@myapihq/cli 2.25.2 → 2.26.1

package/dist/commands/init.d.ts

@@ -0,0 +1,7 @@
+import type { Flags } from '../helpers.js';
+import type { FlagSchema } from '../flags.js';
+import type { Exposes } from '../exposes.js';
+export declare const SCHEMA: FlagSchema;
+export declare const EXPOSES: Exposes;
+export declare const HELP = "Usage: myapi init --org <org_id> [--name <label>] [--spend-cap <usd>]\n\nBind THIS DIRECTORY to one org, so commands run here can never target another.\n\nIt mints an API key locked to that org, stores it, and writes .myapi.json\nnaming the org. The file holds the org id and never the key.\n\n  --org <id>          The org this project works in (required)\n  --name <label>      Key name; defaults to the directory name\n  --spend-cap <usd>   Ceiling for this key, e.g. --spend-cap 50\n  --grant <list>      Narrow what it can touch, e.g. --grant crm:write,email:read\n  --force             Re-bind a directory that already names an org\n\nWhy this exists: `myapi config set-org` writes a default into ~/.myapi/config.json,\none file for the whole machine. Two projects on one laptop overwrite each other's,\nand commands then land in the wrong org while still succeeding. A key that the\nserver has locked to one org cannot do that \u2014 a wrong target is refused (403),\nnot silently accepted.";
+export declare function run(_sub: string | undefined, _args: string[], flags: Flags): Promise<void>;

package/dist/commands/init.js

@@ -0,0 +1,134 @@
+import { hq } from '@myapihq/sdk';
+import { requireConfig, saveConfig, accountLockedTo, loadConfig } from '../config.js';
+import { success, error, info, printJson } from '../output.js';
+import { writeProjectOrg, findProjectOrg, PROJECT_FILE } from '../project.js';
+import { _parseGrants, _dollarsToCents } from './keys.js';
+export const SCHEMA = {
+    org: 'string',
+    name: 'string',
+    // string + _dollarsToCents, matching `keys create` exactly.
+    'spend-cap': 'string',
+    grant: 'string',
+    force: 'boolean',
+};
+export const EXPOSES = ['POST /hq/account/create/key', 'GET /hq/orgs/{id}'];
+export const HELP = `Usage: myapi init --org <org_id> [--name <label>] [--spend-cap <usd>]
+
+Bind THIS DIRECTORY to one org, so commands run here can never target another.
+
+It mints an API key locked to that org, stores it, and writes ${PROJECT_FILE}
+naming the org. The file holds the org id and never the key.
+
+  --org <id>          The org this project works in (required)
+  --name <label>      Key name; defaults to the directory name
+  --spend-cap <usd>   Ceiling for this key, e.g. --spend-cap 50
+  --grant <list>      Narrow what it can touch, e.g. --grant crm:write,email:read
+  --force             Re-bind a directory that already names an org
+
+Why this exists: \`myapi config set-org\` writes a default into ~/.myapi/config.json,
+one file for the whole machine. Two projects on one laptop overwrite each other's,
+and commands then land in the wrong org while still succeeding. A key that the
+server has locked to one org cannot do that — a wrong target is refused (403),
+not silently accepted.`;
+// keys.ts owns the grant syntax; this reuses its pure parser rather than
+// writing a second one. Two parsers for one flag is exactly how `--org` and
+// the campaign source flags drifted into disagreeing.
+function centsOrDie(raw) {
+    const parsed = _dollarsToCents(raw);
+    if (typeof parsed === 'string')
+        error(parsed);
+    return parsed;
+}
+function grantsOrDie(raw) {
+    const parsed = _parseGrants(raw);
+    if (typeof parsed === 'string')
+        error(parsed);
+    return parsed;
+}
+export async function run(_sub, _args, flags) {
+    if (flags.help) {
+        info(HELP);
+        return;
+    }
+    const config = requireConfig();
+    const orgId = typeof flags.org === 'string' ? flags.org : '';
+    if (!orgId) {
+        error('Missing --org <org_id>.\nWhich org does this project work in? List them with: myapi org list\n\n' + HELP);
+    }
+    const existing = findProjectOrg();
+    if (existing && !flags.force) {
+        if (existing.org === orgId) {
+            info(`Already bound: ${existing.file} names org ${orgId}.`);
+            return;
+        }
+        error(`${existing.file} already binds this directory to org ${existing.org}.\n` +
+            `Re-bind to ${orgId} with --force, or edit the file directly.`);
+    }
+    // Name the org before touching anything, so a mistyped id fails here rather
+    // than after a key has been minted. It also puts the NAME in front of the
+    // user: a wrong UUID is unverifiable at a glance, a wrong name is obvious.
+    let orgName;
+    try {
+        orgName = (await hq.getOrg(config.api_key, orgId))?.name;
+    }
+    catch {
+        error(`Could not read org ${orgId}. Check the id with: myapi org list`);
+    }
+    // Reuse a key already locked to this org rather than minting another. Keys
+    // are a revocation surface; one per project per org is enough, and silently
+    // accumulating them makes the list unreadable exactly when someone is trying
+    // to revoke the right one in a hurry.
+    const already = accountLockedTo(orgId);
+    if (already) {
+        const file = writeProjectOrg(process.cwd(), orgId);
+        success(`Bound this directory to ${orgName ?? orgId}`);
+        info(`  ${file}`);
+        info(`  using the key already locked to this org (${already.email ?? already.account_id})`);
+        if (flags.json)
+            printJson({ org_id: orgId, org_name: orgName, project_file: file, minted: false });
+        return;
+    }
+    const label = typeof flags.name === 'string' && flags.name
+        ? flags.name
+        : (process.cwd().split('/').filter(Boolean).pop() ?? 'project');
+    // Same type and same parser as `keys create --spend-cap`. When one command
+    // declares a flag a string and another a number, the merged schema silently
+    // picks one and the loser is parsed wrong — that is how `--ttl` broke.
+    const capUsd = typeof flags['spend-cap'] === 'string' && flags['spend-cap']
+        ? centsOrDie(flags['spend-cap'])
+        : undefined;
+    const grant = typeof flags.grant === 'string' ? flags.grant : undefined;
+    const minted = await hq.createApiKey(config.api_key, label, {
+        orgId,
+        ...(capUsd !== undefined ? { spendCapCents: capUsd } : {}),
+        ...(grant ? { grants: grantsOrDie(grant) } : {}),
+    });
+    const value = minted.api_key
+        ?? minted.key;
+    if (!value) {
+        error('The API was asked for a key and returned none. Nothing was written; no project file was created.');
+    }
+    // Stored as its own account entry — saveConfig upserts by api_key, and
+    // deliberately does NOT make it active. A project credential must not become
+    // the identity every other terminal on this machine signs in as.
+    saveConfig({
+        ...(loadConfig() ?? { api_key: value, account_id: config.account_id }),
+        api_key: value,
+        account_id: config.account_id,
+        email: config.email,
+        key_org_id: orgId,
+        default_org: orgId,
+        org_names: { ...(config.org_names ?? {}), ...(orgName ? { [orgId]: orgName } : {}) },
+    });
+    const file = writeProjectOrg(process.cwd(), orgId);
+    if (flags.json) {
+        printJson({ org_id: orgId, org_name: orgName, project_file: file, key_id: minted.id, minted: true });
+        return;
+    }
+    success(`Bound this directory to ${orgName ?? orgId}`);
+    info(`  ${file}          names the org (no key in it — safe to commit)`);
+    info(`  key "${label}"   locked to this org${capUsd !== undefined ? `, capped at $${(capUsd / 100).toFixed(2)}` : ''}`);
+    info('');
+    info('Commands run here now target this org without --org, and a command that');
+    info('names a different one is refused before it is sent.');
+}

