@quonfig/cli 0.0.60 → 0.0.62

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.60 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.62 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -201,7 +201,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -230,7 +230,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -299,7 +299,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -338,7 +338,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/activity/restore.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -366,7 +366,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -407,7 +407,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -453,7 +453,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -498,7 +498,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -538,7 +538,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -584,7 +584,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -700,7 +700,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -746,7 +746,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -950,7 +950,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1031,7 +1031,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1079,7 +1079,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1119,7 +1119,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1149,7 +1149,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1189,7 +1189,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1214,7 +1214,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1327,7 +1327,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1390,7 +1390,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1428,7 +1428,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1460,7 +1460,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1491,7 +1491,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1546,7 +1546,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1594,7 +1594,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1643,7 +1643,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1694,7 +1694,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1732,7 +1732,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1759,7 +1759,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1791,7 +1791,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1820,7 +1820,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1847,7 +1847,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -1904,7 +1904,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1975,7 +1975,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2052,7 +2052,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2084,7 +2084,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2186,7 +2186,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2209,7 +2209,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2232,7 +2232,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2265,7 +2265,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2299,7 +2299,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2327,7 +2327,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.60/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.62/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/pull.js

@@ -55,7 +55,7 @@ CLI shortcuts (no JSON editing needed for simple cases):
         // Resolve workspace ID — supports both OAuth and QUONFIG_API_KEY paths,
         // mirroring what APICommand does via get-client.ts so `qfg pull` behaves
         // the same in CI as `qfg create` or `qfg push`.
-        const { workspaceId, orgSlug } = await resolveWorkspaceUuid(this, flags.workspace);
+        const { workspaceId, orgSlug } = await resolveWorkspaceUuid(this, flags.workspace, resolvedDir);
         this.verboseLog('Pull', { workspaceId, orgSlug, dir: resolvedDir });
         // Get or mint Gitea read token
         const tokenEntry = await this.resolveTokenEntry(workspaceId, orgSlug);

package/dist/commands/push.js

@@ -66,7 +66,7 @@ Enforces three guards before touching the remote:
         // Resolve requested target. --workspace > QUONFIG_WORKSPACE > active OAuth
         // profile. Supports API-key mode for headless runs so `qfg push` behaves
         // the same way `qfg create` does (both resolve via resolve-workspace.ts).
-        const { workspaceId: requestedTarget, orgSlug } = await resolveWorkspaceUuid(this, flags.workspace);
+        const { workspaceId: requestedTarget, orgSlug } = await resolveWorkspaceUuid(this, flags.workspace, resolvedDir);
         const { deps, cleanup } = buildRealDeps(this, orgSlug);
         try {
             const result = await runPush({

package/dist/commands/sync.d.ts

@@ -16,4 +16,12 @@ export default class Sync extends BaseCommand {
     private looksLike401;
     private refreshToken;
     private runSync;
+    /**
+     * Point `origin` at `repoUrl`, but refuse first if the dir already has a
+     * remote pointing at a DIFFERENT workspace (qfg-08i). Without this guard,
+     * `qfg sync --dir ./our-config` under an unrelated active profile silently
+     * rewrites origin to the wrong repo and fetches it in, producing phantom
+     * "diverged" state. Mirrors the guard `qfg pull` runs (qfg-glrd.3).
+     */
+    private setRemoteGuarded;
 }

