@myapihq/cli 1.3.11 → 1.3.13

package/dist/commands/crm/companies.js

@@ -5,6 +5,10 @@ import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
+    // Backend (2026-06-06): bare GET list with query-param filters —
+    // companion to the POST /search verb. See contacts.ts for the same
+    // pattern.
+    'GET /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
     'POST /crm/orgs/{org_id}/companies/search',
     'GET /crm/orgs/{org_id}/companies/{id}',

package/dist/commands/crm/contacts.js

@@ -5,6 +5,11 @@ import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
+    // Backend (2026-06-06): bare GET list with query-param filters —
+    // companion to the POST /search verb (richer filters via body). The
+    // CLI `list` verb still uses /search for forward-compat; the bare GET
+    // is declared so it's covered.
+    'GET /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
     'POST /crm/orgs/{org_id}/contacts/search',
     'GET /crm/orgs/{org_id}/contacts/{id}',

package/dist/commands/funnel.js

@@ -27,6 +27,7 @@ export const SCHEMA = {
     funnel: 'string',
     slug: 'string',
     env: 'string',
+    force: 'boolean',
     'api-fn': 'string',
     // form
     fields: 'string',
@@ -44,6 +45,28 @@ function validateFunnelName(name) {
         error(`Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`);
     }
 }
+// Canonical key for comparing slugs across the wire shapes the backend may
+// return (`/about`, `about`, `/about/`). Home is the empty string whether it
+// arrives as `/` or ``.
+function slugKey(s) {
+    return (s.startsWith('/') ? s.slice(1) : s).replace(/\/+$/, '');
+}
+// Resolve human-readable labels for the namespace a destructive write lands
+// on. The whole point of the funnel-write guardrails is that the agent (and
+// the human reading the transcript) can SEE which org + funnel it touched —
+// a bare UUID hides the cross-org mistake this is meant to catch. Best-effort:
+// fall back to ids if either lookup fails so we never block the real work on a
+// cosmetic call.
+async function describeTarget(apiKey, orgId, funnelId) {
+    const [org, funnelRes] = await Promise.all([
+        hq.getOrg(apiKey, orgId).catch(() => undefined),
+        sdkFunnel.getFunnel(apiKey, orgId, funnelId).catch(() => undefined),
+    ]);
+    const orgLabel = org?.name ? `${org.name} (${orgId})` : orgId;
+    const fname = funnelRes?.funnel?.name;
+    const funnelLabel = fname ? `${fname} (${funnelId})` : funnelId;
+    return { orgLabel, funnelLabel };
+}
 export async function list(flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi funnel list [--org <id>]');
@@ -149,6 +172,29 @@ export async function push(slug, flags) {
     if (process.stdin.isTTY) {
         error("No content provided via stdin. Use a pipe or file:\n  echo '<h1>Hello</h1>' | myapi funnel push /\n  cat page.html | myapi funnel push /about");
     }
+    // Overwrite guard. `push` silently replaces whatever is live at the slug,
+    // so an agent pushing `/` onto an org's existing site destroys it with no
+    // second chance. Mirror the my-domain-api principle ("destructive ops don't
+    // ride on silent defaults"): if a page already exists at this slug, refuse
+    // and name the org + funnel + slug, unless --force. We do this BEFORE
+    // reading stdin so a refused push never consumes the generated HTML.
+    const force = flags.force === true;
+    const existingPages = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+    const clash = existingPages.find(p => slugKey(p.slug) === slugKey(finalSlug));
+    if (clash && !force) {
+        const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
+        const when = clash.updated_at ? `, last updated ${formatDate(clash.updated_at)}` : '';
+        error(`Refusing to overwrite an existing page.
+
+  Org:    ${orgLabel}
+  Funnel: ${funnelLabel}
+  Slug:   ${finalSlug}  (already published${when})
+
+This funnel already serves a page at ${finalSlug}; pushing would replace it.
+  • Wrong org or funnel? Re-run with --org <id> and/or --funnel <id>.
+  • New demo? Create a fresh funnel: myapi funnel create --name <demo> --org <id>
+  • Meant to replace it? Re-run the same command with --force.`);
+    }
     const html = await new Promise((resolve, reject) => {
         let data = '';
         process.stdin.setEncoding('utf-8');
@@ -159,9 +205,12 @@ export async function push(slug, flags) {
     if (!html.trim())
         error("No content provided via stdin. Usage: echo '<h1>Hello</h1>' | myapi funnel push [slug]");
     const result = await sdkFunnel.pushFunnelPage(config.api_key, orgId, funnelId, { slug: finalSlug, html });
-    success(`Pushed page to ${finalSlug}`);
+    const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
+    success(`Pushed ${clash ? '(overwrote) ' : ''}page to ${finalSlug}`);
+    info(`Org:    ${orgLabel}`);
+    info(`Funnel: ${funnelLabel}`);
     if (resolvedFromOrg) {
-        info(`(Used the org's only funnel: ${funnelId}. Set a default with: myapi config set-funnel ${funnelId})`);
+        info(`(Auto-picked the org's only funnel. Pin it explicitly with --funnel ${funnelId} or: myapi config set-funnel ${funnelId})`);
     }
     let liveUrl = result?.url;
     if (!liveUrl) {
@@ -405,6 +454,29 @@ export async function publish(dir, flags) {
     const files = await collectFiles(dir, dir);
     if (files.length === 0)
         error(`No files found under ${dir}.`);
+    // Overwrite guard — prod only. Publishing to prod replaces the whole live
+    // site; the dev channel is the throwaway preview you re-publish freely, so
+    // it stays unguarded. If the funnel already serves pages and this is a prod
+    // publish, refuse without --force and name the namespace at risk.
+    const force = flags.force === true;
+    const channel = env || 'prod';
+    if (channel === 'prod' && !force) {
+        const existingPages = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
+        if (existingPages.length > 0) {
+            const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
+            error(`Refusing to replace a published site.
+
+  Org:    ${orgLabel}
+  Funnel: ${funnelLabel}
+  Live:   ${existingPages.length} page(s) currently published
+
+Publishing to the prod channel replaces the entire live site.
+  • Wrong org or funnel? Re-run with --org <id> and/or --funnel <id>.
+  • New demo? Create a fresh funnel: myapi funnel create --name <demo> --org <id>
+  • Preview safely first: myapi funnel publish ${dir} --env dev
+  • Meant to replace it? Re-run the same command with --force.`);
+        }
+    }
     const result = await sdkFunnel.publishFiles(config.api_key, orgId, funnelId, files, {
         env: env,
         apiFunctionId: flags['api-fn'],
@@ -413,7 +485,10 @@ export async function publish(dir, flags) {
         printJson(result);
         return;
     }
+    const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
     success(`Published ${result.file_count} file(s) to the ${result.channel} channel`);
+    info(`Org:    ${orgLabel}`);
+    info(`Funnel: ${funnelLabel}`);
     info(`Size:   ${(result.size_bytes / 1024).toFixed(1)} KB`);
     info(`SPA:    ${result.spa_mode ? 'on' : 'off'}`);
     info(`Live:   ${result.published_url}`);
@@ -466,7 +541,7 @@ free.`,
     'get': 'myapi funnel get <id> [--org <id>] [--json]',
     'list': 'myapi funnel list [--org <id>] [--json]',
     'pages': 'myapi funnel pages [funnel_id] [--funnel <id>] [--org <id>] [--json]',
-    'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--org <id>]
+    'publish': `myapi funnel publish <dir> [--funnel <id>] [--env dev|prod] [--api-fn <id>] [--force] [--org <id>]
 