package/dist/commands/org-create-default.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/org-create-default.test.js

@@ -0,0 +1,108 @@
+// `org create --yes` used to re-point the whole machine.
+//
+// --yes meant two things at once: skip the "set as default?" prompt, AND make
+// the new org the default. Since `org create --name X --yes` is the documented
+// non-interactive form, every scripted or agent-driven org creation retargeted
+// the machine's default org — so a throwaway org made by one project became the
+// target of every bare command in every other project on that laptop.
+//
+// That is the cross-project collision customers report, arriving through a door
+// nobody was watching: they were told to stop using `config set-org`, and
+// `org create --yes` kept doing it to them anyway. It moved my own default org
+// twice in one day, once while I was building the fix for the other door.
+//
+// The two meanings are now separate, and the interesting assertions are about
+// what does NOT happen.
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+const ORG_A = 'aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa';
+const NEW_ORG = 'nnnnnnnn-2222-4222-8222-nnnnnnnnnnnn';
+const sdk = vi.hoisted(() => ({
+    hq: { createOrg: vi.fn() },
+    funnel: { listFunnels: vi.fn() },
+}));
+vi.mock('@myapihq/sdk', () => sdk);
+const saved = vi.hoisted(() => []);
+let stored;
+vi.mock('../config.js', () => ({
+    requireConfig: () => ({ ...stored }),
+    loadConfig: () => ({ ...stored }),
+    saveConfig: (c) => { saved.push(c); },
+    CONFIG_DIR: '/tmp/nowhere',
+}));
+const confirmMock = vi.hoisted(() => vi.fn());
+vi.mock('../prompt.js', () => ({
+    confirm: confirmMock,
+    isNonInteractive: () => false,
+}));
+let printed;
+beforeEach(async () => {
+    saved.length = 0;
+    printed = [];
+    vi.clearAllMocks();
+    stored = { api_key: 'hq_live_test', account_id: 'acct' };
+    sdk.hq.createOrg.mockResolvedValue({ id: NEW_ORG, name: 'Throwaway' });
+    sdk.funnel.listFunnels.mockResolvedValue([]);
+    const output = await import('../output.js');
+    const cap = ((m) => { printed.push(String(m)); });
+    vi.spyOn(output, 'info').mockImplementation(cap);
+    vi.spyOn(output, 'success').mockImplementation(cap);
+    vi.spyOn(output, 'printJson').mockImplementation(cap);
+    vi.spyOn(output, 'error').mockImplementation(((m) => {
+        printed.push(String(m));
+        throw new Error('__EXIT__');
+    }));
+});
+afterEach(() => vi.restoreAllMocks());
+async function createOrg(flags) {
+    const { create } = await import('./org.js');
+    try {
+        await create(['Throwaway'], flags);
+    }
+    catch (e) {
+        if (e?.message !== '__EXIT__')
+            throw e;
+    }
+}
+describe('org create and the machine default', () => {
+    it('--yes does NOT re-point an existing default', async () => {
+        stored.default_org = ORG_A;
+        await createOrg({ yes: true });
+        expect(saved).toEqual([]);
+    });
+    it('says the default is unchanged, rather than saying nothing', async () => {
+        // Silence is what let a throwaway org take over a machine without anyone
+        // noticing which command did it.
+        stored.default_org = ORG_A;
+        stored.org_names = { [ORG_A]: 'Real Work' };
+        await createOrg({ yes: true });
+        const out = printed.join('\n');
+        expect(out).toMatch(/default org is unchanged/i);
+        expect(out).toContain('Real Work');
+        expect(out).toContain(`myapi init --org ${NEW_ORG}`);
+    });
+    it('--set-default re-points it, because that was asked for by name', async () => {
+        stored.default_org = ORG_A;
+        await createOrg({ yes: true, 'set-default': true });
+        expect(saved.at(-1)).toMatchObject({ default_org: NEW_ORG });
+    });
+    it('sets the default when there is none, since nothing can be clobbered', async () => {
+        // A user with no default cannot run an org-scoped command at all, so the
+        // first org is pure gain.
+        await createOrg({ yes: true });
+        expect(saved.at(-1)).toMatchObject({ default_org: NEW_ORG });
+        expect(printed.join('\n')).toMatch(/no default org/i);
+    });
+    it('still asks when interactive without --yes, and honours a no', async () => {
+        stored.default_org = ORG_A;
+        confirmMock.mockResolvedValue(false);
+        await createOrg({});
+        expect(confirmMock).toHaveBeenCalled();
+        expect(saved).toEqual([]);
+    });
+    it('honours a yes at the prompt', async () => {
+        stored.default_org = ORG_A;
+        confirmMock.mockResolvedValue(true);
+        await createOrg({});
+        expect(saved.at(-1)).toMatchObject({ default_org: NEW_ORG });
+    });
+});