package/dist/commands/sync.js

@@ -3,8 +3,9 @@ import { Flags } from '@oclif/core';
 import { BaseCommand } from '../index.js';
 import { loadGiteaToken, isGiteaTokenExpired, saveGiteaToken } from '../util/gitea-token-storage.js';
 import { mintGiteaToken } from '../util/gitea-api.js';
+import { evaluateOriginGuard } from '../push/identity-check.js';
 import { resolveWorkspaceUuid } from '../util/resolve-workspace.js';
-import { isGitRepo, isWorkingTreeClean, gitFetch, canFastForward, hasDivergedFromRemote, gitMergeFfOnly, gitSetRemote, } from '../util/git-ops.js';
+import { isGitRepo, isWorkingTreeClean, gitFetch, canFastForward, hasDivergedFromRemote, gitMergeFfOnly, gitSetRemote, getAllRemoteUrls, getRemoteUrl, displayUrl, } from '../util/git-ops.js';
 const sleep = (ms) => new Promise((resolve) => {
     setTimeout(resolve, ms);
 });
@@ -39,7 +40,7 @@ export default class Sync extends BaseCommand {
             return this.err('No directory specified. Use --dir <path> or set QUONFIG_DIR.');
         }
         this.resolvedDir = path.resolve(dir);
-        const resolved = await resolveWorkspaceUuid(this);
+        const resolved = await resolveWorkspaceUuid(this, undefined, this.resolvedDir);
         this.workspaceId = resolved.workspaceId;
         this.orgSlug = resolved.orgSlug;
         // Validate the directory is a git repo
@@ -68,7 +69,7 @@ export default class Sync extends BaseCommand {
             await this.refreshToken();
             return;
         }
-        await gitSetRemote(this.resolvedDir, entry.repoUrl);
+        await this.setRemoteGuarded(entry.repoUrl);
     }
     looksLike401(err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -78,7 +79,7 @@ export default class Sync extends BaseCommand {
         const data = await mintGiteaToken(this.workspaceId, this.orgSlug, 'read', 'pull');
         const entry = { token: data.token, repoUrl: data.repoUrl, expiresAt: data.expiresAt };
         await saveGiteaToken(this.workspaceId, entry);
-        await gitSetRemote(this.resolvedDir, entry.repoUrl);
+        await this.setRemoteGuarded(entry.repoUrl);
         this.verboseLog('Sync', 'Token refreshed.');
     }
     async runSync() {
@@ -136,4 +137,31 @@ export default class Sync extends BaseCommand {
             }
         }
     }
+    /**
+     * Point `origin` at `repoUrl`, but refuse first if the dir already has a
+     * remote pointing at a DIFFERENT workspace (qfg-08i). Without this guard,
+     * `qfg sync --dir ./our-config` under an unrelated active profile silently
+     * rewrites origin to the wrong repo and fetches it in, producing phantom
+     * "diverged" state. Mirrors the guard `qfg pull` runs (qfg-glrd.3).
+     */
+    async setRemoteGuarded(repoUrl) {
+        const allRemotes = await getAllRemoteUrls(this.resolvedDir);
+        const originUrl = await getRemoteUrl(this.resolvedDir);
+        const guard = evaluateOriginGuard(allRemotes, originUrl, repoUrl);
+        if (guard.kind === 'no-quonfig-remote') {
+            const remoteList = allRemotes.map((r) => `  - ${displayUrl(r)}`).join('\n');
+            this.error(`Refusing to sync ${this.resolvedDir}: no configured git remote matches the resolved Quonfig workspace.\n` +
+                `Configured remotes:\n${remoteList}\n` +
+                `Expected: ${displayUrl(repoUrl)}\n\n` +
+                `This usually means the active workspace doesn't match this directory. Pin it in quonfig.json ` +
+                `(\`"workspace": "<org>/<ws>"\`) or pass the right workspace, then retry — sync will not rewrite origin.`, { exit: 1 });
+        }
+        if (guard.kind === 'not-origin') {
+            this.error(`Refusing to sync ${this.resolvedDir}: the Quonfig remote is not named "origin".\n` +
+                `  matching remote: ${displayUrl(guard.matching)}\n` +
+                `  origin:          ${originUrl ? displayUrl(originUrl) : '(unset)'}\n\n` +
+                `Rename the Quonfig remote to origin, or point origin at ${displayUrl(repoUrl)}.`, { exit: 1 });
+        }
+        await gitSetRemote(this.resolvedDir, repoUrl);
+    }
 }

package/dist/push/identity-check.d.ts

@@ -72,3 +72,24 @@ export declare function checkIdentity(input: IdentityCheckInput): IdentityCheckO
  * to embed a fresh token).
  */
 export declare function findQuonfigRemote(remotes: string[], backendRepoUrl: string): string | undefined;
+export type OriginGuardResult = {
+    kind: 'ok';
+} | {
+    kind: 'no-quonfig-remote';
+} | {
+    kind: 'not-origin';
+    matching: string;
+};
+/**
+ * Decide — WITHOUT mutating git — whether a working dir's remotes are safe to
+ * point at `backendRepoUrl`. Pure, so it unit-tests cleanly. Mirrors the
+ * inline guard `qfg pull` already runs (qfg-glrd.3); `qfg sync` uses it so it
+ * stops blindly rewriting `origin` to the active workspace and corrupting a
+ * dir pinned to a different one (qfg-08i).
+ *
+ *  - No remotes configured        -> 'ok' (fresh dir; caller may set origin).
+ *  - A remote matches & is origin  -> 'ok'.
+ *  - A remote matches but isn't origin -> 'not-origin' (refuse; don't clobber).
+ *  - Remotes exist, none match     -> 'no-quonfig-remote' (refuse).
+ */
+export declare function evaluateOriginGuard(allRemotes: string[], originUrl: string | null, backendRepoUrl: string): OriginGuardResult;

package/dist/push/identity-check.js

@@ -188,3 +188,27 @@ export function findQuonfigRemote(remotes, backendRepoUrl) {
     }
     return undefined;
 }
+/**
+ * Decide — WITHOUT mutating git — whether a working dir's remotes are safe to
+ * point at `backendRepoUrl`. Pure, so it unit-tests cleanly. Mirrors the
+ * inline guard `qfg pull` already runs (qfg-glrd.3); `qfg sync` uses it so it
+ * stops blindly rewriting `origin` to the active workspace and corrupting a
+ * dir pinned to a different one (qfg-08i).
+ *
+ *  - No remotes configured        -> 'ok' (fresh dir; caller may set origin).
+ *  - A remote matches & is origin  -> 'ok'.
+ *  - A remote matches but isn't origin -> 'not-origin' (refuse; don't clobber).
+ *  - Remotes exist, none match     -> 'no-quonfig-remote' (refuse).
+ */
+export function evaluateOriginGuard(allRemotes, originUrl, backendRepoUrl) {
+    if (allRemotes.length === 0)
+        return { kind: 'ok' };
+    const matching = findQuonfigRemote(allRemotes, backendRepoUrl);
+    if (!matching)
+        return { kind: 'no-quonfig-remote' };
+    const target = normalizeRemoteUrl(backendRepoUrl);
+    const originMatches = originUrl !== null && normalizeRemoteUrl(originUrl) === target;
+    if (!originMatches)
+        return { kind: 'not-origin', matching };
+    return { kind: 'ok' };
+}

package/dist/util/resolve-workspace.d.ts

@@ -14,11 +14,19 @@ export interface ResolvedWorkspace {
  * don't extend APICommand (e.g. pull, push — which talk to Gitea, not the
  * oRPC API, but still need to mint a Gitea token for the right org).
  *
- * Handles all three auth paths in the same order as util/get-client.ts:
- *   1. QUONFIG_API_KEY + QUONFIG_WORKSPACE (or --workspace flag) — CI/headless.
- *   2. OAuth profile — the default interactive path.
+ * Resolution precedence (qfg-08i):
+ *   1. --workspace flag
+ *   2. QUONFIG_WORKSPACE env
+ *   3. the target dir's quonfig.json `workspace` pin (when `dir` is given)
+ *   4. active OAuth profile / QUONFIG_API_KEY + QUONFIG_WORKSPACE
+ *
+ * Ranking the pin above the active profile makes a pinned workspace dir
+ * self-describing: a bare `qfg pull`/`qfg sync` inside it targets the pinned
+ * workspace no matter which workspace the user's default profile points at.
+ * Without this, `qfg sync --dir ./our-config` under an unrelated active
+ * profile would rewrite that dir's git origin to the wrong workspace.
  *
  * Mirrors the error messages from get-client.ts so behavior feels identical
  * whether you're hitting the API directly or going through Gitea.
  */
-export declare function resolveWorkspaceUuid(command: BaseCommand, flagOverride?: string): Promise<ResolvedWorkspace>;
+export declare function resolveWorkspaceUuid(command: BaseCommand, flagOverride?: string, dir?: string): Promise<ResolvedWorkspace>;

package/dist/util/resolve-workspace.js

@@ -1,6 +1,6 @@
 import { getApiUrl } from './domain-urls.js';
 import { getValidAccessToken } from './get-valid-token.js';
-import { tryParseWorkspacePin } from './quonfig-json.js';
+import { readWorkspaceSlug, tryParseWorkspacePin } from './quonfig-json.js';
 import { findOrgIdBySlug, getActiveProfile, loadAuthConfig, loadTokens, saveAuthConfig, } from './token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 const BARE_SLUG_ENV_MIGRATION_MESSAGE = 'QUONFIG_WORKSPACE must be in org/workspace form (e.g. acme/foo). ' +
@@ -10,15 +10,26 @@ const BARE_SLUG_ENV_MIGRATION_MESSAGE = 'QUONFIG_WORKSPACE must be in org/worksp
  * don't extend APICommand (e.g. pull, push — which talk to Gitea, not the
  * oRPC API, but still need to mint a Gitea token for the right org).
  *
- * Handles all three auth paths in the same order as util/get-client.ts:
- *   1. QUONFIG_API_KEY + QUONFIG_WORKSPACE (or --workspace flag) — CI/headless.
- *   2. OAuth profile — the default interactive path.
+ * Resolution precedence (qfg-08i):
+ *   1. --workspace flag
+ *   2. QUONFIG_WORKSPACE env
+ *   3. the target dir's quonfig.json `workspace` pin (when `dir` is given)
+ *   4. active OAuth profile / QUONFIG_API_KEY + QUONFIG_WORKSPACE
+ *
+ * Ranking the pin above the active profile makes a pinned workspace dir
+ * self-describing: a bare `qfg pull`/`qfg sync` inside it targets the pinned
+ * workspace no matter which workspace the user's default profile points at.
+ * Without this, `qfg sync --dir ./our-config` under an unrelated active
+ * profile would rewrite that dir's git origin to the wrong workspace.
  *
  * Mirrors the error messages from get-client.ts so behavior feels identical
  * whether you're hitting the API directly or going through Gitea.
  */
-export async function resolveWorkspaceUuid(command, flagOverride) {
-    const override = flagOverride ?? process.env.QUONFIG_WORKSPACE;
+export async function resolveWorkspaceUuid(command, flagOverride, dir) {
+    // The pin only acts as a fallback BELOW the flag and env var, so a user can
+    // always point a pinned dir at a different workspace for a one-off command.
+    const pinOverride = flagOverride || process.env.QUONFIG_WORKSPACE ? undefined : await readPinOverride(command, dir);
+    const override = flagOverride ?? process.env.QUONFIG_WORKSPACE ?? pinOverride;
     const apiKey = process.env.QUONFIG_API_KEY;
     if (apiKey && apiKey.length > 0) {
         if (!override) {
@@ -93,6 +104,33 @@ export async function resolveWorkspaceUuid(command, flagOverride) {
     }
     return { workspaceId: profileData.workspace, orgSlug: profileData.organizationSlug };
 }
+/**
+ * Read the `<org>/<ws>` workspace pin from `<dir>/quonfig.json`, returning it
+ * as the same override string the flag/env path accepts. Returns `undefined`
+ * when no dir is given, the file/field is absent, or the pin can't be parsed
+ * (e.g. a legacy bare slug) — resolution then falls through to the active
+ * profile, exactly as before this fix. A malformed pin must never crash
+ * `qfg pull`/`qfg sync`, so all errors degrade to `undefined` with a verbose
+ * log rather than propagating.
+ */
+async function readPinOverride(command, dir) {
+    if (!dir)
+        return undefined;
+    try {
+        const pin = await readWorkspaceSlug(dir);
+        if (!pin)
+            return undefined;
+        command.verboseLog('resolve-workspace: using quonfig.json pin', pin);
+        return `${pin.orgSlug}/${pin.workspaceSlug}`;
+    }
+    catch (error) {
+        command.verboseLog('resolve-workspace: ignoring unreadable quonfig.json pin', {
+            dir,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+}
 /**
  * OAuth-mode resolver for an explicit `<org-slug>/<workspace-slug>` override.
  *

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.60";
+declare const _default: "0.0.62";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.60';
+export default '0.0.62';

package/oclif.manifest.json

@@ -3417,13 +3417,15 @@
         "verify.js"
       ]
     },
-    "sdk-key:create": {
+    "migrate:doctor": {
       "aliases": [],
       "args": {},
-      "description": "Create a new SDK key",
+      "description": "Preflight health checks for `qfg migrate`. Verifies auth, workspace provisioning, working tree, and identifier collisions.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> --environment production --type server",
-        "<%= config.bin %> <%= command.id %> --environment staging --type browser"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY",
+        "<%= config.bin %> <%= command.id %> --dir ./my-workspace --language node",
+        "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
@@ -3455,53 +3457,45 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "workspace": {
-          "char": "w",
-          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
-          "helpGroup": "GLOBAL",
-          "name": "workspace",
+        "api-key": {
+          "description": "Legacy SDK API key to validate against the source",
+          "name": "api-key",
           "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "profile": {
-          "char": "p",
-          "description": "Deprecated: use --workspace instead",
-          "helpGroup": "GLOBAL",
-          "hidden": true,
-          "name": "profile",
-          "required": false,
+        "dir": {
+          "description": "Workspace directory to check (git clean / identifier map)",
+          "name": "dir",
+          "default": ".",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "environment": {
-          "char": "e",
-          "description": "Environment name (e.g. production, staging)",
-          "name": "environment",
-          "required": false,
+        "from": {
+          "description": "Legacy SDK to migrate from",
+          "name": "from",
+          "default": "launch",
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "launch"
+          ],
           "type": "option"
         },
-        "type": {
-          "char": "t",
-          "description": "Key type: server (backend) or browser (frontend)",
-          "name": "type",
+        "language": {
+          "description": "Customer SDK language — used to warn when datadir mode is unavailable (e.g. javascript-browser)",
+          "name": "language",
           "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "server",
-            "browser"
-          ],
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "sdk-key:create",
+      "id": "migrate:doctor",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3511,17 +3505,18 @@
       "relativePath": [
         "dist",
         "commands",
-        "sdk-key",
-        "create.js"
+        "migrate",
+        "doctor.js"
       ]
     },
-    "sdk-key:list": {
+    "migrate:my-code": {
       "aliases": [],
       "args": {},
-      "description": "List SDK keys for your workspace",
+      "description": "Migrate Launch SDK call sites in your codebase to Quonfig SDK call sites (invokes the qfg-migrate-code Claude skill)",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --environment production"
+        "<%= config.bin %> <%= command.id %> --from launch",
+        "<%= config.bin %> <%= command.id %> --dry-run"
       ],
       "flags": {
         "json": {
@@ -3553,40 +3548,27 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "workspace": {
-          "char": "w",
-          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
-          "helpGroup": "GLOBAL",
-          "name": "workspace",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "char": "p",
-          "description": "Deprecated: use --workspace instead",
-          "helpGroup": "GLOBAL",
-          "hidden": true,
-          "name": "profile",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "dry-run": {
+          "description": "Show what would be migrated without editing any files",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
         },
-        "environment": {
-          "char": "e",
-          "description": "Filter by environment name",
-          "name": "environment",
-          "required": false,
+        "from": {
+          "description": "Legacy SDK to migrate from",
+          "name": "from",
+          "default": "launch",
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "launch"
+          ],
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "sdk-key:list",
+      "id": "migrate:my-code",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3596,22 +3578,18 @@
       "relativePath": [
         "dist",
         "commands",
-        "sdk-key",
-        "list.js"
+        "migrate",
+        "my-code.js"
       ]
     },
-    "sdk-key:revoke": {
+    "migrate:status": {
       "aliases": [],
-      "args": {
-        "keyId": {
-          "description": "ID of the SDK key to revoke",
-          "name": "keyId",
-          "required": true
-        }
-      },
-      "description": "Revoke an SDK key by its ID",
+      "args": {},
+      "description": "Show the status of a workspace migrated with `qfg migrate`. Reads .qf/import-state.json and summarizes source, counts, and next steps.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> a1b2c3d4-e5f6-7890-abcd-ef1234567890"
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> --dir ./my-workspace",
+        "<%= config.bin %> <%= command.id %> --json"
       ],
       "flags": {
         "json": {
@@ -3643,23 +3621,10 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "workspace": {
-          "char": "w",
-          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
-          "helpGroup": "GLOBAL",
-          "name": "workspace",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "profile": {
-          "char": "p",
-          "description": "Deprecated: use --workspace instead",
-          "helpGroup": "GLOBAL",
-          "hidden": true,
-          "name": "profile",
-          "required": false,
+        "dir": {
+          "description": "Workspace directory to inspect",
+          "name": "dir",
+          "default": ".",
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -3667,7 +3632,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "sdk-key:revoke",
+      "id": "migrate:status",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3677,19 +3642,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "sdk-key",
-        "revoke.js"
+        "migrate",
+        "status.js"
       ]
     },
-    "migrate:doctor": {
+    "sdk-key:create": {
       "aliases": [],
       "args": {},
-      "description": "Preflight health checks for `qfg migrate`. Verifies auth, workspace provisioning, working tree, and identifier collisions.",
+      "description": "Create a new SDK key",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --from launch --api-key $LAUNCH_API_KEY",
-        "<%= config.bin %> <%= command.id %> --dir ./my-workspace --language node",
-        "<%= config.bin %> <%= command.id %> --json"
+        "<%= config.bin %> <%= command.id %> --environment production --type server",
+        "<%= config.bin %> <%= command.id %> --environment staging --type browser"
       ],
       "flags": {
         "json": {
@@ -3721,45 +3684,53 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "api-key": {
-          "description": "Legacy SDK API key to validate against the source",
-          "name": "api-key",
+        "workspace": {
+          "char": "w",
+          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
+          "helpGroup": "GLOBAL",
+          "name": "workspace",
           "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "dir": {
-          "description": "Workspace directory to check (git clean / identifier map)",
-          "name": "dir",
-          "default": ".",
+        "profile": {
+          "char": "p",
+          "description": "Deprecated: use --workspace instead",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "profile",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "from": {
-          "description": "Legacy SDK to migrate from",
-          "name": "from",
-          "default": "launch",
+        "environment": {
+          "char": "e",
+          "description": "Environment name (e.g. production, staging)",
+          "name": "environment",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "launch"
-          ],
           "type": "option"
         },
-        "language": {
-          "description": "Customer SDK language — used to warn when datadir mode is unavailable (e.g. javascript-browser)",
-          "name": "language",
+        "type": {
+          "char": "t",
+          "description": "Key type: server (backend) or browser (frontend)",
+          "name": "type",
           "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
+          "options": [
+            "server",
+            "browser"
+          ],
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "migrate:doctor",
+      "id": "sdk-key:create",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3769,18 +3740,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "migrate",
-        "doctor.js"
+        "sdk-key",
+        "create.js"
       ]
     },
-    "migrate:my-code": {
+    "sdk-key:list": {
       "aliases": [],
       "args": {},
-      "description": "Migrate Launch SDK call sites in your codebase to Quonfig SDK call sites (invokes the qfg-migrate-code Claude skill)",
+      "description": "List SDK keys for your workspace",
       "examples": [
         "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --from launch",
-        "<%= config.bin %> <%= command.id %> --dry-run"
+        "<%= config.bin %> <%= command.id %> --environment production"
       ],
       "flags": {
         "json": {
@@ -3812,27 +3782,40 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "dry-run": {
-          "description": "Show what would be migrated without editing any files",
-          "name": "dry-run",
-          "allowNo": false,
-          "type": "boolean"
+        "workspace": {
+          "char": "w",
+          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
+          "helpGroup": "GLOBAL",
+          "name": "workspace",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         },
-        "from": {
-          "description": "Legacy SDK to migrate from",
-          "name": "from",
-          "default": "launch",
+        "profile": {
+          "char": "p",
+          "description": "Deprecated: use --workspace instead",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "profile",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "environment": {
+          "char": "e",
+          "description": "Filter by environment name",
+          "name": "environment",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
-          "options": [
-            "launch"
-          ],
           "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "migrate:my-code",
+      "id": "sdk-key:list",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3842,18 +3825,22 @@
       "relativePath": [
         "dist",
         "commands",
-        "migrate",
-        "my-code.js"
+        "sdk-key",
+        "list.js"
       ]
     },
-    "migrate:status": {
+    "sdk-key:revoke": {
       "aliases": [],
-      "args": {},
-      "description": "Show the status of a workspace migrated with `qfg migrate`. Reads .qf/import-state.json and summarizes source, counts, and next steps.",
+      "args": {
+        "keyId": {
+          "description": "ID of the SDK key to revoke",
+          "name": "keyId",
+          "required": true
+        }
+      },
+      "description": "Revoke an SDK key by its ID",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> --dir ./my-workspace",
-        "<%= config.bin %> <%= command.id %> --json"
+        "<%= config.bin %> <%= command.id %> a1b2c3d4-e5f6-7890-abcd-ef1234567890"
       ],
       "flags": {
         "json": {
@@ -3885,10 +3872,23 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "dir": {
-          "description": "Workspace directory to inspect",
-          "name": "dir",
-          "default": ".",
+        "workspace": {
+          "char": "w",
+          "description": "Workspace slug to use (overrides QUONFIG_WORKSPACE env var and saved default)",
+          "helpGroup": "GLOBAL",
+          "name": "workspace",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "profile": {
+          "char": "p",
+          "description": "Deprecated: use --workspace instead",
+          "helpGroup": "GLOBAL",
+          "hidden": true,
+          "name": "profile",
+          "required": false,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -3896,7 +3896,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "migrate:status",
+      "id": "sdk-key:revoke",
       "pluginAlias": "@quonfig/cli",
       "pluginName": "@quonfig/cli",
       "pluginType": "core",
@@ -3906,8 +3906,8 @@
       "relativePath": [
         "dist",
         "commands",
-        "migrate",
-        "status.js"
+        "sdk-key",
+        "revoke.js"
       ]
     },
     "workspace:bootstrap": {
@@ -4126,5 +4126,5 @@
       ]
     }
   },
-  "version": "0.0.60"
+  "version": "0.0.62"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.60",
+  "version": "0.0.62",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },
@@ -21,7 +21,7 @@
     "@oclif/core": "^3.18.2",
     "@oclif/plugin-help": "^6",
     "@oclif/plugin-plugins": "^4",
-    "@quonfig/node": "^0.0.32",
+    "@quonfig/node": "^1.0.0",
     "acorn": "^8.10.0",
     "acorn-walk": "^8.3.5",
     "chalk": "^5.6.2",