@quonfig/cli 0.0.30 → 0.0.32

package/README.md

@@ -14,7 +14,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.30 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.32 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -91,7 +91,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -176,7 +176,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -222,7 +222,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -425,7 +425,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -448,7 +448,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -480,7 +480,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/get.ts)_
 
 ## `qfg info [NAME]`
 
@@ -528,7 +528,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -568,7 +568,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -598,7 +598,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -638,7 +638,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/list.ts)_
 
 ## `qfg log-level NAME`
 
@@ -703,7 +703,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -728,7 +728,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -751,7 +751,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -766,7 +766,7 @@ USAGE
 FLAGS
   --api-key=<value>    API key for the legacy source (or set LAUNCH_API_KEY)
   --dir=<value>        Target local workspace directory. Defaults to cwd if it looks like a Quonfig workspace, otherwise
-                       ./quonfig-config.
+                       ./quonfig-repo.
   --dry-run            Fetch and summarize changes without writing anything
   --from=<option>      (required) Legacy source to migrate from
                        <options: launch|launchdarkly|flagsmith>
@@ -794,18 +794,18 @@ DESCRIPTION
   and https://docs.quonfig.com/docs/migrating/troubleshooting when something goes sideways.
 
 EXAMPLES
-  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config
+  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo
 
   $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --workspace acme-prod --push
 
-  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --reset
+  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --reset
 
-  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --dry-run
+  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --dry-run
 
-  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --staging
+  $ qfg migrate --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -843,7 +843,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -875,7 +875,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -906,7 +906,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -961,7 +961,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1053,7 +1053,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/push.ts)_
 
 ## `qfg schema NAME`
 
@@ -1091,7 +1091,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1118,7 +1118,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1150,7 +1150,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1179,7 +1179,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1206,7 +1206,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1277,7 +1277,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -1354,7 +1354,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -1386,7 +1386,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -1488,7 +1488,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -1511,7 +1511,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -1534,7 +1534,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -1567,7 +1567,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -1601,7 +1601,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -1629,7 +1629,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.30/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.32/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/migrate.js

@@ -13,7 +13,7 @@ import { mintGiteaToken } from '../util/gitea-api.js';
 import { displayUrl } from '../util/git-ops.js';
 import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
 import { loadAuthConfig } from '../util/token-storage.js';
-const DEFAULT_DIR = 'quonfig-config';
+const DEFAULT_DIR = 'quonfig-repo';
 export default class Migrate extends BaseCommand {
     static description = 'Migrate flags and configs from a legacy feature-flag system into a Quonfig workspace.\n\n' +
         'Currently supported sources:\n' +
@@ -21,11 +21,11 @@ export default class Migrate extends BaseCommand {
         'See https://docs.quonfig.com/docs/migrating/from-launch for the step-by-step guide,\n' +
         'and https://docs.quonfig.com/docs/migrating/troubleshooting when something goes sideways.';
     static examples = [
-        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config',
+        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo',
         '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --workspace acme-prod --push',
-        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --reset',
-        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --dry-run',
-        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --staging',
+        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --reset',
+        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --dry-run',
+        '<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging',
     ];
     static flags = {
         'api-key': Flags.string({
@@ -33,7 +33,7 @@ export default class Migrate extends BaseCommand {
             env: 'LAUNCH_API_KEY',
         }),
         dir: Flags.string({
-            description: 'Target local workspace directory. Defaults to cwd if it looks like a Quonfig workspace, otherwise ./quonfig-config.',
+            description: 'Target local workspace directory. Defaults to cwd if it looks like a Quonfig workspace, otherwise ./quonfig-repo.',
         }),
         'dry-run': Flags.boolean({
             default: false,

package/dist/commands/pull.d.ts

@@ -8,6 +8,17 @@ export default class Pull extends BaseCommand {
         workspace: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;
+    /**
+     * Wraps `readWorkspaceSlug` so a legacy bare-slug value (`"workspace":
+     * "foo"` instead of `"workspace": "org/foo"`) reads as `undefined`
+     * rather than throwing. The caller then takes the "no pin set" branch
+     * and overwrites with the canonical form, completing the migration.
+     *
+     * Any other parse error still resolves to `undefined` here (and is
+     * verbose-logged) — backfill is non-fatal; the next push surfaces the
+     * real diagnosis.
+     */
+    private readPinTolerant;
     /**
      * Local-only backfill of the `workspace` pin in `quonfig.json`.
      *