package/dist/commands/org.js

@@ -21,6 +21,9 @@ export const SCHEMA = {
     description: 'string',
     'business-sector': 'string',
     'logo-url': 'string',
+    // Setting the machine's default org is now something you ask for, not
+    // something --yes does to you on the way past.
+    'set-default': 'boolean',
     org: 'string',
 };
 const SYNC_BRAND_TIMEOUT_MS = 5 * 60 * 1000;
@@ -45,11 +48,23 @@ export async function create(restArgs, flags) {
             info(`Preview domain: https://${org.preview_subdomain}.makeautonomous.com`);
         }
     }
-    // Never re-point the CLI's defaults on a silent fallback: in non-interactive
-    // contexts (CI, agent pipelines) only --yes may switch the default org —
-    // an unanswered prompt must not count as consent.
-    const setDefault = !!flags.yes ||
-        (!isNonInteractive() && await confirm('› Set as default org and funnel? (Y/n) ', true));
+    // `--yes` used to mean two things: skip the prompt, AND make this the default
+    // org. Since `org create --name X --yes` is the documented non-interactive
+    // form, every scripted or agent-driven org creation silently re-pointed the
+    // machine's default — so a throwaway org created by one project became the
+    // target of every bare command in every other project on that machine. That
+    // is the cross-project collision customers report, arriving through a door
+    // nobody was watching. I did it to my own default org twice in one day.
+    //
+    // Now the two are separate:
+    //   - no default yet   → set it. First org, nothing to clobber, and a user
+    //                        with no default cannot run an org-scoped command.
+    //   - --set-default    → set it, because it was asked for by name.
+    //   - interactive      → ask, as before. A prompt is consent.
+    //   - --yes with an existing default → leave it alone and say so.
+    const hasDefault = !!config.default_org;
+    const setDefault = !!flags['set-default'] || !hasDefault ||
+        (!flags.yes && !isNonInteractive() && await confirm('› Set as default org and funnel? (Y/n) ', true));
     let funnelId;
     if (setDefault) {
         config.default_org = org.id;
@@ -59,8 +74,18 @@ export async function create(restArgs, flags) {
             funnelId = funnels[0].id;
         }
         saveConfig(config);
-        if (!flags.json)
+        if (!flags.json) {
             success(`Default org${funnelId ? ' and funnel' : ''} updated.`);
+            if (!hasDefault)
+                info('  (you had no default org — set because an org-scoped command needs one)');
+        }
+    }
+    else if (!flags.json && hasDefault) {
+        // Say what did NOT happen. Silence here is what let a throwaway org take
+        // over a machine without anyone noticing which command did it.
+        const name = config.org_names?.[config.default_org] ?? config.default_org;
+        info(`  Your default org is unchanged (${name}).`);
+        info(`  Work in the new one with: myapi init --org ${org.id}   (binds this directory only)`);
     }
     if (flags.json) {
         const result = { id: org.id, name: org.name };
@@ -232,16 +257,25 @@ Examples:
   myapi org update --tagline "Now with even more cowbell"
   myapi org update abc-123 --name "Acme Inc" --description "Updated tagline"
   myapi org update --logo-url https://example.com/logo.png --json`,
-    'create': `myapi org create <name> [--tagline <str>] [--description <str>] [--business-sector <str>] [--logo-url <url>] [--yes] [--json]
+    'create': `myapi org create <name> [--tagline <str>] [--description <str>] [--business-sector <str>] [--logo-url <url>] [--yes] [--set-default] [--json]
        myapi org create --name <name> [...]
 
 Creates a new organization. A funnel (website) is automatically created alongside it.
-Pass --yes to skip the "set as default?" prompt (useful in CI / agent workflows).
+
+--yes skips the "set as default?" prompt and leaves your default org ALONE.
+--set-default points your machine's default at the new org.
+
+They are separate because they used to be the same flag: every scripted
+\`org create --yes\` re-pointed the whole machine, so a throwaway org created by
+one project became the target of bare commands in every other project.
+
+To work in the new org without touching anything else, bind the directory:
+  myapi init --org <new-org-id>
 
 Examples:
   myapi org create "Acme Inc"
-  myapi org create "Acme Inc" --yes
-  myapi org create --name "Acme Inc" --yes`,
+  myapi org create "Acme Inc" --yes                 # default org untouched
+  myapi org create "Acme Inc" --yes --set-default`,
     'get': 'myapi org get <id> [--json]',
     'delete': `myapi org delete <id> [--yes]
 

package/dist/completion.js

@@ -27,7 +27,7 @@ const BLOCK_END = `# end ${PROGRAM} completion`;
 // is missing here.
 export const COMMANDS = [
     'account', 'audience', 'auth', 'billing', 'company', 'completion', 'config', 'container',
-    'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image',
+    'crm', 'database', 'domain', 'email', 'fn', 'funnel', 'git', 'help', 'image', 'init',
     'doctor', 'install-skills', 'keys', 'llm', 'login', 'org', 'payments', 'people', 'pixel',
     'feedback', 'queue', 'setup', 'status', 'storage', 'task', 'update', 'url', 'webhook', 'whoami',
     'workflow',

package/dist/config.d.ts

@@ -9,6 +9,7 @@ export interface AccountEntry {
     registrant?: sdkDomain.Registrant;
     is_anonymous?: boolean;
     skills_installed?: boolean;
+    key_org_id?: string;
     last_org_used?: string;
     org_names?: Record<string, string>;
 }
@@ -24,6 +25,16 @@ export declare const CONFIG_DIR: string;
 export declare const CONFIG_FILE: string;
 export declare function loadFullConfig(): FullConfig | null;
 export declare function loadConfig(): Config | null;
+/**
+ * The stored account whose key is locked to `orgId`, if there is one.
+ *
+ * This is what lets a project directory name an org and get the right
+ * credential without keeping a secret in the repo: the project file says which
+ * org, the config says which key belongs to it.
+ */
+export declare function accountLockedTo(orgId: string): AccountEntry | undefined;
+/** Every distinct org this machine holds an org-locked key for. */
+export declare function lockedOrgs(): string[];
 export declare function saveConfig(config: Config): void;
 export declare function addAccount(account: AccountEntry): number;
 export declare function switchAccount(index: number): boolean;

