@myapihq/cli 2.15.1 → 2.15.2

package/dist/config-save-upsert.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/config-save-upsert.test.js

@@ -0,0 +1,98 @@
+// saveConfig() writes by api_key, not by the active index.
+//
+// The bug this pins is data loss, not misconfiguration. saveConfig wrote to
+// accounts[active] on the assumption that the Config handed to it belongs to
+// the active account. It does not when MYAPI_API_KEY names a key the file has
+// never seen: loadConfig deliberately returns a bare `{ api_key, account_id:'' }`
+// for an unknown key — inheriting the active account's defaults is the
+// cross-tenant bug config-envkey.test.ts pins — and saving that stub then
+// overwrote the signed-in entry with it. api_key, account_id, default_org and
+// default_funnel, gone from disk.
+//
+// It was reachable from any org-scoped command once requireOrg began persisting
+// `last_org_used`, which turned a config-command bug into a data-loss one on an
+// ordinary `database namespaces`. Reported by the backend team 2026-08-17 while
+// setting up a developer with an org-locked key; reproduced before fixing.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+const SIGNED_IN = 'hq_live_signed_in_account';
+const ORG_LOCKED = 'hq_live_org_locked_key';
+let tmpHome;
+let realHome;
+const FULL_CONFIG = {
+    active: 0,
+    accounts: [
+        {
+            api_key: SIGNED_IN,
+            account_id: 'acct-real',
+            email: 'operator@example.com',
+            default_org: 'org-real',
+            default_funnel: 'fun-real',
+        },
+    ],
+};
+async function freshConfigModule() {
+    vi.resetModules();
+    return import('./config.js');
+}
+function readAccounts() {
+    return JSON.parse(fs.readFileSync(path.join(tmpHome, '.myapi', 'config.json'), 'utf-8')).accounts;
+}
+beforeEach(() => {
+    tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-save-'));
+    fs.mkdirSync(path.join(tmpHome, '.myapi'), { recursive: true });
+    fs.writeFileSync(path.join(tmpHome, '.myapi', 'config.json'), JSON.stringify(FULL_CONFIG));
+    realHome = process.env.HOME;
+    process.env.HOME = tmpHome;
+    delete process.env.MYAPI_API_KEY;
+    delete process.env.MYAPI_KEY;
+});
+afterEach(() => {
+    if (realHome !== undefined)
+        process.env.HOME = realHome;
+    delete process.env.MYAPI_API_KEY;
+    fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+describe('saveConfig upserts by api_key', () => {
+    it('does not destroy the signed-in account when saving an unknown env key', async () => {
+        process.env.MYAPI_API_KEY = ORG_LOCKED;
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        const cfg = loadConfig();
+        expect(cfg.api_key).toBe(ORG_LOCKED);
+        expect(cfg.account_id).toBe(''); // the stub loadConfig hands back on purpose
+        // What any org-scoped command now does via requireOrg.
+        saveConfig({ ...cfg, last_org_used: 'org-customer' });
+        const accounts = readAccounts();
+        const original = accounts.find((a) => a.api_key === SIGNED_IN);
+        expect(original, 'the signed-in account must still exist').toBeDefined();
+        expect(original.account_id).toBe('acct-real');
+        expect(original.default_org).toBe('org-real');
+        expect(original.default_funnel).toBe('fun-real');
+    });
+    it('gives the env key its own entry so its defaults can persist', async () => {
+        process.env.MYAPI_API_KEY = ORG_LOCKED;
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        saveConfig({ ...loadConfig(), default_org: 'org-customer' });
+        const entry = readAccounts().find((a) => a.api_key === ORG_LOCKED);
+        expect(entry, 'an unknown key should be appended, not merged into another').toBeDefined();
+        expect(entry.default_org).toBe('org-customer');
+    });
+    it('leaves `active` alone — an env key must not become the signed-in account', async () => {
+        process.env.MYAPI_API_KEY = ORG_LOCKED;
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        saveConfig({ ...loadConfig(), default_org: 'org-customer' });
+        const full = JSON.parse(fs.readFileSync(path.join(tmpHome, '.myapi', 'config.json'), 'utf-8'));
+        expect(full.active).toBe(0);
+        expect(full.accounts[full.active].api_key).toBe(SIGNED_IN);
+    });
+    it('still updates in place for a key the config already knows', async () => {
+        const { loadConfig, saveConfig } = await freshConfigModule();
+        saveConfig({ ...loadConfig(), default_org: 'org-moved' });
+        const accounts = readAccounts();
+        expect(accounts).toHaveLength(1); // updated, not duplicated
+        expect(accounts[0].default_org).toBe('org-moved');
+        expect(accounts[0].account_id).toBe('acct-real');
+    });
+});

package/dist/config.js

@@ -94,13 +94,37 @@ function writeFullConfig(full) {
     // configs written by older CLI versions (pre-0o600) that are still 0644.
     fs.chmodSync(CONFIG_FILE, 0o600);
 }
+// Upsert by api_key, NOT by the active index.
+//
+// Writing to accounts[active] assumed the config being saved is the active
+// account's. It is not when MYAPI_API_KEY names a key the file has never seen:
+// loadConfig deliberately returns a bare `{ api_key, account_id: '' }` for an
+// unknown key (see the comment there — inheriting the active account's defaults
+// is the cross-tenant bug it exists to avoid), and saving that stub then
+// overwrote the signed-in entry with it. One ordinary command wiped the stored
+// api_key, account_id, default_org and default_funnel.
+//
+// It became reachable from any org-scoped command once requireOrg started
+// persisting `last_org_used`, which is what made a config-only bug into a
+// data-loss one. Reproduced 2026-08-17.
+//
+// Matching loadConfig's own lookup makes read and write symmetric, and gives an
+// env-supplied key somewhere of its own to keep defaults — which is what lets a
+// developer holding an org-locked key have a default_org at all.
 export function saveConfig(config) {
     const full = loadFullConfig() ?? { active: 0, accounts: [] };
     const { autocomplete_setup, ...account } = config;
-    if (full.accounts.length === 0)
-        full.accounts.push(account);
-    else
-        full.accounts[full.active] = account;
+    const entry = account;
+    const existing = full.accounts.findIndex(a => a.api_key === entry.api_key);
+    if (existing >= 0) {
+        full.accounts[existing] = entry;
+    }
+    else {
+        // Appended, and `active` is deliberately left alone: a key passed through
+        // the environment for one command must not silently become the account the
+        // user is signed in as.
+        full.accounts.push(entry);
+    }
     if (autocomplete_setup !== undefined)
         full.autocomplete_setup = autocomplete_setup;
     writeFullConfig(full);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.15.1",
+  "version": "2.15.2",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.15.1"
+    "@myapihq/sdk": "^2.15.2"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",