@quonfig/cli 0.0.29 → 0.0.31

package/dist/commands/whoami.js

@@ -1,6 +1,6 @@
 import { BaseCommand } from '../index.js';
 import { getApiUrl } from '../util/domain-urls.js';
-import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
+import { getValidAccessToken } from '../util/get-valid-token.js';
 import { decodeJWT } from '../util/oauth-client.js';
 import { tryParseWorkspacePin } from '../util/quonfig-json.js';
 import { findOrgIdBySlug, loadTokens } from '../util/token-storage.js';
@@ -31,6 +31,7 @@ export default class Whoami extends BaseCommand {
             slug: t.org_slug ?? orgId,
             name: t.org_name ?? t.org_slug ?? orgId,
             role: '—',
+            sessionStatus: sessionStatusFor(t),
         }));
         const merged = mergeMemberships(localOrgs, memberships);
         this.log(`Logged in as: ${userEmail || 'Unknown'}`);
@@ -44,7 +45,13 @@ export default class Whoami extends BaseCommand {
                 const marker = org.workosOrgId === activeOrgId ? '*' : ' ';
                 const label = `${org.slug}${org.workosOrgId === activeOrgId ? ' (active)' : ''}`;
                 const padded = label.padEnd(labelWidth, ' ');
-                this.log(`  ${marker} ${padded}— ${org.role}`);
+                const statusSuffix = org.sessionStatus ? ` (${org.sessionStatus.description})` : '';
+                this.log(`  ${marker} ${padded}— ${org.role}${statusSuffix}`);
+            }
+            const expiredCount = merged.filter((o) => o.sessionStatus?.expired).length;
+            if (expiredCount > 0) {
+                this.log('');
+                this.log(`${expiredCount} of ${merged.length} session(s) expired. Run \`qfg login\` to refresh.`);
             }
         }
         return {
@@ -58,6 +65,7 @@ export default class Whoami extends BaseCommand {
                 name: o.name,
                 role: o.role,
                 active: o.workosOrgId === activeOrgId,
+                sessionExpired: o.sessionStatus?.expired ?? null,
             })),
         };
     }
@@ -82,7 +90,11 @@ export default class Whoami extends BaseCommand {
         }
         if (defaultOrgId)
             return defaultOrgId;
-        return resolveDefaultOrgId().then((id) => id || undefined);
+        // Fall back to the first token entry — gives a stable marker rather than nothing.
+        const store = await loadTokens();
+        if (!store)
+            return undefined;
+        return Object.keys(store.tokensByOrg)[0];
     }
     /**
      * Best-effort fetch of `me.organizations` for role enrichment. Failure
@@ -92,7 +104,10 @@ export default class Whoami extends BaseCommand {
     async fetchOrganizations() {
         let jwt;
         try {
-            const orgId = await resolveDefaultOrgId();
+            const store = await loadTokens();
+            if (!store)
+                return [];
+            const orgId = pickAnyOrgId(store);
             if (!orgId)
                 return [];
             jwt = await getValidAccessToken(orgId, this.verboseLog);
@@ -132,7 +147,51 @@ function mergeMemberships(local, server) {
     const merged = new Map();
     for (const o of local)
         merged.set(o.workosOrgId, o);
-    for (const o of server)
-        merged.set(o.workosOrgId, o);
+    for (const o of server) {
+        // Server data wins for slug/name/role but lacks sessionStatus — that's
+        // a property of the locally-cached token, so preserve it.
+        const existing = merged.get(o.workosOrgId);
+        merged.set(o.workosOrgId, { ...o, sessionStatus: existing?.sessionStatus });
+    }
     return [...merged.values()].sort((a, b) => a.slug.localeCompare(b.slug));
 }
+/**
+ * Read-only check of a TokenSet's expiry. Prefers the JWT's `exp` claim
+ * (matches getValidAccessToken's logic), falls back to the stored
+ * `expires_at` timestamp if the JWT can't be decoded. No network calls —
+ * whoami stays fast even with many cached orgs.
+ */
+function sessionStatusFor(tokens) {
+    let expMs = tokens.expires_at;
+    try {
+        const payload = decodeJWT(tokens.access_token);
+        if (typeof payload.exp === 'number')
+            expMs = payload.exp * 1000;
+    }
+    catch {
+        /* keep stored expires_at */
+    }
+    const delta = expMs - Date.now();
+    if (delta <= 0)
+        return { expired: true, description: 'expired — run `qfg login`' };
+    return { expired: false, description: `expires in ${formatRelative(delta)}` };
+}
+function formatRelative(deltaMs) {
+    const minutes = Math.round(deltaMs / 60_000);
+    if (minutes < 1)
+        return '<1m';
+    if (minutes < 60)
+        return `${minutes}m`;
+    const hours = Math.floor(minutes / 60);
+    const remMin = minutes % 60;
+    if (hours < 24)
+        return remMin > 0 ? `${hours}h ${remMin}m` : `${hours}h`;
+    const days = Math.floor(hours / 24);
+    const remHours = hours % 24;
+    return remHours > 0 ? `${days}d ${remHours}h` : `${days}d`;
+}
+function pickAnyOrgId(store) {
+    if (store.defaultOrgId && store.tokensByOrg[store.defaultOrgId])
+        return store.defaultOrgId;
+    return Object.keys(store.tokensByOrg)[0];
+}

