@quonfig/cli 0.0.24 → 0.0.26

package/dist/commands/login.js

@@ -1,12 +1,12 @@
 import { Flags } from '@oclif/core';
-import { select } from '@inquirer/prompts';
 import { BaseCommand } from '../index.js';
-import { decodeJWT, pollForToken, requestDeviceCode } from '../util/oauth-client.js';
 import { getApiUrl } from '../util/domain-urls.js';
+import { orchestrateMultiOrgLogin } from '../util/login-orchestrator.js';
+import { decodeJWT, pollForToken, requestDeviceCode } from '../util/oauth-client.js';
 import { openBrowser } from '../util/open-browser.js';
 import { getAuthConfigFilePath, getTokenFilePath, loadAuthConfig, saveAuthConfig, saveTokens, } from '../util/token-storage.js';
 export default class Login extends BaseCommand {
-    static description = 'Log in to Quonfig via WorkOS device authorization';
+    static description = 'Log in to Quonfig via WorkOS device authorization (mints one token per org)';
     static examples = ['<%= config.bin %> <%= command.id %>', '<%= config.bin %> <%= command.id %> --profile myprofile'];
     static flags = {
         profile: Flags.string({
@@ -28,9 +28,8 @@ export default class Login extends BaseCommand {
         this.log(`\nTo authenticate, visit:\n`);
         this.log(`  ${deviceAuth.verification_uri_complete}\n`);
         this.log(`Or go to ${deviceAuth.verification_uri} and enter code: ${deviceAuth.user_code}\n`);
-        // Listen for Enter to open the URL in the user's browser.
-        // Runs concurrently with token polling so the user can also authenticate
-        // by pasting the URL manually without having to press Enter first.
+        // Listen for Enter to open the URL in the user's browser. Runs alongside
+        // token polling so the user can also paste the URL manually.
         const stdinIsTTY = Boolean(process.stdin.isTTY);
         let browserOpened = false;
         const onEnter = (chunk) => {
@@ -59,95 +58,71 @@ export default class Login extends BaseCommand {
                 process.stdin.pause();
             }
         }
-        const user = tokenResponse.user;
-        const userEmail = user.email;
-        // Decode JWT to inspect claims
         if (this.isVerbose) {
             const payload = decodeJWT(tokenResponse.access_token);
             this.verboseLog('\n=== Decoded JWT Payload ===');
             this.verboseLog(JSON.stringify(payload, null, 2));
             this.verboseLog('===========================\n');
         }
-        // Extract org_id from JWT (WorkOS scopes the token to the selected org)
-        const jwtPayload = decodeJWT(tokenResponse.access_token);
-        const orgId = jwtPayload.org_id || user.organization_id;
-        // Use the JWT's actual exp claim for expiry
-        let expiresAt = Date.now() + 300 * 1000; // fallback: 5 minutes
-        if (typeof jwtPayload.exp === 'number') {
-            expiresAt = jwtPayload.exp * 1000;
+        // Step 4: Multi-org orchestration — fetch /me/organizations, mint one
+        // org-scoped TokenSet per org in parallel, build the per-org TokenStore.
+        const apiUrl = getApiUrl();
+        let result;
+        try {
+            result = await orchestrateMultiOrgLogin({
+                apiUrl,
+                initialAccessToken: tokenResponse.access_token,
+                initialRefreshToken: tokenResponse.refresh_token,
+                user: tokenResponse.user,
+            });
+        }
+        catch (error) {
+            return this.err(`Login failed: ${error.message}`);
+        }
+        if (result.skippedOrgSlugs.length > 0) {
+            this.log(`\nNote: you belong to ${result.organizations.length} orgs; minting tokens for the first 10 alphabetically. ` +
+                `Skipped: ${result.skippedOrgSlugs.join(', ')}.`);
         }
-        // Save tokens — verifies the file actually persisted before returning.
+        // Step 5: Persist token store.
         this.verboseLog('Saving tokens to', getTokenFilePath());
         let tokensPath;
         try {
-            tokensPath = await saveTokens({
