@quonfig/cli 0.0.29 → 0.0.30

package/README.md

@@ -14,7 +14,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.29 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.30 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -91,7 +91,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -176,7 +176,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -222,7 +222,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -425,7 +425,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -448,7 +448,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -480,7 +480,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/get.ts)_
 
 ## `qfg info [NAME]`
 
@@ -528,7 +528,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -568,7 +568,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -598,7 +598,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -638,7 +638,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/list.ts)_
 
 ## `qfg log-level NAME`
 
@@ -703,7 +703,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -728,7 +728,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -751,7 +751,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -805,7 +805,7 @@ EXAMPLES
   $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -843,7 +843,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -875,7 +875,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -906,7 +906,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -961,7 +961,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1053,7 +1053,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/push.ts)_
 
 ## `qfg schema NAME`
 
@@ -1091,7 +1091,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1118,7 +1118,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1150,7 +1150,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1179,7 +1179,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1206,7 +1206,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1277,7 +1277,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -1354,7 +1354,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -1386,7 +1386,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -1488,7 +1488,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -1511,7 +1511,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -1534,7 +1534,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -1567,7 +1567,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -1601,7 +1601,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -1629,7 +1629,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.29/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/codegen/fetch-workspace-snapshot.js

@@ -20,11 +20,11 @@ const looksLike401 = (err) => {
  * caller is responsible for calling `cleanup()` in a `finally` block.
  */
 export async function fetchWorkspaceSnapshot(command, options = {}) {
-    const workspaceId = await resolveWorkspaceUuid(command, options.workspace);
+    const { workspaceId, orgSlug } = await resolveWorkspaceUuid(command, options.workspace);
     let entry = await loadGiteaToken(workspaceId);
     if (!entry || isGiteaTokenExpired(entry)) {
         command.verboseLog('fetchWorkspaceSnapshot', 'Minting new Gitea read token...');
-        entry = await mintAndStoreGiteaReadToken(workspaceId);
+        entry = await mintAndStoreGiteaReadToken(workspaceId, orgSlug);
     }
     const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'qfg-codegen-'));
     const cleanup = () => fs.promises.rm(tmpDir, { force: true, recursive: true });
@@ -36,7 +36,7 @@ export async function fetchWorkspaceSnapshot(command, options = {}) {
         catch (error) {
             if (looksLike401(error)) {
                 command.verboseLog('fetchWorkspaceSnapshot', 'Got 401 on clone, refreshing Gitea token...');
-                const fresh = await mintAndStoreGiteaReadToken(workspaceId);
+                const fresh = await mintAndStoreGiteaReadToken(workspaceId, orgSlug);
                 await gitClone(fresh.repoUrl, tmpDir);
             }
             else {

package/dist/commands/delete.js

@@ -47,7 +47,8 @@ Examples
     };
     async run() {
         const { args, flags } = await this.parse(Delete);
-        // TODO(qfg-kr7.5): pick the token set keyed by the resolved workosOrgId.
+        // Auth happens through APICommand's apiClient (used below). This is just
+        // a "logged in?" gate — any cached token answers that.
         const store = await loadTokens();
         const tokens = store ? Object.values(store.tokensByOrg)[0] : undefined;
         if (!tokens?.access_token) {

package/dist/commands/login.js

@@ -135,7 +135,6 @@ export default class Login extends BaseCommand {
                     [profileName]: {
                         organizationName: result.defaultOrg.name,
                         organizationSlug: result.defaultOrg.slug,
-                        workosOrgId: result.defaultOrgId,
                         workspace: defaultWorkspace?.workspaceId ?? result.defaultOrgId,
                         workspaceName: defaultWorkspace?.workspaceSlug,
                         workspaceSlug: defaultWorkspace?.workspaceSlug,