 Uploads a whole local directory as the funnel's site. Each file's path
 within <dir> becomes its path on the site (e.g. dir/about/index.html →
@@ -475,18 +550,29 @@ within <dir> becomes its path on the site (e.g. dir/about/index.html →
   --env dev|prod    Target channel (default prod). dev publishes to
                     <name>-dev.makeautonomous.com for preview.
   --api-fn <id>     Bind /api/* on the site to a deployed function.
+  --force           Publish to prod even when the funnel already serves
+                    pages (replaces the entire live site). Refused without
+                    it. The dev channel is never guarded.
 
+Publishing to prod replaces the whole live site. The command prints the
+resolved org + funnel so you can confirm the namespace before it lands.
 SPA fallback is auto-enabled when the publish has a root index.html.
 
 Examples:
-  myapi funnel publish ./dist
-  myapi funnel publish ./dist --env dev
+  myapi funnel publish ./dist --env dev          # safe preview
+  myapi funnel publish ./dist                    # prod — refused if a site exists
+  myapi funnel publish ./dist --force            # prod — replace existing site
   myapi funnel publish ./site --api-fn <function_id>`,
-    'push': `myapi funnel push [slug] [--funnel <id>] [--slug <path>] [--org <id>] < page.html
+    'push': `myapi funnel push [slug] [--funnel <id>] [--slug <path>] [--force] [--org <id>] < page.html
 
 Reads HTML from stdin and publishes to <slug> on your funnel. Funnel is resolved
 from --funnel, the default funnel, or (only if the org has exactly one) auto-picked.
 
