@wave-ai-os/wave-cli 0.1.63 → 0.1.65

package/README.md

@@ -39,7 +39,7 @@ Secure stdin auth/context examples:
 ```bash
 printf '%s' "token-value" | wave --token-stdin --base-url https://api.example.com --organization-id 42 tasks list --page 1 --per 10
 
-printf '%s' '{"token":"token-value","baseUrl":"https://api.example.com","organizationId":"42","agentName":"atlas"}' \
+printf '%s' '{"token":"token-value","baseUrl":"https://api.example.com","agentName":"atlas"}' \
   | wave --auth-json-stdin tasks list --page 1 --per 10
 ```
 
@@ -72,10 +72,7 @@ Required (from flags, stdin, env, config, or stored credentials):
 - `WAVE_API_BASE_URL`
 
 Organization-scoped data commands use the organization certified by the
-authenticated CLI token. `--organization-id` is the only local override. The
-CLI intentionally ignores `WAVE_ORGANIZATION_ID`, `WAVE_ORG_ID`, stdin, and
-stored config organization values as automatic scopes so a stale local value
-cannot select a different organization.
+authenticated CLI token. `--organization-id` is the only local override.
 
 Optional env:
 
@@ -103,7 +100,6 @@ Config files are JSON objects using the same keys accepted by `--auth-json-stdin
 {
   "token": "token-value",
   "baseUrl": "https://api.example.com",
-  "organizationId": "42",
   "agentName": "atlas"
 }
 ```

package/dist/index.cjs

@@ -128,9 +128,7 @@ function getConfig(options) {
   const parsed = configSchema.safeParse({
     baseUrl,
     token,
-    organizationId: toOptionalNonEmpty(
-      options.organizationId ?? process.env.WAVE_ORGANIZATION_ID ?? process.env.WAVE_ORG_ID
-    ),
+    organizationId: toOptionalNonEmpty(options.organizationId),
     timeoutMs: parseTimeoutMs(options.timeoutMs ?? process.env.WAVE_TIMEOUT_MS),
     debug: options.debug ?? parseDebug(process.env.WAVE_DEBUG),
     agentName: toOptionalNonEmpty(options.agentName ?? process.env.WAVE_AGENT_NAME),
@@ -2187,7 +2185,6 @@ function parseAuthJson(raw) {
     return {
       token: normalize3(obj.token),
       baseUrl: normalize3(obj.baseUrl ?? obj.base_url),
-      organizationId: normalize3(obj.organizationId ?? obj.organization_id),
       timeoutMs: typeof obj.timeoutMs === "number" || typeof obj.timeoutMs === "string" ? obj.timeoutMs : typeof obj.timeout_ms === "number" || typeof obj.timeout_ms === "string" ? obj.timeout_ms : void 0,
       debug: parseBool(obj.debug),
       agentName: normalize3(obj.agentName ?? obj.agent_name),
@@ -2270,7 +2267,6 @@ function resolveAuthToken(options, stdin, config, env) {
     { token: normalize3(options.token), source: "flag" },
     { token: normalize3(stdin.token), source: "stdin" },
     { token: normalize3(env.WAVE_API_TOKEN), source: "env" },
-    { token: normalize3(config.token), source: "config" },
     { token: normalize3(config.token), source: "config" }
   ];
   return candidates.find((candidate) => candidate.token) ?? { source: "none" };
@@ -2283,18 +2279,8 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(env.WAVE_API_URL),
     normalize3(config.baseUrl)
   );
-  const organizationCandidates = [
-    { organizationId: normalize3(options.organizationId), source: "flag" },
-    { organizationId: normalize3(stdin.organizationId), source: "stdin" },
-    { organizationId: normalize3(env.WAVE_ORGANIZATION_ID), source: "env" },
-    { organizationId: normalize3(env.WAVE_ORG_ID), source: "env" },
-    { organizationId: normalize3(config.organizationId), source: "config" }
-  ];
-  const resolvedOrganization = organizationCandidates.find((candidate) => candidate.organizationId) ?? {
-    organizationId: void 0,
-    source: "none"
-  };
-  const organizationId = resolvedOrganization.organizationId;
+  const organizationId = normalize3(options.organizationId);
+  const organizationIdSource = organizationId ? "flag" : "none";
   const timeoutMs = firstDefined(options.timeoutMs, stdin.timeoutMs, env.WAVE_TIMEOUT_MS, config.timeoutMs);