package/dist/config.js

@@ -1,6 +1,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import { findProjectOrg } from './project.js';
 // MYAPI_CONFIG_DIR redirects the whole config surface — key, accounts,
 // defaults — somewhere other than ~/.myapi.
 //
@@ -79,11 +80,44 @@ export function loadConfig() {
     }
     if (!active)
         return null;
+    // The directory picks the CREDENTIAL, not just the org.
+    //
+    // Resolving the org from .myapi.json while still authenticating with the
+    // account-wide key gets the right answer by client-side convention only —
+    // the server has nothing to enforce, because an account-wide key may touch
+    // every org. Selecting the key that is LOCKED to this project's org is what
+    // turns the whole thing from a default into a boundary: from here on a
+    // mistake is a 403, not a write into the wrong tenant.
+    //
+    // Falls through to the active account when the directory names no org, or
+    // names one this machine holds no locked key for.
+    const dirOrg = process.env.MYAPI_ORG || findProjectOrg()?.org;
+    if (dirOrg) {
+        const locked = full.accounts.find(a => a.key_org_id === dirOrg);
+        if (locked)
+            return { ...locked, autocomplete_setup: full.autocomplete_setup };
+    }
     return {
         ...active,
         autocomplete_setup: full.autocomplete_setup,
     };
 }
+/**
+ * The stored account whose key is locked to `orgId`, if there is one.
+ *
+ * This is what lets a project directory name an org and get the right
+ * credential without keeping a secret in the repo: the project file says which
+ * org, the config says which key belongs to it.
+ */
+export function accountLockedTo(orgId) {
+    const full = loadFullConfig();
+    return full?.accounts.find(a => a.key_org_id === orgId);
+}
+/** Every distinct org this machine holds an org-locked key for. */
+export function lockedOrgs() {
+    const full = loadFullConfig();
+    return [...new Set((full?.accounts ?? []).map(a => a.key_org_id).filter(Boolean))];
+}
 // Single point of truth for writes. Ensures CONFIG_DIR exists and that the
 // file is created with mode 0o600 (owner read/write only) — no caller has
 // to remember either.

package/dist/exposes.test.js

@@ -15,6 +15,7 @@ const COMMAND_MODULES = [
     './commands/crm/companies.js',
     './commands/crm/pagination.js',
     './commands/database.js',
+    './commands/init.js',
     './commands/domain.js',
     './commands/email/index.js',
     './commands/email/mailbox.js',

package/dist/helpers.d.ts

@@ -1,5 +1,21 @@
 import { type Config } from './config.js';
 export type Flags = Record<string, string | boolean | number>;
+export type OrgSource = 'flag' | 'env' | 'project' | 'key' | 'default';
+export interface ResolvedOrg {
+    org: string;
+    source: OrgSource;
+    /** For 'project', the file it came from, so output can name it. */
+    from?: string;
+}
+/**
+ * Resolves the org without side effects, so it can be tested and reported on
+ * (`myapi status`) rather than only observed by running a real command.
+ *
+ * Precedence: --org > MYAPI_ORG > nearest .myapi.json > the key's own lock >
+ * default_org. The first four are per-invocation or per-directory. The last is
+ * the machine-global one that two projects fight over.
+ */
+export declare function resolveOrg(flags: Flags, config: Config): ResolvedOrg | undefined;
 export declare function requireOrg(flags: Flags, config: Config, usage: string): string;
 export declare function orgLine(orgId: string, name: string | undefined, changedFrom?: string): string;
 /** The org this invocation resolved to, for `--json` consumers. */

package/dist/helpers.js

@@ -1,8 +1,33 @@
 import { error, banner } from './output.js';
+import { findProjectOrg } from './project.js';
 import { loadConfig, saveConfig } from './config.js';
 import { confirm, isNonInteractive } from './prompt.js';
-// error() returns `never`, so after `if (!x) error(...)` TS narrows x to a
-// non-falsy value and the casts disappear.
+/**
+ * Resolves the org without side effects, so it can be tested and reported on
+ * (`myapi status`) rather than only observed by running a real command.
+ *
+ * Precedence: --org > MYAPI_ORG > nearest .myapi.json > the key's own lock >
+ * default_org. The first four are per-invocation or per-directory. The last is
+ * the machine-global one that two projects fight over.
+ */
+export function resolveOrg(flags, config) {
+    if (typeof flags.org === 'string' && flags.org)
+        return { org: flags.org, source: 'flag' };
+    const env = process.env.MYAPI_ORG;
+    if (env)
+        return { org: env, source: 'env' };
+    const project = findProjectOrg();
+    if (project)
+        return { org: project.org, source: 'project', from: project.file };
+    // A locked key does not need to be told which org it is for — the server will
+    // only accept one. Ranking it above default_org means an org-locked key makes
+    // the machine-global default irrelevant, which is the whole point.
+    if (config.key_org_id)
+        return { org: config.key_org_id, source: 'key' };
+    if (config.default_org)
+        return { org: config.default_org, source: 'default' };
+    return undefined;
+}
 export function requireOrg(flags, config, usage) {
     // A present-but-empty --org (e.g. --org "$ORG" with $ORG unset, or a bare
     // --org that swallowed no value) must never degrade to the default org —
@@ -10,14 +35,34 @@ export function requireOrg(flags, config, usage) {
     if ('org' in flags && (flags.org === '' || flags.org === true)) {
         error(`--org was passed without a value. Refusing to fall back to the default org.\nUsage: ${usage}`);
     }
-    const orgId = (typeof flags.org === 'string' ? flags.org : '') || config.default_org;
-    if (!orgId) {
-        error(`Missing required arguments.\nUsage: ${usage}\n(Or set default: myapi config set-org <id>)`);
+    const resolved = resolveOrg(flags, config);
+    if (!resolved) {
+        error(`Missing required arguments.\nUsage: ${usage}\n` +
+            `(This directory has no org. Set one up with: myapi init --org <id>)`);
+    }
+    const orgId = resolved.org;
+    // The key is locked server-side; a mismatch is a guaranteed 403. Saying so
+    // here costs nothing and can explain WHICH org the key belongs to, which the
+    // server's refusal cannot: it will not name another tenant's id back to a
+    // caller that has no authority over it.
+    if (config.key_org_id && orgId !== config.key_org_id) {
+        error(`This API key is locked to org ${config.key_org_id}, but ${describeSource(resolved)} says ${orgId}.\n` +
+            `The server would refuse this (403 SCOPE_FORBIDDEN), so nothing was sent.\n` +
+            `Use a key for ${orgId}, or drop the override to work in ${config.key_org_id}.`);
     }
     announceOrg(orgId, config);
     recordResolvedOrg(orgId, config);
     return orgId;
 }
+function describeSource(r) {
+    switch (r.source) {
+        case 'flag': return '--org';
+        case 'env': return 'MYAPI_ORG';
+        case 'project': return r.from ?? '.myapi.json';
+        case 'key': return 'the key';
+        case 'default': return 'your machine-wide default org';
+    }
+}
 // ── Which org am I in? ───────────────────────────────────────────────────────
 //
 // The org is ambient, sticky and invisible: it comes from a saved default that

package/dist/index.js

@@ -35,6 +35,7 @@ import * as urlCmd from './commands/url.js';
 import * as authProductCmd from './commands/authproduct.js';
 import * as configCmd from './commands/config.js';
 import * as statusCmd from './commands/status.js';
+import * as initCmd from './commands/init.js';
 import * as peopleCmd from './commands/people.js';
 import * as companyCmd from './commands/company.js';
 import * as audienceCmd from './commands/audience.js';
@@ -317,6 +318,9 @@ async function main() {
             case 'status':
                 await statusCmd.run(subcommand, restArgs, flags);
                 break;
+            case 'init':
+                await initCmd.run(subcommand, restArgs, flags);
+                break;
             case 'keys':
                 await keysCmd.run(subcommand, restArgs, flags);
                 break;
@@ -510,10 +514,11 @@ Commands:
   funnel          Manage websites (publish pages, custom domains, funnels)
   git             Hosted git repositories — repos, commits, branches, history
   image           Generate AI images and manage them in storage
+  init            Bind this directory to one org (locked key + .myapi.json)
   install-skills  Install or update the MyAPI skills pack for AI agents
   llm             Run LLM completions and embeddings (chat + embed, with usage/cost)
   login           Sign in via your browser — Google or email code (preview: --mock)
-  org             Manage organizations (tip: myapi org create "name" --yes to auto-set as default)
+  org             Manage organizations (create, list, delete; --set-default to re-point the machine)
   payments        Take payments with Stripe Checkout (connect, charge, refund)
   people          Search the contact database (filter by industry, seniority, country, ...)
   pixel           Read pixel analytics: visits, events, identity resolution

package/dist/org-resolution.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/org-resolution.test.js

