@quonfig/cli 0.0.25 → 0.0.26

package/dist/util/get-client.js

@@ -1,9 +1,12 @@
 import { Client } from '@quonfig/node';
 import { getApiUrl } from '../util/domain-urls.js';
 import jsonMaybe from '../util/json-maybe.js';
-import { getActiveProfile, loadAuthConfig, loadTokens, resolveWorkspaceId } from '../util/token-storage.js';
-import { getValidAccessToken } from '../util/get-valid-token.js';
+import { tryParseWorkspacePin } from '../util/quonfig-json.js';
+import { findOrgIdBySlug, getActiveProfile, loadAuthConfig, loadTokens } from '../util/token-storage.js';
+import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
 import version from '../version.js';
+const BARE_SLUG_ENV_MIGRATION_MESSAGE = 'QUONFIG_WORKSPACE must be in org/workspace form (e.g. acme/foo). ' +
+    'Bare workspace slugs are no longer accepted. Update your .env and run `qfg login` if you have not yet migrated.';
 let clientInstance;
 let cachedWorkspaceId;
 export const resetClientCache = () => {
@@ -27,9 +30,9 @@ const getClient = async (command, sdkKey, profile) => {
     }
     else if (apiKey && apiKey.length > 0) {
         // API-key (workspace-scoped bearer) path. getValidAccessToken short-circuits
-        // when QUONFIG_API_KEY is set, so this never touches disk.
+        // when QUONFIG_API_KEY is set, so this never touches disk and orgId is ignored.
         try {
-            jwt = await getValidAccessToken(command.verboseLog);
+            jwt = await getValidAccessToken('', command.verboseLog);
         }
         catch (error) {
             command.error(error instanceof Error ? error.message : String(error), { exit: 1 });
@@ -70,46 +73,75 @@ const getClient = async (command, sdkKey, profile) => {
         }
     }
     else {
-        const authConfig = await loadAuthConfig();
-        const tokens = await loadTokens();
-        command.verboseLog('OAuth auth', {
-            hasAuthConfig: Boolean(authConfig),
-            hasAccessToken: Boolean(tokens?.accessToken),
-        });
-        if (!authConfig || !tokens?.accessToken) {
-            command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
-        }
-        command.verboseLog('Checking token validity...');
-        try {
-            jwt = await getValidAccessToken(command.verboseLog);
-            command.verboseLog('Token valid (or refreshed)');
-        }
-        catch (error) {
-            const detail = error instanceof Error ? error.message : String(error);
-            command.error(`Session expired. Please run \`qfg login\` to re-authenticate. (${detail})`, { exit: 401 });
-        }
-        // Resolve workspace: --workspace/QUONFIG_WORKSPACE (slug) → QUONFIG_PROFILE (profile name) → default
+        // OAuth path: --workspace/QUONFIG_WORKSPACE must be in `org/ws` form so we
+        // can mint the org-scoped JWT for the right org and resolve the workspace
+        // slug *within that org*. No override → use the saved default profile.