   const debug = firstDefined(
     options.debug,
@@ -2383,7 +2369,7 @@ function resolveFromSources(options, stdin, config, env) {
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
   return {
     organizationId,
-    organizationIdSource: resolvedOrganization.source,
+    organizationIdSource,
     runtimeOptions: {
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
@@ -2523,7 +2509,9 @@ async function resolveCommandContext(options) {
 function organizationIdFromCliAuthStatus(data) {
   const status = data.cliAuthStatus;
   if (!status || typeof status !== "object" || Array.isArray(status)) return void 0;
-  const organization = status.organization;
+  const cliAuthStatus = status;
+  if (cliAuthStatus.authenticated !== true) return void 0;
+  const organization = cliAuthStatus.organization;
   if (!organization || typeof organization !== "object" || Array.isArray(organization)) return void 0;
   return normalize3(organization.id);
 }
@@ -14460,7 +14448,7 @@ async function runDatasheetsQuery(cmd, config) {
   });
 }
 async function runDatasheetsMutation(cmd, opts, config) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = config.organizationContext === "optional" ? await resolveUnscopedCommandContext(cmd.optsWithGlobals()) : await resolveCommandContext(cmd.optsWithGlobals());
   const variables = config.organizationContext === "optional" ? context.organizationId ? { organization_id: context.organizationId } : {} : { organization_id: resolveOrganizationId(context.organizationId) };
   for (const id of config.requiredIds ?? []) {
     variables[id.variable] = requireNonEmpty(opts[id.option], id.label, config.command);
@@ -14497,7 +14485,7 @@ async function runDatasheetsMutation(cmd, opts, config) {
     runtimeOptions: context.runtimeOptions,
     field: config.field,
     variables: normalizeGraphqlVariables2(variables),
-    variableTypes: { organization_id: "ID!" },
+    variableTypes: config.organizationContext === "optional" && !context.organizationId ? {} : { organization_id: "ID!" },
     selectionSet: DATASHEET_MUTATION_SELECTION
   });
 }
@@ -15840,7 +15828,9 @@ async function resolveDoctorAuthOrganization(params) {
     if (!status || typeof status !== "object" || Array.isArray(status)) {
       return null;
     }
-    const organization = status.organization;
+    const cliAuthStatus = status;
+    if (cliAuthStatus.authenticated !== true) return null;
+    const organization = cliAuthStatus.organization;
     if (!organization || typeof organization !== "object" || Array.isArray(organization)) {
       return null;
     }
@@ -15881,7 +15871,7 @@ async function runDoctor(cmd, opts) {
       name: "organization_id",
       ok: Boolean(organizationId || authOrganization?.id || authOrganization?.slug),
       status: organizationId || authOrganization?.id || authOrganization?.slug ? "resolved" : "missing",
-      source: organizationId ? "flag/stdin/env" : authOrganization ? "auth_token" : "unresolved",
+      source: organizationId ? "explicit_flag" : authOrganization ? "auth_token" : "unresolved",
       ...authOrganization?.id ? { id: authOrganization.id } : {},
       ...authOrganization?.slug ? { slug: authOrganization.slug } : {}
     },
@@ -16134,20 +16124,20 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.63";
+var CLI_VERSION = "0.1.65";
 
 // src/cli.ts
 function buildCli(options) {
   const program = new import_commander.Command();
   program.name("wave").description("Wave agent CLI").version(CLI_VERSION, "-V, --version", "output the version number").showHelpAfterError(false).allowExcessArguments(false).option("--token <token>", "API token (prefer WAVE_API_TOKEN env var)").option("--token-stdin", "Read API token from stdin").option(
     "--auth-json-stdin",
-    "Read auth/runtime context JSON from stdin (token, baseUrl, organizationId, ...)"
