@overaihq/cli 0.14.0 → 0.14.2

package/README.md

@@ -85,6 +85,26 @@ at once without changing anything shared. Inside a clone, commands use its
 organization automatically. Precedence is `--org`, then `OVERAI_ORG_ID`, then the
 clone, then the saved default.
 
+If you belong to many organizations, name one every time. The saved default is
+machine-global, so it is whichever organization some other shell, editor, or
+agent last switched to — and a command that falls back to it reads the wrong
+tenant rather than failing. Give the orgs you work in aliases and pass `--org`:
+
+```sh
+overai org alias acme fcps:org_abc        # once
+overai org alias                          # what you have named
+overai --org acme push                    # every time
+export OVERAI_REQUIRE_EXPLICIT_ORG=1      # make forgetting an error
+```
+
+`OVERAI_REQUIRE_EXPLICIT_ORG=1` refuses to run any command that acts on an
+organization until one is named, whether by `--org`, `OVERAI_ORG_ID`, or the
+clone you are standing in. That includes `clone`, which reaches into an org, and
+bare `signout`, which revokes one — `signout <ref>` and `signout --all` are
+explicit already. `signin`, `whoami`, `org`, `remote`, `best-practices`, `help`,
+`version`, and `update` stay available: the first four are how you find the org
+to name, and the rest touch none.
+
 Missing org sessions are established from an eligible saved CLI login. SSO requires
 browser authorization, and the prompt names the exact command to run. Ordinary
 commands never launch a browser. `whoami` shows the remote, org, identity, session

package/dist/index.js

@@ -26665,6 +26665,7 @@ var leadingFlag = (name2) => {
   return void 0;
 };
 var LEADING_FLAGS = ["--org"];
+var requireExplicitOrg = process.env.OVERAI_REQUIRE_EXPLICIT_ORG === "1";
 var orgRefOverride = leadingFlag("--org") ?? (process.env.OVERAI_ORG_ID != null && process.env.OVERAI_ORG_ID !== "" ? process.env.OVERAI_ORG_ID : void 0);
 var orgRefSource = leadingFlag("--org") != null ? "--org" : orgRefOverride != null ? "OVERAI_ORG_ID" : void 0;
 var appBaseUrl = (backend) => {
@@ -26918,11 +26919,12 @@ var scopedOrgId = () => {
     return null;
   }
 };
+var orgScopeSource = () => orgOverride()?.source ?? (orgScopeOverride != null ? ".overai/manifest.json" : "saved default");
 var announceOrgScope = () => {
   const org = scopedOrgId();
   if (org == null) return;
   process.stderr.write(
-    `Using org ${org} on ${remoteName(apiBaseUrl())} (${orgOverride()?.source ?? (orgScopeOverride != null ? ".overai/manifest.json" : "saved default")}).
+    `Using org ${org} on ${remoteName(apiBaseUrl())} (${orgScopeSource()}).
 `
   );
 };
@@ -27131,7 +27133,7 @@ var v2Error = (label, res, rawBody) => {
   const claimed = (typeof field === "string" ? field : rawBody).trim().slice(0, 500);
   const reason = claimed.length === 0 || claimed === "Error" || claimed === "null" || claimed === "undefined" || claimed.toLowerCase() === STATUS_TEXT[res.status]?.toLowerCase() ? null : claimed;
   const orgHint = res.status === 404 || res.status === 403 ? `
-  If it lives in another org, prefix the command with OVERAI_ORG_ID=<orgId> (\`overai org list\` shows them).` : "";
+  If it lives in another org, name that org: overai --org <ref> ... (\`overai org list\` shows them, \`overai org alias\` your shorthands).` : "";
   if (reason != null) return new Error(`${reason}${orgHint}`);
   const path = (() => {
     try {
@@ -27571,6 +27573,10 @@ var signOut = async (all = false, target) => {
       setOrgScope(manifest.organizationId);
     }
   }
+  if (requireExplicitOrg && !all && orgScopeSource() === "saved default")
+    throw new Error(
+      "OVERAI_REQUIRE_EXPLICIT_ORG is set and nothing named an org to sign out of. Name one: overai signout <ref>, or revoke every saved session with: overai signout --all"
+    );
   const baseUrl = apiBaseUrl();
   const orgId = scopedOrgId();
   await withStoreLock(async (store) => {
@@ -27808,7 +27814,7 @@ var runAutomation = async (args) => {
 // src/workspace/validateElements.ts
 var findings = (parsed) => parsed.success ? [] : parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`);
 var validateAutomationElements = async (elements) => {
-  const { automationNodesSchema } = await import("./types-3BS55ING.js");
+  const { automationNodesSchema } = await import("./types-7JF7GZMJ.js");
   return findings(automationNodesSchema.safeParse(elements));
 };
 var validateWebPageConfig = async (config) => {
@@ -35348,6 +35354,7 @@ var generateRandomVariableName = customAlphabet(
 
 // ../common/src/ids.ts
 var ID_PREFIXES = {
+  action: { prefix: "act", body: 20 },
   action_runner: { prefix: "ar", body: 10 },
   action_runner_email_alert: { prefix: "area", body: 10 },
   action_runner_email_subscription: { prefix: "ares", body: 10 },
@@ -36589,7 +36596,11 @@ Organization context: Commands in a clone select its org automatically. Outside
 put --org <ref> before the command (overai --org acme sql ...), or set OVERAI_ORG_ID for a
 whole shell. A ref is an org id, a local alias, or <remote>:<orgId>, and a named org
 selects its own deployment \u2014 never switch the machine-global default to reach another org,
-because every other session on the machine shares it. Each remote/org has an independent
+because every other session on the machine shares it. Prefer naming the org on every
+command rather than relying on the saved default: the default is whatever another session
+last switched to, so falling back to it reads the wrong tenant instead of failing.
+OVERAI_REQUIRE_EXPLICIT_ORG=1 turns that fallback into an error for every command
+that acts on an org. Each remote/org has an independent
 saved session. Use whoami to inspect the effective scope. If browser authorization is
 required, ask the user to run the suggested signin command. Never change org to work
 around a clone-sync mismatch; use the correct workspace folder.
@@ -37343,6 +37354,102 @@ var runSql = async (args) => {
   }
 };
 
+// src/commands/storage.ts
+import { openAsBlob, writeFileSync as writeFileSync6 } from "fs";
+var USAGE3 = "Usage: overai storage upload <path> [--no-random-prefix] | storage download <key> [path|-] | storage exists <key> | storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]";
+var runStorage = async (args) => {
+  const [operation, first2, second] = args;
+  if (operation == null) throw new Error(USAGE3);
+  const { organizationId } = await getAccessToken();
+  const segment = (key) => encodeURIComponent(key);
+  if (operation === "upload") {
+    if (first2 == null || first2 === "-") {
+      throw new Error("Upload requires a file path (stdin uploads need a filename to build the key).");
+    }
+    const randomPrefix = !args.includes("--no-random-prefix");
+    const query = randomPrefix ? "" : "?disableRandomPrefix=true";
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/stream${query}`,
+      {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/octet-stream",
+          "x-file-name": first2.split("/").pop() ?? first2
+        },
+        body: await openAsBlob(first2)
+      }
+    );
+    if (!response.ok) {
+      throw v2Error("storage upload", response, await response.text());
+    }
+    const { path } = await response.json();
+    const key = path.startsWith(`${organizationId}/`) ? path.slice(organizationId.length + 1) : path;
+    const format2 = resolveFormat(flagValue(args, "-o", "--output"));
+    if (format2 === "json") printResult({ key, path }, format2);
+    else process.stdout.write(`${key}
+`);
+    return;
+  }
+  if (first2 == null) throw new Error(USAGE3);
+  if (operation === "download") {
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}`,
+      { redirect: "follow" }
+    );
+    if (!response.ok) {
+      throw v2Error("storage download", response, await response.text());
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    if (second != null && second !== "-") writeFileSync6(second, bytes);
+    else process.stdout.write(bytes);
+    return;
+  }
+  if (operation === "exists") {
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}/exists`
+    );
+    if (response.status === 404) {
+      if (resolveFormat(flagValue(args, "-o", "--output")) === "json") {
+        printResult({ exists: false }, "json");
+      }
+      process.exitCode = 1;
+      return;
+    }
+    if (!response.ok) {
+      throw v2Error("storage exists", response, await response.text());
+    }
+    printResult(
+      { exists: true, ...await response.json() },
+      resolveFormat(flagValue(args, "-o", "--output"))
+    );
+    return;
+  }
+  if (operation === "head") {
+    const lines = flagValue(args, "--lines") ?? "50";
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}/head?numLines=${encodeURIComponent(lines)}`
+    );
+    if (!response.ok) {
+      throw v2Error("storage head", response, await response.text());
+    }
+    process.stdout.write(await response.text());
+    return;
+  }
+  if (operation === "presign") {
+    const expiresIn2 = flagValue(args, "--expires-in") ?? String(60 * 60 * 24 * 7);
+    const response = await v2Fetch(
+      `/v2/storage/${organizationId}/${segment(first2)}/presign?expiresIn=${encodeURIComponent(expiresIn2)}`
+    );
+    if (!response.ok) {
+      throw v2Error("storage presign", response, await response.text());
+    }
+    process.stdout.write(`${(await response.text()).trim()}
+`);
+    return;
+  }
+  throw new Error(USAGE3);
+};
+
 // src/commands/workspace.ts
 var workspaceIdFrom = (args) => args.find(
   (arg, index) => !arg.startsWith("-") && args[index - 1] !== "-o" && args[index - 1] !== "--output"
@@ -37426,7 +37533,7 @@ var listWorkspaceUsers = async (args) => {
     resolveFormat(flagValue(args, "-o", "--output"))
   );
 };
-var USAGE3 = `Usage:
+var USAGE4 = `Usage:
   overai workspace list [--archived] [--limit <n>]
   overai workspace show [workspaceId]
   overai workspace users [workspaceId]
@@ -37444,7 +37551,7 @@ var runWorkspace = async (args) => {
     await listWorkspaceUsers(args.slice(1));
     return;
   }
-  process.stderr.write(USAGE3);
+  process.stderr.write(USAGE4);
   process.exitCode = 1;
 };
 
@@ -37606,6 +37713,9 @@ Other resources:
   overai data-stream query <id> --start <date> --end <date> [--query <filter>]
   overai data-file upload <id> <path> [-m <message>]
   overai data-file download <id> [path|-] | data-file head <id>
+  overai storage upload <path> [--no-random-prefix]
+  overai storage download <key> [path|-] | storage exists <key>
+  overai storage head <key> [--lines N] | storage presign <key> [--expires-in <seconds>]
   overai knowledge-base upload <id> <file...>
   overai knowledge-base search <id> <query> [--limit N]
   overai integration configure <id> --config <json|@file|@->
@@ -37644,6 +37754,9 @@ Output: table on a TTY, JSON when piped; -o json|table|csv to force.
 Aliases: login = signin, logout = signout, ws = workspace.
 Env: OVERAI_API_URL, OVERAI_APP_URL override the target deployment.
      OVERAI_ORG_ID overrides the organization for this shell.
+     OVERAI_REQUIRE_EXPLICIT_ORG=1 refuses to fall back to the saved default
+     org, so every command that acts on one must name it with --org or stand in
+     a clone.
 Global flags (before the command): --org <ref>
 `;
 process.stdout.on("error", (error) => {
@@ -37668,6 +37781,24 @@ var ORG_AGNOSTIC_COMMANDS = /* @__PURE__ */ new Set([
   "--help",
   "-h"
 ]);
+var ORG_OPTIONAL_COMMANDS = /* @__PURE__ */ new Set([
+  "signin",
+  "login",
+  "signout",
+  "logout",
+  "whoami",
+  "org",
+  "remote",
+  "best-practices",
+  "update",
+  "upgrade",
+  "version",
+  "--version",
+  "-v",
+  "help",
+  "--help",
+  "-h"
+]);
 var SKIP_UPDATE_CHECK = /* @__PURE__ */ new Set([
   void 0,
   "update",
@@ -37696,10 +37827,13 @@ var run = async () => {
     throw new Error(
       `${misplaced} goes before the command: overai ${misplaced} <ref> ${command2 ?? "<command>"} ...`
     );
-  if (command2 != null && !ORG_AGNOSTIC_COMMANDS.has(command2)) {
-    pinOrgFromClone();
-    announceOrgScope();
-  }
+  const orgFromFolder = command2 != null && !ORG_AGNOSTIC_COMMANDS.has(command2);
+  if (orgFromFolder) pinOrgFromClone();
+  if (requireExplicitOrg && command2 != null && !ORG_OPTIONAL_COMMANDS.has(command2) && orgScopeSource() === "saved default")
+    throw new Error(
+      `OVERAI_REQUIRE_EXPLICIT_ORG is set and nothing named an org for "${command2}". Put --org <ref> before the command, or run it inside a clone. See your shorthands with: overai org alias`
+    );
+  if (orgFromFolder) announceOrgScope();
   if (rest.includes("--recursive")) {
     if (command2 !== "status" && command2 !== "diff" && command2 !== "pull" && command2 !== "push")
       throw new Error(
@@ -37827,6 +37961,9 @@ var run = async () => {
     case "data-file":
       await runDataFile(rest);
       return;
+    case "storage":
+      await runStorage(rest);
+      return;
     case "integration":
       await runIntegration(rest);
       return;

package/dist/{types-3BS55ING.js → types-7JF7GZMJ.js}

@@ -643,31 +643,6 @@ var automationStateSchema = external_exports.record(
   external_exports.string(),
   automationNodeStateSchema
 );
-var automationNodePathSchema = external_exports.tuple([
-  external_exports.array(
-    external_exports.tuple([
-      external_exports.string().describe("The variableId of the loop node"),
-      external_exports.number().min(0).describe("The iteration number of the loop node")
-    ])
-  ).describe(
-    "An array of loop variableIds and iterations, ordered from outermost to innermost"
-  ),
-  external_exports.string().describe(
-    "The variableId of the terminal (innermost) node in the automation"
-  )
-]);
-var emptyAutomationNodePath = [[], ""];
-var addAutomationNodePathLoop = (currentPath, iteration) => {
-  const result = [
-    [...currentPath[0], [currentPath[1], iteration]],
-    ""
-  ];
-  return result;
-};
-var setAutomationNodePathTerminal = (currentPath, node) => {
-  const result = [[...currentPath[0]], node];
-  return result;
-};
 var runStepPayloadSchema = external_exports.object({
   runId: external_exports.string(),
   automationId: external_exports.string(),
@@ -679,16 +654,13 @@ export {
   MacAddressComparatorOptions,
   NodeEnum,
   ServiceEnum,
-  addAutomationNodePathLoop,
   automationFileTypesSchema,
-  automationNodePathSchema,
   automationNodeSchema,
   automationNodeStateSchema,
   automationNodesSchema,
   automationStateSchema,
   conditionalNodeTypeIds,
   doesNodeRequireExecutionContext,
-  emptyAutomationNodePath,
   httpMethodSchema,
   integrationHttpActionEditableSchema,
   integrationHttpActionOutputs,
@@ -701,7 +673,6 @@ export {
   jsonStringSchema,
   monthsSchema,
   runStepPayloadSchema,
-  setAutomationNodePathTerminal,
   timeZoneOffset,
   timeZonesSchema,
   transformationSchema,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overaihq/cli",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Create, edit, deploy, and run OverAI workspace resources from the command line",
   "type": "module",
   "homepage": "https://overai.com",
@@ -21,12 +21,12 @@
   },
   "devDependencies": {
     "@perygee/common": "0.0.0",
-    "@types/node": "^24.13.3",
+    "@types/node": "^24.13.5",
     "@types/proper-lockfile": "^4.1.4",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
-    "zod": "^4.5.4"
+    "zod": "^4.6.5"
   },
   "dependencies": {
     "proper-lockfile": "^4.1.2"