+Pushing OVERWRITES whatever page is already live at <slug>. If a page already
+exists there, push refuses and names the org + funnel + slug at risk; re-run
+with --force to replace it. On success it prints the resolved org + funnel so
+you can confirm you wrote to the namespace you intended.
+
 By default, your funnel is served on a preview subdomain (*.makeautonomous.com).
 To serve on your own domain, register and assign one with:
   myapi domain register <domain>
@@ -495,7 +581,7 @@ To serve on your own domain, register and assign one with:
 Examples:
   echo '<h1>Hello</h1>' | myapi funnel push /
   cat about.html | myapi funnel push /about
-  myapi funnel push < index.html
+  cat new.html | myapi funnel push / --force         # replace the live homepage
   cat p.html | myapi funnel push /pricing --funnel <uuid>`,
     'verify': `myapi funnel verify [slug] [--funnel <id>] [--org <id>]
 

package/dist/skills/my-funnel-api/SKILL.md

@@ -15,6 +15,8 @@ A funnel is a website tied to an org. Push raw HTML pages to slugs and they're s
 <!-- llm:start -->
 Funnels are the publishing surface. You create a funnel under an org (one command), then `funnel push` raw HTML to any slug (`/`, `/about`, `/pricing`, etc.). The edge serves the page within seconds — no CI/CD, no build, no deploy queue.
 
+**Before you push, know where you're writing.** `funnel push` and `funnel publish --env prod` **overwrite** whatever is live at the target — no undo. An org may already host a real site; pushing `/` onto it replaces the homepage. See **Namespace & safety** below — this is the #1 way agents wreck an existing site.
+
 By default, your funnel lives on a free preview subdomain (`*.makeautonomous.com`) you get with every org. To serve on a custom domain, register and assign one via **mydomainapi** first.
 
 Every funnel auto-provisions a **webhook** at creation time (`org_webhook_id`). The funnel exposes two public proxy endpoints your HTML can call directly (no API key needed): a **form submit** at `POST /funnel/funnels/{id}/submit/{slug}` that delivers submissions through that webhook (CRM upsert + bound workflows fire automatically), and an **analytics/event ingest** for pageviews and click tracking. For multi-form funnels you can bind individual slugs to specific destinations with `myapi funnel form ... --capture-to webhook:<id>`.
@@ -28,48 +30,61 @@ Every funnel auto-provisions a **webhook** at creation time (`org_webhook_id`).
 | `myapi funnel list` | List all funnels with preview/domain URLs |
 | `myapi funnel get <id>` | Inspect a funnel's metadata + preview URL |
 | `myapi funnel delete <id>` | Delete the funnel and purge its edge pages |
-| `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`) |
+| `myapi funnel push [slug]` | Push HTML from stdin to a slug (default: `/`). **Overwrites** an existing page — refused without `--force`, prints the resolved org + funnel on success |
 | `myapi funnel pages [funnel_id]` | List the pages currently published to a funnel |
 | `myapi funnel form [funnel_id]` | Emit canonical form HTML (and register a binding with `--capture-to`) |
 | `myapi funnel verify [slug]` | Verify a published page is reachable + check links/webhooks |
 <!-- generated:end -->
 
+## Namespace & safety (read before any write)
+
+A write targets a `(org, funnel, slug)` address. Get all three right *before* pushing — the CLI will help, but the thinking is yours:
+
+1. **Confirm the org.** `--org` (or `default_org`) decides whose namespace you touch. For a demo or a new project, pass `--org <id>` explicitly every time — don't trust the ambient default. `myapi org list` shows the orgs you can reach.
+2. **Look before you write.** `myapi funnel list --org <id>` shows the org's funnels; `myapi funnel pages --funnel <id>` shows what's already published. If a slug is taken by something real, you're about to replace it.
+3. **A new demo = a new funnel.** Don't reuse an org's existing funnel for an unrelated demo. `myapi funnel create --name <demo> --org <id>` gives you a clean namespace and its own preview subdomain.
+4. **Pin the funnel.** When an org has exactly one funnel, `push`/`publish` auto-pick it — convenient, but it's how a demo lands on the wrong site. Pass `--funnel <id>` (or set a default) so the target is explicit, not inferred.
+
+The CLI backstops you: `push` refuses to overwrite an existing slug (and `publish --env prod` refuses to replace a live site) without `--force`, and both print the resolved **org + funnel** on success. `--force` is the deliberate "yes, replace it" — never reach for it just to clear the error; first check whether the clash means you're aimed at the wrong place.
+
 ## Examples
 <!-- llm:start -->
 ```bash
-# Create a funnel + push a homepage
-myapi funnel create
-echo '<h1>Hello</h1>' | myapi funnel push /
+# New demo, done safely — explicit org, fresh funnel, confirm, then push
+myapi org list                                      # which orgs can I reach?
+myapi funnel list --org <org_id>                    # what already lives here?
+myapi funnel create --name acme-demo --org <org_id> # clean namespace for the demo
+echo '<h1>Hello</h1>' | myapi funnel push / --funnel <new_funnel_id>
 
-# Push multiple pages
-cat about.html    | myapi funnel push /about
-cat pricing.html  | myapi funnel push /pricing
+# Push multiple pages to that funnel
+cat about.html    | myapi funnel push /about   --funnel <new_funnel_id>
+cat pricing.html  | myapi funnel push /pricing --funnel <new_funnel_id>
 
-# Pipe directly from a generator
-my-html-gen        | myapi funnel push /landing
+# Inspect what's published before touching an existing funnel
+myapi funnel pages  --funnel <funnel_id>
+myapi funnel verify /pricing --funnel <funnel_id>
 
-# Inspect what's published
-myapi funnel pages
-myapi funnel verify /pricing
+# Deliberately replace a live page (only after confirming it's the right target)
+cat new-home.html | myapi funnel push / --funnel <funnel_id> --force
 
 # Clean up
-myapi funnel delete <funnel_id>
+myapi funnel delete <funnel_id> --org <org_id>
 ```
 
-Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked.
+Omitting `[slug]` defaults to `/`. The funnel id is resolved from `--funnel`, the saved default funnel, or — only if the org has exactly one funnel — auto-picked (so an unintended push can silently land on an existing site; pass `--funnel` to be sure). `push` refuses to overwrite an occupied slug without `--force`.
 <!-- llm:end -->
 
 ## Form submissions (canonical recipe)
 
 The funnel submit proxy is the canonical form-capture path. **Never hardcode `https://api.mywebhookapi.com/webhook/in/<slug>` into funnel HTML** — that URL leaks into your git history, breaks on rotation, gets scraped, and locks the platform out of future form-quality features (rate-limit, captcha, anti-bot, field validation). Use the proxy instead — same plumbing, hidden URL, automatic CRM ingest on `email`.
 
-Zero-config form (the happy path most agents want):
+Zero-config form (the happy path most agents want) — still pin the org + funnel so the snippet and the page land in the namespace you mean (see **Namespace & safety**):
 
 ```bash
-myapi funnel create
-myapi funnel form --slug join --fields email:required,name > snippet.html
+myapi funnel create --name acme-demo --org <org_id>
+myapi funnel form --slug join --fields email:required,name --funnel <funnel_id> > snippet.html
 # paste snippet.html into your page (or pipe through funnel push):
-cat page-with-snippet.html | myapi funnel push /
+cat page-with-snippet.html | myapi funnel push / --funnel <funnel_id>
 # Submissions land in the funnel's auto-provisioned webhook → CRM upsert on `email` → any bound workflow fires.
 ```
 
@@ -97,7 +112,8 @@ myapi funnel form <funnel_id> --slug survey \
 
 ## Notes
 
-- Set defaults with `myapi config set-org <id>` and `myapi config set-funnel <id>` to skip flags on every command.
+- Set defaults with `myapi config set-org <id>` and `myapi config set-funnel <id>` to skip flags on every command — but a stale default is exactly how a push lands on the wrong org/funnel. For demos and one-offs, pass `--org`/`--funnel` explicitly instead of relying on whatever default was set last.
+- `push` (any slug) and `publish --env prod` overwrite live content and are refused without `--force` when something already exists at the target. `--force` means "yes, replace the live page/site" — confirm you're aimed at the right `(org, funnel, slug)` before using it, don't use it to silence the error.
 - Deleting a funnel purges all its edge pages immediately.
 - `402` errors mean insufficient credits — run `myapi billing topup <amount>`.
 

package/dist/skills/my-llm-api/SKILL.md

@@ -89,6 +89,22 @@ Shared usage block on every verb:
 
 The model/provider is **never** named in the verb response. That's the point — the verb is the contract, the model is implementation.
 