package/dist/commands/pull.js

@@ -134,6 +134,25 @@ CLI shortcuts (no JSON editing needed for simple cases):
         await this.backfillWorkspacePin(resolvedDir, tokenEntry, workspaceId, orgSlug);
         return { dir: resolvedDir, workspaceId };
     }
+    /**
+     * Wraps `readWorkspaceSlug` so a legacy bare-slug value (`"workspace":
+     * "foo"` instead of `"workspace": "org/foo"`) reads as `undefined`
+     * rather than throwing. The caller then takes the "no pin set" branch
+     * and overwrites with the canonical form, completing the migration.
+     *
+     * Any other parse error still resolves to `undefined` here (and is
+     * verbose-logged) — backfill is non-fatal; the next push surfaces the
+     * real diagnosis.
+     */
+    async readPinTolerant(dir) {
+        try {
+            return await readWorkspaceSlug(dir);
+        }
+        catch (error) {
+            this.verboseLog('Pull', `quonfig.json workspace pin needs migration: ${String(error)}`);
+            return undefined;
+        }
+    }
     /**
      * Local-only backfill of the `workspace` pin in `quonfig.json`.
      *
@@ -165,18 +184,15 @@ CLI shortcuts (no JSON editing needed for simple cases):
             return;
         }
         // The pin is stored as `<org-slug>/<workspace-slug>`. The backend's
-        // `workspaceSlug` is just the workspace component today; until the
-        // server learns to return the org slug, we can only backfill / compare
-        // when the backend response itself already carries the slash form
-        // (e.g. when later beads in this epic update the API). Otherwise,
-        // skip with a verbose log — pull itself already succeeded.
-        const backendPin = tryParseWorkspacePin(backendSlug);
-        if (!backendPin) {
-            this.verboseLog('Pull', `Backend workspaceSlug "${backendSlug}" is not in <org>/<ws> form; skipping pin backfill.`);
-            return;
-        }
+        // mint-token still returns the bare workspace component; we already
+        // resolved the org separately during workspace lookup, so combine the
+        // two halves locally. If the backend ever upgrades to returning slash
+        // form, tryParseWorkspacePin handles it; the explicit org overrides
+        // any mismatch in favor of the workspace we actually authenticated as.
+        const parsedBackend = tryParseWorkspacePin(backendSlug);
+        const backendPin = parsedBackend ?? { orgSlug, workspaceSlug: backendSlug };
         try {
-            const existingPin = await readWorkspaceSlug(dir);
+            const existingPin = await this.readPinTolerant(dir);
             if (!existingPin) {
                 await writeWorkspaceSlug(dir, backendPin);
                 const formatted = `${backendPin.orgSlug}/${backendPin.workspaceSlug}`;

package/dist/commands/push.js

@@ -67,6 +67,7 @@ Enforces three guards before touching the remote:
             const result = await runPush({
                 dir: resolvedDir,
                 requestedTarget,
+                orgSlug,
                 yes: flags.yes,
                 skipValidate: flags['skip-validate'],
                 noPinWrite: flags['no-pin-write'],

package/dist/commands/whoami.js

@@ -26,12 +26,15 @@ export default class Whoami extends BaseCommand {
         }
         const activeOrgId = await this.resolveActiveOrgId(store.defaultOrgId);
         const memberships = await this.fetchOrganizations();
-        const localOrgs = Object.entries(store.tokensByOrg).map(([orgId, t]) => ({
-            workosOrgId: orgId,
-            slug: t.org_slug ?? orgId,
-            name: t.org_name ?? t.org_slug ?? orgId,
-            role: '—',
-        }));
+        const localOrgs = Object.entries(store.tokensByOrg).map(([orgId, t]) => {
+            this.verboseLog('whoami: token expiry', { orgSlug: t.org_slug ?? orgId, ...describeExpiry(t) });
+            return {
+                workosOrgId: orgId,
+                slug: t.org_slug ?? orgId,
+                name: t.org_name ?? t.org_slug ?? orgId,
+                role: '—',
+            };
+        });
         const merged = mergeMemberships(localOrgs, memberships);
         this.log(`Logged in as: ${userEmail || 'Unknown'}`);
         this.log('Orgs:');
@@ -143,6 +146,25 @@ function mergeMemberships(local, server) {
         merged.set(o.workosOrgId, o);
     return [...merged.values()].sort((a, b) => a.slug.localeCompare(b.slug));
 }
+/**
+ * Verbose-only diagnostic: reports the access token's remaining lifetime.
+ * Access tokens are short-lived (~5 min) and `getValidAccessToken` refreshes
+ * them transparently on next use, so this is informational, not actionable.
+ * The hot stuff — actual refresh failures — is logged from get-valid-token.
+ */
+function describeExpiry(tokens) {
+    let expMs = tokens.expires_at;
+    try {
+        const payload = decodeJWT(tokens.access_token);
+        if (typeof payload.exp === 'number')
+            expMs = payload.exp * 1000;
+    }
+    catch {
+        /* keep stored expires_at */
+    }
+    const delta = expMs - Date.now();
+    return { expired: delta <= 0, expiresAt: expMs, deltaMs: delta };
+}
 function pickAnyOrgId(store) {
     if (store.defaultOrgId && store.tokensByOrg[store.defaultOrgId])
         return store.defaultOrgId;