package/dist/commands/workspace/bootstrap.js

@@ -5,6 +5,7 @@ import { BaseCommand } from '../../index.js';
 import { getActiveProfile, loadAuthConfig } from '../../util/token-storage.js';
 import { mintGiteaToken } from '../../util/gitea-api.js';
 import { readWorkspaceSlug, tryParseWorkspacePin, writeWorkspaceSlug } from '../../util/quonfig-json.js';
+import { resolveWorkspaceUuid } from '../../util/resolve-workspace.js';
 import { isGitRepo, hasAtLeastOneCommit, gitSetRemote, gitPushForceLease, gitPushForce, getRemoteUrl, displayUrl, runGit, } from '../../util/git-ops.js';
 export default class WorkspaceBootstrap extends BaseCommand {
     static description = "Push a local git repo to Gitea as this workspace's config repository";
@@ -32,19 +33,14 @@ export default class WorkspaceBootstrap extends BaseCommand {
         // Resolve target directory
         const dir = flags.dir || process.env.QUONFIG_DIR || process.cwd();
         const resolvedDir = path.resolve(dir);
-        // Load auth
+        const { workspaceId, orgSlug } = await resolveWorkspaceUuid(this);
+        // The display name is best-effort; we still want it for the confirmation
+        // prompt. Fall back through saved profile → workspaceId UUID.
         const authConfig = await loadAuthConfig();
-        if (!authConfig) {
-            return this.err('Not logged in. Run `qfg login` first.');
-        }
         const activeProfile = getActiveProfile();
-        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
-        if (!profile) {
-            return this.err('No active profile found. Run `qfg login` first.');
-        }
-        const workspaceId = profile.workspace;
-        const workspaceName = profile.workspaceSlug || profile.workspaceName || workspaceId;
-        this.verboseLog('WorkspaceBootstrap', { workspaceId, dir: resolvedDir });
+        const profile = authConfig?.profiles[activeProfile] || authConfig?.profiles[authConfig?.defaultProfile || 'default'];
+        const workspaceName = profile?.workspaceSlug || profile?.workspaceName || workspaceId;
+        this.verboseLog('WorkspaceBootstrap', { workspaceId, orgSlug, dir: resolvedDir });
         // Validate: must be a git repo with at least one commit
         const isRepo = await isGitRepo(resolvedDir);
         if (!isRepo) {
@@ -98,7 +94,7 @@ export default class WorkspaceBootstrap extends BaseCommand {
         this.log('Connecting to Gitea...');
         let tokenData;
         try {
-            tokenData = await mintGiteaToken(workspaceId, 'write', 'bootstrap');
+            tokenData = await mintGiteaToken(workspaceId, orgSlug, 'write', 'bootstrap');
         }
         catch (error) {
             return this.err(`Could not get Gitea credentials: ${String(error)}\n\nMake sure the workspace is fully provisioned in the Quonfig app before bootstrapping.`);

package/dist/commands/workspace/create.d.ts

@@ -15,11 +15,15 @@ export default class WorkspaceCreate extends BaseCommand {
      * Pick the org for the new workspace from the per-org token store.
      *
      * - 0 orgs → "No orgs found. Run `qfg login` first."
-     * - 1 org → auto-select that org's workosOrgId.
+     * - 1 org → auto-select that org.
      * - 2+ orgs → require `--org <slug-or-uuid>`. Slug is matched against
      *   `org_slug` in the token store; UUID is matched against the token
      *   store key. Either way the org must exist locally — we never invent
      *   an orgId we don't have a token for.
+     *
+     * Always returns BOTH the WorkOS org id (needed to mint the JWT) and the
+     * org slug (needed for the create-workspace request body). If the token
+     * lacks `org_slug`, errors with a `qfg login` hint.
      */
     private resolveOrgFromTokens;
     /**

package/dist/commands/workspace/create.js

@@ -55,18 +55,25 @@ export default class WorkspaceCreate extends BaseCommand {
         const { workosOrgId, orgSlug } = orgResolution;
         let accessToken;
         try {
-            accessToken = await getValidAccessToken(workosOrgId);
+            accessToken = await getValidAccessToken(workosOrgId, this.verboseLog);
         }
-        catch {
-            return this.err('Not logged in. Run `qfg login` first.');
+        catch (error) {
+            // Surface the underlying token error (e.g. "Token refresh failed for
+            // org X: invalid_grant — Refresh token already exchanged") so users
+            // and agents can distinguish "never logged in" from "session went
+            // stale and refresh was rejected" — both used to read "Not logged in".
+            const detail = error instanceof Error ? error.message : String(error);
+            const hint = detail.includes('qfg login') ? '' : ' Run `qfg login` to re-authenticate.';
+            return this.err(`${detail}${hint}`);
         }
         const apiUrl = getApiUrl();
-        const body = { slug, organizationId: workosOrgId };
+        // The server expects organizationSlug (it resolves to the local org
+        // UUID) — not the WorkOS org id, which is what we have keyed in the
+        // token store. resolveOrgFromTokens guarantees orgSlug is populated.
+        const body = { slug, organizationSlug: orgSlug };
         if (flags.name)
             body.name = flags.name;
-        if (orgSlug) {
-            this.log(`Creating workspace in org: ${orgSlug}`);
-        }
+        this.log(`Creating workspace in org: ${orgSlug}`);
         this.verboseLog('WorkspaceCreate', { apiUrl, body });
         let res;
         try {
@@ -135,11 +142,15 @@ export default class WorkspaceCreate extends BaseCommand {
      * Pick the org for the new workspace from the per-org token store.
      *
      * - 0 orgs → "No orgs found. Run `qfg login` first."
-     * - 1 org → auto-select that org's workosOrgId.
+     * - 1 org → auto-select that org.
      * - 2+ orgs → require `--org <slug-or-uuid>`. Slug is matched against
      *   `org_slug` in the token store; UUID is matched against the token
      *   store key. Either way the org must exist locally — we never invent
      *   an orgId we don't have a token for.
+     *
+     * Always returns BOTH the WorkOS org id (needed to mint the JWT) and the
+     * org slug (needed for the create-workspace request body). If the token
+     * lacks `org_slug`, errors with a `qfg login` hint.
      */
     async resolveOrgFromTokens(flagOrg) {
         const store = await loadTokens();
@@ -147,13 +158,19 @@ export default class WorkspaceCreate extends BaseCommand {
             return { error: 'No orgs found. Run `qfg login` first.' };
         }
         const entries = Object.entries(store.tokensByOrg);
+        const requireSlug = (workosOrgId, orgSlug) => {
+            if (!orgSlug) {
+                return { error: `Org \`${workosOrgId}\` is missing its slug locally. Run \`qfg login\` to refresh your org list.` };
+            }
+            return { workosOrgId, orgSlug };
+        };
         if (flagOrg) {
             if (UUID_PATTERN.test(flagOrg)) {
                 const tokens = store.tokensByOrg[flagOrg];
                 if (!tokens) {
                     return { error: `Org \`${flagOrg}\` not found in your token store. Run \`qfg login\` to refresh your org list.` };
                 }
-                return { workosOrgId: flagOrg, orgSlug: tokens.org_slug };
+                return requireSlug(flagOrg, tokens.org_slug);
             }
             const matchedId = findOrgIdBySlug(store, flagOrg);
             if (!matchedId) {
@@ -163,7 +180,7 @@ export default class WorkspaceCreate extends BaseCommand {
         }
         if (entries.length === 1) {
             const [orgId, tokens] = entries[0];
-            return { workosOrgId: orgId, orgSlug: tokens.org_slug };
+            return requireSlug(orgId, tokens.org_slug);
         }
         const slugList = entries
             .map(([, tokens]) => tokens.org_slug)

package/dist/commands/workspace/switch.d.ts

@@ -16,5 +16,11 @@ export default class WorkspaceSwitch extends BaseCommand {
      *   migration message used elsewhere in the CLI.
      */
     private matchByArg;
-    private fetchAllWorkspaces;
+    /**
+     * Iterate every cached org and merge its workspace list. Each org has its
+     * own access token; one token only sees one org's workspaces. We tolerate
+     * a single org's failure (verbose-log it) so a stale token in one org
+     * doesn't block switching into a working one.
+     */
+    private fetchAllOrgsWorkspaces;
 }

package/dist/commands/workspace/switch.js

@@ -21,16 +21,10 @@ export default class WorkspaceSwitch extends BaseCommand {
         if (!store || Object.keys(store.tokensByOrg).length === 0) {
             return this.err('Not logged in. Run `qfg login` first.');
         }
-        const orgEntries = Object.entries(store.tokensByOrg);
-        const firstOrgId = orgEntries[0][0];
-        let accessToken;
-        try {
-            accessToken = await getValidAccessToken(firstOrgId, this.verboseLog);
-        }
-        catch {
-            return this.err('Not logged in. Run `qfg login` first.');
-        }
-        const candidates = await this.fetchAllWorkspaces(accessToken);
+        // /userWorkspaces/list is per-token-org-scoped — a single org's JWT
+        // only sees that org's workspaces. To support multi-org pickers we
+        // must iterate every cached org and merge.
+        const candidates = await this.fetchAllOrgsWorkspaces(store);
         if (candidates.length === 0) {
             return this.err('No workspaces found for your account.');
         }
@@ -70,7 +64,6 @@ export default class WorkspaceSwitch extends BaseCommand {
                     workspaceSlug: match.workspaceSlug,
                     organizationName: match.organizationName,
                     organizationSlug: orgSlug,
-                    workosOrgId: match.workosOrgId,
                 },
             },
         });
@@ -83,7 +76,6 @@ export default class WorkspaceSwitch extends BaseCommand {
             activeWorkspace: pin,
             organizationName: match.organizationName,
             organizationSlug: orgSlug,
-            workosOrgId: match.workosOrgId,
             workspaceId: match.workspaceId,
             workspaceSlug: match.workspaceSlug,
         };
@@ -124,23 +116,49 @@ export default class WorkspaceSwitch extends BaseCommand {
         }
         return { match: found };
     }
-    async fetchAllWorkspaces(accessToken) {
-        try {
-            const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
-                method: 'POST',
-                headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
-                body: JSON.stringify({ json: {} }),
-            });
-            if (!res.ok) {
-                throw new Error(`Failed to fetch workspaces (${res.status}). Try \`qfg login\` to re-authenticate.`);
+    /**
+     * Iterate every cached org and merge its workspace list. Each org has its
+     * own access token; one token only sees one org's workspaces. We tolerate
+     * a single org's failure (verbose-log it) so a stale token in one org
+     * doesn't block switching into a working one.
+     */
+    async fetchAllOrgsWorkspaces(store) {
+        const merged = new Map();
+        for (const orgId of Object.keys(store.tokensByOrg)) {
+            let token;
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                token = await getValidAccessToken(orgId, this.verboseLog);
+            }
+            catch (error) {
+                this.verboseLog('workspace switch: token refresh failed', { orgId, error: String(error) });
+                continue;
+            }
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+                    method: 'POST',
+                    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ json: {} }),
+                });
+                if (!res.ok) {
+                    this.verboseLog('workspace switch: list returned non-OK', { orgId, status: res.status });
+                    continue;
+                }
+                // eslint-disable-next-line no-await-in-loop
+                const body = (await res.json());
+                const list = (body.json ?? body);
+                if (!Array.isArray(list))
+                    continue;
+                for (const w of list) {
+                    merged.set(w.workspaceId, w);
+                }
+            }
+            catch (error) {
+                this.verboseLog('workspace switch: fetch failed', { orgId, error: String(error) });
             }
-            const body = (await res.json());
-            const all = (body.json ?? body);
-            return Array.isArray(all) ? all : [];
-        }
-        catch (error) {
-            throw new Error(`Failed to fetch workspaces: ${error instanceof Error ? error.message : String(error)}`);
         }
+        return [...merged.values()];
     }
 }
 function pinFor(w) {

package/dist/commands/workspace.d.ts

@@ -18,5 +18,10 @@ export default class Workspace extends BaseCommand {
      */
     private activePin;
     private fetchWorkspaces;
+    /**
+     * Fan out across every cached org's token and merge the results. One org's
+     * stale token doesn't block the others — we verbose-log and continue.
+     */
+    private fetchAllOrgsWorkspaces;
     private runApiKeyMode;
 }

package/dist/commands/workspace.js

@@ -20,15 +20,10 @@ export default class Workspace extends BaseCommand {
         const orgSlugsWithTokens = orgEntries
             .map(([orgId, t]) => t.org_slug ?? orgId)
             .sort((a, b) => a.localeCompare(b));
-        const firstOrgId = orgEntries[0][0];
-        let jwt;
-        try {
-            jwt = await getValidAccessToken(firstOrgId, this.verboseLog);
-        }
-        catch (error) {
-            return this.err(error instanceof Error ? error.message : String(error));
-        }
-        const allWorkspaces = await this.fetchWorkspaces(jwt);
+        // /userWorkspaces/list is per-token-org-scoped — a single org's JWT
+        // only sees that org's workspaces. Iterate every cached org so the
+        // listing is comprehensive in multi-org accounts.
+        const allWorkspaces = await this.fetchAllOrgsWorkspaces(orgEntries);
         const defaultProfilePin = this.profilePin(authConfig, allWorkspaces);
         const activePin = this.activePin(store, authConfig, allWorkspaces, defaultProfilePin);
         this.log(`Active workspace: ${activePin ?? '(none)'}`);
@@ -135,6 +130,30 @@ export default class Workspace extends BaseCommand {
             return [];
         }
     }
+    /**
+     * Fan out across every cached org's token and merge the results. One org's
+     * stale token doesn't block the others — we verbose-log and continue.
+     */
+    async fetchAllOrgsWorkspaces(orgEntries) {
+        const merged = new Map();
+        for (const [orgId] of orgEntries) {
+            let jwt;
+            try {
+                // eslint-disable-next-line no-await-in-loop
+                jwt = await getValidAccessToken(orgId, this.verboseLog);
+            }
+            catch (error) {
+                this.verboseLog('workspace: token refresh failed for org', { orgId, error: String(error) });
+                continue;
+            }
+            // eslint-disable-next-line no-await-in-loop
+            const list = await this.fetchWorkspaces(jwt);
+            for (const w of list) {
+                merged.set(w.workspaceId, w);
+            }
+        }
+        return [...merged.values()];
+    }
     async runApiKeyMode() {
         const override = process.env.QUONFIG_WORKSPACE;
         if (!override) {

package/dist/migrate/sources/launch/translate.js

@@ -144,17 +144,20 @@ export function transformConfig(config, envIdMap, onDroppedEnv) {
         const defaultSection = out.default;
         const firstRule = defaultSection?.rules?.[0];
         const innerValue = firstRule?.value?.value;
+        const key = String(out.key ?? 'unknown');
         if (!innerValue || innerValue.schemaType !== 'ZOD' || typeof innerValue.schema !== 'string') {
-            throw new Error(`Unsupported schema payload for ${String(out.key ?? 'unknown')}`);
+            // qfg-p74d: surface as a per-config skip so one bad source config doesn't
+            // abort the whole push. Surfaces in MIGRATION_REPORT.md "Skipped invalid
+            // configs" alongside variant mismatches.
+            throw new InvalidSourceConfigError(`Unsupported schema payload for "${key}"`);
         }
-        const key = String(out.key ?? 'unknown');
         let converted;
         try {
             converted = zodToJsonSchema(innerValue.schema);
         }
         catch (error) {
             const msg = error instanceof Error ? error.message : String(error);
-            throw new Error(`Schema conversion failed for "${key}": ${msg}\n--- Zod source ---\n${innerValue.schema}\n--- end ---`);
+            throw new InvalidSourceConfigError(`Schema conversion failed for "${key}": ${msg}\n--- Zod source ---\n${innerValue.schema}\n--- end ---`);
         }
         return converted.schema;
     }

package/dist/migrate/sources/launch/zod-to-json-schema.js

@@ -352,10 +352,14 @@ function convertObjectShape(objectLiteral, ctx) {
             required.push(key);
         }
     }
+    // qfg-mrab: Quonfig's authoring validator requires additionalProperties:false on
+    // every object with properties; default zod is open, so we close it here. Users
+    // who genuinely want an open object can edit the emitted schema post-migrate.
     return {
         type: 'object',
         properties,
         required,
+        additionalProperties: false,
     };
 }
 function convertBaseZodCall(method, args, ctx) {

package/dist/push/config-push-client.d.ts

@@ -15,4 +15,4 @@
  * `QUONFIG_API_KEY` is set in the environment); see `getValidAccessToken`.
  */
 import type { ConfigPushInput, ConfigPushResult } from './run-push.js';
-export declare const callConfigsPush: (input: ConfigPushInput) => Promise<ConfigPushResult>;
+export declare const callConfigsPush: (input: ConfigPushInput, orgSlug: string) => Promise<ConfigPushResult>;

package/dist/push/config-push-client.js

@@ -15,11 +15,9 @@
  * `QUONFIG_API_KEY` is set in the environment); see `getValidAccessToken`.
  */
 import { getApiUrl } from '../util/domain-urls.js';
-import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
-export const callConfigsPush = async (input) => {
-    // TODO(qfg-kr7.5): thread workosOrgId through from the resolved workspace address.
-    const orgId = await resolveDefaultOrgId();
-    const accessToken = await getValidAccessToken(orgId);
+import { getValidAccessTokenForOrgSlug } from '../util/get-valid-token.js';
+export const callConfigsPush = async (input, orgSlug) => {
+    const accessToken = await getValidAccessTokenForOrgSlug(orgSlug);
     const apiUrl = getApiUrl();
     const res = await fetch(`${apiUrl}/api/v1/configs/push`, {
         method: 'POST',

package/dist/util/get-client.js

@@ -3,7 +3,7 @@ import { getApiUrl } from '../util/domain-urls.js';
 import jsonMaybe from '../util/json-maybe.js';
 import { tryParseWorkspacePin } from '../util/quonfig-json.js';
 import { findOrgIdBySlug, getActiveProfile, loadAuthConfig, loadTokens } from '../util/token-storage.js';
-import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
+import { getValidAccessToken, getValidAccessTokenForOrgSlug } from '../util/get-valid-token.js';
 import version from '../version.js';
 const BARE_SLUG_ENV_MIGRATION_MESSAGE = 'QUONFIG_WORKSPACE must be in org/workspace form (e.g. acme/foo). ' +
     'Bare workspace slugs are no longer accepted. Update your .env and run `qfg login` if you have not yet migrated.';
@@ -133,15 +133,6 @@ const getClient = async (command, sdkKey, profile) => {
                 command.error('No authentication found. Please run `qfg login`.', { exit: 401 });
             }
             command.verboseLog('OAuth auth', { hasAuthConfig: true });
-            try {
-                const orgId = await resolveDefaultOrgId();
-                jwt = await getValidAccessToken(orgId, command.verboseLog);
-                command.verboseLog('Token valid (or refreshed)');
-            }
-            catch (error) {
-                const detail = error instanceof Error ? error.message : String(error);
-                command.error(`Session expired. Please run \`qfg login\` to re-authenticate. (${detail})`, { exit: 401 });
-            }
             const activeProfile = getActiveProfile(profileNameOverride);
             const profileData = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
             command.verboseLog('Workspace lookup', {
@@ -150,9 +141,18 @@ const getClient = async (command, sdkKey, profile) => {
                 hasProfileData: Boolean(profileData),
                 workspaceId: profileData?.workspace,
             });
-            if (profileData) {
-                workspaceId = profileData.workspace;
+            if (!profileData?.organizationSlug) {
+                command.error('Saved profile is missing organization_slug. Run `qfg login` to refresh, or `qfg workspace switch <org>/<ws>`.', { exit: 1 });
+            }
+            try {
+                jwt = await getValidAccessTokenForOrgSlug(profileData.organizationSlug, command.verboseLog);
+                command.verboseLog('Token valid (or refreshed)');
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                command.error(`Session expired. Please run \`qfg login\` to re-authenticate. (${detail})`, { exit: 401 });
             }
+            workspaceId = profileData.workspace;
         }
     }
     // Store workspaceId on the command for use in building URLs and cache it

package/dist/util/get-valid-token.d.ts

@@ -10,14 +10,14 @@
  */
 type Logger = (msg: string, data?: unknown) => void;
 /**
- * Transitional helper: pick a default workosOrgId from the token store.
- * Returns '' if no store exists (fine for the QUONFIG_API_KEY short-circuit
- * path, which ignores the orgId argument).
+ * Slug-based wrapper around getValidAccessToken. Commands talk in
+ * `<org-slug>` (the user-vocabulary form); the slug → workosOrgId
+ * mapping is contained here so the rest of the CLI doesn't see WorkOS
+ * identifiers.
  *
- * TODO(qfg-kr7.5/7/8/9): callers should pass through the workosOrgId resolved
- * from the workspace address (org-slug/workspace-slug parsing). This helper
- * is the stopgap until each caller's resolution lands in its own bead.
+ * The `QUONFIG_API_KEY` short-circuit fires before any disk lookup, so
+ * an empty/unknown slug is fine in CI mode.
  */
-export declare function resolveDefaultOrgId(): Promise<string>;
+export declare function getValidAccessTokenForOrgSlug(orgSlug: string, log?: Logger): Promise<string>;
 export declare function getValidAccessToken(workosOrgId: string, log?: Logger): Promise<string>;
 export {};

package/dist/util/get-valid-token.js

@@ -9,24 +9,30 @@
  * ignored because API keys are workspace-scoped.
  */
 import { authenticateWithOrg, decodeJWT } from './oauth-client.js';
-import { getTokenForOrg, loadTokens, saveTokens } from './token-storage.js';
+import { findOrgIdBySlug, getTokenForOrg, loadTokens, saveTokens } from './token-storage.js';
 const noopLog = () => { };
 /**
- * Transitional helper: pick a default workosOrgId from the token store.
- * Returns '' if no store exists (fine for the QUONFIG_API_KEY short-circuit
- * path, which ignores the orgId argument).
+ * Slug-based wrapper around getValidAccessToken. Commands talk in
+ * `<org-slug>` (the user-vocabulary form); the slug → workosOrgId
+ * mapping is contained here so the rest of the CLI doesn't see WorkOS
+ * identifiers.
  *
- * TODO(qfg-kr7.5/7/8/9): callers should pass through the workosOrgId resolved
- * from the workspace address (org-slug/workspace-slug parsing). This helper
- * is the stopgap until each caller's resolution lands in its own bead.
+ * The `QUONFIG_API_KEY` short-circuit fires before any disk lookup, so
+ * an empty/unknown slug is fine in CI mode.
  */
-export async function resolveDefaultOrgId() {
+export async function getValidAccessTokenForOrgSlug(orgSlug, log = noopLog) {
+    const envKey = process.env.QUONFIG_API_KEY;
+    if (envKey && envKey.length > 0)
+        return getValidAccessToken('', log);
     const store = await loadTokens();
-    if (!store)
-        return '';
-    if (store.defaultOrgId && store.tokensByOrg[store.defaultOrgId])
-        return store.defaultOrgId;
-    return Object.keys(store.tokensByOrg)[0] ?? '';
+    if (!store) {
+        throw new Error('Not logged in. Run `qfg login` first.');
+    }
+    const workosOrgId = findOrgIdBySlug(store, orgSlug);
+    if (!workosOrgId) {
+        throw new Error(`No token for org \`${orgSlug}\`. Run \`qfg login\` to add this org.`);
+    }
+    return getValidAccessToken(workosOrgId, log);
 }
 export async function getValidAccessToken(workosOrgId, log = noopLog) {
     const envKey = process.env.QUONFIG_API_KEY;

package/dist/util/gitea-api.d.ts

@@ -18,8 +18,8 @@ export interface GiteaTokenResponse {
      */
     workspaceSlug: string;
 }
-export declare const mintGiteaToken: (workspaceId: string, scope: "read" | "write", purpose: "pull" | "bootstrap" | "push") => Promise<GiteaTokenResponse>;
+export declare const mintGiteaToken: (workspaceId: string, orgSlug: string, scope: "read" | "write", purpose: "pull" | "bootstrap" | "push") => Promise<GiteaTokenResponse>;
 /**
  * Mint a Gitea read token, store it, and return the entry.
  */
-export declare const mintAndStoreGiteaReadToken: (workspaceId: string) => Promise<GiteaTokenEntry>;
+export declare const mintAndStoreGiteaReadToken: (workspaceId: string, orgSlug: string) => Promise<GiteaTokenEntry>;