         const workspaceSlugOverride = profile ?? process.env.QUONFIG_WORKSPACE;
         const profileNameOverride = process.env.QUONFIG_PROFILE;
+        const store = await loadTokens();
+        if (!store || Object.keys(store.tokensByOrg).length === 0) {
+            command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
+        }
         if (workspaceSlugOverride) {
-            // Try slug resolution first, then fall back to treating it as a profile name
-            const resolved = resolveWorkspaceId(authConfig, workspaceSlugOverride);
-            if (resolved) {
-                workspaceId = resolved;
-                command.verboseLog('Workspace lookup', { source: 'slug', slug: workspaceSlugOverride, workspaceId });
-            }
-            else {
-                const profileData = authConfig.profiles[workspaceSlugOverride];
-                if (profileData) {
-                    workspaceId = profileData.workspace;
-                    command.verboseLog('Workspace lookup', { source: 'profile-name', profile: workspaceSlugOverride, workspaceId });
-                }
-                else {
-                    command.error(`Workspace '${workspaceSlugOverride}' not found. Run \`qfg workspace switch\` to select and save a workspace.`, { exit: 1 });
-                }
+            const pin = tryParseWorkspacePin(workspaceSlugOverride);
+            if (!pin) {
+                command.error(BARE_SLUG_ENV_MIGRATION_MESSAGE, { exit: 1 });
+            }
+            const { orgSlug, workspaceSlug } = pin;
+            const orgId = findOrgIdBySlug(store, orgSlug);
+            if (!orgId) {
+                command.error(`No token found for org \`${orgSlug}\`. Run \`qfg login\` to add this org.`, { exit: 401 });
             }
+            try {
+                jwt = await getValidAccessToken(orgId, command.verboseLog);
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                command.error(`Session expired for org ${orgSlug}: ${detail}. Run \`qfg login\` to re-authenticate.`, {
+                    exit: 401,
+                });
+            }
+            let res;
+            try {
+                res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+                    method: 'POST',
+                    headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ json: {} }),
+                });
+            }
+            catch (error) {
+                command.error(`Failed to resolve workspace "${workspaceSlugOverride}": ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+            }
+            if (!res.ok) {
+                command.error(`Failed to resolve workspace "${workspaceSlugOverride}" (HTTP ${res.status}).`, { exit: 1 });
+            }
+            const body = (await res.json());
+            const entries = (body.json ?? body);
+            const candidates = Array.isArray(entries) ? entries : [];
+            const match = candidates.find((w) => w.workosOrgId === orgId && w.workspaceSlug === workspaceSlug);
+            if (!match) {
+                const inOrg = candidates.filter((w) => w.workosOrgId === orgId).map((w) => w.workspaceSlug);
+                const available = inOrg.length > 0 ? inOrg.join(', ') : '(none)';
+                command.error(`Workspace "${workspaceSlug}" not found in org "${orgSlug}". Available: ${available}.`, { exit: 1 });
+            }
+            workspaceId = match.workspaceId;
+            command.verboseLog('Workspace lookup', { source: 'org/ws', orgSlug, workspaceSlug, orgId, workspaceId });
         }
         else {
+            const authConfig = await loadAuthConfig();
+            if (!authConfig) {
+                command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
+            }
+            command.verboseLog('OAuth auth', { hasAuthConfig: true });
+            try {
+                const orgId = await resolveDefaultOrgId();
+                jwt = await getValidAccessToken(orgId, command.verboseLog);
+                command.verboseLog('Token valid (or refreshed)');
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                command.error(`Session expired. Please run \`qfg login\` to re-authenticate. (${detail})`, { exit: 401 });
+            }
             const activeProfile = getActiveProfile(profileNameOverride);
             const profileData = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
             command.verboseLog('Workspace lookup', {

package/dist/util/get-valid-token.d.ts

@@ -1,11 +1,23 @@
 /**
- * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
- * Throws if not logged in or if refresh fails.
+ * Returns a valid (non-expired) WorkOS access token for the given org,
+ * refreshing if needed. Throws if no token for that org is on disk or if
+ * refresh fails.
  *
  * If `QUONFIG_API_KEY` is set in the environment (non-empty), it is used
  * directly as a bearer token and no disk reads/writes or refresh calls
- * are made. This is the non-interactive (CI) path.
+ * are made. This is the non-interactive (CI) path; `workosOrgId` is
+ * ignored because API keys are workspace-scoped.
  */
 type Logger = (msg: string, data?: unknown) => void;
-export declare function getValidAccessToken(log?: Logger): Promise<string>;
+/**
+ * Transitional helper: pick a default workosOrgId from the token store.
+ * Returns '' if no store exists (fine for the QUONFIG_API_KEY short-circuit
+ * path, which ignores the orgId argument).
+ *
+ * TODO(qfg-kr7.5/7/8/9): callers should pass through the workosOrgId resolved
+ * from the workspace address (org-slug/workspace-slug parsing). This helper
+ * is the stopgap until each caller's resolution lands in its own bead.