package/dist/commands/migrate/doctor.js

@@ -4,7 +4,9 @@ import { formatHumanReport, runDoctor } from '../../migrate/doctor.js';
 import { loadTokens } from '../../util/token-storage.js';
 const SUPPORTED_SOURCES = new Set(['launch']);
 const defaultLoadSession = async () => {
-    // TODO(qfg-kr7.5): pick the token set keyed by the resolved workosOrgId.
+    // Doctor only checks token freshness, which is identical across the user's
+    // per-org tokens (they all expire on the same WorkOS clock). Reading the
+    // first one is sufficient.
     let store;
     try {
         store = await loadTokens();

package/dist/commands/migrate.js

@@ -11,7 +11,8 @@ import { NotYetImplementedError, } from '../migrate/source.js';
 import { applyLaunchBaseUrl } from '../migrate/sources/launch/api.js';
 import { mintGiteaToken } from '../util/gitea-api.js';
 import { displayUrl } from '../util/git-ops.js';
-import { getActiveProfile, loadAuthConfig, resolveWorkspaceId } from '../util/token-storage.js';
+import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
+import { loadAuthConfig } from '../util/token-storage.js';
 const DEFAULT_DIR = 'quonfig-config';
 export default class Migrate extends BaseCommand {
     static description = 'Migrate flags and configs from a legacy feature-flag system into a Quonfig workspace.\n\n' +
@@ -128,11 +129,11 @@ export default class Migrate extends BaseCommand {
                 return payload;
             }
             if (flags.push && workspaceContext) {
-                const { workspaceId } = workspaceContext;
+                const { workspaceId, orgSlug } = workspaceContext;
                 this.log('Connecting to Gitea...');
                 let repoUrl;
                 try {
-                    const tokenData = await mintGiteaToken(workspaceId, 'write', 'bootstrap');
+                    const tokenData = await mintGiteaToken(workspaceId, orgSlug, 'write', 'bootstrap');
                     repoUrl = tokenData.repoUrl;
                 }
                 catch (error) {
@@ -219,16 +220,12 @@ export default class Migrate extends BaseCommand {
         const authConfig = await loadAuthConfig();
         if (!authConfig)
             return 'Not logged in. Run `qfg login` first, then re-run with --push.';
-        if (slugOrId) {
-            const resolved = resolveWorkspaceId(authConfig, slugOrId);
-            return { authConfig, workspaceId: resolved ?? slugOrId };
-        }
-        const activeProfile = getActiveProfile();
-        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
-        if (!profile) {
-            return 'No active profile found. Pass --workspace <slug> or run `qfg login` first.';
-        }
-        return { authConfig, workspaceId: profile.workspace };
+        // For migrate --push we need both the workspaceId and the owning org's
+        // slug (so mintGiteaToken can pick the right per-org WorkOS token).
+        // resolveWorkspaceUuid handles both --workspace (org/ws form) and the
+        // saved-profile fallback uniformly.
+        const resolved = await resolveWorkspaceUuid(this, slugOrId);
+        return { authConfig, workspaceId: resolved.workspaceId, orgSlug: resolved.orgSlug };
     }
 }
 function latestChangedAtOf(changes, fallback) {

package/dist/commands/override.js

@@ -97,7 +97,7 @@ Examples
     };
     async run() {
         const { args, flags } = await this.parse(Override);
-        // TODO(qfg-kr7.5): pick the token set keyed by the resolved workosOrgId.
+        // user_email is the same across all org-scoped tokens, so any one will do.
         const store = await loadTokens();
         const tokens = store ? Object.values(store.tokensByOrg)[0] : undefined;
         const userEmail = tokens?.user_email;