-                accessToken: tokenResponse.access_token,
-                expiresAt,
-                refreshToken: tokenResponse.refresh_token,
-                userEmail,
-                userId: user.id,
-            });
+            tokensPath = await saveTokens(result.tokenStore);
         }
         catch (error) {
             return this.err(`Login failed: could not save tokens. ${error.message}`);
         }
         this.verboseLog('Tokens saved at', tokensPath);
-        // Resolve org_id → workspace UUID via the API
-        let workspaceId;
-        let workspaceName;
-        let workspaceSlug;
-        let organizationName;
-        let organizationId;
-        let multipleWorkspacesAvailable = false;
+        // Step 6: Pick a default workspace from the default org for the saved
+        // profile. The default org is the only one for single-org users, or the
+        // first slug alphabetically for multi-org users (no interactive prompt).
+        let defaultWorkspace;
         try {
-            const apiUrl = getApiUrl();
-            this.verboseLog('Resolving workspace...', { apiUrl, orgId });
+            const defaultToken = result.tokenStore.tokensByOrg[result.defaultOrgId];
             const res = await fetch(`${apiUrl}/api/v1/userWorkspaces/list`, {
-                method: 'POST',
+                body: JSON.stringify({ json: {} }),
                 headers: {
-                    Authorization: `Bearer ${tokenResponse.access_token}`,
+                    Authorization: `Bearer ${defaultToken.access_token}`,
                     'Content-Type': 'application/json',
                 },
-                body: JSON.stringify({ json: {} }),
+                method: 'POST',
             });
             if (res.ok) {
                 const body = (await res.json());
-                const allWorkspaces = (body.json ?? body);
-                const candidates = Array.isArray(allWorkspaces) ? allWorkspaces : [];
-                multipleWorkspacesAvailable = candidates.length > 1;
-                let match;
-                if (candidates.length === 1) {
-                    match = candidates[0];
-                }
-                else if (candidates.length > 1) {
-                    const chosen = await select({
-                        choices: candidates.map((w) => ({
-                            name: `${w.organizationName} / ${w.workspaceSlug}`,
-                            value: w.workspaceId,
-                        })),
-                        message: 'Select workspace:',
-                    });
-                    match = candidates.find((w) => w.workspaceId === chosen);
-                }
-                if (match) {
-                    workspaceId = match.workspaceId;
-                    workspaceName = match.workspaceSlug;
-                    workspaceSlug = match.workspaceSlug;
-                    organizationName = match.organizationName;
-                    organizationId = match.workosOrgId;
-                    this.verboseLog('Resolved workspace', { workspaceId, workspaceName, workspaceSlug, organizationName });
-                }
+                const list = (body.json ?? body);
+                const candidates = (Array.isArray(list) ? list : []).filter((w) => w.workosOrgId === result.defaultOrgId);
+                candidates.sort((a, b) => a.workspaceSlug.localeCompare(b.workspaceSlug));
+                defaultWorkspace = candidates[0];
             }
             else {
-                this.verboseLog('Failed to resolve workspace', { status: res.status });
+                this.verboseLog('userWorkspaces/list non-OK', { status: res.status });
             }
         }
         catch (error) {
-            this.verboseLog('Failed to resolve workspace', { error: String(error) });
+            this.verboseLog('userWorkspaces/list failed', { error: String(error) });
         }
-        // Get or create config with profile
+        // Step 7: Save auth config with the picked workspace.
         const existingConfig = await loadAuthConfig();
-        // Save auth config