+ */
+export declare function resolveDefaultOrgId(): Promise<string>;
+export declare function getValidAccessToken(workosOrgId: string, log?: Logger): Promise<string>;
 export {};

package/dist/util/get-valid-token.js

@@ -1,16 +1,34 @@
 /**
- * Returns a valid (non-expired) WorkOS access token, refreshing if needed.
- * Throws if not logged in or if refresh fails.
+ * Returns a valid (non-expired) WorkOS access token for the given org,
+ * refreshing if needed. Throws if no token for that org is on disk or if
+ * refresh fails.
  *
  * If `QUONFIG_API_KEY` is set in the environment (non-empty), it is used
  * directly as a bearer token and no disk reads/writes or refresh calls
- * are made. This is the non-interactive (CI) path.
+ * are made. This is the non-interactive (CI) path; `workosOrgId` is
+ * ignored because API keys are workspace-scoped.
  */
-import { getDomain } from './domain-urls.js';
-import { decodeJWT, refreshAccessToken } from './oauth-client.js';
-import { loadTokens, saveTokens } from './token-storage.js';
+import { authenticateWithOrg, decodeJWT } from './oauth-client.js';
+import { getTokenForOrg, loadTokens, saveTokens } from './token-storage.js';
 const noopLog = () => { };
-export async function getValidAccessToken(log = noopLog) {
+/**
+ * Transitional helper: pick a default workosOrgId from the token store.
+ * Returns '' if no store exists (fine for the QUONFIG_API_KEY short-circuit
+ * path, which ignores the orgId argument).
+ *
+ * TODO(qfg-kr7.5/7/8/9): callers should pass through the workosOrgId resolved
+ * from the workspace address (org-slug/workspace-slug parsing). This helper
+ * is the stopgap until each caller's resolution lands in its own bead.
+ */
+export async function resolveDefaultOrgId() {
+    const store = await loadTokens();
+    if (!store)
+        return '';
+    if (store.defaultOrgId && store.tokensByOrg[store.defaultOrgId])
+        return store.defaultOrgId;
+    return Object.keys(store.tokensByOrg)[0] ?? '';
+}
+export async function getValidAccessToken(workosOrgId, log = noopLog) {
     const envKey = process.env.QUONFIG_API_KEY;
     if (envKey && envKey.length > 0) {
         if (!envKey.startsWith('qf_uk_')) {
@@ -19,66 +37,65 @@ export async function getValidAccessToken(log = noopLog) {
         log('getValidAccessToken: using QUONFIG_API_KEY (CI path)');
         return envKey;
     }
-    const tokens = await loadTokens();
+    const store = await loadTokens();
+    const tokens = store ? getTokenForOrg(store, workosOrgId) : undefined;
     log('getValidAccessToken: loaded tokens', {
-        domain: getDomain(),
-        hasAccessToken: Boolean(tokens?.accessToken),
-        hasRefreshToken: Boolean(tokens?.refreshToken),
-        expiresAt: tokens?.expiresAt,
+        workosOrgId,
+        hasStore: Boolean(store),
+        hasAccessToken: Boolean(tokens?.access_token),
+        hasRefreshToken: Boolean(tokens?.refresh_token),
+        expiresAt: tokens?.expires_at,
     });
-    if (!tokens?.accessToken) {
-        throw new Error('Not authenticated. Please run `qfg login` first.');
+    if (!store || !tokens?.access_token) {
+        throw new Error(`No token for org ${workosOrgId}. Run \`qfg login\` to mint one.`);
     }
-    // Check expiry using the JWT's exp claim, falling back to stored expiresAt
-    let expired = tokens.expiresAt ? tokens.expiresAt < Date.now() : false;
+    // Check expiry using the JWT's exp claim, falling back to stored expires_at
+    let expired = tokens.expires_at ? tokens.expires_at < Date.now() : false;
     let expirySource = 'stored';
     try {
-        const payload = decodeJWT(tokens.accessToken);
+        const payload = decodeJWT(tokens.access_token);
         if (typeof payload.exp === 'number') {
             expired = payload.exp * 1000 < Date.now();
             expirySource = 'jwt';
         }
     }
     catch {
-        /* use stored expiresAt */
+        /* use stored expires_at */
     }
-    log('getValidAccessToken: expiry check', { expired, expirySource, now: Date.now() });
+    log('getValidAccessToken: expiry check', { workosOrgId, expired, expirySource, now: Date.now() });
     if (!expired) {
-        return tokens.accessToken;
+        return tokens.access_token;
     }
-    if (!tokens.refreshToken) {
-        throw new Error('Session expired (no refresh_token on disk). Please run `qfg login` to re-authenticate.');
+    if (!tokens.refresh_token) {
+        throw new Error(`Session expired for org ${workosOrgId} (no refresh_token on disk). Run \`qfg login\` to re-authenticate.`);
     }
-    log('getValidAccessToken: access token expired, calling WorkOS refresh');
+    log('getValidAccessToken: access token expired, calling WorkOS refresh', { workosOrgId });
     let refreshed;
     try {
-        refreshed = await refreshAccessToken(tokens.refreshToken);
+        // authenticateWithOrg passes organization_id so the new access token is
+        // org-scoped and carries the user's permissions[] for that org. Refreshing
+        // without organization_id would mint a user-scoped token (the qfg-kr7
+        // root cause) that fails every write path.
+        refreshed = await authenticateWithOrg(tokens.refresh_token, workosOrgId);
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);
-        log('getValidAccessToken: refresh FAILED', { detail });
-        throw new Error(`Token refresh failed: ${detail}`);
+        log('getValidAccessToken: refresh FAILED', { workosOrgId, detail });
+        throw new Error(`Token refresh failed for org ${workosOrgId}: ${detail}`);
     }
     log('getValidAccessToken: refresh succeeded', {
+        workosOrgId,
         gotNewRefreshToken: Boolean(refreshed.refresh_token),
     });
-    let expiresAt = Date.now() + 300 * 1000;
-    try {
-        const payload = decodeJWT(refreshed.access_token);
-        if (typeof payload.exp === 'number') {
-            expiresAt = payload.exp * 1000;
-        }
-    }
-    catch {
-        /* use fallback */
-    }
-    const updated = {
+    store.tokensByOrg[workosOrgId] = {
         ...tokens,
-        accessToken: refreshed.access_token,
-        expiresAt,
-        refreshToken: refreshed.refresh_token,
+        access_token: refreshed.access_token,
+        expires_at: refreshed.expires_at,
+        refresh_token: refreshed.refresh_token,
+        user_email: refreshed.user_email ?? tokens.user_email,
+        user_id: refreshed.user_id ?? tokens.user_id,
     };
-    await saveTokens(updated);
-    log('getValidAccessToken: refreshed tokens saved', { newExpiresAt: expiresAt });
+    await saveTokens(store);
+    log('getValidAccessToken: refreshed tokens saved', { workosOrgId, newExpiresAt: refreshed.expires_at });
     return refreshed.access_token;
 }

package/dist/util/git-ops.d.ts

@@ -1,11 +1,101 @@
+/**
+ * Args prepended to every git invocation. Empty `credential.helper` resets the
+ * helper chain for this child process only — prevents macOS git's osxkeychain
+ * helper from popping a "Keychain Not Found" dialog when qfg-managed creds are
+ * embedded in the URL.
+ */
+export declare const GIT_SAFE_ARGS: readonly string[];
+/**
+ * Env additions for every git invocation. Suppress tty prompts and Git
+ * Credential Manager interactive flows.
+ */
+export declare const GIT_SAFE_ENV: Readonly<NodeJS.ProcessEnv>;
 /**
  * Redact a token from a URL string so it is safe to display to users.
  */
 export declare const redactToken: (url: string) => string;
+export interface RunGitOptions {
+    cwd?: string;
+    /** Extra env vars merged on top of `process.env` and `GIT_SAFE_ENV`. */
+    env?: NodeJS.ProcessEnv;
+}
+/**
+ * Canonical entry point for shelling out to git from the CLI. Always prepends
+ * `GIT_SAFE_ARGS` and merges `GIT_SAFE_ENV` so credential prompts never leak
+ * to the user. Errors are re-thrown with tokens redacted from message/stderr.
+ */
+export declare const runGit: (args: string[], options?: RunGitOptions) => Promise<{
+    stdout: string;
+    stderr: string;
+}>;
+export interface SpawnGitOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    /** If set, written to the child's stdin and then stdin is closed. */
+    stdin?: string;
+}
+/**
+ * Spawn-based git invocation for cases where stdin needs to be piped (e.g.
+ * `git commit -F -`). Same safe-args/env injection as `runGit`.
+ */
+export declare const spawnGit: (args: string[], options?: SpawnGitOptions) => Promise<void>;
 export declare const gitClone: (repoUrl: string, dir: string) => Promise<void>;
 export declare const isGitRepo: (dir: string) => Promise<boolean>;
 export declare const getRemoteUrl: (dir: string) => Promise<string | null>;
 export declare const isWorkingTreeClean: (dir: string) => Promise<boolean>;
+/**
+ * Returns true if `file` (relative to `dir`) has any working-tree or
+ * staged change, false if its tracked content matches HEAD.
+ */
+export declare const hasFileChanges: (dir: string, file: string) => Promise<boolean>;
+/**
+ * Returns the list of tracked files (relative paths) with working-tree
+ * or staged modifications. Untracked files (`??`) are excluded — they
+ * are not considered "dirty" by callers that want to know whether the
+ * user has work-in-progress that should not be swept into a commit.
+ */
+export declare const dirtyTrackedFiles: (dir: string) => Promise<string[]>;
+/**
+ * Stage and commit a single file with the given message. The path argument
+ * to `git commit` ensures only this file is committed even if other files
+ * are already staged in the index.
+ *
+ * Returns true if a commit was created, false if there was nothing to
+ * commit (file matches HEAD already). Throws on real git errors.
+ */
+export declare const addAndCommitFile: (dir: string, file: string, message: string) => Promise<boolean>;
+/**
+ * Read the contents of `file` (relative to `dir`) at HEAD. Returns
+ * `undefined` if the file does not exist at HEAD or if HEAD itself is
+ * unset (empty repo).
+ */
+export declare const readFileAtHead: (dir: string, file: string) => Promise<string | undefined>;
+/**
+ * Result of `commitPinFixIfPinOnly`. Tells callers whether a commit was
+ * made and, if not, why — useful for verbose logging without throwing on
+ * the migration path.
+ */
+export type PinFixResult = {
+    kind: 'committed';
+    slug: string;
+} | {
+    kind: 'clean';
+} | {
+    kind: 'skipped';
+    reason: string;
+};
+/**
+ * Migration helper for legacy state where `qfg pull` wrote the workspace
+ * pin to the working tree but never committed it (qfg-0fn). If
+ * `quonfig.json` is dirty AND its only diff vs HEAD is an added or
+ * changed `workspace` key matching `expectedSlug`, stage and commit the
+ * file so push's HEAD-vs-origin delta picks it up.
+ *
+ * Skips (returns `kind: 'skipped'`) when the dirty file has any other
+ * changes, when the pin doesn't match the backend slug, or when JSON
+ * parsing fails — leaving the user's working tree alone.
+ */
+export declare const commitPinFixIfPinOnly: (dir: string, file: string, expectedSlug: string) => Promise<PinFixResult>;
 export declare const gitFetch: (dir: string) => Promise<void>;
 /**
  * Returns true if origin/main has commits that can be fast-forwarded into the local branch.