@quonfig/cli 0.0.71 → 0.0.72

package/README.md

@@ -17,7 +17,7 @@ $ npm install -g @quonfig/cli
 $ qfg COMMAND
 running command...
 $ qfg (--version)
-@quonfig/cli/0.0.71 linux-x64 node-v24.4.1
+@quonfig/cli/0.0.72 linux-x64 node-v24.4.1
 $ qfg --help [COMMAND]
 USAGE
   $ qfg COMMAND
@@ -201,7 +201,7 @@ EXAMPLES
   $ qfg activity restore my.flag --yes
 ```
 
-_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/activity.ts)_
+_See code: [src/commands/activity.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/activity.ts)_
 
 ## `qfg activity deleted`
 
@@ -230,7 +230,7 @@ EXAMPLES
   $ qfg activity deleted --json
 ```
 
-_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/activity/deleted.ts)_
+_See code: [src/commands/activity/deleted.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/activity/deleted.ts)_
 
 ## `qfg activity feed`
 
@@ -265,7 +265,7 @@ EXAMPLES
   $ qfg activity feed --json
 ```
 
-_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/activity/feed.ts)_
+_See code: [src/commands/activity/feed.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/activity/feed.ts)_
 
 ## `qfg activity history [NAME]`
 
@@ -299,7 +299,7 @@ EXAMPLES
   $ qfg activity history request.timeout --json
 ```
 
-_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/activity/history.ts)_
+_See code: [src/commands/activity/history.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/activity/history.ts)_
 
 ## `qfg activity restore [NAME]`
 
@@ -338,7 +338,7 @@ EXAMPLES
   $ qfg activity restore request.timeout --type config --yes
 ```
 
-_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/activity/restore.ts)_
+_See code: [src/commands/activity/restore.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/activity/restore.ts)_
 
 ## `qfg audit-log [NAME]`
 
@@ -366,7 +366,7 @@ EXAMPLES
   $ qfg audit-log my.flag
 ```
 
-_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/audit-log.ts)_
+_See code: [src/commands/audit-log.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/audit-log.ts)_
 
 ## `qfg cleanup`
 
@@ -407,7 +407,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key
 ```
 
-_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/cleanup.ts)_
+_See code: [src/commands/cleanup.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/cleanup.ts)_
 
 ## `qfg cleanup list`
 
@@ -453,7 +453,7 @@ EXAMPLES
   $ qfg cleanup list --json
 ```
 
-_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/cleanup/list.ts)_
+_See code: [src/commands/cleanup/list.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/cleanup/list.ts)_
 
 ## `qfg cleanup remove [NAME]`
 
@@ -498,7 +498,7 @@ EXAMPLES
   $ qfg cleanup remove my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/cleanup/remove.ts)_
+_See code: [src/commands/cleanup/remove.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/cleanup/remove.ts)_
 
 ## `qfg cleanup status [NAME]`
 
@@ -538,7 +538,7 @@ EXAMPLES
   $ qfg cleanup status my.flag.key --json
 ```
 
-_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/cleanup/status.ts)_
+_See code: [src/commands/cleanup/status.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/cleanup/status.ts)_
 
 ## `qfg cleanup verify [NAME]`
 
@@ -584,7 +584,7 @@ EXAMPLES
   $ qfg cleanup verify my.flag.key && qfg delete my.flag.key
 ```
 
-_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/cleanup/verify.ts)_
+_See code: [src/commands/cleanup/verify.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/cleanup/verify.ts)_
 
 ## `qfg config-schema`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ qfg config-schema --json-schema    # full JSON Schema document (copy into your editor)
 ```
 
-_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/config-schema.ts)_
+_See code: [src/commands/config-schema.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/config-schema.ts)_
 
 ## `qfg create NAME`
 
@@ -700,7 +700,7 @@ EXAMPLES
   $ qfg set-rollout my.new.flag --environment production --true-percent 20
 ```
 
-_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/create.ts)_
+_See code: [src/commands/create.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/create.ts)_
 