package/dist/commands/workspace/create.js

@@ -55,10 +55,16 @@ export default class WorkspaceCreate extends BaseCommand {
         const { workosOrgId, orgSlug } = orgResolution;
         let accessToken;
         try {
-            accessToken = await getValidAccessToken(workosOrgId);
+            accessToken = await getValidAccessToken(workosOrgId, this.verboseLog);
         }
-        catch {
-            return this.err('Not logged in. Run `qfg login` first.');
+        catch (error) {
+            // Surface the underlying token error (e.g. "Token refresh failed for
+            // org X: invalid_grant — Refresh token already exchanged") so users
+            // and agents can distinguish "never logged in" from "session went
+            // stale and refresh was rejected" — both used to read "Not logged in".
+            const detail = error instanceof Error ? error.message : String(error);
+            const hint = detail.includes('qfg login') ? '' : ' Run `qfg login` to re-authenticate.';
+            return this.err(`${detail}${hint}`);
         }
         const apiUrl = getApiUrl();
         // The server expects organizationSlug (it resolves to the local org

package/dist/push/run-push.d.ts

@@ -88,6 +88,14 @@ export interface RunPushInput {
     message?: string;
     /** `--no-pin-write` — do not offer to write the slug pin into quonfig.json. */
     noPinWrite: boolean;
+    /**
+     * Caller's resolved org slug for this workspace. Used to construct the
+     * `<org>/<ws>` pin when the backend's mint-token returns just the bare
+     * workspace component (current backend behavior). Optional in tests; if
+     * omitted, pin backfill only runs when the backend already returns the
+     * slash form.
+     */
+    orgSlug?: string;
     /** `--workspace` flag, or the active profile's workspace UUID. Must be non-empty. */
     requestedTarget: string;
     /** `--skip-validate` — suppress the validate step. */

package/dist/push/run-push.js

@@ -72,7 +72,15 @@ export async function runPush(input, deps) {
     // the backend's canonical identity) but we want the pin/origin up front.
     // The pin is `<org>/<ws>`; identity-check still operates on the workspace
     // component until backend responses carry the org slug too (qfg-kr7 epic).
-    const repoPin = await readWorkspaceSlug(input.dir);
+    // A legacy bare-slug pin is treated as "no pin set" so the post-push
+    // backfill can rewrite it to the canonical form.
+    let repoPin;
+    try {
+        repoPin = await readWorkspaceSlug(input.dir);
+    }
+    catch {
+        repoPin = undefined;
+    }
     const repoPinSlug = repoPin?.workspaceSlug;
     const hasGit = await deps.gitOps.isGitRepo(input.dir);
     const remoteOriginUrl = hasGit ? await deps.gitOps.getRemoteOriginUrl(input.dir) : undefined;
@@ -200,12 +208,13 @@ export async function runPush(input, deps) {
         throw new PushFatalError(`Push rejected by server: ${result.message}`, 'BAD_REQUEST');
     }
     if (unpinned && !input.noPinWrite) {
-        // Backend `workspaceSlug` is just the workspace component today; until
-        // it returns the slash form, we can only write the pin when the
-        // response is already in `<org>/<ws>` form. Otherwise skip — the pin
-        // is advisory and will be backfilled by a later `qfg pull` once the
-        // backend learns the new shape (qfg-kr7 epic).
-        const backendPin = tryParseWorkspacePin(backend.workspaceSlug);
+        // The backend's mint-token still returns the bare workspace component;
+        // combine it with the caller-supplied orgSlug locally. If the backend
+        // ever upgrades to slash form, tryParseWorkspacePin handles that case
+        // and we use its parts directly. Without either signal, skip — the
+        // pin is advisory and a partial slash form would be worse than absent.
+        const parsedBackend = tryParseWorkspacePin(backend.workspaceSlug);
+        const backendPin = parsedBackend ?? (input.orgSlug ? { orgSlug: input.orgSlug, workspaceSlug: backend.workspaceSlug } : undefined);
         if (backendPin) {
             try {
                 await writeWorkspaceSlug(input.dir, backendPin);

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.30";
+declare const _default: "0.0.32";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.30';
+export default '0.0.32';

package/oclif.manifest.json

@@ -1085,11 +1085,11 @@
       "args": {},
       "description": "Migrate flags and configs from a legacy feature-flag system into a Quonfig workspace.\n\nCurrently supported sources:\n  launch — Reforge Launch (ported from launch-migrator)\n\nSee https://docs.quonfig.com/docs/migrating/from-launch for the step-by-step guide,\nand https://docs.quonfig.com/docs/migrating/troubleshooting when something goes sideways.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config",
+        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo",
         "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --workspace acme-prod --push",
-        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --reset",
-        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --dry-run",
-        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-config --staging"
+        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --reset",
+        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --dry-run",
+        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging"
       ],
       "flags": {
         "json": {
@@ -1130,7 +1130,7 @@
           "type": "option"
         },
         "dir": {
-          "description": "Target local workspace directory. Defaults to cwd if it looks like a Quonfig workspace, otherwise ./quonfig-config.",
+          "description": "Target local workspace directory. Defaults to cwd if it looks like a Quonfig workspace, otherwise ./quonfig-repo.",
           "name": "dir",
           "hasDynamicHelp": false,
           "multiple": false,
@@ -2910,5 +2910,5 @@
       ]
     }
   },
-  "version": "0.0.30"
+  "version": "0.0.32"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.30",
+  "version": "0.0.32",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },