@myapihq/cli 2.4.0 → 2.4.2

package/dist/commands/crm/companies.js

@@ -5,10 +5,6 @@ import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/companies',
-    // Backend (2026-06-06): bare GET list with query-param filters —
-    // companion to the POST /search verb. See contacts.ts for the same
-    // pattern.
-    'GET /crm/orgs/{org_id}/companies',
     'POST /crm/orgs/{org_id}/companies/promote',
     'POST /crm/orgs/{org_id}/companies/search',
     'GET /crm/orgs/{org_id}/companies/{id}',
@@ -125,7 +121,7 @@ async function restore(id, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm companies restore <id> [--org <id>]');
     requireArg(id, 'id', 'myapi crm companies restore <id>');
-    const c = await crm.updateCompany(config.api_key, orgId, id, { deleted_at: null });
+    const c = await crm.restoreCompany(config.api_key, orgId, id);
     if (flags.json) {
         printJson(c);
         return;

package/dist/commands/crm/contacts.js

@@ -5,11 +5,6 @@ import { success, error, info, printTable, printJson } from '../../output.js';
 import { requireOrg, requireArg } from '../../helpers.js';
 export const EXPOSES = [
     'POST /crm/orgs/{org_id}/contacts',
-    // Backend (2026-06-06): bare GET list with query-param filters —
-    // companion to the POST /search verb (richer filters via body). The
-    // CLI `list` verb still uses /search for forward-compat; the bare GET
-    // is declared so it's covered.
-    'GET /crm/orgs/{org_id}/contacts',
     'POST /crm/orgs/{org_id}/contacts/promote',
     'POST /crm/orgs/{org_id}/contacts/search',
     'GET /crm/orgs/{org_id}/contacts/{id}',
@@ -138,7 +133,7 @@ async function restore(id, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi crm contacts restore <id> [--org <id>]');
     requireArg(id, 'id', 'myapi crm contacts restore <id>');
-    const c = await crm.updateContact(config.api_key, orgId, id, { deleted_at: null });
+    const c = await crm.restoreContact(config.api_key, orgId, id);
     if (flags.json) {
         printJson(c);
         return;

package/dist/commands/domain-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/domain-validation.test.js

@@ -0,0 +1,36 @@
+// Unit tests for the domain CLI's reassignment guard.
+//
+// `domain assign` is also the reassign path: run it against a domain that is
+// currently bound to another org and it silently MOVES the domain — taking the
+// old org's site offline. That has happened in production. domain.ts was the
+// largest command module in the CLI with no command-level tests; this is the
+// decision that matters most in it.
+import { describe, it, expect } from 'vitest';
+import { _shouldRefuseReassign } from './domain.js';
+const ORG_A = 'org-aaaa';
+const ORG_B = 'org-bbbb';
+describe('_shouldRefuseReassign', () => {
+    it('refuses when the domain belongs to a different org', () => {
+        expect(_shouldRefuseReassign({ org_id: ORG_B }, ORG_A, false)).toBe(true);
+    });
+    it('allows a first-time assign — domain not in any org yet', () => {
+        // The pre-flight look-up finds nothing; blocking here would make every
+        // initial assign impossible.
+        expect(_shouldRefuseReassign(undefined, ORG_A, false)).toBe(false);
+    });
+    it('allows a re-assign to the org that already owns it (idempotent)', () => {
+        expect(_shouldRefuseReassign({ org_id: ORG_A }, ORG_A, false)).toBe(false);
+    });
+    it('allows a record with no org_id — registered but unassigned', () => {
+        expect(_shouldRefuseReassign({}, ORG_A, false)).toBe(false);
+        expect(_shouldRefuseReassign({ org_id: undefined }, ORG_A, false)).toBe(false);
+        expect(_shouldRefuseReassign({ org_id: '' }, ORG_A, false)).toBe(false);
+        // The wire shape for an unassigned domain: an explicit null, not a
+        // missing field. Treating null as "owned by someone else" would block
+        // every assign onto a freshly registered domain.
+        expect(_shouldRefuseReassign({ org_id: null }, ORG_A, false)).toBe(false);
+    });
+    it('--force bypasses the guard — the documented way to move a domain', () => {
+        expect(_shouldRefuseReassign({ org_id: ORG_B }, ORG_A, true)).toBe(false);
+    });
+});

package/dist/commands/domain.d.ts

@@ -8,6 +8,20 @@ export declare function register(domainArg: string, flags: Flags): Promise<void>
 export declare function importCmd(domainArg: string, flags: Flags): Promise<void>;
 export declare function renew(domainArg: string, flags: Flags): Promise<void>;
 export declare function list(flags: Flags): Promise<void>;
+/**
+ * The `domain assign` reassignment decision, isolated from the I/O around it.
+ * True means: this assign would MOVE the domain away from another org, so
+ * refuse unless --force.
+ *
+ * Exported for tests. Assign is also the reassign path — a bare assign against
+ * a domain already bound elsewhere silently moves it, which has bitten us in
+ * production. The exact shape of `current` matters: an undefined record (domain
+ * not in the org's list) and a record already owned by the target org must both
+ * pass, or every first-time assign would be blocked.
+ */
+export declare function _shouldRefuseReassign(current: {
+    org_id?: string | null;
+} | undefined, targetOrgId: string, force: boolean): boolean;
 export declare function assign(domainArg: string, flags: Flags): Promise<void>;
 export declare function unassign(domainArg: string, flags: Flags): Promise<void>;
 export declare function status(domainArg: string, flags: Flags): Promise<void>;

package/dist/commands/domain.js

@@ -202,6 +202,25 @@ function summarizeDomain(d) {
     const { org_id, ...rest } = d;
     return { ...rest, assigned_to_org: org_id || '(unassigned)' };
 }
+/**
+ * The `domain assign` reassignment decision, isolated from the I/O around it.
+ * True means: this assign would MOVE the domain away from another org, so
+ * refuse unless --force.
+ *
+ * Exported for tests. Assign is also the reassign path — a bare assign against
+ * a domain already bound elsewhere silently moves it, which has bitten us in
+ * production. The exact shape of `current` matters: an undefined record (domain
+ * not in the org's list) and a record already owned by the target org must both
+ * pass, or every first-time assign would be blocked.
+ */
+export function _shouldRefuseReassign(
+// org_id is nullable on the wire: a registered-but-unassigned domain comes
+// back with an explicit null, not a missing field.
+current, targetOrgId, force) {
+    if (force)
+        return false;
+    return !!current?.org_id && current.org_id !== targetOrgId;
+}
 export async function assign(domainArg, flags) {
     const config = requireConfig();
     const orgId = requireOrg(flags, config, 'myapi domain assign <domain> [--no-www] [--org <id>]');
@@ -220,7 +239,7 @@ export async function assign(domainArg, flags) {
         catch (e) {
             error(`Could not verify ${domainArg}'s current assignment (${e instanceof Error ? e.message : e}).\nRefusing to assign blind — retry, or pass --force to skip this check.`);
         }
-        if (current?.org_id && current.org_id !== orgId) {
+        if (_shouldRefuseReassign(current, orgId, false)) {
             error(`${domainArg} is currently assigned to org ${current.org_id}.\nAssigning it to org ${orgId} would MOVE it. Re-run with --force to reassign.`);
         }
     }

package/dist/commands/funnel-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/funnel-validation.test.js

@@ -0,0 +1,86 @@
+// Unit tests for the funnel CLI's overwrite guard.
+//
+// funnel.ts is the largest command module in the CLI and owned the most
+// destructive operation in it — `push` replaces whatever page is live at a
+// slug, with no undo — while having no command-level tests at all. The guard
+// below is the only thing standing between an agent and an org's live
+// homepage, so it gets tested directly rather than through --help smoke.
+import { describe, it, expect, afterEach } from 'vitest';
+import { _slugKey, _findOverwriteClash, formSubmitBase } from './funnel.js';
+describe('formSubmitBase', () => {
+    const saved = { f: process.env.MYAPI_FUNNEL_URL, b: process.env.MYAPI_API_BASE };
+    afterEach(() => {
+        if (saved.f === undefined)
+            delete process.env.MYAPI_FUNNEL_URL;
+        else
+            process.env.MYAPI_FUNNEL_URL = saved.f;
+        if (saved.b === undefined)
+            delete process.env.MYAPI_API_BASE;
+        else
+            process.env.MYAPI_API_BASE = saved.b;
+    });
+    it('defaults to the gateway — the host published pages POST to today', () => {
+        delete process.env.MYAPI_FUNNEL_URL;
+        delete process.env.MYAPI_API_BASE;
+        expect(formSubmitBase()).toBe('https://api.myapihq.com');
+    });
+    it('honors MYAPI_FUNNEL_URL, so a local build stops emitting a prod form action', () => {
+        // The actual bug: this host was a literal, so `funnel form` against a
+        // local backend generated a form that posted to production.
+        process.env.MYAPI_FUNNEL_URL = 'http://localhost:8080';
+        expect(formSubmitBase()).toBe('http://localhost:8080');
+    });
+    it('falls back to MYAPI_API_BASE', () => {
+        delete process.env.MYAPI_FUNNEL_URL;
+        process.env.MYAPI_API_BASE = 'http://localhost:9090';
+        expect(formSubmitBase()).toBe('http://localhost:9090');
+    });
+});
+describe('_slugKey', () => {
+    it('treats every wire shape of the homepage as the same page', () => {
+        // The backend has returned all of these for the root page.
+        expect(_slugKey('/')).toBe('');
+        expect(_slugKey('')).toBe('');
+    });
+    it('normalizes leading slash and trailing slashes', () => {
+        expect(_slugKey('/about')).toBe('about');
+        expect(_slugKey('about')).toBe('about');
+        expect(_slugKey('/about/')).toBe('about');
+        expect(_slugKey('about///')).toBe('about');
+    });
+    it('keeps distinct paths distinct', () => {
+        expect(_slugKey('/about')).not.toBe(_slugKey('/about-us'));
+        expect(_slugKey('/a/b')).toBe('a/b');
+    });
+});
+describe('_findOverwriteClash', () => {
+    const pages = [
+        { slug: '/', updated_at: '2026-07-01T00:00:00Z' },
+        { slug: '/pricing', updated_at: '2026-07-02T00:00:00Z' },
+    ];
+    it('refuses a push onto an existing page', () => {
+        expect(_findOverwriteClash(pages, '/pricing', false)).toEqual(pages[1]);
+    });
+    it('refuses the homepage case — the one that destroys a live site', () => {
+        expect(_findOverwriteClash(pages, '/', false)).toEqual(pages[0]);
+        expect(_findOverwriteClash(pages, '', false)).toEqual(pages[0]);
+    });
+    it('matches across slash shapes, so a typo cannot slip past the guard', () => {
+        expect(_findOverwriteClash(pages, 'pricing', false)).toEqual(pages[1]);
+        expect(_findOverwriteClash(pages, '/pricing/', false)).toEqual(pages[1]);
+    });
+    it('allows a push to a genuinely new slug', () => {
+        expect(_findOverwriteClash(pages, '/about', false)).toBeUndefined();
+    });
+    it('allows any push on an empty funnel', () => {
+        expect(_findOverwriteClash([], '/', false)).toBeUndefined();
+    });
+    it('does not confuse a prefix for a match', () => {
+        expect(_findOverwriteClash(pages, '/pricing-2', false)).toBeUndefined();
+        expect(_findOverwriteClash([{ slug: '/a/b' }], '/a', false)).toBeUndefined();
+    });
+    it('--force bypasses the guard — that is the documented escape hatch', () => {
+        expect(_findOverwriteClash(pages, '/pricing', true)).toBeUndefined();
+        expect(_findOverwriteClash(pages, '/', true)).toBeUndefined();
+    });
+});

