@senticor/hive 1.42.1 → 1.43.1

package/README.md

@@ -49,6 +49,7 @@ hive login alice
 
 # Remote shell (SSH / Coder / container) where the browser is on another host:
 # prints the URL — authenticate anywhere, then paste the code / callback URL back.
+# An imperfect paste gets up to three attempts; the printed link stays valid.
 hive login --no-browser
 
 # Verify the session, then go.

package/hive.cjs

@@ -7771,6 +7771,27 @@ var import_node_child_process2 = require("child_process");
 var import_node_url3 = require("url");
 var import_node_path3 = require("path");
 
+// ../hive-api-contracts/src/admin-orgs.ts
+init_cjs_shims();
+function isValidCorsOrigin(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") return false;
+  if (url2.username || url2.password) return false;
+  if (url2.host === "") return false;
+  if (url2.pathname !== "/" && url2.pathname !== "") return false;
+  if (url2.search || url2.hash) return false;
+  return url2.origin === value;
+}
+var ROLE_KEY_RE = /^[a-z0-9][a-z0-9._:-]{0,63}$/;
+function hasTenantAudienceDelimiter(displayKey) {
+  return /[\s,]/.test(String(displayKey || "").trim());
+}
+
 // src/lib/client.ts
 init_cjs_shims();
 var import_node_http2 = __toESM(require("http"), 1);
@@ -8079,6 +8100,159 @@ function callbackPage(msg, kind) {
 </body>
 </html>`;
 }
+var MAX_PASTE_ATTEMPTS = 3;
+function providerDetail(status2, data) {
+  const error51 = typeof data.error === "string" ? data.error.trim() : "";
+  const described = typeof data.error_description === "string" ? data.error_description.trim() : "";
+  if (described) return error51 ? `${described} (${error51})` : described;
+  if (error51) {
+    const flat = error51.replace(/\s+/g, " ").trim();
+    return flat.length > 200 ? `${flat.slice(0, 200)}\u2026` : flat;
+  }
+  return `HTTP ${status2 ?? "?"}`;
+}
+function classifyTokenFailure(res) {
+  const error51 = typeof res.data.error === "string" ? res.data.error.trim() : "";
+  const detail = providerDetail(res.status, res.data);
+  if (error51 === "invalid_grant") {
+    const fromAnotherRun = /pkce|redirect_uri/i.test(
+      typeof res.data.error_description === "string" ? res.data.error_description : ""
+    );
+    return {
+      retryable: true,
+      headline: "The authorization server rejected that code",
+      detail,
+      hint: fromAnotherRun ? "That code belongs to a different 'hive login' run \u2014 use the link printed above." : "Codes are single-use and expire within about a minute, and a truncated paste looks the same. Open this link again for a fresh code:",
+      needsFreshCode: true
+    };
+  }
+  if (error51 === "invalid_client" || error51 === "unauthorized_client" || error51 === "invalid_request") {
+    return {
+      retryable: false,
+      headline: "The authorization server refused the token request",
+      detail,
+      hint: "Check the OIDC client and issuer this CLI is pointed at; pasting another code cannot fix this.",
+      needsFreshCode: false
+    };
+  }
+  return {
+    retryable: false,
+    headline: "The authorization server could not complete the token request",
+    detail,
+    hint: "This looks like a server-side problem \u2014 try again in a moment.",
+    needsFreshCode: false
+  };
+}
+function pasteFailure(e) {
+  const fromAnotherRun = /state mismatch/i.test(e.message);
+  return {
+    retryable: true,
+    headline: "Could not read that paste",
+    detail: e.message,
+    hint: fromAnotherRun ? "That URL is from a different 'hive login' run \u2014 use the link printed above." : "Copy the whole address from the browser address bar, or just the code=\u2026 value.",
+    needsFreshCode: fromAnotherRun
+  };
+}
+function networkFailure(e, endpoint) {
+  return {
+    retryable: false,
+    headline: `Could not reach the authorization server at ${endpoint}`,
+    detail: e.message,
+    hint: "Check the issuer URL and your network; pasting another code cannot fix this.",
+    needsFreshCode: false
+  };
+}
+function missingTokenFailure(status2) {
+  return {
+    retryable: false,
+    headline: "The authorization server returned no access token",
+    detail: `HTTP ${status2 ?? "?"} without an access_token field`,
+    hint: "This looks like a server-side problem; pasting another code cannot fix it.",
+    needsFreshCode: false
+  };
+}
+function formatRetryNotice(f, attemptsLeft, authUrl) {
+  const left = `${attemptsLeft} attempt${attemptsLeft === 1 ? "" : "s"} left.`;
+  const link = f.needsFreshCode ? `
+  ${authUrl}` : "";
+  return `
+${f.headline}: ${f.detail}
+${f.hint}${link}
+${left}
+`;
+}
+function formatFinalError(f, attempts, opts) {
+  const command = opts.noBrowser ? "hive login --no-browser" : "hive login";
+  const middle = opts.stopped ? opts.stopped === "eof" ? "No further input available (stdin closed)." : "No further input available (stdin is not a terminal)." : attempts > 1 ? `No attempts left (${attempts} of ${attempts}).` : "";
+  const tail2 = opts.stopped ? `Re-run '${command}' from a terminal, or set HIVE_TOKEN for non-interactive use.` : f.retryable ? `Re-run '${command}' for a fresh link.` : f.hint;
+  return [`${f.headline} \u2014 ${f.detail}.`, middle, tail2].filter(Boolean).join(" ");
+}
+function createPastePrompter(input = process.stdin, output2 = process.stdout) {
+  const rl = import_node_readline.default.createInterface({ input, output: output2 });
+  let closed = false;
+  let inFlight = null;
+  let deliver = null;
+  rl.on("close", () => {
+    closed = true;
+    const pending2 = deliver;
+    deliver = null;
+    inFlight = null;
+    pending2?.({ kind: "eof" });
+  });
+  return {
+    ask(query) {
+      if (closed) return Promise.resolve({ kind: "eof" });
+      if (inFlight) return inFlight;
+      inFlight = new Promise((resolve3) => {
+        deliver = resolve3;
+        rl.question(query, (answer) => {
+          deliver = null;
+          inFlight = null;
+          resolve3({ kind: "paste", text: answer.trim() });
+        });
+      });
+      return inFlight;
+    },
+    canReask: () => !closed && input.isTTY === true,
+    close: () => {
+      try {
+        rl.close();
+      } catch {
+      }
+    }
+  };
+}
+function createPeekable(produce) {
+  let pending2 = null;
+  return {
+    peek: () => pending2 ??= produce(),
+    /** The value `peek()` resolved with was used — arm a fresh slot. */
+    consume: () => {
+      pending2 = null;
+    }
+  };
+}
+function createInbox() {
+  const queued = [];
+  let waiter = null;
+  return {
+    push(value) {
+      if (waiter) {
+        const w = waiter;
+        waiter = null;
+        w(value);
+      } else {
+        queued.push(value);
+      }
+    },
+    take() {
+      const buffered = queued.shift();
+      return buffered !== void 0 ? Promise.resolve(buffered) : new Promise((resolve3) => {
+        waiter = resolve3;
+      });
+    }
+  };
+}
 async function loginWithBrowser(issuerUrl, opts = {}) {
   const issuer = issuerUrl || process.env.HIVE_OIDC_ISSUER_URL || DEFAULT_ISSUER;
   const disco = await getDiscovery(issuer);
@@ -8091,122 +8265,171 @@ async function loginWithBrowser(issuerUrl, opts = {}) {
   const open = opts.open || openBrowser;
   const clientId = opts.clientId || process.env.HIVE_OIDC_CLIENT_ID || CLIENT_ID;
   const timeoutMs = opts.timeoutMs ?? 3e5;
-  const { code, redirectUri } = await new Promise((resolve3, reject) => {
-    let redirectUri2 = "";
-    let timer;
-    let settled = false;
-    let rl;
-    const cleanup = () => {
-      clearTimeout(timer);
-      try {
-        server.close();
-      } catch {
-      }
-      try {
-        rl?.close();
-      } catch {
-      }
-    };
-    const succeed = (code2) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      resolve3({ code: code2, redirectUri: redirectUri2 });
-    };
-    const abort = (e) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      reject(e);
+  const tokenEndpoint = rewriteForInternalKeycloak(disco.token_endpoint, issuer);
+  const maxAttempts = opts.noBrowser ? Math.max(1, opts.maxPasteAttempts ?? MAX_PASTE_ATTEMPTS) : 1;
+  const inbox = createInbox();
+  let prompter;
+  let timer;
+  const server = import_node_http.default.createServer((req2, res) => {
+    const u = new import_node_url.URL(req2.url || "/", "http://127.0.0.1");
+    if (u.pathname !== "/callback") {
+      res.statusCode = 404;
+      res.setHeader("content-type", "text/plain; charset=utf-8");
+      res.end("Not found");
+      return;
+    }
+    const fail = (m, e) => {
+      res.statusCode = 400;
+      res.setHeader("content-type", "text/html; charset=utf-8");
+      res.end(callbackPage(m, "error"));
+      inbox.push({ kind: "fatal", error: e });
     };
-    const server = import_node_http.default.createServer((req2, res2) => {
-      const u = new import_node_url.URL(req2.url || "/", "http://127.0.0.1");
-      if (u.pathname !== "/callback") {
-        res2.statusCode = 404;
-        res2.setHeader("content-type", "text/plain; charset=utf-8");
-        res2.end("Not found");
-        return;
-      }
-      const fail = (m, e) => {
-        res2.statusCode = 400;
-        res2.setHeader("content-type", "text/html; charset=utf-8");
-        res2.end(callbackPage(m, "error"));
-        abort(e);
-      };
-      const err = u.searchParams.get("error");
-      if (err) return fail("Sign-in cancelled.", new Error(`Authorization failed: ${err}`));
-      if (u.searchParams.get("state") !== state) return fail("Invalid state.", new Error("OAuth state mismatch"));
-      const gotCode = u.searchParams.get("code");
-      if (!gotCode) return fail("No code received.", new Error("No authorization code in callback"));
-      res2.statusCode = 200;
-      res2.setHeader("content-type", "text/html; charset=utf-8");
-      res2.end(callbackPage("Signed in successfully.", "success"));
-      succeed(gotCode);
+    const err = u.searchParams.get("error");
+    if (err) return fail("Sign-in cancelled.", new Error(`Authorization failed: ${err}`));
+    if (u.searchParams.get("state") !== state) return fail("Invalid state.", new Error("OAuth state mismatch"));
+    const gotCode = u.searchParams.get("code");
+    if (!gotCode) return fail("No code received.", new Error("No authorization code in callback"));
+    res.statusCode = 200;
+    res.setHeader("content-type", "text/html; charset=utf-8");
+    res.end(callbackPage("Signed in successfully.", "success"));
+    inbox.push({ kind: "loopback", code: gotCode });
+  });
+  try {
+    const redirectUri = await new Promise((resolve3, reject) => {
+      const onListenError = (e) => reject(e);
+      server.once("error", onListenError);
+      server.listen(0, "127.0.0.1", () => {
+        server.removeListener("error", onListenError);
+        server.on("error", (e) => inbox.push({ kind: "fatal", error: e }));
+        resolve3(`http://127.0.0.1:${server.address().port}/callback`);
+      });
     });
-    server.on("error", (e) => abort(e));
-    server.listen(0, "127.0.0.1", () => {
-      const port = server.address().port;
-      redirectUri2 = `http://127.0.0.1:${port}/callback`;
-      const authUrl = new import_node_url.URL(disco.authorization_endpoint);
-      authUrl.searchParams.set("response_type", "code");
-      authUrl.searchParams.set("client_id", clientId);
-      authUrl.searchParams.set("redirect_uri", redirectUri2);
-      authUrl.searchParams.set("scope", "openid profile email");
-      authUrl.searchParams.set("state", state);
-      authUrl.searchParams.set("code_challenge", challenge);
-      authUrl.searchParams.set("code_challenge_method", "S256");
-      if (opts.loginHint) authUrl.searchParams.set("login_hint", opts.loginHint);
-      const href = authUrl.toString();
-      if (opts.noBrowser) {
-        console.log("\nOpen this link in a browser on any device and sign in:");
-        console.log(`  ${href}
+    const authUrl = new import_node_url.URL(disco.authorization_endpoint);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("scope", "openid profile email");
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    if (opts.loginHint) authUrl.searchParams.set("login_hint", opts.loginHint);
+    const href = authUrl.toString();
+    if (opts.noBrowser) {
+      console.log("\nOpen this link in a browser on any device and sign in:");
+      console.log(`  ${href}
 `);
-        console.log(
-          "You are then redirected to a 127.0.0.1 page, which may not load here.\nCopy the address from the address bar (or just the code=\u2026 value) and paste it below.\n"
+      console.log(
+        "You are then redirected to a 127.0.0.1 page, which may not load here.\nCopy the address from the address bar (or just the code=\u2026 value) and paste it below.\n"
+      );
+    } else {
+      console.log("\nOpening the browser to sign in (or copy the link):");
+      console.log(`  ${href}
+`);
+      open(href);
+    }
+    const deadline = new Promise((resolve3) => {
+      timer = setTimeout(
+        () => resolve3({ kind: "fatal", error: new Error("Login timed out \u2014 not confirmed in time.") }),
+        timeoutMs
+      );
+    });
+    let attempts = 0;
+    const pasteQuery = () => maxAttempts > 1 && attempts > 0 ? `Paste the code or callback URL (attempt ${attempts + 1} of ${maxAttempts}): ` : "Paste the code or callback URL: ";
+    const loopback = createPeekable(() => inbox.take());
+    let paste;
+    let canReask = () => true;
+    if (opts.noBrowser) {
+      const injected = opts.prompt;
+      if (injected) {
+        paste = createPeekable(
+          () => injected(pasteQuery()).then(
+            (text) => text === null || text === void 0 ? { kind: "eof" } : { kind: "paste", text },
+            (e) => ({ kind: "fatal", error: e })
+          )
         );
-        const onPaste = (pasted) => {
-          try {
-            succeed(parsePastedCallback(pasted, state));
-          } catch (e) {
-            abort(e);
-          }
-        };
-        if (opts.prompt) {
-          opts.prompt("Paste the code or callback URL: ").then(onPaste).catch((e) => abort(e));
-        } else {
-          rl = import_node_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-          rl.question("Paste the code or callback URL: ", onPaste);
-        }
       } else {
-        console.log("\nOpening the browser to sign in (or copy the link):");
-        console.log(`  ${href}
-`);
-        open(href);
+        const live = createPastePrompter();
+        prompter = live;
+        paste = createPeekable(() => live.ask(pasteQuery()));
+        canReask = () => live.canReask();
+      }
+    }
+    let last;
+    const nextStep = (f) => {
+      if (!f.retryable || attempts >= maxAttempts) return "exhausted";
+      if (!paste || !canReask()) return maxAttempts > 1 ? "no-input" : "exhausted";
+      console.error(formatRetryNotice(f, maxAttempts - attempts, href));
+      return "retry";
+    };
+    const giveUp = (f, step) => new Error(
+      formatFinalError(f, attempts, {
+        noBrowser: Boolean(opts.noBrowser),
+        stopped: step === "no-input" ? "not-a-tty" : void 0
+      })
+    );
+    for (; ; ) {
+      const sources = paste ? [loopback.peek(), paste.peek(), deadline] : [loopback.peek(), deadline];
+      const ev = await Promise.race(sources);
+      if (ev.kind === "loopback") loopback.consume();
+      if (ev.kind === "paste" || ev.kind === "eof") paste?.consume();
+      if (ev.kind === "fatal") throw ev.error;
+      if (ev.kind === "eof") {
+        throw last ? new Error(formatFinalError(last, attempts, { noBrowser: true, stopped: "eof" })) : new Error(
+          "No code was entered \u2014 stdin closed before any input. Run 'hive login --no-browser' from a terminal, or set HIVE_TOKEN for non-interactive use."
+        );
       }
-      timer = setTimeout(() => abort(new Error("Login timed out \u2014 not confirmed in time.")), timeoutMs);
-    });
-  });
-  const tokenEndpoint = rewriteForInternalKeycloak(disco.token_endpoint, issuer);
-  const res = await fetchUrlencoded(tokenEndpoint, {
-    grant_type: "authorization_code",
-    client_id: clientId,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: verifier
-  });
-  if (!res.ok) {
-    throw new Error(res.data.error_description || `Token exchange failed with status ${res.status}`);
+      attempts += 1;
+      let code;
+      if (ev.kind === "loopback") {
+        code = ev.code;
+      } else {
+        try {
+          code = parsePastedCallback(ev.text, state);
+        } catch (e) {
+          last = pasteFailure(e);
+          const step2 = nextStep(last);
+          if (step2 === "retry") continue;
+          throw giveUp(last, step2);
+        }
+      }
+      let res;
+      try {
+        res = await fetchUrlencoded(tokenEndpoint, {
+          grant_type: "authorization_code",
+          client_id: clientId,
+          code,
+          redirect_uri: redirectUri,
+          code_verifier: verifier
+        });
+      } catch (e) {
+        throw giveUp(networkFailure(e, tokenEndpoint), "exhausted");
+      }
+      const accessToken = typeof res.data.access_token === "string" ? res.data.access_token : "";
+      if (res.ok && accessToken) {
+        const claims2 = parseJwt(accessToken);
+        saveCredentials({
+          issuer,
+          access_token: accessToken,
+          refresh_token: res.data.refresh_token,
+          expires_at: Date.now() + (res.data.expires_in || 3600) * 1e3,
+          user: claims2 ? claims2.preferred_username || claims2.sub : opts.loginHint,
+          clientId
+        });
+        return true;
+      }
+      last = res.ok ? missingTokenFailure(res.status) : classifyTokenFailure(res);
+      const step = nextStep(last);
+      if (step === "retry") continue;
+      throw giveUp(last, step);
+    }
+  } finally {
+    clearTimeout(timer);
+    try {
+      server.close();
+    } catch {
+    }
+    prompter?.close();
   }
-  const claims2 = parseJwt(res.data.access_token);
-  saveCredentials({
-    issuer,
-    access_token: res.data.access_token,
-    refresh_token: res.data.refresh_token,
-    expires_at: Date.now() + (res.data.expires_in || 3600) * 1e3,
-    user: claims2 ? claims2.preferred_username || claims2.sub : opts.loginHint,
-    clientId
-  });
-  return true;
 }
 async function refreshToken(creds) {
   if (!creds || !creds.refresh_token) return false;
@@ -8543,16 +8766,36 @@ async function fetchAuthConfig(apiUrl) {
 
 // src/lib/errors.ts
 init_cjs_shims();
+
+// src/lib/tenant-selection.ts
+init_cjs_shims();
+var applied = null;
+function recordTenantSelection(selection) {
+  applied = selection;
+}
+function appliedTenantSelection() {
+  return applied;
+}
+function describeAppliedTenant(selection) {
+  if (!selection.applied || selection.value === null) {
+    return "No X-Hive-Tenant was sent, so the server resolved your self-tenant";
+  }
+  return `Sent X-Hive-Tenant: ${selection.value} (${selection.source}, from ${selection.origin})`;
+}
+
+// src/lib/errors.ts
 var CliCommandError = class extends Error {
   exitCode;
   symbolicCode;
   remediation;
+  tenant;
   constructor(symbolicCode, exitCode, message, options) {
     super(message, options);
     this.name = "CliCommandError";
     this.exitCode = exitCode;
     this.symbolicCode = symbolicCode;
     this.remediation = options?.remediation;
+    this.tenant = options?.tenant;
   }
 };
 function commandError(symbolicCode, exitCode, message, options) {
@@ -8593,14 +8836,36 @@ function schemaErrorFields(data) {
 }
 function remoteFailureRemediation(data) {
   const code = remoteErrorFields(data).code.toUpperCase();
+  const scope = tenantFailureScope();
   if (code === "TENANT_NOT_ALLOWED") {
-    return "The requested tenant is not in your active memberships. For platform-admin operations (org/mission create) omit --tenant / HIVE_TENANT. If the tenant is saved in CLI config, run 'hive config clear --tenant'; then run 'hive diag authz' to list memberships and optionally pin one with 'hive config use --tenant=<displayKey>'.";
+    const selection = appliedTenantSelection();
+    const pinned = selection?.applied === true && selection.source === "pinned";
+    return scope + "The requested tenant is not in your active memberships. " + (pinned ? "It is a saved pin, not something this command asked for \u2014 run 'hive config clear --tenant' to drop it. " : "If the tenant is saved in CLI config, run 'hive config clear --tenant'. ") + "Platform-scoped commands (hive org *, hive admin list|grant|revoke) ignore a pin already; for other platform-admin operations (mission create) omit --tenant / HIVE_TENANT. Run 'hive diag authz' to list memberships and optionally pin one with 'hive config use --tenant=<displayKey>'.";
   }
   if (code === "MISSION_NOT_FOUND") {
-    return "The mission id was not found in the CURRENT tenant scope. A mission is only visible under the tenant it was created in \u2014 check you are using the same --tenant / HIVE_TENANT (or self-tenant) as at create time. Run 'hive mission list --tenant <tenant>' to find the scope that owns it.";
+    return scope + "The mission id was not found in the CURRENT tenant scope. A mission is only visible under the tenant it was created in \u2014 check you are using the same --tenant / HIVE_TENANT (or self-tenant) as at create time. Run 'hive mission list --tenant <tenant>' to find the scope that owns it.";
   }
   return void 0;
 }
+function tenantFailureScope() {
+  const selection = appliedTenantSelection();
+  return selection ? `${describeAppliedTenant(selection)}. ` : "";
+}
+function remoteFailureTenant(data) {
+  const code = remoteErrorFields(data).code.toUpperCase();
+  if (code !== "TENANT_NOT_ALLOWED" && code !== "MISSION_NOT_FOUND") return void 0;
+  return appliedTenantSelection() ?? void 0;
+}
+function remoteFailureError(status2, data, action, exitCode = exitCodeForStatus(status2)) {
+  const remediation = remoteFailureRemediation(data);
+  const tenant = remoteFailureTenant(data);
+  return commandError(
+    "REMOTE_FAILED",
+    exitCode,
+    `${action} failed${status2 ? ` (HTTP ${status2})` : ""}: ${remoteFailureText(data)}${remediation ? ` \u2014 ${remediation}` : ""}`,
+    remediation || tenant ? { ...remediation ? { remediation } : {}, ...tenant ? { tenant } : {} } : void 0
+  );
+}
 function remoteFailureText(data) {
   const body = data;
   const { code, message } = remoteErrorFields(data);
@@ -8618,7 +8883,8 @@ function toStructuredError(err) {
     error: {
       code,
       message,
-      ...e?.remediation ? { remediation: e.remediation } : {}
+      ...e?.remediation ? { remediation: e.remediation } : {},
+      ...e?.tenant ? { tenant: e.tenant } : {}
     }
   };
 }
@@ -8667,9 +8933,13 @@ function installRemoteFailureExit() {
     if (!failure) return;
     const symbolic = remoteErrorFields(failure.body).code || remoteFailureCode(failure.status);
     const remediation = remoteFailureRemediation(failure.body) ?? (failure.status === 401 ? "Run 'hive login' to authenticate, or set HIVE_TOKEN." : void 0);
+    const tenant = remoteFailureTenant(failure.body);
     const message = `${failure.method} ${failure.path} failed${failure.status ? ` (HTTP ${failure.status})` : ""}: ${remoteFailureText(failure.body)}`;
     if (isJsonMode()) {
-      console.error(JSON.stringify({ ok: false, error: { code: symbolic, message, ...remediation ? { remediation } : {} } }));
+      console.error(JSON.stringify({
+        ok: false,
+        error: { code: symbolic, message, ...remediation ? { remediation } : {}, ...tenant ? { tenant } : {} }
+      }));
     } else {
       console.error(`\x1B[31mError:\x1B[0m ${symbolic}: ${message}`);
       if (remediation) console.error(remediation);
@@ -8758,15 +9028,40 @@ function normalizeArgv(argv) {
   }
   return [...positionals, ...flags];
 }
-function ctx(args) {
+function ctx(args, opts = {}) {
   const cfg = readConfig();
-  const resolvedTenant = resolveTenantContext(args, cfg);
-  const tenant = resolvesToSelfTenant(resolvedTenant) ? null : resolvedTenant.value;
+  const resolvedTenant = rawTenantContext(args, cfg);
+  const pinIgnored = opts.adminScope === true && resolvedTenant.source === "pinned";
+  const selfTenant = resolvesToSelfTenant(resolvedTenant);
+  let problem = null;
+  if (!pinIgnored && !selfTenant) {
+    try {
+      assertCanonicalTenantSelector(resolvedTenant.value, resolvedTenant.source);
+    } catch (err) {
+      if (!opts.diagnostic) throw err;
+      problem = err instanceof Error ? err.message : String(err);
+    }
+  }
+  const tenant = pinIgnored || selfTenant || problem !== null ? null : resolvedTenant.value;
   if (tenant === null && resolvedTenant.source === "pinned" && resolvedTenant.value === "default" && shouldEmitHuman(args)) {
-    process.stderr.write(
-      "Note: ignoring a saved tenant 'default' (a legacy login fallback that matches no tenant). Using your self-tenant; run 'hive config clear --tenant' to remove it, or pass --tenant <id>.\n"
+    noteOnce(
+      "Note: ignoring a saved tenant 'default' (a legacy login fallback that matches no tenant). Using your self-tenant; run 'hive config clear --tenant' to remove it, or pass --tenant <id>."
+    );
+  }
+  if (pinIgnored && resolvedTenant.value !== "default" && shouldEmitHuman(args)) {
+    noteOnce(
+      `Note: this command is platform-scoped, so it is NOT applying the tenant pinned in ${configPath()} ('${resolvedTenant.value}'). Pass --tenant to force one.`
     );
   }
+  if (problem !== null && shouldEmitHuman(args)) {
+    noteOnce(`Note: not sending an unusable tenant selector \u2014 ${problem}`);
+  }
+  recordTenantSelection({
+    value: resolvedTenant.source === "default" ? null : resolvedTenant.value,
+    source: resolvedTenant.source,
+    origin: tenantSelectorOrigin(resolvedTenant.source),
+    applied: tenant !== null
+  });
   const client = new HiveClient({
     apiUrl: args.apiUrl ?? process.env.HIVE_API_URL ?? cfg.apiUrl,
     // env (HIVE_TENANT / legacy HIVE_TENANT_ID) must win over the saved config,
@@ -8781,6 +9076,19 @@ function resolvesToSelfTenant(resolved) {
   if (resolved.source === "default") return true;
   return resolved.source === "pinned" && resolved.value === "default";
 }
+var _notesEmitted = /* @__PURE__ */ new Set();
+function noteOnce(line) {
+  if (_notesEmitted.has(line)) return;
+  _notesEmitted.add(line);
+  process.stderr.write(`${line}
+`);
+}
+function tenantSelectorOrigin(source) {
+  if (source === "flag") return "--tenant";
+  if (source === "env") return cleanString(process.env.HIVE_TENANT) ? "HIVE_TENANT" : "HIVE_TENANT_ID";
+  if (source === "pinned") return configPath();
+  return "no --tenant, HIVE_TENANT or pinned tenant";
+}
 function configureGlobalTls(argv = process.argv.slice(2)) {
   let savedCaFile;
   try {
@@ -8905,8 +9213,15 @@ function flagValueFromArgv(argv, forms) {
 function cleanString(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
+function hasControlCharacter(value) {
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
 function assertCanonicalTenantSelector(value, source = "tenant selector") {
-  const trimmed2 = value.trim();
+  const trimmed2 = String(value ?? "").trim();
   if (/^tenant:/i.test(trimmed2)) {
     const bare = trimmed2.slice("tenant:".length);
     throw commandError(
@@ -8915,19 +9230,39 @@ function assertCanonicalTenantSelector(value, source = "tenant selector") {
       `The 'tenant:<key>' selector form is retired (#1556). Pass the displayKey '${bare}' instead \u2014 e.g. --tenant ${bare} (or HIVE_TENANT=${bare}). [${source}]`
     );
   }
+  if (trimmed2 && (hasTenantAudienceDelimiter(trimmed2) || hasControlCharacter(trimmed2))) {
+    const fix = source === "pinned" ? "Run 'hive config clear --tenant', then re-pin with 'hive config use --tenant <displayKey>'." : "Pass a bare tenant displayKey (e.g. --tenant talentiq) or a tenant UUID.";
+    throw commandError(
+      "INVALID_TENANT_SELECTOR",
+      2,
+      `'${trimmed2}' cannot be a tenant selector: a tenant displayKey never contains whitespace, a comma or a control character (the server refuses them \u2014 the key is also an OIDC audience). ${fix} [${source}]`,
+      { remediation: fix }
+    );
+  }
 }
 function resolveTenantContext(args, cfg = readConfig()) {
+  const resolved = rawTenantContext(args, cfg);
+  if (resolved.source !== "default") assertCanonicalTenantSelector(resolved.value, resolved.source);
+  return resolved;
+}
+function rawTenantContext(args, cfg = readConfig()) {
   const flag = cleanString(args.tenant);
-  if (flag) return canonicalTenant({ value: flag, source: "flag" });
+  if (flag) return { value: flag, source: "flag" };
   const env = cleanString(process.env.HIVE_TENANT) ?? cleanString(process.env.HIVE_TENANT_ID);
-  if (env) return canonicalTenant({ value: env, source: "env" });
+  if (env) return { value: env, source: "env" };
   const pinned = cleanString(cfg.tenant);
-  if (pinned) return canonicalTenant({ value: pinned, source: "pinned" });
+  if (pinned) return { value: pinned, source: "pinned" };
   return { value: "default", source: "default" };
 }
-function canonicalTenant(resolved) {
-  if (typeof resolved.value === "string") assertCanonicalTenantSelector(resolved.value, resolved.source);
-  return resolved;
+function describeTenantContext(args, cfg = readConfig()) {
+  const resolved = rawTenantContext(args, cfg);
+  if (resolved.source === "default") return { ...resolved, problem: null };
+  try {
+    assertCanonicalTenantSelector(resolved.value, resolved.source);
+    return { ...resolved, problem: null };
+  } catch (err) {
+    return { ...resolved, problem: err instanceof Error ? err.message : String(err) };
+  }
 }
 function resolveMissionContext(args, cfg = readConfig()) {
   const flag = cleanString(args.missionId) ?? cleanString(args.mission);
@@ -8955,8 +9290,14 @@ function shouldEmitHuman(args) {
 }
 function printContextNotice(args, opts = {}) {
   if (!shouldEmitHuman(args)) return;
-  const tenant = resolveTenantContext(args);
-  if (resolvesToSelfTenant(tenant)) {
+  const tenant = describeTenantContext(args);
+  if (opts.adminScope && tenant.source === "pinned") {
+    process.stderr.write(`Using tenant: your self-tenant (platform-scoped command; pinned '${tenant.value}' not applied)
+`);
+  } else if (tenant.problem !== null) {
+    process.stderr.write(`Using tenant: your self-tenant (the ${tenant.source} selector is unusable \u2014 ${tenant.problem})
+`);
+  } else if (resolvesToSelfTenant(tenant)) {
     process.stderr.write("Using tenant: your self-tenant (no --tenant / HIVE_TENANT set)\n");
   } else {
     process.stderr.write(`Using tenant: ${tenant.value} from ${tenant.source}
@@ -9154,22 +9495,22 @@ var artifactName = injectedString(
   true ? "hive-cli" : void 0
 ) || String(process.env.HIVE_CLI_ARTIFACT_NAME || "hive-cli").trim() || "hive-cli";
 var packageVersion = injectedString(
-  true ? "1.42.1" : void 0
+  true ? "1.43.1" : void 0
 ) || String(process.env.HIVE_CLI_PACKAGE_VERSION || "").trim() || readPackageVersion();
 var releaseVersion = injectedString(
-  true ? "1.42.1" : void 0
+  true ? "1.43.1" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_VERSION || "").trim() || packageVersion || "dev";
 var releaseChannel = injectedString(
   true ? "final" : void 0
 ) || String(process.env.HIVE_CLI_RELEASE_CHANNEL || "").trim() || (releaseVersion.includes("-rc.") ? "rc" : releaseVersion === "dev" ? "dev" : "final");
 var buildCommit = injectedString(
-  true ? "13c162232e544bfb80b687d2086ba9b9c573330f" : void 0
+  true ? "13ae9d3999b3acdb12e76a63041ef64c9f20d52d" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_COMMIT || "").trim() || "unknown";
 var buildTimestamp = injectedString(
-  true ? "2026-09-22T12:45:17Z" : void 0
+  true ? "2026-09-22T15:34:58Z" : void 0
 ) || String(process.env.HIVE_CLI_BUILD_TIMESTAMP || "").trim() || "unknown";
 var ociRef = injectedString(
-  true ? "registry.onstackit.cloud/senticor/hive-cli:1.42.1" : void 0
+  true ? "registry.onstackit.cloud/senticor/hive-cli:1.43.1" : void 0
 ) || String(process.env.HIVE_CLI_OCI_REF || "").trim() || `registry.onstackit.cloud/senticor/${artifactName}:${releaseVersion}`;
 var RELEASE_INFO = Object.freeze({
   packageVersion,
@@ -10024,6 +10365,52 @@ init_cjs_shims();
 var import_node_path6 = __toESM(require("path"), 1);
 var DEFAULT_API_URL = "http://localhost:8787";
 var DEFAULT_ISSUER2 = "http://localhost:30180/realms/chos";
+function sameEndpoint(a, b) {
+  const norm = (value) => String(value ?? "").trim().replace(/\/+$/, "");
+  return norm(a) === norm(b);
+}
+function endpointChange(saved, apiUrl, issuerUrl) {
+  if (saved.apiUrl?.trim() && !sameEndpoint(saved.apiUrl, apiUrl)) {
+    return { from: saved.apiUrl.trim(), to: apiUrl };
+  }
+  if (saved.issuerUrl?.trim() && !sameEndpoint(saved.issuerUrl, issuerUrl)) {
+    return { from: saved.issuerUrl.trim(), to: issuerUrl };
+  }
+  return null;
+}
+function activeMemberships(body) {
+  const memberships = body?.memberships;
+  if (!Array.isArray(memberships)) return null;
+  const bare = (value) => typeof value === "string" && value.trim() ? value.trim().replace(/^tenant:/i, "") : null;
+  return memberships.filter((row) => row?.status === "active").map((row) => {
+    const membership = row;
+    const displayKey = bare(membership.displayKey);
+    const tenantId = bare(membership.tenantId);
+    return { displayKey, selectors: [displayKey, tenantId].filter((v) => v !== null) };
+  });
+}
+async function warnIfTenantIsNotAMembership(apiUrl, tenant) {
+  try {
+    const client = new HiveClient({ apiUrl, tenant: null });
+    const me = await client.get("/api/me");
+    remoteFailureHandled();
+    if (me.status !== 200) return;
+    const memberships = activeMemberships(me.data);
+    if (memberships === null) return;
+    const selector = tenant.value.trim();
+    const matches = (value) => value.toLowerCase() === selector.toLowerCase();
+    if (memberships.some((membership) => membership.selectors.some(matches))) return;
+    const source = tenant.source === "saved" ? "pinned" : tenant.source;
+    const keys = memberships.map((membership) => membership.displayKey).filter((key) => key !== null);
+    const have = keys.length ? keys.join(", ") : "none";
+    console.error(
+      `
+\x1B[33mWarning:\x1B[0m tenant '${selector}' (${source}) is not one of your active memberships on ${apiUrl} (you have: ${have}).
+Every command will fail with TENANT_NOT_ALLOWED until you fix it: run 'hive config clear --tenant', or 'hive config use --tenant=<displayKey>' to pin one of the above.`
+    );
+  } catch {
+  }
+}
 var loginArgs = {
   ...globalArgs,
   username: { type: "positional", required: false, description: "Username (pre-fills the browser login)" },
@@ -10063,10 +10450,13 @@ var login = defineCommand({
         issuer = await resolveSetting({ saved: cfg.issuerUrl, def: DEFAULT_ISSUER2, label: "OIDC issuer URL" });
       }
     }
+    const moved = endpointChange(cfg, api.value, issuer.value);
+    const savedPin = cfg.tenant?.trim() ?? "";
+    const droppedPin = moved !== null && savedPin !== "" ? savedPin : null;
     const tenant = await resolveSetting({
       flag: args.tenant,
       envVar: ["HIVE_TENANT", "HIVE_TENANT_ID"],
-      saved: cfg.tenant,
+      saved: moved ? void 0 : cfg.tenant,
       def: "default",
       label: "Tenant"
     });
@@ -10075,6 +10465,7 @@ var login = defineCommand({
     }
     const caFileRaw = String(args.caFile ?? process.env.HIVE_CA_FILE ?? "").trim();
     const caFile = caFileRaw ? import_node_path6.default.resolve(caFileRaw) : "";
+    if (droppedPin && tenant.source === "default") clearConfig(["tenant"]);
     saveConfig({
       apiUrl: api.value,
       issuerUrl: issuer.value,
@@ -10086,6 +10477,11 @@ var login = defineCommand({
     console.log(`  Issuer:   ${issuer.value}  \x1B[90m(${issuer.source})\x1B[0m`);
     if (clientId) console.log(`  Client:   ${clientId}`);
     console.log(`  Tenant:   ${tenant.value}  \x1B[90m(${tenant.source})\x1B[0m`);
+    if (droppedPin && moved) {
+      console.log(
+        `  \x1B[33mCleared pinned tenant '${droppedPin}'\x1B[0m \u2014 it was set for ${moved.from}, and this login is against ${moved.to}. Re-pin with 'hive config use --tenant=<displayKey>' (${configPath()}).`
+      );
+    }
     console.log("");
     const loginHint = args.username || args.user || void 0;
     const noBrowser = args.browser === false;
@@ -10093,6 +10489,7 @@ var login = defineCommand({
       await loginWithBrowser(issuer.value, { loginHint, noBrowser, clientId });
       const creds = getStoredCredentials();
       console.log(`\x1B[32mSigned in successfully${creds?.user ? ` as ${creds.user}` : ""}.\x1B[0m`);
+      if (tenant.source !== "default") await warnIfTenantIsNotAMembership(api.value, tenant);
     } catch (err) {
       console.error(`
 \x1B[31mLogin failed:\x1B[0m ${err.message}`);
@@ -10146,7 +10543,10 @@ function configSnapshot(args) {
     path: configPath(),
     config: cfg,
     resolved: {
-      tenant: resolveTenantContext(args, cfg),
+      // Describes rather than resolves (#173): `config show`/`config doctor` is
+      // where an operator looks when a saved selector is the problem, so it
+      // reports an unusable one (`problem`) instead of refusing to run.
+      tenant: describeTenantContext(args, cfg),
       mission: resolveMissionContext(args, cfg)
     }
   };
@@ -10169,7 +10569,7 @@ var config = defineCommand({
       meta: { name: "show", description: "Show saved and resolved CLI context" },
       args: withArgs(),
       run({ args }) {
-        const { fmt } = ctx(args);
+        const { fmt } = ctx(args, { diagnostic: true });
         return output(configSnapshot(args), fmt);
       }
     }),
@@ -10180,7 +10580,7 @@ var config = defineCommand({
         const before = readConfig();
         const patch2 = pickConfig(args);
         const after = saveConfig(patch2);
-        const { fmt } = ctx(args);
+        const { fmt } = ctx(args, { diagnostic: true });
         return output({ ok: true, previous: before, current: after, changed: patch2 }, fmt);
       }
     }),
@@ -10206,7 +10606,7 @@ var config = defineCommand({
           if (args.caFile) keys.push("caFile");
         }
         const after = keys.length ? clearConfig(keys) : before;
-        const { fmt } = ctx(args);
+        const { fmt } = ctx(args, { diagnostic: true });
         return output({ ok: true, previous: before, current: after, cleared: keys }, fmt);
       }
     }),
@@ -10214,7 +10614,7 @@ var config = defineCommand({
       meta: { name: "doctor", description: "Check local pinned context for obvious problems" },
       args: withArgs(),
       async run({ args }) {
-        const { fmt } = ctx(args);
+        const { fmt } = ctx(args, { diagnostic: true });
         return output(configSnapshot(args), fmt);
       }
     })
@@ -10231,7 +10631,7 @@ var auth = defineCommand({
       meta: { name: "status", description: "Show active auth/session state" },
       args: withArgs(),
       run({ args }) {
-        const { fmt } = ctx(args);
+        const { fmt } = ctx(args, { diagnostic: true });
         const creds = getStoredCredentials();
         const now = Date.now();
         const expiresInSeconds = creds?.expires_at ? Math.floor((creds.expires_at - now) / 1e3) : null;
@@ -10290,8 +10690,8 @@ var doctor = defineCommand({
   meta: { name: "doctor", description: "Diagnose CLI install, auth, API reachability, tenant, and mission context" },
   args: withArgs(),
   async run({ args }) {
-    const { client, fmt } = ctx(args);
-    const tenant = resolveTenantContext(args);
+    const { client, fmt } = ctx(args, { diagnostic: true });
+    const tenant = describeTenantContext(args);
     const mission2 = resolveMissionContext(args);
     const creds = getStoredCredentials();
     const checks = {
@@ -24960,24 +25360,6 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config2(en_default());
 
-// ../hive-api-contracts/src/admin-orgs.ts
-init_cjs_shims();
-function isValidCorsOrigin(value) {
-  let url2;
-  try {
-    url2 = new URL(value);
-  } catch {
-    return false;
-  }
-  if (url2.protocol !== "http:" && url2.protocol !== "https:") return false;
-  if (url2.username || url2.password) return false;
-  if (url2.host === "") return false;
-  if (url2.pathname !== "/" && url2.pathname !== "") return false;
-  if (url2.search || url2.hash) return false;
-  return url2.origin === value;
-}
-var ROLE_KEY_RE = /^[a-z0-9][a-z0-9._:-]{0,63}$/;
-
 // ../hive-api-contracts/src/mission-kafka-ingest.ts
 init_cjs_shims();
 var MISSION_KAFKA_SASL_MECHANISMS = [
@@ -25923,7 +26305,7 @@ function platformAdminLeaf(name, description) {
     meta: { name, description },
     args: adminArgs,
     async run({ args }) {
-      const { client, fmt } = ctx(args);
+      const { client, fmt } = ctx(args, { adminScope: true });
       if (name === "list") {
         return output((await client.get("/api/admin/platform-admins")).data, fmt);
       }
@@ -25972,15 +26354,10 @@ var orgArgs = withArgs({
 });
 function ensureOk(status2, data, action) {
   if (isHttpOk(status2)) return;
-  const remediation = remoteFailureRemediation(data);
-  throw commandError(
-    "REMOTE_FAILED",
-    // #124: 401/403 and 404 carry their own contract codes; everything else
-    // stays the generic remote failure this always threw.
-    exitCodeForStatus(status2),
-    `${action} failed${status2 ? ` (HTTP ${status2})` : ""}: ${remoteFailureText(data)}${remediation ? ` \u2014 ${remediation}` : ""}`,
-    remediation ? { remediation } : void 0
-  );
+  throw remoteFailureError(status2, data, action);
+}
+function adminCtx(args) {
+  return ctx(args, { adminScope: true });
 }
 function applyRuntimeConfig(args, body) {
   for (const [flag, clearFlag, key] of [
@@ -26041,7 +26418,7 @@ async function resolveTenantId(args) {
   if (!key) {
     throw commandError("TENANT_ID_REQUIRED", 1, "Pass --tenant-id <uuid> or --tenant-key/--display-key <tenant>.");
   }
-  const { client } = ctx(args);
+  const { client } = adminCtx(args);
   const res = await client.get("/api/admin/orgs");
   ensureOk(res.status, res.data, "list tenants");
   const matches = tenantList(res.data).filter(
@@ -26106,7 +26483,7 @@ var org = defineCommand({
       meta: { name: "list", description: "List admin-visible tenants" },
       args: orgArgs,
       async run({ args }) {
-        const { client, fmt } = ctx(args);
+        const { client, fmt } = adminCtx(args);
         const res = await client.get("/api/admin/orgs");
         ensureOk(res.status, res.data, "list tenants");
         return output(res.data, fmt);
@@ -26116,8 +26493,8 @@ var org = defineCommand({
       meta: { name: "create", description: "Create or reuse an org/customer tenant (--display-key, [--reuse], [--pin])" },
       args: orgArgs,
       async run({ args }) {
-        const { client, fmt } = ctx(args);
-        printContextNotice(args);
+        const { client, fmt } = adminCtx(args);
+        printContextNotice(args, { adminScope: true });
         req(args, "displayKey");
         assertCanonicalTenantSelector(String(args.displayKey), "--display-key");
         const body = {
@@ -26177,7 +26554,7 @@ var org = defineCommand({
           args: orgArgs,
           async run({ args }) {
             const { tenantId } = await resolveTenantId(args);
-            const { client, fmt } = ctx(args);
+            const { client, fmt } = adminCtx(args);
             const res = await client.get(`/api/admin/orgs/${enc(tenantId)}/members`);
             ensureOk(res.status, res.data, "list tenant members");
             return output(res.data, fmt);
@@ -26187,7 +26564,7 @@ var org = defineCommand({
           meta: { name: "admit", description: "Admit a user/principal by email and optional roles" },
           args: orgArgs,
           async run({ args }) {
-            printContextNotice(args);
+            printContextNotice(args, { adminScope: true });
             const { tenantId } = await resolveTenantId(args);
             req(args, "email");
             const body = {
@@ -26196,7 +26573,7 @@ var org = defineCommand({
             };
             if (args.displayName) body.displayName = args.displayName;
             if (args.kind) body.kind = args.kind;
-            const { client, fmt } = ctx(args);
+            const { client, fmt } = adminCtx(args);
             const res = await client.post(`/api/admin/orgs/${enc(tenantId)}/members`, body);
             ensureOk(res.status, res.data, "admit tenant member");
             return output({ ...recordOf2(res.data), idempotent: true }, fmt);
@@ -26212,12 +26589,12 @@ var org = defineCommand({
           meta: { name: "grant", description: "Grant a tenant role to a principal" },
           args: orgArgs,
           async run({ args }) {
-            printContextNotice(args);
+            printContextNotice(args, { adminScope: true });
             const { tenantId } = await resolveTenantId(args);
             req(args, "principalId");
             const role = rolesFromArgs(args)[0];
             if (!role) throw commandError("ROLE_REQUIRED", 1, "Pass --role <role-key>.");
-            const { client, fmt } = ctx(args);
+            const { client, fmt } = adminCtx(args);
             const res = await client.put(`/api/admin/orgs/${enc(tenantId)}/members/${enc(args.principalId)}/roles`, { roleKey: role });
             ensureOk(res.status, res.data, "grant tenant role");
             return output({ ...recordOf2(res.data), idempotent: true }, fmt);
@@ -26227,12 +26604,12 @@ var org = defineCommand({
           meta: { name: "revoke", description: "Revoke a tenant role from a principal" },
           args: orgArgs,
           async run({ args }) {
-            printContextNotice(args);
+            printContextNotice(args, { adminScope: true });
             const { tenantId } = await resolveTenantId(args);
             req(args, "principalId");
             const role = rolesFromArgs(args)[0];
             if (!role) throw commandError("ROLE_REQUIRED", 1, "Pass --role <role-key>.");
-            const { client, fmt } = ctx(args);
+            const { client, fmt } = adminCtx(args);
             const res = await client.del(`/api/admin/orgs/${enc(tenantId)}/members/${enc(args.principalId)}/roles/${enc(role)}`);
             ensureOk(res.status, res.data, "revoke tenant role");
             return output(res.data, fmt);
@@ -26247,7 +26624,7 @@ var org = defineCommand({
       },
       args: orgArgs,
       async run({ args }) {
-        printContextNotice(args);
+        printContextNotice(args, { adminScope: true });
         req(args, "displayKey");
         assertCanonicalTenantSelector(String(args.displayKey), "--display-key");
         req(args, "email");
@@ -26264,7 +26641,7 @@ var org = defineCommand({
           );
         }
         const kind = String(args.kind || "organization").trim();
-        const { client, fmt } = ctx(args);
+        const { client, fmt } = adminCtx(args);
         const createBody = { kind, displayKey: args.displayKey };
         applyRuntimeConfig(args, createBody);
         if (args.ownerPrincipalId) createBody.ownerPrincipalId = args.ownerPrincipalId;
@@ -26619,7 +26996,7 @@ function firstNonBlank(...values) {
 }
 function authzDiagContext(args) {
   const cfg = readConfig();
-  const tenantSelection = resolveTenantContext(args, cfg);
+  const tenantSelection = describeTenantContext(args, cfg);
   return {
     client: new HiveClient({
       apiUrl: firstNonBlank(args.apiUrl, process.env.HIVE_API_URL, cfg.apiUrl),
@@ -26666,7 +27043,10 @@ async function runAuthzDiag(args) {
       cliTenantSelection: {
         value: tenantSelection.source === "default" ? null : tenantSelection.value,
         source: tenantSelection.source,
-        applied: false
+        applied: false,
+        // #173: present only when the local selector could never name a tenant
+        // — the answer to "why does every other command 403?".
+        ...tenantSelection.problem ? { problem: tenantSelection.problem } : {}
       },
       requestId: typeof request.requestId === "string" ? request.requestId : typeof meBody.requestId === "string" ? meBody.requestId : null,
       tenantSelectionSource: typeof request.tenantSelectionSource === "string" ? request.tenantSelectionSource : null,
@@ -27048,13 +27428,7 @@ function parseObjectArg(value, flag) {
 }
 function assertRemoteOk(status2, data, action, exitCode = exitCodeForStatus(status2)) {
   if (isHttpOk(status2)) return;
-  const remediation = remoteFailureRemediation(data);
-  throw commandError(
-    "REMOTE_FAILED",
-    exitCode,
-    `${action} failed${status2 ? ` (HTTP ${status2})` : ""}: ${remoteFailureText(data)}${remediation ? ` \u2014 ${remediation}` : ""}`,
-    remediation ? { remediation } : void 0
-  );
+  throw remoteFailureError(status2, data, action, exitCode);
 }
 var MEMBERSHIP_ERROR_CODES = {
   "cannot grant the owner role (single-owner v1)": "MISSION_OWNER_GRANT_FORBIDDEN",
@@ -28582,13 +28956,7 @@ var Ajv2 = ajvModule2.default ?? ajvModule2;
 var addFormats2 = ajvFormatsModule2.default ?? ajvFormatsModule2;
 function assertRemoteOk2(status2, data, action) {
   if (status2 && status2 >= 200 && status2 < 300) return;
-  const remediation = remoteFailureRemediation(data);
-  throw commandError(
-    "REMOTE_FAILED",
-    3,
-    `${action} failed${status2 ? ` (HTTP ${status2})` : ""}: ${remoteFailureText(data)}${remediation ? ` \u2014 ${remediation}` : ""}`,
-    remediation ? { remediation } : void 0
-  );
+  throw remoteFailureError(status2, data, action, EXIT_REMOTE_FAILED);
 }
 function parseMaxBytes(value, fallback = 8 * 1024 * 1024) {
   if (value === void 0 || value === null || value === "") return fallback;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@senticor/hive",
-  "version": "1.42.1",
+  "version": "1.43.1",
   "description": "Cognitive Hive OS — unified CLI",
   "type": "commonjs",
   "bin": {