         const isFirstProfile = !existingConfig || Object.keys(existingConfig.profiles).length === 0;
         const shouldSetDefault = isFirstProfile || profileName === 'default' || !existingConfig?.defaultProfile;
         this.verboseLog('Saving auth config to', getAuthConfigFilePath());
@@ -158,10 +133,12 @@ export default class Login extends BaseCommand {
                 profiles: {
                     ...existingConfig?.profiles,
                     [profileName]: {
-                        workspace: workspaceId || orgId || 'unknown',
-                        workspaceName: workspaceName || (orgId ? `org:${orgId}` : undefined),
-                        workspaceSlug,
-                        organizationName,
+                        organizationName: result.defaultOrg.name,
+                        organizationSlug: result.defaultOrg.slug,
+                        workosOrgId: result.defaultOrgId,
+                        workspace: defaultWorkspace?.workspaceId ?? result.defaultOrgId,
+                        workspaceName: defaultWorkspace?.workspaceSlug,
+                        workspaceSlug: defaultWorkspace?.workspaceSlug,
                     },
                 },
             });
@@ -170,34 +147,38 @@ export default class Login extends BaseCommand {
             return this.err(`Login failed: could not save auth config. ${error.message}`);
         }
         this.verboseLog('Auth config saved at', configPath);
+        // Step 8: User-facing summary.
         this.log('\nSuccessfully logged in!');
-        if (userEmail) {
-            this.log(`Logged in as: ${userEmail}`);
-        }
-        if (workspaceName) {
-            const orgPrefix = organizationName ? `${organizationName} / ` : '';
-            this.log(`Workspace:    ${orgPrefix}${workspaceName}`);
-            if (workspaceId) {
-                this.log(`              (${workspaceId})`);
+        if (result.email)
+            this.log(`Logged in as: ${result.email}`);
+        this.log(`Tokens stored for orgs: ${result.mintedOrgSlugs.join(', ')}`);
+        if (defaultWorkspace) {
+            const pin = `${result.defaultOrg.slug}/${defaultWorkspace.workspaceSlug}`;
+            this.log(`Default workspace: ${pin}  (${defaultWorkspace.workspaceId})`);
+            this.log(`\nTo pin a project to this workspace, add to your .env:`);
+            this.log(`  QUONFIG_WORKSPACE=${pin}`);
+            if (result.organizations.length > 1) {
+                this.log(`\nYou belong to multiple orgs. To switch: qfg workspace switch`);
             }
         }
-        else if (orgId) {
-            this.log(`Organization: ${orgId}`);
-        }
-        if (multipleWorkspacesAvailable && workspaceSlug) {
-            this.log(`\nYou have multiple workspaces. To pin this project to ${workspaceSlug},`);
-            this.log(`add this to your project's .env file:`);
-            this.log(`  QUONFIG_WORKSPACE=${workspaceSlug}`);
-            this.log(`\nTo switch your default workspace: qfg workspace switch`);
+        else {
+            this.log(`\nNo workspaces found in ${result.defaultOrg.slug}. Create one with: qfg workspace create <slug> --org ${result.defaultOrg.slug}`);
         }
         return {
-            email: userEmail,
-            organizationId: organizationId || orgId,
-            organizationName,
+            defaultOrg: {
+                organizationName: result.defaultOrg.name,
+                organizationSlug: result.defaultOrg.slug,
+                workosOrgId: result.defaultOrgId,
+            },
+            email: result.email,
+            mintedOrgSlugs: result.mintedOrgSlugs,
+            organizationId: result.defaultOrgId,
+            organizationName: result.defaultOrg.name,
+            skippedOrgSlugs: result.skippedOrgSlugs,
             success: true,
-            userId: user.id,
-            workspaceId,
-            workspaceSlug,
+            userId: result.userId,
+            workspaceId: defaultWorkspace?.workspaceId,
+            workspaceSlug: defaultWorkspace?.workspaceSlug,
         };
     }
 }

package/dist/commands/migrate/doctor.js

@@ -4,10 +4,20 @@ import { formatHumanReport, runDoctor } from '../../migrate/doctor.js';
 import { loadTokens } from '../../util/token-storage.js';
 const SUPPORTED_SOURCES = new Set(['launch']);
 const defaultLoadSession = async () => {
-    const tokens = await loadTokens();
-    if (!tokens?.accessToken)
+    // TODO(qfg-kr7.5): pick the token set keyed by the resolved workosOrgId.
+    let store;
+    try {
+        store = await loadTokens();
+    }
+    catch {
+        // Legacy on-disk shape (pre-qfg-kr7.3) — treat as "not logged in" so the
+        // doctor can tell the user to re-run `qfg login` rather than crashing.
+        return null;
+    }
+    const tokens = store ? Object.values(store.tokensByOrg)[0] : undefined;
+    if (!tokens?.access_token)
         return null;
-    return { expiresAt: tokens.expiresAt ?? 0 };
+    return { expiresAt: tokens.expires_at ?? 0 };
 };
 export default class MigrateDoctor extends BaseCommand {
     static description = 'Preflight health checks for `qfg migrate`. Verifies auth, workspace provisioning, working tree, and identifier collisions.';

package/dist/commands/override.js

@@ -97,8 +97,10 @@ Examples
     };
     async run() {
         const { args, flags } = await this.parse(Override);
-        const tokens = await loadTokens();
-        const userEmail = tokens?.userEmail;
+        // TODO(qfg-kr7.5): pick the token set keyed by the resolved workosOrgId.
+        const store = await loadTokens();
+        const tokens = store ? Object.values(store.tokensByOrg)[0] : undefined;
+        const userEmail = tokens?.user_email;
         if (!userEmail) {
             return this.err('Not logged in. Run `qfg login` first.');
         }

package/dist/commands/pull.d.ts

@@ -21,6 +21,17 @@ export default class Pull extends BaseCommand {
      * This never throws — a broken `quonfig.json` shouldn't fail `qfg pull`.
      */
     private backfillWorkspacePin;
+    /**
+     * Commit the freshly-written pin if `dir` is a git repo. Only commits
+     * when `quonfig.json` is the only thing dirty in the working tree —
+     * we don't want to sweep up the user's unrelated work-in-progress
+     * (untracked files are fine; tracked modifications are not).
+     *
+     * Skips silently when not in a git repo, when other tracked files are
+     * dirty, or when git itself errors. Pull already succeeded; this is
+     * cleanup that the next push can also do (qfg-0fn).
+     */
+    private commitPinIfRepo;
     private looksLike401;
     private maybeWriteQuonfigDir;
     private refreshAndGetUrl;

package/dist/commands/pull.js

@@ -4,9 +4,9 @@ import { Flags } from '@oclif/core';
 import { BaseCommand } from '../index.js';
 import { loadGiteaToken, isGiteaTokenExpired, saveGiteaToken } from '../util/gitea-token-storage.js';
 import { mintAndStoreGiteaReadToken, mintGiteaToken } from '../util/gitea-api.js';
-import { readWorkspaceSlug, writeWorkspaceSlug } from '../util/quonfig-json.js';
+import { readWorkspaceSlug, tryParseWorkspacePin, writeWorkspaceSlug } from '../util/quonfig-json.js';
 import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
-import { isGitRepo, getRemoteUrl, gitFetch, gitSetRemote, canFastForward, hasDivergedFromRemote, gitMergeFfOnly, gitClone, displayUrl, } from '../util/git-ops.js';
+import { isGitRepo, getRemoteUrl, gitFetch, gitSetRemote, canFastForward, hasDivergedFromRemote, gitMergeFfOnly, gitClone, displayUrl, addAndCommitFile, dirtyTrackedFiles, } from '../util/git-ops.js';
 export default class Pull extends BaseCommand {
     static description = `Clone or update a local copy of your workspace config files.
 
