@overaihq/cli 0.13.8 → 0.14.1

package/README.md

@@ -69,21 +69,68 @@ and `printable-page render`; `overai help` shows their arguments.
 
 ## Working across organizations
 
-Each backend and organization has an independent saved CLI session. Work in
-separate workspace folders: commands automatically use the clone’s organization.
-For commands outside a clone, use `OVERAI_ORG_ID=<orgId> overai <command>` or set
-the shell variable. `org switch <orgId>` changes the machine-global default for
-unscoped commands; it leaves other org sessions intact.
+Each deployment and organization has an independent saved CLI session. Name an
+organization with a **ref** — its id, a local alias, or `<remote>:<orgId>` —
+wherever one is accepted:
+
+```sh
+overai --org acme sql TBS123 "select 1"   # one invocation, for scripts and agents
+OVERAI_ORG_ID=acme overai status          # one shell
+overai org switch acme                    # the machine-global default
+overai org alias acme fcps:org_abc        # name an org locally, like a shell alias
+```
+
+A named org selects its own deployment, so two agents can hold two organizations
+at once without changing anything shared. Inside a clone, commands use its
+organization automatically. Precedence is `--org`, then `OVERAI_ORG_ID`, then the
+clone, then the saved default.
+
+If you belong to many organizations, name one every time. The saved default is
+machine-global, so it is whichever organization some other shell, editor, or
+agent last switched to — and a command that falls back to it reads the wrong
+tenant rather than failing. Give the orgs you work in aliases and pass `--org`:
+
+```sh
+overai org alias acme fcps:org_abc        # once
+overai org alias                          # what you have named
+overai --org acme push                    # every time
+export OVERAI_REQUIRE_EXPLICIT_ORG=1      # make forgetting an error
+```
+
+`OVERAI_REQUIRE_EXPLICIT_ORG=1` refuses to run any command that acts on an
+organization until one is named, whether by `--org`, `OVERAI_ORG_ID`, or the
+clone you are standing in. That includes `clone`, which reaches into an org, and
+bare `signout`, which revokes one — `signout <ref>` and `signout --all` are
+explicit already. `signin`, `whoami`, `org`, `remote`, `best-practices`, `help`,
+`version`, and `update` stay available: the first four are how you find the org
+to name, and the rest touch none.
 
 Missing org sessions are established from an eligible saved CLI login. SSO requires
-browser authorization: run `OVERAI_ORG_ID=<orgId> overai signin`. Ordinary commands
-never launch a browser. `whoami` shows the backend, org, identity, and selection
-source; `org list` also indicates which orgs have saved sessions.
-
-`signout` revokes the effective org’s CLI session. `signout --all` revokes all sessions
-saved by this installation, across backends, without signing out browsers or other
-machines. Failed revocations retain credentials for retry. Clone sync commands reject
-an `OVERAI_ORG_ID` that disagrees with the clone.
+browser authorization, and the prompt names the exact command to run. Ordinary
+commands never launch a browser. `whoami` shows the remote, org, identity, session
+expiry, and what selected them; `org list` covers every remote you're signed into.
+
+`signout [<ref>]` revokes one organization's CLI session. `signout --all` revokes all
+sessions saved by this installation, across remotes, without signing out browsers or
+other machines. Failed revocations retain credentials for retry. Clone sync commands
+reject an override that disagrees with the clone.
+
+## Remotes
+
+A remote is a deployment. `prod` and `local` are built in — they need no
+registration and cannot be removed or renamed. Register others by name:
+
+```sh
+overai remote add acme https://api.acme.overai.com   # --app <url> for a self-hosted webapp
+overai signin acme                                   # or: overai signin https://api.acme.overai.com
+overai signin acme:org_abc                           # straight to one organization
+overai remote list                                   # what you can reach, and where you're signed in
+overai remote remove acme                            # forget it and revoke its sessions
+```
+
+Signing in to a URL registers it as a remote, naming it after its host. A clone
+records the remote it came from, so a workspace folder keeps working against the
+right deployment.
 
 Existing credentials migrate automatically. Credentials for different backends are
 never exchanged between them; custom deployments remember `OVERAI_APP_URL` at signin.

package/dist/{chunk-M2NX2CHG.js → chunk-FTBTDB2B.js}

@@ -1,6 +1,6 @@
 import {
   external_exports
-} from "./chunk-XCJJTK3H.js";
+} from "./chunk-PF6GZFT4.js";
 
 // ../common/src/types/value-type.ts
 var TypeEnum = /* @__PURE__ */ ((TypeEnum2) => {