (!isOrganizationScopeMismatch(response.status, body))
+      return response;
+    const resolved = await recover();
+    if (!resolved)
+      return response;
+    if (retryTemplate) {
+      retryTemplate.headers.set("x-organization-id", resolved);
+      return fetch(retryTemplate);
+    }
+    const headers = new Headers(init?.headers);
+    headers.set("x-organization-id", resolved);
+    return fetch(input, { ...init, headers });
+  };
+}
+var ORGANIZATION_ID_PATTERN;
+var init_organization_scope = __esm(() => {
+  init_errors();
+  init_sdk_debug();
+  ORGANIZATION_ID_PATTERN = /^org_[A-Za-z0-9_-]{8,}$/;
+});
+
+// src/lib/config.ts
+import { cosmiconfigSync } from "cosmiconfig";
+import { z } from "zod";
+import { homedir } from "os";
+import { join } from "path";
+import { existsSync, readFileSync, mkdirSync } from "fs";
+function parseJsonSafe(content, schema) {
+  try {
+    const parsed = JSON.parse(content);
+    return schema.parse(parsed);
+  } catch {
+    return null;
+  }
+}
+function loadConfig() {
+  const explorer = cosmiconfigSync("mutagent");
+  const result = explorer.search();
+  const rcConfig = result?.config;
+  let credentials = null;
+  if (existsSync(CREDENTIALS_FILE)) {
+    credentials = parseJsonSafe(readFileSync(CREDENTIALS_FILE, "utf-8"), credentialsSchema);
+  }
+  const merged = {
+    providers: {},
+    environment: "production",
+    ...rcConfig,
+    ...credentials,
+    apiKey: process.env.MUTAGENT_API_KEY ?? credentials?.apiKey ?? rcConfig?.apiKey,
+    endpoint: process.env.MUTAGENT_ENDPOINT ?? credentials?.endpoint ?? rcConfig?.endpoint,
+    defaultWorkspace: process.env.MUTAGENT_WORKSPACE_ID ?? credentials?.defaultWorkspace ?? rcConfig?.defaultWorkspace,
+    defaultWorkspaceSource: process.env.MUTAGENT_WORKSPACE_ID ? "user" : credentials?.defaultWorkspace ? credentials.defaultWorkspaceSource ?? "login-inferred" : rcConfig?.defaultWorkspace ? "login-inferred" : undefined,
+    defaultOrganization: credentials?.defaultOrganization ?? rcConfig?.defaultOrganization
+  };
+  return configSchema.parse(merged);
+}
+function saveCredentials(apiKey, endpoint) {
+  if (!existsSync(CREDENTIALS_DIR)) {
+    mkdirSync(CREDENTIALS_DIR, { recursive: true });
+  }
+  const config = loadConfig();
+  const credentials = {
+    apiKey,
+    endpoint: endpoint ?? config.endpoint
+  };
+  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2));
+}
+function saveFullCredentials(creds) {
+  if (!existsSync(CREDENTIALS_DIR)) {
+    mkdirSync(CREDENTIALS_DIR, { recursive: true });
+  }
+  let existingCredentials = {};
+  if (existsSync(CREDENTIALS_FILE)) {
+    try {
+      existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+    } catch {}
+  }
+  const existingSource = existingCredentials.defaultWorkspaceSource;
+  const workspaceChanged = creds.workspaceId !== undefined && creds.workspaceId !== existingCredentials.defaultWorkspace;
+  const source = creds.workspaceId === undefined ? existingSource : workspaceChanged ? "login-inferred" : existingSource ?? "login-inferred";
+  const credentials = {
+    ...existingCredentials,
+    apiKey: creds.apiKey,
+    endpoint: creds.endpoint ?? existingCredentials.endpoint ?? "https://api.mutagent.io",
+    defaultWorkspace: creds.workspaceId ?? existingCredentials.defaultWorkspace,
+    defaultWorkspaceSource: source,
+    defaultOrganization: creds.organizationId ?? existingCredentials.defaultOrganization,
+    expiresAt: creds.expiresAt
+  };
+  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(credentials, null, 2));
+}
+function clearCredentials() {
+  if (existsSync(CREDENTIALS_FILE)) {
+    writeSecureFile(CREDENTIALS_FILE, JSON.stringify({}));
+  }
+}
+function hasCredentials() {
+  if (process.env.MUTAGENT_API_KEY)
+    return true;
+  if (!existsSync(CREDENTIALS_FILE))
+    return false;
+  const credentials = parseJsonSafe(readFileSync(CREDENTIALS_FILE, "utf-8"), credentialsSchema);
+  return credentials?.apiKey !== undefined && credentials.apiKey !== "";
+}
+function getApiKey() {
+  const apiKey = process.env.MUTAGENT_API_KEY ?? loadConfig().apiKey;
+  registerSecret(apiKey);
+  return apiKey;
+}
+function setDefaultWorkspace(workspaceId, source = "user") {
+  if (!existsSync(CREDENTIALS_DIR)) {
+    mkdirSync(CREDENTIALS_DIR, { recursive: true });
+  }
+  let existingCredentials = {};
+  if (existsSync(CREDENTIALS_FILE)) {
+    try {
+      existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+    } catch {}
+  }
+  const updated = {
+    ...existingCredentials,
+    defaultWorkspace: workspaceId,
+    defaultWorkspaceSource: source
+  };
+  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(updated, null, 2));
+}
+function setDefaultOrganization(organizationId) {
+  if (!isWellFormedOrganizationId(organizationId)) {
+    throw new MutagentError("INVALID_ORGANIZATION_ID", `"${organizationId}" is not an organization id.`, `Organization ids look like org_xxxxxxxxxxxxxxxxxxxxx.
+` + "List the ones you can use with: mutagent auth status");
+  }
+  if (!existsSync(CREDENTIALS_DIR)) {
+    mkdirSync(CREDENTIALS_DIR, { recursive: true });
+  }
+  let existingCredentials = {};
+  if (existsSync(CREDENTIALS_FILE)) {
+    try {
+      existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+    } catch {}
+  }
+  const updated = {
+    ...existingCredentials,
+    defaultOrganization: organizationId
+  };
+  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(updated, null, 2));
+}
+function clearDefaultOrganization() {
+  if (!existsSync(CREDENTIALS_FILE))
+    return;
+  let existingCredentials;
+  try {
+    existingCredentials = JSON.parse(readFileSync(CREDENTIALS_FILE, "utf-8"));
+  } catch {
+    return;
+  }
+  if (!("defaultOrganization" in existingCredentials))
+    return;
+  delete existingCredentials.defaultOrganization;
+  writeSecureFile(CREDENTIALS_FILE, JSON.stringify(existingCredentials, null, 2));
+}
+var configSchema, credentialsSchema, CREDENTIALS_DIR, CREDENTIALS_FILE;
+var init_config = __esm(() => {
+  init_secure_file();
+  init_known_secrets();
+  init_organization_scope();
+  init_errors();
+  configSchema = z.object({
+    apiKey: z.string().optional(),
+    endpoint: z.string().default("https://api.mutagent.io"),
+    format: z.enum(["table", "json"]).default("table"),
+    timeout: z.number().default(30000),
+    defaultWorkspace: z.string().optional(),
+    defaultWorkspaceSource: z.enum(["user", "login-inferred"]).optional(),
+    defaultOrganization: z.string().optional()
+  });
+  credentialsSchema = z.object({
+    apiKey: z.string().optional(),
+    endpoint: z.string().optional(),
+    defaultWorkspace: z.string().optional(),
+    defaultWorkspaceSource: z.enum(["user", "login-inferred"]).optional(),
+    defaultOrganization: z.string().optional(),
+    expiresAt: z.string().optional()
+  }).loose();
+  CREDENTIALS_DIR = join(homedir(), ".config", "mutagent");
+  CREDENTIALS_FILE = join(CREDENTIALS_DIR, "credentials.json");
+});
+
+// src/lib/provider-request.ts
+function buildCreateProviderBody(data) {
+  const body = {
+    name: data.name,
+    provider: data.provider,
+    isDefault: data.isDefault ?? false
+  };
+  if (data.apiKey)
+    body.apiKey = data.apiKey;
+  if (data.baseUrl)
+    body.baseUrl = data.baseUrl;
+  if (data.hostedFamily)
+    body.hostedFamily = data.hostedFamily;
+  if (data.credentialFields && Object.keys(data.credentialFields).length > 0) {
+    body.credentialFields = data.credentialFields;
+  }
+  if (data.metadata && Object.keys(data.metadata).length > 0)
+    body.metadata = data.metadata;
+  if (data.supportedModels !== undefined)
+    body.supportedModels = data.supportedModels;
+  return body;
+}
+
 // src/lib/sdk-mappers.ts
 import { LlmProviderType as SDKProviderEnum } from "@mutagent/sdk/models";
 function isProviderType(value) {
@@ -814,6 +921,7 @@ class SDKClientWrapper {
   organizationId;
   workspaceResolution = "none";
   debugSecrets = new Set;
+  recoveringFetch;
   constructor(opts) {
     this.apiKey = opts.apiKey;
     this.endpoint = opts.serverURL ?? "http://localhost:3003";
@@ -822,7 +930,16 @@ class SDKClientWrapper {
     if (opts.workspaceId && opts.workspaceSource === "user") {
       this.workspaceResolution = "configured";
     }
-    const httpClient = new HTTPClient;
+    this.recoveringFetch = createOrgScopeRecoveringFetcher({
+      apiKey: this.apiKey,
+      endpoint: this.endpoint,
+      currentOrganization: () => this.organizationId,
+      adoptOrganization: (id) => {
+        this.organizationId = id;
+      },
+      forgetStoredOrganization: opts.clearStoredOrganization
+    });
+    const httpClient = new HTTPClient({ fetcher: this.recoveringFetch });
     httpClient.addHook("beforeRequest", (req) => {
       if (this.workspaceId)
         req.headers.set("x-workspace-id", this.workspaceId);
@@ -887,7 +1004,7 @@ class SDKClientWrapper {
       tenancyHeaders["x-workspace-id"] = this.workspaceId;
     if (this.organizationId)
       tenancyHeaders["x-organization-id"] = this.organizationId;
-    const response = await fetch(`${this.endpoint}${path}`, {
+    const response = await this.recoveringFetch(`${this.endpoint}${path}`, {
       ...options,
       headers: {
         "x-api-key": this.apiKey,
@@ -1199,7 +1316,8 @@ async function getSDKClient() {
       serverURL: config.endpoint,
       workspaceId: config.defaultWorkspace,
       organizationId: config.defaultOrganization,
-      workspaceSource: config.defaultWorkspaceSource
+      workspaceSource: config.defaultWorkspaceSource,
+      clearStoredOrganization: clearDefaultOrganization
     });
     await sdkClient.ensureContext().catch((err) => {
       if (isDebugEnabled()) {
@@ -1224,19 +1342,6 @@ async function validateApiKey(apiKey, endpoint) {
     return false;
   }
 }
-async function fetchOrganizations(apiKey, endpoint) {
-  try {
-    const response = await fetch(`${endpoint}/api/organizations`, {
-      headers: { "x-api-key": apiKey }
-    });
-    if (!response.ok)
-      return [];
-    const data = await response.json();
-    return data.data ?? [];
-  } catch {
-    return [];
-  }
-}
 async function fetchWorkspaces(apiKey, endpoint, orgId) {
   try {
     const response = await fetch(`${endpoint}/api/workspaces`, {
@@ -1254,9 +1359,11 @@ var sdkClient = null;
 var init_sdk_client = __esm(() => {
   init_errors();
   init_config();
+  init_organization_scope();
   init_sdk_debug();
   init_known_secrets();
   init_sdk_mappers();
+  init_organization_scope();
 });
 
 // src/index.ts
@@ -1480,4 +1587,4 @@ export {
   ApiError
 };
 
-//# debugId=0E9FCC198FD63F3C64756E2164756E21
+//# debugId=437AE9F8B6FD0C9364756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutagent/cli",
-  "version": "0.1.358",
+  "version": "0.1.360",
   "description": "Bun-native CLI for the MutagenT AI platform - auth, provider config, and lifecycle-tool installer for AI-native workflows",
   "type": "module",
   "bin": {
@@ -42,7 +42,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.7.2",
-    "@mutagent/sdk": "0.6.2",
+    "@mutagent/sdk": "0.6.3",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "cosmiconfig": "^9.0.0",