+    "Read auth/runtime context JSON from stdin (token, baseUrl, tracing fields, ...)"
   ).option(
     "--base-url <baseUrl>",
     "API base URL (prefer WAVE_API_BASE_URL env var)"
   ).option(
     "--organization-id <organizationId>",
-    "Organization ID (prefer WAVE_ORGANIZATION_ID env var)"
+    "Explicit organization ID override"
   ).option(
     "--config <configPath>",
     "Optional JSON config file (default: WAVE_CONFIG_PATH or ~/.wave/config.json when present)"

package/dist/index.js

@@ -127,9 +127,7 @@ function getConfig(options) {
   const parsed = configSchema.safeParse({
     baseUrl,
     token,
-    organizationId: toOptionalNonEmpty(
-      options.organizationId ?? process.env.WAVE_ORGANIZATION_ID ?? process.env.WAVE_ORG_ID
-    ),
+    organizationId: toOptionalNonEmpty(options.organizationId),
     timeoutMs: parseTimeoutMs(options.timeoutMs ?? process.env.WAVE_TIMEOUT_MS),
     debug: options.debug ?? parseDebug(process.env.WAVE_DEBUG),
     agentName: toOptionalNonEmpty(options.agentName ?? process.env.WAVE_AGENT_NAME),
@@ -2186,7 +2184,6 @@ function parseAuthJson(raw) {
     return {
       token: normalize3(obj.token),
       baseUrl: normalize3(obj.baseUrl ?? obj.base_url),
-      organizationId: normalize3(obj.organizationId ?? obj.organization_id),
       timeoutMs: typeof obj.timeoutMs === "number" || typeof obj.timeoutMs === "string" ? obj.timeoutMs : typeof obj.timeout_ms === "number" || typeof obj.timeout_ms === "string" ? obj.timeout_ms : void 0,
       debug: parseBool(obj.debug),
       agentName: normalize3(obj.agentName ?? obj.agent_name),
@@ -2269,7 +2266,6 @@ function resolveAuthToken(options, stdin, config, env) {
     { token: normalize3(options.token), source: "flag" },
     { token: normalize3(stdin.token), source: "stdin" },
     { token: normalize3(env.WAVE_API_TOKEN), source: "env" },
-    { token: normalize3(config.token), source: "config" },
     { token: normalize3(config.token), source: "config" }
   ];
   return candidates.find((candidate) => candidate.token) ?? { source: "none" };
@@ -2282,18 +2278,8 @@ function resolveFromSources(options, stdin, config, env) {
     normalize3(env.WAVE_API_URL),
     normalize3(config.baseUrl)
   );
-  const organizationCandidates = [
-    { organizationId: normalize3(options.organizationId), source: "flag" },
-    { organizationId: normalize3(stdin.organizationId), source: "stdin" },
-    { organizationId: normalize3(env.WAVE_ORGANIZATION_ID), source: "env" },
-    { organizationId: normalize3(env.WAVE_ORG_ID), source: "env" },
-    { organizationId: normalize3(config.organizationId), source: "config" }
-  ];
-  const resolvedOrganization = organizationCandidates.find((candidate) => candidate.organizationId) ?? {
-    organizationId: void 0,
-    source: "none"
-  };
-  const organizationId = resolvedOrganization.organizationId;
+  const organizationId = normalize3(options.organizationId);
+  const organizationIdSource = organizationId ? "flag" : "none";
   const timeoutMs = firstDefined(options.timeoutMs, stdin.timeoutMs, env.WAVE_TIMEOUT_MS, config.timeoutMs);
   const debug = firstDefined(
     options.debug,
@@ -2382,7 +2368,7 @@ function resolveFromSources(options, stdin, config, env) {
   const resolvedAuth = resolveAuthToken(options, stdin, config, env);
   return {
     organizationId,
-    organizationIdSource: resolvedOrganization.source,
+    organizationIdSource,
     runtimeOptions: {
       token: resolvedAuth.token,
       tokenSource: resolvedAuth.token ? resolvedAuth.source : "none",
@@ -2522,7 +2508,9 @@ async function resolveCommandContext(options) {
 function organizationIdFromCliAuthStatus(data) {
   const status = data.cliAuthStatus;
   if (!status || typeof status !== "object" || Array.isArray(status)) return void 0;
-  const organization = status.organization;
+  const cliAuthStatus = status;
+  if (cliAuthStatus.authenticated !== true) return void 0;
+  const organization = cliAuthStatus.organization;
   if (!organization || typeof organization !== "object" || Array.isArray(organization)) return void 0;
   return normalize3(organization.id);
 }
@@ -14459,7 +14447,7 @@ async function runDatasheetsQuery(cmd, config) {
   });
 }
 async function runDatasheetsMutation(cmd, opts, config) {
-  const context = await resolveCommandContext(cmd.optsWithGlobals());
+  const context = config.organizationContext === "optional" ? await resolveUnscopedCommandContext(cmd.optsWithGlobals()) : await resolveCommandContext(cmd.optsWithGlobals());
   const variables = config.organizationContext === "optional" ? context.organizationId ? { organization_id: context.organizationId } : {} : { organization_id: resolveOrganizationId(context.organizationId) };
   for (const id of config.requiredIds ?? []) {
     variables[id.variable] = requireNonEmpty(opts[id.option], id.label, config.command);
@@ -14496,7 +14484,7 @@ async function runDatasheetsMutation(cmd, opts, config) {
     runtimeOptions: context.runtimeOptions,
     field: config.field,
     variables: normalizeGraphqlVariables2(variables),
-    variableTypes: { organization_id: "ID!" },
+    variableTypes: config.organizationContext === "optional" && !context.organizationId ? {} : { organization_id: "ID!" },
     selectionSet: DATASHEET_MUTATION_SELECTION
   });
 }
@@ -15839,7 +15827,9 @@ async function resolveDoctorAuthOrganization(params) {
     if (!status || typeof status !== "object" || Array.isArray(status)) {
       return null;
     }
-    const organization = status.organization;
+    const cliAuthStatus = status;
+    if (cliAuthStatus.authenticated !== true) return null;
+    const organization = cliAuthStatus.organization;
     if (!organization || typeof organization !== "object" || Array.isArray(organization)) {
       return null;
     }
@@ -15880,7 +15870,7 @@ async function runDoctor(cmd, opts) {
       name: "organization_id",
       ok: Boolean(organizationId || authOrganization?.id || authOrganization?.slug),
       status: organizationId || authOrganization?.id || authOrganization?.slug ? "resolved" : "missing",
-      source: organizationId ? "flag/stdin/env" : authOrganization ? "auth_token" : "unresolved",
+      source: organizationId ? "explicit_flag" : authOrganization ? "auth_token" : "unresolved",
       ...authOrganization?.id ? { id: authOrganization.id } : {},
       ...authOrganization?.slug ? { slug: authOrganization.slug } : {}
     },
@@ -16133,20 +16123,20 @@ function attachDiscoveryHelp(program) {
 }
 
 // src/version.ts
-var CLI_VERSION = "0.1.63";
+var CLI_VERSION = "0.1.65";
 
 // src/cli.ts
 function buildCli(options) {
   const program = new Command();
   program.name("wave").description("Wave agent CLI").version(CLI_VERSION, "-V, --version", "output the version number").showHelpAfterError(false).allowExcessArguments(false).option("--token <token>", "API token (prefer WAVE_API_TOKEN env var)").option("--token-stdin", "Read API token from stdin").option(
     "--auth-json-stdin",
-    "Read auth/runtime context JSON from stdin (token, baseUrl, organizationId, ...)"
+    "Read auth/runtime context JSON from stdin (token, baseUrl, tracing fields, ...)"
   ).option(
     "--base-url <baseUrl>",
     "API base URL (prefer WAVE_API_BASE_URL env var)"
   ).option(
     "--organization-id <organizationId>",
-    "Organization ID (prefer WAVE_ORGANIZATION_ID env var)"
+    "Explicit organization ID override"
   ).option(
     "--config <configPath>",
     "Optional JSON config file (default: WAVE_CONFIG_PATH or ~/.wave/config.json when present)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wave-ai-os/wave-cli",
-  "version": "0.1.63",
+  "version": "0.1.65",
   "type": "module",
   "bin": {
     "wave": "dist/index.js"

package/scripts/benchmark-cli.mjs

@@ -2,6 +2,7 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { spawnSync } from "node:child_process";
+import { REQUIRED_WAVE_RUNTIME_INPUTS } from "./cli-token-scope.mjs";
 
 const DEFAULTS = {
   runs: 10,
@@ -479,7 +480,7 @@ function main() {
   };
 
   const waveEntryAbs = resolve(cwd, options.waveEntry);
-  const waveMissing = ["WAVE_API_BASE_URL", "WAVE_API_TOKEN", "WAVE_ORGANIZATION_ID"].filter((key) => !baseEnv[key]);
+  const waveMissing = REQUIRED_WAVE_RUNTIME_INPUTS.filter((key) => !baseEnv[key]);
   const waveReady = existsSync(waveEntryAbs) && waveMissing.length === 0;
 
   const obsidian = resolveObsidianBinary(options.obsidianBin);

package/scripts/cli-token-scope.mjs

@@ -0,0 +1,10 @@
+export const REQUIRED_WAVE_RUNTIME_INPUTS = ["WAVE_API_BASE_URL", "WAVE_API_TOKEN"];
+
+export function organizationIdFromAuthenticatedStatus(envelope) {
+  if (!envelope || envelope.ok !== true) return undefined;
+  if (envelope.data?.authenticated !== true) return undefined;
+  const organizationId = envelope.data?.organization?.id;
+  return typeof organizationId === "string" && organizationId.trim() !== ""
+    ? organizationId
+    : undefined;
+}

package/scripts/verify-dev-api.mjs

@@ -2,6 +2,7 @@
 import { readFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
+import { organizationIdFromAuthenticatedStatus } from "./cli-token-scope.mjs";
 
 function loadDotEnv(filePath) {
   const raw = readFileSync(filePath, "utf8");
@@ -348,12 +349,18 @@ const dot = loadDotEnv(envFile);
 const env = {
   WAVE_API_BASE_URL: dot.WAVE_API_BASE_URL,
   WAVE_API_TOKEN: dot.WAVE_API_TOKEN,
-  WAVE_ORGANIZATION_ID: dot.WAVE_ORGANIZATION_ID,
   WAVE_AGENT_NAME: dot.WAVE_AGENT_NAME || "cli-verifier",
   WAVE_AGENT_RUN_ID: `verify-${Date.now()}`,
   WAVE_TIMEOUT_MS: dot.WAVE_TIMEOUT_MS || "10000"
 };
 
+const authStatus = runWave(["auth", "status"], env);
+const orgId = organizationIdFromAuthenticatedStatus(authStatus.parsed);
+if (!orgId) {
+  console.error("verify-dev-api failed: authenticated CLI token status did not return an organization id.");
+  process.exit(1);
+}
+
 const idLookup = {};
 const listSeeds = [
   ["projects", ["projects", "list", "--page", "1", "--per", "2"]],
@@ -386,7 +393,7 @@ const listSeeds = [
   ["quarterlyObjectives", ["foundation", "quarterly-objectives", "list", "--page", "1", "--per", "2"]]
 ];
 
-const results = [];
+const results = [authStatus];
 for (const [key, args] of listSeeds) {
   const res = runWave(args, env);
   results.push(res);
@@ -413,7 +420,6 @@ for (const [key, args] of listSeeds) {
   }
 }
 
-const orgId = env.WAVE_ORGANIZATION_ID;
 const projectId = idLookup.projects;
 const taskId = idLookup.tasks;
 const rockId = idLookup.rocks;