@@ -0,0 +1,157 @@
+// Which org does a command target, and can a second project on the same
+// machine change the answer?
+//
+// `myapi config set-org` writes `default_org` into ~/.myapi/config.json — one
+// file per MACHINE. Two checkouts share it: project A sets A, project B sets B,
+// and every later bare command in A targets B. It succeeds, against the wrong
+// tenant. That is the most-reported problem with the CLI and it is a scope
+// mismatch, not a bug: the org is a property of the work, stored per machine.
+//
+// The chain here fixes it by putting four per-invocation or per-directory
+// sources ahead of the machine-global one, and by refusing outright when the
+// key's server-side lock disagrees with any of them.
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { resolveOrg } from './helpers.js';
+import { findProjectOrg, writeProjectOrg } from './project.js';
+const A = 'aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa';
+const B = 'bbbbbbbb-2222-4222-8222-bbbbbbbbbbbb';
+const base = { api_key: 'hq_live_test', account_id: 'acct' };
+let tmp;
+let cwdSpy;
+function chdirTo(dir) {
+    cwdSpy?.mockRestore();
+    cwdSpy = vi.spyOn(process, 'cwd').mockReturnValue(dir);
+}
+beforeEach(() => {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'myapi-org-'));
+    delete process.env.MYAPI_ORG;
+    chdirTo(tmp);
+});
+afterEach(() => {
+    cwdSpy?.mockRestore();
+    delete process.env.MYAPI_ORG;
+    fs.rmSync(tmp, { recursive: true, force: true });
+});
+describe('org resolution order', () => {
+    it('--org beats everything', () => {
+        process.env.MYAPI_ORG = B;
+        writeProjectOrg(tmp, B);
+        const r = resolveOrg({ org: A }, { ...base, key_org_id: B, default_org: B });
+        expect(r).toMatchObject({ org: A, source: 'flag' });
+    });
+    it('MYAPI_ORG beats the project file and the default', () => {
+        process.env.MYAPI_ORG = A;
+        writeProjectOrg(tmp, B);
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: A, source: 'env' });
+    });
+    it('the project file beats the machine-wide default — the whole point', () => {
+        // Project B set the global default to B. This directory is project A.
+        writeProjectOrg(tmp, A);
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: A, source: 'project' });
+    });
+    it("a locked key beats the machine-wide default, so the default stops mattering", () => {
+        expect(resolveOrg({}, { ...base, key_org_id: A, default_org: B }))
+            .toMatchObject({ org: A, source: 'key' });
+    });
+    it('falls back to the default when nothing else says', () => {
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: B, source: 'default' });
+    });
+    it('resolves to nothing when there is nothing to resolve', () => {
+        expect(resolveOrg({}, base)).toBeUndefined();
+    });
+});
+describe('the project file', () => {
+    it('is found by walking up, like .git', () => {
+        const nested = path.join(tmp, 'src', 'deep', 'nested');
+        fs.mkdirSync(nested, { recursive: true });
+        writeProjectOrg(tmp, A);
+        chdirTo(nested);
+        expect(findProjectOrg()).toMatchObject({ org: A });
+    });
+    it('takes the NEAREST one, so a nested project wins over its parent', () => {
+        const inner = path.join(tmp, 'inner');
+        fs.mkdirSync(inner);
+        writeProjectOrg(tmp, A);
+        writeProjectOrg(inner, B);
+        chdirTo(inner);
+        expect(findProjectOrg()).toMatchObject({ org: B });
+    });
+    it('never carries a key', () => {
+        // A file named in a repo gets committed eventually. Trading a wrong-org
+        // write for a leaked credential would be a worse deal than the bug.
+        const file = writeProjectOrg(tmp, A);
+        const raw = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        expect(Object.keys(raw)).toEqual(['org']);
+        expect(JSON.stringify(raw)).not.toMatch(/hq_live|api_key|key/i);
+    });
+    it('preserves keys it does not own', () => {
+        const file = path.join(tmp, '.myapi.json');
+        fs.writeFileSync(file, JSON.stringify({ note: 'mine', org: B }));
+        writeProjectOrg(tmp, A);
+        expect(JSON.parse(fs.readFileSync(file, 'utf-8'))).toEqual({ note: 'mine', org: A });
+    });
+    it('ignores a malformed file rather than bricking every command below it', () => {
+        fs.writeFileSync(path.join(tmp, '.myapi.json'), '{ not json');
+        expect(findProjectOrg()).toBeUndefined();
+        expect(resolveOrg({}, { ...base, default_org: B })).toMatchObject({ org: B, source: 'default' });
+    });
+    it('ignores a file that names no org', () => {
+        fs.writeFileSync(path.join(tmp, '.myapi.json'), JSON.stringify({ note: 'hi' }));
+        expect(findProjectOrg()).toBeUndefined();
+    });
+});
+describe('a locked key refuses a mismatched target', () => {
+    // The server enforces this (403 SCOPE_FORBIDDEN, verified against production
+    // 2026-08-23). Refusing locally costs nothing and can say WHICH org the key
+    // belongs to — which the server's refusal deliberately will not, since it
+    // must not name one tenant's id to a caller with no authority over it.
+    let exitError;
+    beforeEach(async () => {
+        exitError = null;
+        const output = await import('./output.js');
+        vi.spyOn(output, 'error').mockImplementation(((m) => {
+            exitError = String(m);
+            throw new Error('__EXIT__');
+        }));
+        vi.spyOn(output, 'banner').mockImplementation(() => { });
+    });
+    afterEach(() => vi.restoreAllMocks());
+    async function requireOrgSafely(flags, config) {
+        const { requireOrg } = await import('./helpers.js');
+        try {
+            return requireOrg(flags, config, 'usage');
+        }
+        catch (e) {
+            if (e?.message !== '__EXIT__')
+                throw e;
+            return undefined;
+        }
+    }
+    it('refuses --org pointing somewhere the key cannot go, before sending', async () => {
+        await requireOrgSafely({ org: B }, { ...base, key_org_id: A });
+        expect(exitError).toContain(A);
+        expect(exitError).toContain(B);
+        expect(exitError).toMatch(/nothing was sent/i);
+    });
+    it('names the source of the conflicting org, not just the conflict', async () => {
+        writeProjectOrg(tmp, B);
+        await requireOrgSafely({}, { ...base, key_org_id: A });
+        expect(exitError).toContain('.myapi.json');
+    });
+    it('allows an --org that agrees with the lock', async () => {
+        const got = await requireOrgSafely({ org: A }, { ...base, key_org_id: A });
+        expect(got).toBe(A);
+        expect(exitError).toBeNull();
+    });
+    it('needs no --org at all when the key is locked', async () => {
+        const got = await requireOrgSafely({}, { ...base, key_org_id: A });
+        expect(got).toBe(A);
+    });
+    it('still refuses a --org that arrived empty', async () => {
+        await requireOrgSafely({ org: '' }, { ...base, key_org_id: A, default_org: A });
+        expect(exitError).toMatch(/without a value/);
+    });
+});

package/dist/project.d.ts

@@ -0,0 +1,20 @@
+export declare const PROJECT_FILE = ".myapi.json";
+export interface ProjectConfig {
+    org?: string;
+}
+export interface FoundProject {
+    org: string;
+    /** Absolute path of the file it came from, so output can name it. */
+    file: string;
+}
+/**
+ * Walks up from `startDir` looking for the nearest `.myapi.json` that names an
+ * org. Stops at the filesystem root.
+ *
+ * A malformed file is ignored rather than fatal: it must not be able to brick
+ * every command in a directory tree, and the resolution chain has other rungs.
+ * It is reported by `myapi status` instead.
+ */
+export declare function findProjectOrg(startDir?: string): FoundProject | undefined;
+/** Writes `.myapi.json` in `dir`, preserving any keys we do not own. */
+export declare function writeProjectOrg(dir: string, orgId: string): string;

package/dist/project.js

@@ -0,0 +1,59 @@
+import * as fs from 'fs';
+import * as path from 'path';
+// Which org does this directory belong to?
+//
+// `myapi config set-org` writes `default_org` into ~/.myapi/config.json — one
+// file per MACHINE. Two checkouts on one laptop share it, so project A sets it
+// to A, project B sets it to B, and every later bare command in A quietly
+// targets B. The command succeeds; it just lands in the wrong tenant. That is
+// the single most-reported problem with the CLI, and it is a scope mismatch:
+// the org is a property of the work, stored per machine.
+//
+// So: the nearest `.myapi.json` walking up from cwd, the way git finds .git and
+// npm finds package.json. Two projects get two files and stop fighting.
+//
+// It holds the ORG ID AND NEVER A KEY. A file named in a repo gets committed
+// eventually — that is not a prediction, it is what happens — and trading a
+// wrong-org write for a leaked credential would be a worse deal than the bug it
+// fixes. The org id is not a secret: it is useless without a key that the
+// server has already locked to it.
+export const PROJECT_FILE = '.myapi.json';
+/**
+ * Walks up from `startDir` looking for the nearest `.myapi.json` that names an
+ * org. Stops at the filesystem root.
+ *
+ * A malformed file is ignored rather than fatal: it must not be able to brick
+ * every command in a directory tree, and the resolution chain has other rungs.
+ * It is reported by `myapi status` instead.
+ */
+export function findProjectOrg(startDir = process.cwd()) {
+    let dir = path.resolve(startDir);
+    for (;;) {
+        const candidate = path.join(dir, PROJECT_FILE);
+        try {
+            if (fs.existsSync(candidate)) {
+                const parsed = JSON.parse(fs.readFileSync(candidate, 'utf-8'));
+                if (typeof parsed?.org === 'string' && parsed.org) {
+                    return { org: parsed.org, file: candidate };
+                }
+            }
+        }
+        catch { /* unreadable or malformed — keep walking */ }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/** Writes `.myapi.json` in `dir`, preserving any keys we do not own. */
+export function writeProjectOrg(dir, orgId) {
+    const file = path.join(path.resolve(dir), PROJECT_FILE);
+    let existing = {};
+    try {
+        if (fs.existsSync(file))
+            existing = JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch { /* replace an unreadable file rather than fail the command */ }
+    fs.writeFileSync(file, `${JSON.stringify({ ...existing, org: orgId }, null, 2)}\n`);
+    return file;
+}

package/dist/regression-register.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/regression-register.test.js

@@ -0,0 +1,71 @@
+// Every customer incident names the guard that fails if it comes back — and
+// this checks the guard is really there.
+//
+// A register that nobody verifies is worse than none: it reads as "we checked,
+// we know" while the test it names has been renamed, skipped or deleted. That
+// exact rot has already happened three times in this repo's linters, in the
+// form of waivers claiming gaps that were closed.
+//
+// So the register is only as good as this file. It asserts, for every entry:
+// the guard file exists, it still contains the named assertion, and that
+// assertion is not skipped. Entries with no guard must say why, so a gap is
+// counted rather than quietly absent.
+//
+// What it deliberately does NOT claim: that we have thought of everything. It
+// covers incidents customers have already hit. The unknown ones are the
+// probe's job (scripts/probe/probe.mjs) — this is memory, that is discovery.
+import { describe, it, expect } from 'vitest';
+import { readFileSync, existsSync } from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const REPO_ROOT = fileURLToPath(new URL('../../../', import.meta.url));
+const REGISTER = path.join(REPO_ROOT, 'regressions.json');
+const register = JSON.parse(readFileSync(REGISTER, 'utf-8'));
+describe('the regression register', () => {
+    it('has entries (or it is a file that proves nothing)', () => {
+        expect(register.incidents.length).toBeGreaterThanOrEqual(9);
+    });
+    it.each(register.incidents.map(i => [i.id, i]))('%s — its guard exists and still asserts it', (_id, incident) => {
+        const guardPath = path.join(REPO_ROOT, incident.guard.file);
+        expect(existsSync(guardPath), `${incident.guard.file} is named as the guard for ` +
+            `"${incident.id}" and does not exist. Either restore it, or move the incident to ` +
+            '"unguarded" with the reason — silently dropping the guard is how a fixed bug ' +
+            'comes back.').toBe(true);
+        const source = readFileSync(guardPath, 'utf-8');
+        expect(source.includes(incident.guard.test), `${incident.guard.file} no longer contains "${incident.guard.test}".\n` +
+            `That assertion is the only thing standing between this customer and:\n  ` +
+            `${incident.symptom}\n` +
+            'Renaming it is fine — update regressions.json to match.').toBe(true);
+    });
+    it.each(register.incidents.map(i => [i.id, i]))('%s — its guard is not skipped', (_id, incident) => {
+        const source = readFileSync(path.join(REPO_ROOT, incident.guard.file), 'utf-8');
+        // A skipped guard is the worst shape: present, green, and asserting
+        // nothing. Cheaper to catch here than to discover from a repeat report.
+        const skipped = new RegExp(`(it|test|describe)\\.(skip|todo)\\(\\s*['\`"]${escapeRe(incident.guard.test)}`).test(source) || /describe\.skip\(/.test(source);
+        expect(skipped, `the guard for "${incident.id}" is skipped`).toBe(false);
+    });
+    it('every incident says who it cost and what it cost them', () => {
+        // The register is read when someone is deciding whether a behaviour is safe
+        // to change. Without the cost it reads as a list of trivia, and gets
+        // treated like one.
+        const thin = register.incidents.filter(i => !i.symptom?.trim() || !i.cost?.trim() || !i.customer?.trim());
+        expect(thin.map(i => i.id)).toEqual([]);
+    });
+    it('every unguarded gap explains itself, so none is silent', () => {
+        const unexplained = (register.unguarded ?? []).filter(u => !u.why_no_guard_here?.trim());
+        expect(unexplained.map(u => u.id)).toEqual([]);
+    });
+    it('reports how much is NOT guarded here, rather than only what is', () => {
+        // Printed on every run. A register that only ever shows its green half
+        // teaches the reader it is complete, which is the one thing it is not.
+        const gaps = register.unguarded ?? [];
+        // eslint-disable-next-line no-console
+        console.log(`  regression register: ${register.incidents.length} incident(s) guarded here, ` +
+            `${gaps.length} not (${gaps.filter(g => g.cross_repo).length} guarded in myapi-hq, ` +
+            `${gaps.filter(g => !g.cross_repo).length} not guarded anywhere).`);
+        expect(Array.isArray(gaps)).toBe(true);
+    });
+});
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

package/dist/skills/my-api-hq/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: my-api-hq
-version: 1.3.0
+version: 1.3.2
 description: >
   Auth, organizations, and billing hub. Start here to get an api_key and org_id — every other service depends on both.
 triggers: [api key, account, organization, org, billing, balance, topup, credits, setup, defaults, brand, sync brand, doctor, health check, is my org healthy]
-checksum: sha256-fd266da15b05dee12ce1e683612b76e0f5554247f255a9c8db9be006a403a8ff
+checksum: sha256-d09b77d74b93ca44d7b913fce6b684a6dda21d0dff9efe2686143abffeb217ee
 ---
 
 # MyApiHQ
@@ -13,20 +13,20 @@ The root service. It manages accounts, API keys, organizations, and billing. No
 
 ## Capabilities
 <!-- llm:start -->
-MyApiHQ is the platform's foundation. Every other service requires both an `api_key` and (for org-scoped resources) an `org_id` minted here. Setup is one command — `myapi account setup` — which provisions an account, generates an api_key, creates a default org, and stores everything in `~/.myapi/config.json`. Subsequent commands pick up those defaults automatically.
+MyApiHQ is the platform's foundation: every other service needs an `api_key` and (for org-scoped resources) an `org_id` minted here. `myapi account setup` provisions an account, key and first org into `~/.myapi/config.json`, and later commands pick those up.
 