+### OpenAI-compatible drop-in
+
+`POST /llm/orgs/{org_id}/chat/completions` (and `/v1/chat/completions` alias) accepts the OpenAI request shape and returns the OpenAI response shape — **no envelope**. Same catalog and pricing as raw `complete`. Use it when existing OpenAI SDK / LangChain / any `base_url`-configurable tooling should point at MyAPI without rewriting.
+
+```python
+from openai import OpenAI
+client = OpenAI(
+    api_key="hq_live_…",
+    base_url="https://api.myapihq.com/llm/orgs/<org_id>/v1",
+)
+r = client.chat.completions.create(model="Qwen/Qwen3-Coder-30B-A3B-Instruct",
+    messages=[{"role":"user","content":"Hi"}])
+```
+
+Use raw `complete` (MyAPI shape) for first-party integrations; use the OpenAI-compat path for compatibility with existing client code.
+
 <!-- llm:end -->
 
 ## Commands
@@ -145,10 +161,7 @@ INTENT=$(printf '%s' "$BODY" | myapi llm classify - \
 
 ## Notes
 
-- **`draft` context safety — what the platform does and doesn't do.** Every field in `context` is quoted into the prompt as referent data the model is told to incorporate.  Sensitive-named keys (`secret`, `api_key`, `password`, `token`, etc.) are **not** automatically redacted — if you pass `{"secret": "abc123"}`, the model may include `"abc123"` in the output.  The verb does two things on top:
-  - **Injection defense.** Keys named `instructions`, `system`, `system_prompt`, `prompt`, `override`, `directives`, and the JS prototype-pollution sentinels are stripped at the boundary and surfaced in `meta.warnings`; the model can't be hijacked through them.
-  - **Output guardrail.** After generation, every fact value (length ≥ 4) is substring-scanned in the output; matches surface under `meta.guardrails.facts_in_output: ["secret", "api_key", ...]`.  This is a **signal, not a redaction** — you see when a value landed in the body.
-  Rule of thumb: if a value must not appear in the output, **do not put it in `context`**.  Pass identifiers (recipient name, account id, topic) and let the prompt reference them indirectly; keep credentials, PII, and any internal-only metadata out of the body entirely.
-- **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks (future proprietary models land here, wrapped behind the verb contract).
-- **Cost + latency.** `usage.cost_cents` is authoritative — no markup today. Qwen3-Coder-30B-A3B: 200–600ms to first token, 1–3s end-to-end on a few-hundred-token reply.
-- **Live catalog, no streaming, no BYOK.** Don't hard-code model ids — `models` is the source of truth (CLI picks if `--model` omitted). Full reply only.
+- **`draft` context safety.** `context` fields are quoted into the prompt verbatim; sensitive-named keys (`secret`, `api_key`, `password`, …) are NOT redacted. Two guards on top: (a) injection-defense strips `instructions`/`system`/`prompt`/`override` keys and surfaces them in `meta.warnings`; (b) output guardrail substring-scans fact values (length ≥ 4) in the response and lists matches in `meta.guardrails.facts_in_output` (signal, not redaction). Rule of thumb: never put credentials, PII, or internal metadata in `context` — pass identifiers, reference them indirectly.
+- **Self-hosted raw, server-picked verbs.** Raw runs on MyAPI's TPU; verbs route wherever the server picks.
+- **Cost + latency.** `usage.cost_cents` is authoritative — no markup. Qwen3-Coder-30B: 200–600 ms to first token, 1–3 s end-to-end.
+- **Live catalog, no streaming, no BYOK.** Don't hard-code ids — `models` is truth (CLI auto-picks if `--model` omitted). Full reply only.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "1.3.11",
+  "version": "1.3.13",
   "description": "MyAPI command-line interface",
   "type": "module",
   "files": [
@@ -17,6 +17,7 @@
     "dev": "tsc --watch",
     "test": "vitest run src test/scripts",
     "test:smoke": "npm run build && vitest run src test/smoke test/scripts",
+    "test:smoke:ci": "vitest run src test/smoke test/scripts",
     "test:online": "npm run build && MYAPI_RUN_RESET=1 vitest run test/online",
     "test:realistic": "npm run build && MYAPI_RUN_REALISTIC=1 vitest run test/realistic/autonomous-company.test.ts",
     "test:realistic:cleanup": "npm run build && vitest run test/realistic/cleanup.test.ts",
@@ -26,11 +27,11 @@
     "update-schema": "node scripts/update-schema.js",
     "lint:changelog": "node ../../scripts/lint-changelog.js",
     "lint:help-order": "node scripts/lint-help-order.js",
-    "lint:skills": "node scripts/lint-skills.js",
-    "lint:skills:strict": "node scripts/lint-skills.js --strict"
+    "lint:skills": "node scripts/copy-skills.js && node scripts/lint-skills.js",
+    "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^1.3.11"
+    "@myapihq/sdk": "^1.3.12"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",