package/dist/commands/funnel.d.ts

@@ -3,6 +3,18 @@ import { type Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
 export declare const SCHEMA: FlagSchema;
+export declare function formSubmitBase(): string;
+export declare function _slugKey(s: string): string;
+/**
+ * The `funnel push` overwrite decision, isolated from the I/O around it.
+ * Returns the clashing page when the push must be refused, else undefined.
+ *
+ * Exported for tests rather than inlined because this is the single call that
+ * stands between an agent and silently replacing an org's live homepage.
+ */
+export declare function _findOverwriteClash<T extends {
+    slug: string;
+}>(existingPages: readonly T[], targetSlug: string, force: boolean): T | undefined;
 export declare function list(flags: Flags): Promise<void>;
 export declare function create(flags: Flags): Promise<void>;
 export declare function get(id: string, flags: Flags): Promise<void>;

package/dist/commands/funnel.js

@@ -45,12 +45,46 @@ function validateFunnelName(name) {
         error(`Invalid --name "${name}". Lowercase letters, digits, hyphens; 1-50 chars; starts with a letter or digit.`);
     }
 }
+// Host for the form-action URL baked into the generated snippet.
+//
+// This one is NOT the SDK's FUNNEL_BASE, deliberately. The URL is embedded in
+// a published page and POSTed to by a visitor's browser, so it has to be a
+// host that serves the public submit route with the right CORS — today that's
+// the gateway, and moving it to api.myfunnelapi.com is an outward-facing
+// change that can only be verified against prod. What was actually broken is
+// the override: the host was a hardcoded literal, so a funnel built against a
+// local backend emitted a form that posted to production. MYAPI_FUNNEL_URL
+// (the same var the SDK reads) now wins when set, matching how storage.ts and
+// login.ts mirror their bases.
+//
+// Exported for tests.
+export function formSubmitBase() {
+    return process.env.MYAPI_FUNNEL_URL
+        ?? process.env.MYAPI_API_BASE
+        ?? 'https://api.myapihq.com';
+}
 // Canonical key for comparing slugs across the wire shapes the backend may
 // return (`/about`, `about`, `/about/`). Home is the empty string whether it
 // arrives as `/` or ``.
-function slugKey(s) {
+// Exported for tests: this normalization IS the overwrite guard. If it
+// under-matches, `push /about` sails past a live `about` page and overwrites
+// it without ever showing the refusal.
+export function _slugKey(s) {
     return (s.startsWith('/') ? s.slice(1) : s).replace(/\/+$/, '');
 }
+const slugKey = _slugKey;
+/**
+ * The `funnel push` overwrite decision, isolated from the I/O around it.
+ * Returns the clashing page when the push must be refused, else undefined.
+ *
+ * Exported for tests rather than inlined because this is the single call that
+ * stands between an agent and silently replacing an org's live homepage.
+ */
+export function _findOverwriteClash(existingPages, targetSlug, force) {
+    if (force)
+        return undefined;
+    return existingPages.find(p => slugKey(p.slug) === slugKey(targetSlug));
+}
 // Resolve human-readable labels for the namespace a destructive write lands
 // on. The whole point of the funnel-write guardrails is that the agent (and
 // the human reading the transcript) can SEE which org + funnel it touched —
@@ -65,7 +99,11 @@ async function describeTarget(apiKey, orgId, funnelId) {
     const orgLabel = org?.name ? `${org.name} (${orgId})` : orgId;
     const fname = funnelRes?.funnel?.name;
     const funnelLabel = fname ? `${fname} (${funnelId})` : funnelId;
-    return { orgLabel, funnelLabel };
+    // THIS funnel's own base URL. Every funnel in an org has its own preview
+    // subdomain; the org-level `preview_subdomain` is only the first one. See
+    // the note in push() for what using the wrong one costs.
+    const base = funnelRes?.subdomain_url;
+    return { orgLabel, funnelLabel, funnelBaseUrl: base ? base.replace(/\/+$/, '') : undefined };
 }
 export async function list(flags) {
     const config = requireConfig();
@@ -181,8 +219,8 @@ export async function push(slug, flags) {
     // reading stdin so a refused push never consumes the generated HTML.
     const force = flags.force === true;
     const existingPages = await sdkFunnel.listFunnelPages(config.api_key, orgId, funnelId);
-    const clash = existingPages.find(p => slugKey(p.slug) === slugKey(finalSlug));
-    if (clash && !force) {
+    const clash = _findOverwriteClash(existingPages, finalSlug, force);
+    if (clash) {
         const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
         const when = clash.updated_at ? `, last updated ${formatDate(clash.updated_at)}` : '';
         error(`Refusing to overwrite an existing page.
@@ -206,16 +244,22 @@ This funnel already serves a page at ${finalSlug}; pushing would replace it.
     if (!html.trim())
         error("No content provided via stdin. Usage: echo '<h1>Hello</h1>' | myapi funnel push [slug]");
     const result = await sdkFunnel.pushFunnelPage(config.api_key, orgId, funnelId, { slug: finalSlug, html });
-    const { orgLabel, funnelLabel } = await describeTarget(config.api_key, orgId, funnelId);
-    let liveUrl = result?.url;
-    if (!liveUrl) {
-        // Best-effort URL enrichment — the push already succeeded, so a failed
-        // org lookup must not turn a successful write into a non-zero exit.
-        const org = await hq.getOrg(config.api_key, orgId).catch(() => null);
-        if (org?.preview_subdomain) {
-            liveUrl = `https://${org.preview_subdomain}.makeautonomous.com${finalSlug}`;
-        }
-    }
+    const { orgLabel, funnelLabel, funnelBaseUrl } = await describeTarget(config.api_key, orgId, funnelId);
+    // Best-effort URL enrichment — the push already succeeded, so a failed
+    // lookup must not turn a successful write into a non-zero exit.
+    //
+    // This used to fall back to the ORG's `preview_subdomain`, which is only
+    // correct when the org has exactly one funnel. Push to any other funnel and
+    // it printed a sibling funnel's URL: verified against production 2026-07-26,
+    // where a push to `write-check-…` reported `fine-vole-…`, and that URL
+    // returned 404 while the page was live on the right one. An agent following
+    // it concludes its own successful push failed — and the natural recovery is
+    // to push again, which the overwrite guard then refuses. Two confusing
+    // failures from one wrong string.
+    //
+    // A wrong URL is strictly worse than no URL, so when the funnel's own base
+    // can't be resolved we print nothing rather than guess.
+    const liveUrl = result?.url ?? (funnelBaseUrl ? `${funnelBaseUrl}${finalSlug}` : undefined);
     // Machine output: the live URL is carried as `subdomain_url` — the same field
     // name `funnel get`/`list`/`create` use — so an agent that pushes has the URL
     // in hand without a follow-up `funnel get` (and without guessing the field).
@@ -351,7 +395,7 @@ export async function formCmd(funnelArg, flags) {
         };
         registeredBinding = await sdkFunnel.createFormBinding(config.api_key, orgId, funnelId, binding);
     }
-    const url = `https://api.myapihq.com/funnel/funnels/${funnelId}/submit/${encodeURIComponent(slug)}`;
+    const url = `${formSubmitBase()}/funnel/funnels/${funnelId}/submit/${encodeURIComponent(slug)}`;
     const escAttr = (s) => s.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
     const escText = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
     // Per-field labels — Email uses the canonical placeholder; others