@@ -87,20 +87,22 @@ CLI shortcuts (no JSON editing needed for simple cases):
             if (diverged) {
                 return this.err('Local commits diverge from remote — resolve manually.');
             }
-            if (!ff) {
-                this.log('Already up to date.');
-                return { dir: resolvedDir, newCommits: [], workspaceId };
-            }
-            // Merge
-            const newCommits = await gitMergeFfOnly(resolvedDir);
-            if (newCommits.length > 0) {
-                this.log(`Pulled ${newCommits.length} new commit(s):`);
-                for (const msg of newCommits) {
-                    this.log(`  - ${msg}`);
+            if (ff) {
+                const newCommits = await gitMergeFfOnly(resolvedDir);
+                if (newCommits.length > 0) {
+                    this.log(`Pulled ${newCommits.length} new commit(s):`);
+                    for (const msg of newCommits) {
+                        this.log(`  - ${msg}`);
+                    }
+                }
+                else {
+                    this.log('Updated successfully.');
                 }
             }
             else {
-                this.log('Updated successfully.');
+                this.log('Already up to date.');
+                // Don't early-return: we still want to run the post-pull work
+                // below (QUONFIG_DIR write, workspace pin backfill+commit).
             }
         }
         else {
@@ -125,9 +127,10 @@ CLI shortcuts (no JSON editing needed for simple cases):
         // Write QUONFIG_DIR to ~/.quonfig/config if not set
         await this.maybeWriteQuonfigDir(resolvedDir);
         // Backfill the `workspace` pin in `quonfig.json` if missing
-        // (Guard 1 in project/plans/cli-git-sync.md). Local-only write — we
-        // intentionally do NOT commit or push here; the user's next `qfg push`
-        // will sweep it up naturally.
+        // (Guard 1 in project/plans/cli-git-sync.md). When the workspace dir
+        // is a git repo, we also commit the new pin so it's included in the
+        // user's next `qfg push` delta — push diffs HEAD vs origin, so a
+        // working-tree-only write would never reach the server (qfg-0fn).
         await this.backfillWorkspacePin(resolvedDir, tokenEntry, workspaceId);
         return { dir: resolvedDir, workspaceId };
     }
@@ -161,16 +164,31 @@ CLI shortcuts (no JSON editing needed for simple cases):
             this.verboseLog('Pull', 'Backend did not return a workspaceSlug; skipping pin backfill.');
             return;
         }
+        // The pin is stored as `<org-slug>/<workspace-slug>`. The backend's
+        // `workspaceSlug` is just the workspace component today; until the
+        // server learns to return the org slug, we can only backfill / compare
+        // when the backend response itself already carries the slash form
+        // (e.g. when later beads in this epic update the API). Otherwise,
+        // skip with a verbose log — pull itself already succeeded.
+        const backendPin = tryParseWorkspacePin(backendSlug);
+        if (!backendPin) {
+            this.verboseLog('Pull', `Backend workspaceSlug "${backendSlug}" is not in <org>/<ws> form; skipping pin backfill.`);
+            return;
+        }
         try {
             const existingPin = await readWorkspaceSlug(dir);
             if (!existingPin) {
-                await writeWorkspaceSlug(dir, backendSlug);
-                this.verboseLog('Pull', `Backfilled workspace pin "${backendSlug}" into quonfig.json.`);
+                await writeWorkspaceSlug(dir, backendPin);
+                const formatted = `${backendPin.orgSlug}/${backendPin.workspaceSlug}`;
+                this.verboseLog('Pull', `Backfilled workspace pin "${formatted}" into quonfig.json.`);
+                await this.commitPinIfRepo(dir, formatted);
                 return;
             }
-            if (existingPin !== backendSlug) {
+            if (existingPin.orgSlug !== backendPin.orgSlug || existingPin.workspaceSlug !== backendPin.workspaceSlug) {
+                const existingFormatted = `${existingPin.orgSlug}/${existingPin.workspaceSlug}`;
+                const backendFormatted = `${backendPin.orgSlug}/${backendPin.workspaceSlug}`;
                 this.log('');
-                this.log(`Warning: quonfig.json pins workspace "${existingPin}", but the backend says this workspace is "${backendSlug}".`);
+                this.log(`Warning: quonfig.json pins workspace "${existingFormatted}", but the backend says this workspace is "${backendFormatted}".`);
                 this.log('Leaving the existing pin in place. Run `qfg push` to see the full identity check.');
             }
         }
@@ -179,6 +197,35 @@ CLI shortcuts (no JSON editing needed for simple cases):
             this.verboseLog('Pull', `Could not backfill workspace pin: ${String(error)}`);
         }
     }
+    /**
+     * Commit the freshly-written pin if `dir` is a git repo. Only commits
+     * when `quonfig.json` is the only thing dirty in the working tree —
+     * we don't want to sweep up the user's unrelated work-in-progress
+     * (untracked files are fine; tracked modifications are not).
+     *
+     * Skips silently when not in a git repo, when other tracked files are
+     * dirty, or when git itself errors. Pull already succeeded; this is
+     * cleanup that the next push can also do (qfg-0fn).
+     */
+    async commitPinIfRepo(dir, slug) {
+        try {
+            if (!(await isGitRepo(dir)))
+                return;
+            const dirty = await dirtyTrackedFiles(dir);
+            const otherDirty = dirty.filter((p) => p !== 'quonfig.json');
+            if (otherDirty.length > 0) {
+                this.verboseLog('Pull', `Other tracked files dirty (${otherDirty.join(', ')}); skipping pin commit.`);
+                return;
+            }
+            const committed = await addAndCommitFile(dir, 'quonfig.json', `qfg: pin workspace = ${slug}`);
+            if (committed) {
+                this.log(`Committed workspace pin "${slug}" to quonfig.json.`);
+            }
+        }
+        catch (error) {
+            this.verboseLog('Pull', `Could not commit workspace pin: ${String(error)}`);
+        }
+    }
     looksLike401(err) {
         const msg = err instanceof Error ? err.message : String(err);
         return msg.includes('401') || msg.toLowerCase().includes('authentication failed');

package/dist/commands/push.js

@@ -1,16 +1,13 @@
-import { execFile as execFileCb } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as util from 'node:util';
 import { Flags } from '@oclif/core';
 import { BaseCommand } from '../index.js';
 import { mintGiteaToken } from '../util/gitea-api.js';
-import { getRemoteUrl, gitFetch, gitSetRemote, isGitRepo } from '../util/git-ops.js';
+import { getRemoteUrl, gitFetch, gitSetRemote, isGitRepo, runGit } from '../util/git-ops.js';
 import { PushFatalError, runPush, } from '../push/run-push.js';
 import { computeBarePathDiff } from '../push/bare-path-diff.js';
 import { callConfigsPush } from '../push/config-push-client.js';
 import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
-const execFile = util.promisify(execFileCb);
 export default class Push extends BaseCommand {
     static description = `Push local config changes up to your workspace on Quonfig cloud.
 
@@ -252,7 +249,7 @@ export function buildRealDeps(cmd) {
  * baseline — i.e. origin/main..HEAD.
  */
 async function diffHeadVsOrigin(dir) {
-    const { stdout } = await execFile('git', ['-C', dir, 'diff', '--name-status', 'origin/main..HEAD']);
+    const { stdout } = await runGit(['-C', dir, 'diff', '--name-status', 'origin/main..HEAD']);
     const deltas = [];
     for (const raw of stdout.split('\n')) {
         const line = raw.trim();
@@ -289,7 +286,7 @@ async function diffHeadVsOrigin(dir) {
 }
 async function showAtRef(dir, ref, relPath) {
     try {
-        const { stdout } = await execFile('git', ['-C', dir, 'show', `${ref}:${relPath}`]);
+        const { stdout } = await runGit(['-C', dir, 'show', `${ref}:${relPath}`]);
         return stdout;
     }
     catch {
@@ -306,7 +303,7 @@ async function readWorkingTreeFile(dir, relPath) {
 }
 async function countTrackedFilesAtRef(dir, ref) {
     try {
-        const { stdout } = await execFile('git', ['-C', dir, 'ls-tree', '-r', '--name-only', ref]);
+        const { stdout } = await runGit(['-C', dir, 'ls-tree', '-r', '--name-only', ref]);
         return stdout.split('\n').filter((l) => l.trim().length > 0).length;
     }
     catch {

package/dist/commands/whoami.d.ts

@@ -4,4 +4,17 @@ export default class Whoami extends BaseCommand {
     static description: string;
     static examples: string[];
     run(): Promise<JsonObj | void>;
+    /**
+     * Pick the "active" org for display. Order:
+     *   1. QUONFIG_WORKSPACE in `org/ws` form → look up org by slug in the store.
+     *   2. The token store's defaultOrgId, if it points at an entry we have.
+     *   3. The first token entry — gives a stable marker rather than nothing.
+     */
+    private resolveActiveOrgId;
+    /**
+     * Best-effort fetch of `me.organizations` for role enrichment. Failure
+     * (network, unauthenticated) is non-fatal — whoami still works from the
+     * local store, just without role labels.
+     */
+    private fetchOrganizations;
 }