package/dist/commands/pull.js

@@ -44,10 +44,10 @@ CLI shortcuts (no JSON editing needed for simple cases):
         // Resolve workspace ID — supports both OAuth and QUONFIG_API_KEY paths,
         // mirroring what APICommand does via get-client.ts so `qfg pull` behaves
         // the same in CI as `qfg create` or `qfg push`.
-        const workspaceId = await resolveWorkspaceUuid(this, flags.workspace);
-        this.verboseLog('Pull', { workspaceId, dir: resolvedDir });
+        const { workspaceId, orgSlug } = await resolveWorkspaceUuid(this, flags.workspace);
+        this.verboseLog('Pull', { workspaceId, orgSlug, dir: resolvedDir });
         // Get or mint Gitea read token
-        const tokenEntry = await this.resolveTokenEntry(workspaceId);
+        const tokenEntry = await this.resolveTokenEntry(workspaceId, orgSlug);
         const repoUrl = tokenEntry.repoUrl;
         // Perform git operation
         const isRepo = await isGitRepo(resolvedDir);
@@ -74,7 +74,7 @@ CLI shortcuts (no JSON editing needed for simple cases):
             catch (error) {
                 if (this.looksLike401(error)) {
                     this.verboseLog('Pull', 'Got 401 on fetch, refreshing Gitea token...');
-                    const freshUrl = await this.refreshAndGetUrl(workspaceId);
+                    const freshUrl = await this.refreshAndGetUrl(workspaceId, orgSlug);
                     await gitSetRemote(resolvedDir, freshUrl);
                     await gitFetch(resolvedDir);
                 }
@@ -115,7 +115,7 @@ CLI shortcuts (no JSON editing needed for simple cases):
                 // On 401, refresh token and retry once
                 if (this.looksLike401(error)) {
                     this.verboseLog('Pull', 'Got 401, refreshing Gitea token...');
-                    const freshUrl = await this.refreshAndGetUrl(workspaceId);
+                    const freshUrl = await this.refreshAndGetUrl(workspaceId, orgSlug);
                     await gitClone(freshUrl, resolvedDir);
                 }
                 else {
@@ -131,7 +131,7 @@ CLI shortcuts (no JSON editing needed for simple cases):
         // is a git repo, we also commit the new pin so it's included in the
         // user's next `qfg push` delta — push diffs HEAD vs origin, so a
         // working-tree-only write would never reach the server (qfg-0fn).
-        await this.backfillWorkspacePin(resolvedDir, tokenEntry, workspaceId);
+        await this.backfillWorkspacePin(resolvedDir, tokenEntry, workspaceId, orgSlug);
         return { dir: resolvedDir, workspaceId };
     }
     /**
@@ -146,13 +146,13 @@ CLI shortcuts (no JSON editing needed for simple cases):
      *
      * This never throws — a broken `quonfig.json` shouldn't fail `qfg pull`.
      */
-    async backfillWorkspacePin(dir, tokenEntry, workspaceId) {
+    async backfillWorkspacePin(dir, tokenEntry, workspaceId, orgSlug) {
         let backendSlug = tokenEntry.workspaceSlug;
         if (!backendSlug) {
             // Older cached entries lack the slug. Mint a fresh one solely to learn the
             // slug. Cheap (one API call), and the refresh updates the cache for next time.
             try {
-                const fresh = await mintAndStoreGiteaReadToken(workspaceId);
+                const fresh = await mintAndStoreGiteaReadToken(workspaceId, orgSlug);
                 backendSlug = fresh.workspaceSlug;
             }
             catch (error) {
@@ -248,8 +248,8 @@ CLI shortcuts (no JSON editing needed for simple cases):
             // Non-fatal
         }
     }
-    async refreshAndGetUrl(workspaceId) {
-        const data = await mintGiteaToken(workspaceId, 'read', 'pull');
+    async refreshAndGetUrl(workspaceId, orgSlug) {
+        const data = await mintGiteaToken(workspaceId, orgSlug, 'read', 'pull');
         const entry = {
             token: data.token,
             repoUrl: data.repoUrl,
@@ -259,11 +259,11 @@ CLI shortcuts (no JSON editing needed for simple cases):
         await saveGiteaToken(workspaceId, entry);
         return entry.repoUrl;
     }
-    async resolveTokenEntry(workspaceId) {
+    async resolveTokenEntry(workspaceId, orgSlug) {
         let entry = await loadGiteaToken(workspaceId);
         if (!entry || isGiteaTokenExpired(entry)) {
             this.verboseLog('Pull', 'Minting new Gitea read token...');
-            entry = await mintAndStoreGiteaReadToken(workspaceId);
+            entry = await mintAndStoreGiteaReadToken(workspaceId, orgSlug);
         }
         return entry;
     }

package/dist/commands/push.d.ts

@@ -39,7 +39,7 @@ export declare function giteaResponseToMintResult(resp: GiteaTokenResponse): Git
  * oRPC procedure. We still mint a READ token to authenticate the bare-path
  * probe-clone and the clone-path `git fetch`.
  */
-export declare function buildRealDeps(cmd: Push): {
+export declare function buildRealDeps(cmd: Push, orgSlug: string): {
     deps: Parameters<typeof runPush>[1];
     cleanup: () => Promise<void>;
 };

package/dist/commands/push.js

@@ -61,8 +61,8 @@ Enforces three guards before touching the remote:
         // Resolve requested target. --workspace > QUONFIG_WORKSPACE > active OAuth
         // profile. Supports API-key mode for headless runs so `qfg push` behaves
         // the same way `qfg create` does (both resolve via resolve-workspace.ts).
-        const requestedTarget = await resolveWorkspaceUuid(this, flags.workspace);
-        const { deps, cleanup } = buildRealDeps(this);
+        const { workspaceId: requestedTarget, orgSlug } = await resolveWorkspaceUuid(this, flags.workspace);
+        const { deps, cleanup } = buildRealDeps(this, orgSlug);
         try {
             const result = await runPush({
                 dir: resolvedDir,
@@ -131,7 +131,7 @@ export function giteaResponseToMintResult(resp) {
  * oRPC procedure. We still mint a READ token to authenticate the bare-path
  * probe-clone and the clone-path `git fetch`.
  */
-export function buildRealDeps(cmd) {
+export function buildRealDeps(cmd, orgSlug) {
     const log = (line) => cmd.log(line);
     const errLog = (line) => cmd.logToStderr(line);
     // State captured across calls so a bare-path diff can share its probe clone
@@ -208,7 +208,7 @@ export function buildRealDeps(cmd) {
             // fetch. The actual commit goes through the server via configs.push,
             // which is authorized off the user's WorkOS session — no write PAT
             // needed in the push code path (qfg-azk.13).
-            const resp = await mintGiteaToken(requestedTarget, 'read', 'pull');
+            const resp = await mintGiteaToken(requestedTarget, orgSlug, 'read', 'pull');
             authenticatedRepoUrl = resp.repoUrl;
             return giteaResponseToMintResult(resp);
         },
@@ -219,7 +219,7 @@ export function buildRealDeps(cmd) {
             return { errors };
         },
         gitOps,
-        pushToServer: callConfigsPush,
+        pushToServer: (input) => callConfigsPush(input, orgSlug),
         log,
         errLog,
     };

package/dist/commands/sync.d.ts

@@ -10,6 +10,7 @@ export default class Sync extends BaseCommand {
     };
     private resolvedDir;
     private workspaceId;
+    private orgSlug;
     run(): Promise<JsonObj | void>;
     private ensureRemoteUrl;
     private looksLike401;

package/dist/commands/sync.js

@@ -1,9 +1,9 @@
 import * as path from 'node:path';
 import { Flags } from '@oclif/core';
 import { BaseCommand } from '../index.js';
-import { getActiveProfile, loadAuthConfig } from '../util/token-storage.js';
 import { loadGiteaToken, isGiteaTokenExpired, saveGiteaToken } from '../util/gitea-token-storage.js';
 import { mintGiteaToken } from '../util/gitea-api.js';
+import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
 import { isGitRepo, isWorkingTreeClean, gitFetch, canFastForward, hasDivergedFromRemote, gitMergeFfOnly, gitSetRemote, } from '../util/git-ops.js';
 const sleep = (ms) => new Promise((resolve) => {
     setTimeout(resolve, ms);
@@ -30,6 +30,7 @@ export default class Sync extends BaseCommand {
     };
     resolvedDir;
     workspaceId;
+    orgSlug;
     async run() {
         const { flags } = await this.parse(Sync);
         // Resolve directory
@@ -38,17 +39,9 @@ export default class Sync extends BaseCommand {
             return this.err('No directory specified. Use --dir <path> or set QUONFIG_DIR.');
         }
         this.resolvedDir = path.resolve(dir);
-        // Resolve workspace ID
-        const authConfig = await loadAuthConfig();
-        if (!authConfig) {
-            return this.err('Not logged in. Please run `qfg login` first.');
-        }
-        const activeProfile = getActiveProfile();
-        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
-        if (!profile) {
-            return this.err('No active profile found. Please run `qfg login` first.');
-        }
-        this.workspaceId = profile.workspace;
+        const resolved = await resolveWorkspaceUuid(this);
+        this.workspaceId = resolved.workspaceId;
+        this.orgSlug = resolved.orgSlug;
         // Validate the directory is a git repo
         const isRepo = await isGitRepo(this.resolvedDir);
         if (!isRepo) {
@@ -82,7 +75,7 @@ export default class Sync extends BaseCommand {
         return msg.includes('401') || msg.toLowerCase().includes('authentication failed');
     }
     async refreshToken() {
-        const data = await mintGiteaToken(this.workspaceId, 'read', 'pull');
+        const data = await mintGiteaToken(this.workspaceId, this.orgSlug, 'read', 'pull');
         const entry = { token: data.token, repoUrl: data.repoUrl, expiresAt: data.expiresAt };
         await saveGiteaToken(this.workspaceId, entry);
         await gitSetRemote(this.resolvedDir, entry.repoUrl);

package/dist/commands/whoami.js

@@ -1,6 +1,6 @@
 import { BaseCommand } from '../index.js';
 import { getApiUrl } from '../util/domain-urls.js';
-import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
+import { getValidAccessToken } from '../util/get-valid-token.js';
 import { decodeJWT } from '../util/oauth-client.js';
 import { tryParseWorkspacePin } from '../util/quonfig-json.js';
 import { findOrgIdBySlug, loadTokens } from '../util/token-storage.js';
@@ -82,7 +82,11 @@ export default class Whoami extends BaseCommand {
         }
         if (defaultOrgId)
             return defaultOrgId;
-        return resolveDefaultOrgId().then((id) => id || undefined);
+        // Fall back to the first token entry — gives a stable marker rather than nothing.
+        const store = await loadTokens();
+        if (!store)
+            return undefined;
+        return Object.keys(store.tokensByOrg)[0];
     }
     /**
      * Best-effort fetch of `me.organizations` for role enrichment. Failure
@@ -92,7 +96,10 @@ export default class Whoami extends BaseCommand {
     async fetchOrganizations() {
         let jwt;
         try {
-            const orgId = await resolveDefaultOrgId();
+            const store = await loadTokens();
+            if (!store)
+                return [];
+            const orgId = pickAnyOrgId(store);
             if (!orgId)
                 return [];
             jwt = await getValidAccessToken(orgId, this.verboseLog);
@@ -136,3 +143,8 @@ function mergeMemberships(local, server) {
         merged.set(o.workosOrgId, o);
     return [...merged.values()].sort((a, b) => a.slug.localeCompare(b.slug));
 }
+function pickAnyOrgId(store) {
+    if (store.defaultOrgId && store.tokensByOrg[store.defaultOrgId])
+        return store.defaultOrgId;
+    return Object.keys(store.tokensByOrg)[0];
+}