package/dist/commands/login-validation.test.js

@@ -1,7 +1,7 @@
-// Unit tests for the login command's pure PKCE/URL helpers.
+// Unit tests for the login command's pure PKCE/URL helpers + the browser opener.
 import { describe, it, expect } from 'vitest';
 import * as crypto from 'crypto';
-import { generatePkce, buildAuthorizeUrl } from './login.js';
+import { generatePkce, buildAuthorizeUrl, browserCommand, openBrowser } from './login.js';
 describe('generatePkce', () => {
     it('challenge is base64url(sha256(verifier)) — S256', () => {
         const { verifier, challenge } = generatePkce();
@@ -41,3 +41,25 @@ describe('buildAuthorizeUrl', () => {
         expect(u.searchParams.get('redirect_uri')).toContain(':65530');
     });
 });
+describe('browserCommand', () => {
+    it('picks the platform opener and passes the URL', () => {
+        expect(browserCommand('https://x.test', 'darwin')).toEqual({ cmd: 'open', args: ['https://x.test'] });
+        expect(browserCommand('https://x.test', 'linux')).toEqual({ cmd: 'xdg-open', args: ['https://x.test'] });
+        expect(browserCommand('https://x.test', 'win32')).toEqual({ cmd: 'cmd', args: ['/c', 'start', '', 'https://x.test'] });
+    });
+});
+// Regression guard: openBrowser used to return true whenever spawn() didn't
+// throw. Both real failure modes (missing binary, opener exiting non-zero)
+// surface asynchronously, so a "successful" spawn left the user waiting three
+// minutes at "Waiting for sign-in…" with no URL ever printed.
+describe.skipIf(process.platform === 'win32')('openBrowser failure detection', () => {
+    it('reports failure when the opener binary does not exist (ENOENT)', async () => {
+        expect(await openBrowser('https://x.test', { cmd: 'myapi-no-such-opener-binary', args: [] })).toBe(false);
+    });
+    it('reports failure when the opener exits non-zero', async () => {
+        expect(await openBrowser('https://x.test', { cmd: 'sh', args: ['-c', 'exit 3'] })).toBe(false);
+    });
+    it('reports success when the opener stays up past the grace window', async () => {
+        expect(await openBrowser('https://x.test', { cmd: 'sh', args: ['-c', 'sleep 2'] })).toBe(true);
+    });
+});

package/dist/commands/login.d.ts

@@ -11,4 +11,10 @@ export interface Pkce {
 }
 export declare function generatePkce(): Pkce;
 export declare function buildAuthorizeUrl(base: string, redirectUri: string, pkce: Pkce): string;
+export interface OpenerCommand {
+    cmd: string;
+    args: string[];
+}
+export declare function browserCommand(url: string, platform?: string): OpenerCommand;
+export declare function openBrowser(url: string, opener?: OpenerCommand): Promise<boolean>;
 export declare function login(flags?: Flags): Promise<void>;

package/dist/commands/login.js

@@ -60,20 +60,51 @@ export function buildAuthorizeUrl(base, redirectUri, pkce) {
     return u.toString();
 }
 // ── Browser opener (zero-dep, best-effort) ──────────────────────────────────
-function openBrowser(url) {
-    const cmd = process.platform === 'darwin' ? 'open'
-        : process.platform === 'win32' ? 'cmd'
-            : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
-    try {
-        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
-        child.on('error', () => { });
-        child.unref();
-        return true;
-    }
-    catch {
-        return false;
-    }
+// Resolves false when the opener could not actually launch a browser, so the
+// caller can print the URL instead. spawn() failures (ENOENT — no `xdg-open`
+// on a headless box) and a fast non-zero exit (`xdg-open` with no handler
+// registered) both arrive asynchronously, so returning true the moment spawn()
+// doesn't throw strands the user at "Waiting for sign-in…" with nothing to
+// click. Wait a short beat for those signals before claiming success.
+const BROWSER_LAUNCH_GRACE_MS = 400;
+// Exported so the tests can drive openBrowser with a command whose failure mode
+// is deterministic, instead of whatever browser the test machine happens to have.
+export function browserCommand(url, platform = process.platform) {
+    if (platform === 'darwin')
+        return { cmd: 'open', args: [url] };
+    if (platform === 'win32')
+        return { cmd: 'cmd', args: ['/c', 'start', '', url] };
+    return { cmd: 'xdg-open', args: [url] };
+}
+export function openBrowser(url, opener = browserCommand(url)) {
+    const { cmd, args } = opener;
+    return new Promise(resolve => {
+        let settled = false;
+        let timer;
+        const settle = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            resolve(ok);
+        };
+        try {
+            const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+            // Detach either way — on success the browser outlives us; on failure the
+            // child is already gone.
+            child.unref();
+            child.on('error', () => settle(false));
+            child.on('exit', code => { if (code !== 0)
+                settle(false); });
+        }
+        catch {
+            settle(false);
+            return;
+        }
+        // Survived the grace window without an error/failed exit → assume it opened.
+        timer = setTimeout(() => settle(true), BROWSER_LAUNCH_GRACE_MS);
+    });
 }
 // ── Loopback callback server ────────────────────────────────────────────────
 const CALLBACK_TIMEOUT_MS = 180_000;
@@ -365,7 +396,7 @@ export async function login(flags = {}) {
     const callback = await startCallbackServer(pkce.state);
     const authorizeUrl = buildAuthorizeUrl(authorizeBase(), callback.redirectUri, pkce);
     info('› Opening your browser to sign in…');
-    const opened = flags['no-browser'] ? false : openBrowser(authorizeUrl);
+    const opened = flags['no-browser'] ? false : await openBrowser(authorizeUrl);
     if (!opened) {
         info('› Open this URL to sign in:');
         info(`  ${authorizeUrl}`);
@@ -399,7 +430,7 @@ export async function login(flags = {}) {
         default_org: auth.default_org || undefined,
         default_funnel: auth.default_funnel || undefined,
     });
-    success(`› ✓ Signed in${email ? ` · ${email}` : ''}`);
+    success(`› Signed in${email ? ` · ${email}` : ''}`);
     info(`  Account: ${auth.account_id}`);
     if (auth.default_org)
         info(`  Org: ${auth.default_org}${auth.default_funnel ? ` · Funnel: ${auth.default_funnel}` : ''}`);
@@ -413,7 +444,7 @@ async function loginMock(flags = {}) {
     const idp = await startMockIdp();
     const authorizeUrl = buildAuthorizeUrl(idp.authorizeBase, callback.redirectUri, pkce);
     info('› Opening your browser to sign in… (mock preview — nothing is saved)');
-    const opened = flags['no-browser'] ? false : openBrowser(authorizeUrl);
+    const opened = flags['no-browser'] ? false : await openBrowser(authorizeUrl);
     if (!opened) {
         info('› Open this URL to sign in:');
         info(`  ${authorizeUrl}`);

package/dist/commands/payments.js

@@ -69,9 +69,19 @@ export async function status(flags) {
         printJson(res);
         return;
     }
-    info(`Tier:              ${res.tier}`);
+    // An org with no Stripe connection comes back with these fields unset, and
+    // interpolating them printed the literal string "undefined" three times —
+    // which tells an agent nothing and looks like a bug in the CLI rather than
+    // an unconfigured account. Say what's true and what to do about it.
+    // Observed against production 2026-07-26.
+    if (!res.stripe_account_id) {
+        info('Stripe:            not connected');
+        info('Connect yours:     myapi payments connect --stripe-key <sk_...>');
+        return;
+    }
+    info(`Tier:              ${res.tier ?? 'unknown'}`);
     info(`Stripe account:    ${res.stripe_account_id}`);
-    info(`Onboarding:        ${res.onboarding_status}`);
+    info(`Onboarding:        ${res.onboarding_status ?? 'unknown'}`);
     if (res.application_fee_bps != null) {
         info(`Platform fee:      ${res.application_fee_bps} bps`);
     }

package/dist/commands/setup.d.ts

@@ -1,6 +1,7 @@
 import type { Flags } from '../helpers.js';
 import type { Exposes } from '../exposes.js';
 export declare const EXPOSES: Exposes;
+export declare function _isLocallyModified(src: string): boolean;
 export declare function installSkills(): Promise<void>;
 export declare function importKey(apiKey: string, flags: Flags): Promise<void>;
 export declare function setup(flags?: Flags): Promise<void>;

package/dist/commands/setup.js

@@ -1,8 +1,9 @@
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
+import * as crypto from 'crypto';
 import { loadConfig, saveConfig, addAccount, loadFullConfig } from '../config.js';
-import { info, success } from '../output.js';
+import { info, success, banner } from '../output.js';
 import { ask, confirm } from '../prompt.js';
 import { hq, funnel as sdkFunnel } from '@myapihq/sdk';
 import { emitSkillsInstall } from '../telemetry.js';
@@ -45,6 +46,40 @@ const AGENT_DIRS = {
 const SKILLS_CANONICAL = path.join(os.homedir(), '.agents', 'skills', 'myapi');
 // Skills are bundled inside the npm package at build time from skills/*/SKILL.md
 const BUNDLED_SKILLS_DIR = path.join(path.dirname(new URL(import.meta.url).pathname), '..', 'skills');
+// Does an installed SKILL.md differ from the checksum it declares?
+//
+// The checksum covers the body only (everything after the frontmatter block),
+// which is what makes it self-describing: the digest lives inside the file it
+// describes without being part of what's hashed. Best-effort by design — an
+// unreadable or checksum-less file is simply "not known to be modified", never
+// a reason to block an install.
+export function _isLocallyModified(src) {
+    const m = /^(---\r?\n[\s\S]*?\r?\n---\r?\n)([\s\S]*)$/.exec(src);
+    if (!m)
+        return false;
+    const [, frontmatter, body] = m;
+    const declared = /^checksum:\s*(\S+)/m.exec(frontmatter)?.[1];
+    if (!declared || !declared.startsWith('sha256-'))
+        return false;
+    // Every skill shipped by CLI <= 2.4.1 carries the literal placeholder
+    // `sha256-pending`, which can never equal a real digest. Without this, the
+    // first upgrade would report all 14 previously-installed skills as
+    // locally-modified and announce "your edits are gone" to every existing
+    // user — a false alarm on 100% of upgrades, saying something alarming and
+    // untrue. A placeholder means "unknown", which is not the same as "edited".
+    if (declared === 'sha256-pending')
+        return false;
+    const actual = 'sha256-' + crypto.createHash('sha256').update(body, 'utf-8').digest('hex');
+    return actual !== declared;
+}
+function isLocallyModified(file) {
+    try {
+        return _isLocallyModified(fs.readFileSync(file, 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+}
 export async function installSkills() {
     if (!fs.existsSync(BUNDLED_SKILLS_DIR)) {
         info('No bundled skills found — skipping skills install.');
@@ -58,11 +93,25 @@ export async function installSkills() {
         return;
     }
     // Write canonical copies: ~/.agents/skills/myapi/<skill>/SKILL.md (only SKILL.md)
+    //
+    // This overwrites unconditionally, which is right for the common case (an
+    // update should deliver the new skill) but silently destroys local edits.
+    // The frontmatter `checksum` — a real sha256 of the body, written by
+    // scripts/canonical-sync.mjs — is what lets us tell the two apart, so a user
+    // who customized a skill at least learns it was replaced.
     fs.mkdirSync(SKILLS_CANONICAL, { recursive: true });
+    const modified = [];
     for (const skill of skills) {
         const skillDir = path.join(SKILLS_CANONICAL, skill);
+        const installed = path.join(skillDir, 'SKILL.md');
+        if (fs.existsSync(installed) && isLocallyModified(installed))
+            modified.push(skill);
         fs.mkdirSync(skillDir, { recursive: true });
-        fs.copyFileSync(path.join(BUNDLED_SKILLS_DIR, skill, 'SKILL.md'), path.join(skillDir, 'SKILL.md'));
+        fs.copyFileSync(path.join(BUNDLED_SKILLS_DIR, skill, 'SKILL.md'), installed);
+    }
+    if (modified.length > 0) {
+        banner(`› Replaced ${modified.length} locally-modified skill${modified.length === 1 ? '' : 's'}: ${modified.join(', ')}`);
+        banner(`  Your edits are gone. Keep customizations in a separate skill name — MyAPI skills are overwritten on every install/update.`);
     }
     // Symlink each skill into agent config directories. Surface failures so
     // users can fix permission issues — skills that didn't install will not
@@ -223,7 +272,7 @@ export async function importKey(apiKey, flags) {
         default_org: defaultOrg, default_funnel: defaultFunnel,
         skills_installed: wantsSkills,
     });
-    success(`› ✓ Key imported${email ? ` · ${email}` : ''}`);
+    success(`› Key imported${email ? ` · ${email}` : ''}`);
     if (wantsSkills)
         await installSkills();
     else
@@ -301,7 +350,7 @@ export async function setup(flags = {}) {
         default_funnel: defaultFunnel,
         is_anonymous: isAnonymous,
     }, wantsSkills);
-    success(`› ✓ saved to ~/.myapi/config.json`);
+    success(`› Saved to ~/.myapi/config.json`);
     // Validate key and ensure org/funnel defaults are still correct.
     // (resolveDefaults is non-fatal if the API call fails.)
     try {

package/dist/commands/skill-checksum.test.d.ts

@@ -0,0 +1 @@
+export {};