 ## `qfg delete NAME`
 
@@ -746,7 +746,7 @@ EXAMPLES
   $ qfg delete my.config --yes
 ```
 
-_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/delete.ts)_
+_See code: [src/commands/delete.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/delete.ts)_
 
 ## `qfg flag info [NAME]`
 
@@ -950,7 +950,7 @@ EXAMPLES
   $ qfg generate --targets node-ts -o ./dist # combine with targets
 ```
 
-_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/generate.ts)_
+_See code: [src/commands/generate.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/generate.ts)_
 
 ## `qfg generate-new-hex-key`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ qfg generate-new-hex-key
 ```
 
-_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/generate-new-hex-key.ts)_
+_See code: [src/commands/generate-new-hex-key.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/generate-new-hex-key.ts)_
 
 ## `qfg get [NAME]`
 
@@ -1005,7 +1005,7 @@ EXAMPLES
   $ qfg get my.config.name --environment=production
 ```
 
-_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/get.ts)_
+_See code: [src/commands/get.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/get.ts)_
 
 ## `qfg history NAME`
 
@@ -1031,7 +1031,7 @@ EXAMPLES
   $ qfg history my.flag
 ```
 
-_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/history.ts)_
+_See code: [src/commands/history.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/history.ts)_
 
 ## `qfg info [NAME]`
 
@@ -1079,7 +1079,7 @@ EXAMPLES
   $ qfg info my.config.name --exclude-evaluations   # skip 24h stats
 ```
 
-_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/info.ts)_
+_See code: [src/commands/info.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/info.ts)_
 
 ## `qfg init [DIRECTORY]`
 
@@ -1119,7 +1119,7 @@ EXAMPLES
   $ qfg init --dry-run
 ```
 
-_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/init.ts)_
+_See code: [src/commands/init.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/init.ts)_
 
 ## `qfg interactive`
 
@@ -1149,7 +1149,7 @@ EXAMPLES
   $ qfg
 ```
 
-_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/interactive.ts)_
+_See code: [src/commands/interactive.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/interactive.ts)_
 
 ## `qfg list`
 
@@ -1189,7 +1189,7 @@ EXAMPLES
   $ qfg list --feature-flags
 ```
 
-_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/list.ts)_
+_See code: [src/commands/list.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/list.ts)_
 
 ## `qfg log`
 
@@ -1214,7 +1214,7 @@ EXAMPLES
   $ qfg log --limit 5
 ```
 
-_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/log.ts)_
+_See code: [src/commands/log.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/log.ts)_
 
 ## `qfg log-level NAME`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ qfg log-level log-level.my-app --target=Chatty --value=INFO --environment=production
 ```
 
-_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/log-level.ts)_
+_See code: [src/commands/log-level.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/log-level.ts)_
 
 ## `qfg login`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ qfg login --profile myprofile
 ```
 
-_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/login.ts)_
+_See code: [src/commands/login.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/login.ts)_
 
 ## `qfg logout`
 
@@ -1327,7 +1327,7 @@ EXAMPLES
   $ qfg logout
 ```
 
-_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/logout.ts)_
+_See code: [src/commands/logout.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/logout.ts)_
 
 ## `qfg migrate`
 
@@ -1392,7 +1392,7 @@ EXAMPLES
   $ qfg migrate --from launch --source-api-key $LAUNCH_API_KEY --dir ./quonfig-repo --staging
 ```
 
-_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/migrate.ts)_
+_See code: [src/commands/migrate.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/migrate.ts)_
 
 ## `qfg migrate doctor`
 
@@ -1430,7 +1430,7 @@ EXAMPLES
   $ qfg migrate doctor --json
 ```
 
-_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/migrate/doctor.ts)_
+_See code: [src/commands/migrate/doctor.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/migrate/doctor.ts)_
 
 ## `qfg migrate my-code`
 
@@ -1462,7 +1462,7 @@ EXAMPLES
   $ qfg migrate my-code --dry-run
 ```
 
-_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/migrate/my-code.ts)_
+_See code: [src/commands/migrate/my-code.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/migrate/my-code.ts)_
 
 ## `qfg migrate status`
 
@@ -1493,7 +1493,7 @@ EXAMPLES
   $ qfg migrate status --json
 ```
 
-_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/migrate/status.ts)_
+_See code: [src/commands/migrate/status.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/migrate/status.ts)_
 
 ## `qfg override [NAME] [VALUE]`
 
@@ -1548,7 +1548,7 @@ EXAMPLES
   $ qfg override my.flag true --env=staging
 ```
 
-_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/override.ts)_
+_See code: [src/commands/override.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/override.ts)_
 
 ## `qfg pull`
 
@@ -1595,7 +1595,7 @@ EXAMPLES
   $ qfg pull  # uses QUONFIG_DIR env var
 ```
 
-_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/pull.ts)_
+_See code: [src/commands/pull.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/pull.ts)_
 
 ## `qfg push`
 
@@ -1644,7 +1644,7 @@ EXAMPLES
   $ qfg push --dir ./our-config --yes
 ```
 
-_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/push.ts)_
+_See code: [src/commands/push.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/push.ts)_
 
 ## `qfg run [COMMAND]`
 
@@ -1695,7 +1695,7 @@ EXAMPLES
   $ qfg run --env DATABASE_URL=db.url --preserve-env --environment=staging -- npm test
 ```
 
-_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/run.ts)_
+_See code: [src/commands/run.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/run.ts)_
 
 ## `qfg schema NAME`
 
@@ -1733,7 +1733,7 @@ EXAMPLES
   $ qfg schema my-schema --set-json-schema=@schemas/my-schema.json --protected
 ```
 
-_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/schema.ts)_
+_See code: [src/commands/schema.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/schema.ts)_
 
 ## `qfg sdk-key`
 
@@ -1760,7 +1760,7 @@ EXAMPLES
   $ qfg sdk-key revoke <key-id>
 ```
 
-_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/sdk-key.ts)_
+_See code: [src/commands/sdk-key.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/sdk-key.ts)_
 
 ## `qfg sdk-key create`
 
@@ -1792,7 +1792,7 @@ EXAMPLES
   $ qfg sdk-key create --environment staging --type browser
 ```
 
-_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/sdk-key/create.ts)_
+_See code: [src/commands/sdk-key/create.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/sdk-key/create.ts)_
 
 ## `qfg sdk-key list`
 
@@ -1821,7 +1821,7 @@ EXAMPLES
   $ qfg sdk-key list --environment production
 ```
 
-_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/sdk-key/list.ts)_
+_See code: [src/commands/sdk-key/list.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/sdk-key/list.ts)_
 
 ## `qfg sdk-key revoke KEYID`
 
@@ -1848,7 +1848,7 @@ EXAMPLES
   $ qfg sdk-key revoke a1b2c3d4-e5f6-7890-abcd-ef1234567890
 ```
 
-_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/sdk-key/revoke.ts)_
+_See code: [src/commands/sdk-key/revoke.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/sdk-key/revoke.ts)_
 
 ## `qfg serve`
 
@@ -1905,7 +1905,7 @@ EXAMPLES
   $ qfg serve --port 6581 --frontend-sdk-key PUBLIC_KEY
 ```
 
-_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/serve.ts)_
+_See code: [src/commands/serve.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/serve.ts)_
 
 ## `qfg set-default [NAME]`
 
@@ -1976,7 +1976,7 @@ EXAMPLES
   $ qfg pull && qfg config-schema
 ```
 
-_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/set-default.ts)_
+_See code: [src/commands/set-default.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/set-default.ts)_
 
 ## `qfg set-rollout [NAME]`
 
@@ -2053,7 +2053,7 @@ EXAMPLES
   $ qfg set-rollout my.variant.flag --environment production --weights "a:33,b:33,c:34" --hash-by user.id
 ```
 
-_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/set-rollout.ts)_
+_See code: [src/commands/set-rollout.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/set-rollout.ts)_
 
 ## `qfg sync`
 
@@ -2085,7 +2085,7 @@ EXAMPLES
   $ qfg sync --watch --dir ./our-config --interval 30
 ```
 
-_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/sync.ts)_
+_See code: [src/commands/sync.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/sync.ts)_
 
 ## `qfg toggle [NAME]`
 
@@ -2187,7 +2187,7 @@ EXAMPLES
   $ qfg verify --json
 ```
 
-_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/verify.ts)_
+_See code: [src/commands/verify.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/verify.ts)_
 
 ## `qfg whoami`
 
@@ -2210,7 +2210,7 @@ EXAMPLES
   $ qfg whoami
 ```
 
-_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/whoami.ts)_
+_See code: [src/commands/whoami.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/whoami.ts)_
 
 ## `qfg workspace`
 
@@ -2233,7 +2233,7 @@ EXAMPLES
   $ qfg workspace
 ```
 
-_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/workspace.ts)_
+_See code: [src/commands/workspace.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/workspace.ts)_
 
 ## `qfg workspace bootstrap`
 
@@ -2266,7 +2266,7 @@ EXAMPLES
   $ qfg workspace bootstrap --dir ./our-config --skip-validate
 ```
 
-_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/workspace/bootstrap.ts)_
+_See code: [src/commands/workspace/bootstrap.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/workspace/bootstrap.ts)_
 
 ## `qfg workspace create SLUG`
 
@@ -2300,7 +2300,7 @@ EXAMPLES
   $ qfg workspace create my-team --org 11111111-1111-1111-1111-111111111111
 ```
 
-_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/workspace/create.ts)_
+_See code: [src/commands/workspace/create.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/workspace/create.ts)_
 
 ## `qfg workspace switch [SLUG]`
 
@@ -2328,7 +2328,7 @@ EXAMPLES
   $ qfg workspace switch acme/production
 ```
 
-_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.71/src/commands/workspace/switch.ts)_
+_See code: [src/commands/workspace/switch.ts](https://github.com/quonfig/cli/blob/v0.0.72/src/commands/workspace/switch.ts)_
 <!-- commandsstop -->
 
 ## Local Development

package/dist/commands/get.js

@@ -72,7 +72,9 @@ export default class Get extends APICommand {
         const providedByDep = config.dependencies?.find((dep) => dep.dependencyType === 'providedBy');
         if (providedByDep) {
             const envVarName = providedByDep.source;
-            this.log(`This config is provided by env var '${envVarName}'`);
+            // qfg-zvef: diagnostics go to stderr so stdout stays a bare value —
+            // `qfg get` is commonly used in `$(...)` substitutions.
+            this.logToStderr(`This config is provided by env var '${envVarName}'`);
             const envValue = process.env[envVarName];
             if (envValue === undefined) {
                 return this.err(`Environment variable '${envVarName}' is not set. Cannot resolve config '${key}'.`, {
@@ -82,7 +84,7 @@ export default class Get extends APICommand {
                 });
             }
             value = envValue;
-            this.log(`Successfully resolved config '${key}' from env var`);
+            this.logToStderr(`Successfully resolved config '${key}' from env var`);
         }
         const decryptWithDep = config.dependencies?.find((dep) => dep.dependencyType === 'decryptWith');
         if (decryptWithDep && decryptWithDep.config) {
@@ -90,7 +92,7 @@ export default class Get extends APICommand {
             const keyProvidedByDep = encryptionKeyConfig.dependencies?.find((dep) => dep.dependencyType === 'providedBy');
             if (keyProvidedByDep) {
                 const envVarName = keyProvidedByDep.source;
-                this.log(`This config is encrypted by key '${encryptionKeyConfig.key}' that should be found in env var '${envVarName}'`);
+                this.logToStderr(`This config is encrypted by key '${encryptionKeyConfig.key}' that should be found in env var '${envVarName}'`);
                 const encryptionKey = process.env[envVarName];
                 if (encryptionKey === undefined) {
                     return this.err(`Environment variable '${envVarName}' is not set. Cannot decrypt config '${key}'.`, {
@@ -107,7 +109,7 @@ export default class Get extends APICommand {
                 }
                 try {
                     value = decrypt(value, encryptionKey);
-                    this.log(`Successfully decrypted config '${key}'`);
+                    this.logToStderr(`Successfully decrypted config '${key}'`);
                 }
                 catch (error) {
                     const errorMessage = error instanceof Error ? error.message : String(error);