 ### Anonymous vs registered accounts
 
 Two tiers, chosen at setup time:
 
-- **Anonymous** (`myapi account setup --anonymous`): zero-friction account creation. **Starts with $0 credit.** Good for catalog browsing, reading help, inspecting schemas — nothing that costs upstream money. The agent-onboarding path: provisions an account in one call, no email needed.
-- **Registered** (verified email via `myapi account link <email>`): unlocks $5 free credit and the paid surface (LLM, image, email, domain register, etc.). Required for `myapi billing setup` and anything that hits Stripe.
+- **Anonymous** (`myapi account setup --anonymous`): zero friction, **$0 credit.** Fine for browsing the catalog and reading help.
+- **Registered** (verify email via `myapi account link <email>`): unlocks $5 free credit and the paid surface (LLM, image, email, domain register).
 
-An anonymous account can upgrade at any time via `myapi account link <email>` — the credit grants on successful verification. Anonymous accounts that need paid actions hit a friendly `REGISTRATION_REQUIRED` error pointing at `myapi account link`; a registered account with an empty wallet hits `402 INSUFFICIENT_FUNDS` (top up, or enable auto-recharge — below).
+An anonymous account upgrades any time with `myapi account link <email>`; the credit grants on verification.
 
 ### Health check
 
-`myapi doctor` runs an org-wide consistency check across every slot and layers on customer-perspective DNS/HTTP probes from your machine. It returns per-section findings (`✓` pass / `⚠` warning / `✗` critical) with remediation hints; add `--json` for machine output. The exit code is non-zero **only** on customer-actionable criticals — platform-side issues the MyAPI team is already handling are surfaced with an `ℹ` marker but don't fail the run. Run it to self-check before building (is the org set up?) and after (did everything wire up?).
+`myapi doctor` runs an org-wide consistency check across every slot, plus customer-perspective DNS/HTTP probes from your machine. Per-section findings (`✓` / `⚠` / `✗`) with remediation hints; `--json` for machine output. Exit is non-zero **only** on customer-actionable criticals — platform-side issues show as `ℹ` and do not fail the run, so it works as a CI gate.
 <!-- llm:end -->
 
 ## Commands
@@ -55,7 +55,9 @@ An anonymous account can upgrade at any time via `myapi account link <email>`
 | `myapi billing auto-recharge [show \| set \| disable]` | Keep the wallet funded — off-session refill when balance drops below a threshold, capped monthly |
 | `myapi account sending` / `myapi account resume-sending` | Is sending paused (bounces), and turn it on |
 | `myapi account mailing-address ["<address>"]` | Get or set the account's CAN-SPAM mailing address (required for email send) |
-| `myapi config set-org <id>` / `set-funnel <id>` / `set-domain <name>` | Set CLI defaults |
+| `myapi init --org <id>` | Bind this directory to one org: locked key + `.myapi.json` (`--force` re-binds). Use instead of `config set-org` when a machine has more than one project |
+| `myapi config set-org <id>` / `set-funnel <id>` / `set-domain <name>` | Set machine-wide CLI defaults (single-project machines only) |
+| `myapi org create <name> --yes` | Create an org; your default org is untouched (`--set-default` re-points it) |
 | `myapi install-skills` | Install agent skills into ~/.claude/, ~/.gemini/, ~/.cursor/ |
 | `myapi doctor [--verbose] [--json]` | Org-wide health check: config/integrity findings + DNS/HTTP probes |
 <!-- generated:end -->
@@ -94,7 +96,7 @@ Each org gets a free preview subdomain (`*.makeautonomous.com`) usable before re
 
 ## Notes
 
-- Set `--org` defaults once with `myapi config set-org <id>` to skip the flag on every command.
+- **Bind a directory to an org with `myapi init --org <id>`**, not `config set-org` — `set-org` writes ONE default for the whole machine, so two projects overwrite each other's and commands land in the wrong org while still succeeding. `init` writes `.myapi.json` (org id, never a key) plus a key the server locks to that org.
 - API keys have format `hq_live_...` and are sent as `Authorization: Bearer <key>`.
 - `org sync-brand` is async (scrapes the site, polls the job).
 
@@ -108,7 +110,9 @@ myapi keys create --name agent --org <id> --grant '*'       # locked to ONE org
 myapi keys create --name ci --grant funnel:write,storage:read --spend-cap 25
 ```
 
-- `--org <id>` — **lock it to one org.** Omit for account-wide.
+- `--org <id>` — **lock it to one org.** Omit for account-wide. A locked key is
+  refused (403) on every other org — the only scoping a stale default cannot
+  talk past. `myapi init` sets it up per directory.
 - `--grant <list>` — `slot:read` / `slot:write`; a bare slot means write, `*`
   means all. **Omitting `--grant` mints an unrestricted key.**
 - `--spend-cap <usd>` — hard ceiling; `0` means the key cannot spend at all.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/cli",
   "license": "Apache-2.0",
-  "version": "2.25.2",
+  "version": "2.26.1",
   "description": "MyAPI command-line interface",
   "repository": {
     "type": "git",
@@ -46,7 +46,7 @@
     "lint:skills:strict": "node scripts/copy-skills.js && node scripts/lint-skills.js --strict"
   },
   "dependencies": {
-    "@myapihq/sdk": "^2.25.2"
+    "@myapihq/sdk": "^2.26.1"
   },
   "devDependencies": {
     "@types/node": "^25.6.0",