@sechroom/cli 2026.6.11 → 2026.6.13

package/dist/index.js

@@ -502,9 +502,10 @@ async function runApi(label, fn) {
     s.fail();
     fail(err2);
   }
-  if (res.error !== void 0 && res.error !== null) {
+  const httpFailed = res.response !== void 0 && !res.response.ok;
+  if (res.error !== void 0 && res.error !== null || httpFailed) {
     s.fail();
-    fail(res.error);
+    fail(res.error ?? (res.response ? `HTTP ${res.response.status} ${res.response.statusText}`.trim() : "request failed"));
   }
   s.succeed();
   return res.data;
@@ -2283,20 +2284,50 @@ function systemTimezone() {
     return "UTC";
   }
 }
-async function ensureConfig(g, opts) {
+function resolveBaseUrl(g) {
+  const persisted = readPersisted();
+  const local = readLocalConfig();
+  const baseUrl = g.baseUrl ?? process.env.SECHROOM_BASE_URL ?? local.baseUrl ?? persisted.baseUrl ?? DEFAULT_BASE_URL2;
+  return baseUrl.replace(/\/$/, "");
+}
+async function ensureTenant(baseUrl, g, opts) {
   const persisted = readPersisted();
   const local = readLocalConfig();
-  let baseUrl = g.baseUrl ?? process.env.SECHROOM_BASE_URL ?? local.baseUrl ?? persisted.baseUrl ?? DEFAULT_BASE_URL2;
   let tenant = g.tenant ?? process.env.SECHROOM_TENANT ?? local.tenant ?? persisted.tenant ?? "";
-  if (canPrompt() && !opts.yes) {
-    baseUrl = await promptText("Sechroom API base URL?", baseUrl);
-    tenant = await promptText("Tenant id?", tenant || void 0);
-  }
-  baseUrl = baseUrl.replace(/\/$/, "");
   if (!tenant) {
-    fail(
-      "No tenant set. Pass --tenant <id>, set SECHROOM_TENANT, or run `sechroom config set tenant <id>` \u2014 the API rejects untenanted requests (HTTP 400)."
-    );
+    const client = await makeClient({ baseUrl, tenant: "", clientId: persisted.clientId });
+    const { data, error } = await client.GET("/auth/me/tenants", {});
+    if (error) {
+      fail(`Couldn't list your tenants: ${JSON.stringify(error)}. Pass --tenant <id> to skip this.`);
+    }
+    const tenants = data?.tenants ?? [];
+    if (tenants.length === 0) {
+      fail(
+        "You're signed in, but your account isn't a member of any tenant yet. Ask an admin to add you (or create one in the app), then re-run \u2014 or pass --tenant <id>."
+      );
+    } else if (tenants.length === 1) {
+      tenant = tenants[0].key;
+      if (!opts.json) {
+        process.stderr.write(
+          `${ok("\u2713")} using your tenant ${style.cyan(tenants[0].label)} ${style.dim(`(${tenant})`)}
+`
+        );
+      }
+    } else if (canPrompt() && !opts.yes) {
+      tenant = await promptSelect(
+        "You belong to several tenants \u2014 pick one:",
+        tenants.map((t) => ({ label: t.label, value: t.key, hint: t.key })),
+        data?.defaultTenantKey ?? tenants[0].key
+      );
+    } else {
+      tenant = data?.defaultTenantKey ?? tenants[0].key;
+      if (!opts.json) {
+        process.stderr.write(
+          `using tenant ${tenant} (${tenants.length} available \u2014 pass --tenant to choose another)
+`
+        );
+      }
+    }
   }
   let storeLocal = Boolean(opts.local);
   if (!opts.local && canPrompt() && !opts.yes) {
@@ -2388,8 +2419,9 @@ Examples:
     const json = Boolean(g.json);
     const yes = Boolean(opts.yes);
     const dryRun = Boolean(opts.dryRun);
-    const cfg = await ensureConfig(g, { yes, json, local: Boolean(opts.local) });
-    await ensureAuth(cfg, yes);
+    const baseUrl = resolveBaseUrl(g);
+    await ensureAuth({ baseUrl, tenant: "", clientId: readPersisted().clientId }, yes);
+    const cfg = await ensureTenant(baseUrl, g, { yes, json, local: Boolean(opts.local) });
     const tz = await ensureTimezone(cfg, { yes, dryRun });
     if (!json && tz.action !== "already-set") {
       const line = tz.action === "set" ? `${ok("\u2713")} timezone set to ${tz.timezone}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sechroom/cli",
-  "version": "2026.6.11",
+  "version": "2026.6.13",
   "description": "Sechroom CLI — a thin, generated client over the Sechroom HTTP API. An agent/human surface alongside MCP.",
   "type": "module",
   "license": "UNLICENSED",