package/dist/commands/workspace.d.ts

@@ -13,9 +13,18 @@ export default class Workspace extends BaseCommand {
     private activePin;
     /**
      * Fan out across every cached org's token and merge the results. One org's
-     * stale token doesn't block the others — we verbose-log and continue.
+     * stale token doesn't block the others — that isolation is deliberate for
+     * multi-org accounts. What is NOT ok (qfg-t15h) is losing the fact that an
+     * org failed: each failure is returned so the caller can decide between a
+     * hard session-expired error (nothing listed) and a per-org warning
+     * alongside the orgs that did answer.
      */
     private fetchAllOrgsWorkspaces;
+    /**
+     * qfg-t15h: returns a tagged result rather than a bare array, so a 401 or a
+     * dead connection is distinguishable from an org that genuinely has no
+     * workspaces yet.
+     */
     private fetchWorkspaces;
     /**
      * Pin the default-profile workspaceId to org/ws form by looking it up in

package/dist/commands/workspace.js

@@ -21,7 +21,31 @@ export default class Workspace extends BaseCommand {
         // /userWorkspaces/list is per-token-org-scoped — a single org's JWT
         // only sees that org's workspaces. Iterate every cached org so the
         // listing is comprehensive in multi-org accounts.
-        const allWorkspaces = await this.fetchAllOrgsWorkspaces(orgEntries);
+        const { failures, workspaces: allWorkspaces } = await this.fetchAllOrgsWorkspaces(orgEntries);
+        // qfg-t15h: an empty listing used to be indistinguishable from "your
+        // session is dead", so an expired login rendered as "(no workspaces
+        // yet)" and nudged the user toward creating a duplicate workspace.
+        // When NOTHING could be listed and the cause is auth, fail the way
+        // `qfg pull`/`qfg get` do (get-client.ts:141) instead of printing a
+        // listing we know is a lie.
+        const authFailures = failures.filter((f) => f.auth);
+        if (failures.length === orgEntries.length && authFailures.length > 0) {
+            const label = authFailures.length === 1
+                ? `org ${authFailures[0].orgSlug}`
+                : `orgs ${authFailures.map((f) => f.orgSlug).join(', ')}`;
+            const detail = authFailures.length === 1
+                ? authFailures[0].detail
+                : authFailures.map((f) => `${f.orgSlug}: ${f.detail}`).join('; ');
+            this.error(`Session expired for ${label}: ${detail}. Run \`qfg login\` to re-authenticate.`, { exit: 401 });
+        }
+        // Partial failure keeps the deliberate multi-org isolation above: the
+        // healthy orgs still list, the dead ones say so instead of looking empty.
+        for (const f of failures) {
+            this.logToStderr(f.auth
+                ? `Warning: could not list workspaces for org ${f.orgSlug} — ${f.detail}. Run \`qfg login\` to re-authenticate.`
+                : `Warning: could not list workspaces for org ${f.orgSlug} — ${f.detail}.`);
+        }
+        const failedOrgIds = new Set(failures.map((f) => f.orgId));
         const defaultProfilePin = this.profilePin(authConfig, allWorkspaces);
         const activePin = this.activePin(store, authConfig, allWorkspaces, defaultProfilePin);
         this.log(`Active workspace: ${activePin ?? '(none)'}`);
@@ -37,7 +61,10 @@ export default class Workspace extends BaseCommand {
             for (const group of grouped) {
                 this.log(`  ${group.orgSlug}:`);
                 if (group.workspaces.length === 0) {
-                    this.log('    (no workspaces yet — `qfg workspace create` to add one)');
+                    // qfg-t15h: "yet" is only true if we actually got an answer.
+                    this.log(failedOrgIds.has(group.workosOrgId)
+                        ? '    (could not list workspaces — see warning above)'
+                        : '    (no workspaces yet — `qfg workspace create` to add one)');
                     continue;
                 }
                 for (const w of group.workspaces) {
@@ -56,6 +83,10 @@ export default class Workspace extends BaseCommand {
             activeWorkspace: activePin,
             defaultProfile: defaultProfilePin,
             orgsWithTokens: orgSlugsWithTokens,
+            // qfg-t15h: --json suppresses the stderr warnings, so the failures
+            // have to be in the payload or a script cannot tell an org that
+            // returned nothing from one that could not be asked.
+            failedOrgs: failures.map((f) => ({ orgSlug: f.orgSlug, authFailure: f.auth, reason: f.detail })),
             orgs: grouped.map((g) => ({
                 orgSlug: g.orgSlug,
                 workosOrgId: g.workosOrgId,
@@ -90,28 +121,47 @@ export default class Workspace extends BaseCommand {
     }
     /**
      * Fan out across every cached org's token and merge the results. One org's
-     * stale token doesn't block the others — we verbose-log and continue.
+     * stale token doesn't block the others — that isolation is deliberate for
+     * multi-org accounts. What is NOT ok (qfg-t15h) is losing the fact that an
+     * org failed: each failure is returned so the caller can decide between a
+     * hard session-expired error (nothing listed) and a per-org warning
+     * alongside the orgs that did answer.
      */
     async fetchAllOrgsWorkspaces(orgEntries) {
         const merged = new Map();
-        for (const [orgId] of orgEntries) {
+        const failures = [];
+        for (const [orgId, tokens] of orgEntries) {
+            const orgSlug = tokens.org_slug ?? orgId;
             let jwt;
             try {
                 // eslint-disable-next-line no-await-in-loop
                 jwt = await getValidAccessToken(orgId, this.verboseLog);
             }
             catch (error) {
-                this.verboseLog('workspace: token refresh failed for org', { orgId, error: String(error) });
+                const detail = error instanceof Error ? error.message : String(error);
+                this.verboseLog('workspace: token refresh failed for org', { orgId, error: detail });
+                // A refresh that fails is always an auth failure — the stored
+                // grant is dead (invalid_grant) or there is no refresh token.
+                failures.push({ auth: true, detail, orgId, orgSlug });
                 continue;
             }
             // eslint-disable-next-line no-await-in-loop
-            const list = await this.fetchWorkspaces(jwt);
-            for (const w of list) {
+            const listed = await this.fetchWorkspaces(jwt);
+            if (listed.kind === 'failed') {
+                failures.push({ auth: listed.auth, detail: listed.detail, orgId, orgSlug });
+                continue;
+            }
+            for (const w of listed.entries) {
                 merged.set(w.workspaceId, w);
             }
         }
-        return [...merged.values()];
+        return { failures, workspaces: [...merged.values()] };
     }
+    /**
+     * qfg-t15h: returns a tagged result rather than a bare array, so a 401 or a
+     * dead connection is distinguishable from an org that genuinely has no
+     * workspaces yet.
+     */
     async fetchWorkspaces(jwt) {
         try {
             const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
@@ -121,15 +171,20 @@ export default class Workspace extends BaseCommand {
             });
             if (!res.ok) {
                 this.verboseLog('workspace: userWorkspaces/list non-OK', { status: res.status });
-                return [];
+                return {
+                    auth: res.status === 401 || res.status === 403,
+                    detail: `workspace listing failed (HTTP ${res.status})`,
+                    kind: 'failed',
+                };
             }
             const body = (await res.json());
             const list = (body.json ?? body);
-            return Array.isArray(list) ? list : [];
+            return { entries: Array.isArray(list) ? list : [], kind: 'ok' };
         }
         catch (error) {
-            this.verboseLog('workspace: userWorkspaces/list failed', { error: String(error) });
-            return [];
+            const detail = error instanceof Error ? error.message : String(error);
+            this.verboseLog('workspace: userWorkspaces/list failed', { error: detail });
+            return { auth: false, detail, kind: 'failed' };
         }
     }
     /**
@@ -164,7 +219,11 @@ export default class Workspace extends BaseCommand {
         catch (error) {
             return this.err(error instanceof Error ? error.message : String(error));
         }
-        const entries = await this.fetchWorkspaces(jwt);
+        const listed = await this.fetchWorkspaces(jwt);
+        if (listed.kind === 'failed') {
+            return this.err(`Failed to resolve workspace "${override}" — ${listed.detail}.`);
+        }
+        const { entries } = listed;
         if (entries.length === 0) {
             return this.err(`Failed to resolve workspace "${override}" — no entries returned.`);
         }

package/dist/push/run-push.d.ts

@@ -319,4 +319,25 @@ export declare class PushFatalError extends Error {
  * caller has been updated to drop the call entirely.
  */
 export declare const withPushedViaTrailer: (message: string) => string;
+/**
+ * Render the detail half of one push-denial line (qfg-szte).
+ *
+ * The server's `reason` is already a complete sentence: every family in
+ * app-quonfig `authorize-push-files.ts` renders
+ * `Missing required permission to edit <path>: …<requiredPermission>`, so it
+ * names both the path and the slug. The clone path used to append
+ * `, requires <requiredPermission>` on top of that (slug and path twice), and
+ * the bare path used to print the slug alone and throw the reason away — so
+ * the "why" (which environment is protected, which rule reaches the default)
+ * never reached the user.
+ *
+ * Both now render the reason, and add back only the field it does not
+ * already carry. That keeps the line honest against a server that sends a
+ * terser reason than today's without ever duplicating anything.
+ */
+export declare function formatDenialDetail(d: {
+    path: string;
+    reason: string;
+    requiredPermission: string;
+}): string;
 export declare function runPush(input: RunPushInput, deps: RunPushDeps): Promise<RunPushResult>;

package/dist/push/run-push.js

@@ -64,6 +64,27 @@ const sameRepo = (a, b) => normalizeForCompare(a) === normalizeForCompare(b);
  * caller has been updated to drop the call entirely.
  */
 export const withPushedViaTrailer = (message) => message;
+/**
+ * Render the detail half of one push-denial line (qfg-szte).
+ *
+ * The server's `reason` is already a complete sentence: every family in
+ * app-quonfig `authorize-push-files.ts` renders
+ * `Missing required permission to edit <path>: …<requiredPermission>`, so it
+ * names both the path and the slug. The clone path used to append
+ * `, requires <requiredPermission>` on top of that (slug and path twice), and
+ * the bare path used to print the slug alone and throw the reason away — so
+ * the "why" (which environment is protected, which rule reaches the default)
+ * never reached the user.
+ *
+ * Both now render the reason, and add back only the field it does not
+ * already carry. That keeps the line honest against a server that sends a
+ * terser reason than today's without ever duplicating anything.
+ */
+export function formatDenialDetail(d) {
+    const reason = d.reason.trim() || `missing permission ${d.requiredPermission}`;
+    const withPath = reason.includes(d.path) ? reason : `${d.path}: ${reason}`;
+    return withPath.includes(d.requiredPermission) ? withPath : `${withPath} (requires ${d.requiredPermission})`;
+}
 export async function runPush(input, deps) {
     const log = deps.log ?? ((s) => console.log(s));
     const errLog = deps.errLog ?? ((s) => console.error(s));
@@ -272,8 +293,8 @@ export async function runPush(input, deps) {
         if (packResult.kind === 'denied') {
             errLog(`Push denied for ${packResult.denials.length} commit(s):`);
             for (const d of packResult.denials) {
-                // qfg-7429.5 denial line: `<short-sha>  <path>  -- <reason>, requires <requiredPermission>`
-                errLog(`  ${d.commitSha.slice(0, 8)}  ${d.path}  -- ${d.reason}, requires ${d.requiredPermission}`);
+                // qfg-7429.5 denial line, qfg-szte detail: `<short-sha>  <reason>`
+                errLog(`  ${d.commitSha.slice(0, 8)}  ${formatDenialDetail(d)}`);
             }
             if (packResult.suggestedRecovery) {
                 errLog('');
@@ -369,7 +390,9 @@ export async function runPush(input, deps) {
         if (result.kind === 'denied') {
             errLog(`Push denied for ${result.denials.length} file(s):`);
             for (const d of result.denials) {
-                errLog(`  ${d.path}: missing permission ${d.requiredPermission}`);
+                // qfg-szte: was `<path>: missing permission <perm>`, which dropped the
+                // server's reason (the "why") entirely.
+                errLog(`  ${formatDenialDetail(d)}`);
             }
             throw new PushFatalError(`Push denied for ${result.denials.length} file(s). See errors above.`, 'PUSH_DENIED');
         }

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.71";
+declare const _default: "0.0.72";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.71';
+export default '0.0.72';

package/oclif.manifest.json

@@ -4136,5 +4136,5 @@
       ]
     }
   },
-  "version": "0.0.71"
+  "version": "0.0.72"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.71",
+  "version": "0.0.72",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },