@zivis/cli 0.1.0-alpha.39 → 0.1.0-alpha.40

package/dist/commands/app/index.js

@@ -46,7 +46,7 @@ export function registerAppCommands(program) {
         .description("create a customer-facing Application configured for ephemeral PKCE auth")
         .requiredOption("--name <name>", "application display name")
         .requiredOption("--base-url <url>", "primary base URL (e.g., https://api.acme.io)")
-        .option("--type <type>", "agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url", "agent")
+        .option("--type <type>", "application | agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url", "agent")
         .option("--description <text>", "optional description")
         .option("--client-id <id>", "OAuth client_id (PKCE public client)")
         .option("--oidc-issuer <url>", "OIDC issuer (for discovery)")
@@ -105,7 +105,7 @@ export function registerAppCommands(program) {
         .description("update an application's metadata (name, type, ephemeral-creds toggle, etc.)")
         .option("--name <name>", "rename the application")
         .option("--description <text>", "update the description")
-        .option("--type <type>", "agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url")
+        .option("--type <type>", "application | agent | mcp_server | llm_endpoint | rest_api | ad_hoc_url")
         .option("--use-ephemeral", "opt into ephemeral-creds mode (Phase J)")
         .option("--no-ephemeral-disable", "opt OUT of ephemeral-creds mode (legacy KV-backed)")
         .option("--base-url <url>", "update base URL")

package/dist/commands/auth/index.js

@@ -28,6 +28,7 @@ export function registerAuthCommands(program) {
         .option("-s, --session <name>", "named session for multi-tenant")
         .option("-o, --org <workosOrgId>", "scope JWT to a specific WorkOS org")
         .option("-y, --yes", "skip interactive confirmation")
+        .option("--rebind", "switch this project's bound org via interactive picker")
         .option("--bind", "auto-write .zivis/project.json binding")
         .option("--no-bind", "skip project binding")
         .option("--skip-mint-key", "skip MCP API key mint after successful OAuth")

package/dist/commands/auth/login.d.ts

@@ -4,6 +4,7 @@ export interface LoginCmdOpts {
     yes?: boolean;
     bind?: boolean;
     noBind?: boolean;
+    rebind?: boolean;
     skipMintKey?: boolean;
 }
 export declare function loginCommand(opts: LoginCmdOpts): Promise<void>;

package/dist/commands/auth/login.js

@@ -1,13 +1,25 @@
+import * as readline from "node:readline/promises";
 import { login } from "@zivis/mcp/auth";
 import { getStorageName } from "@zivis/mcp/auth";
 import { saveSessionEntry } from "@zivis/mcp/auth";
 import { detectProjectBinding, resolveConfigFromBinding } from "@zivis/mcp/project-binding";
 import { credentialStorageFromConfig, DEFAULT_CONFIG } from "@zivis/mcp/types";
 import { extractEmail } from "../../internal/orgs.js";
+import { pickOrg } from "../../internal/org-picker.js";
 import { ensureProjectBinding } from "../../internal/project-binding.js";
 import { discardOauthAfterLogin, tryAutoMintBindingTokenAfterLogin, } from "../../internal/binding-token-mint.js";
 import { setupCursorWorkspace, setupVsCodeClaude, setupVsCodeCopilot, setupClaudeCodeCli, } from "../../internal/ide-setup.js";
 import { buildLinkagePrompt } from "../../internal/github-linkage-prompt.js";
+async function confirm(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(question)).trim().toLowerCase();
+        return answer !== "n" && answer !== "no";
+    }
+    finally {
+        rl.close();
+    }
+}
 export async function loginCommand(opts) {
     const config = {
         ...DEFAULT_CONFIG,
@@ -15,29 +27,82 @@ export async function loginCommand(opts) {
     };
     const detected = detectProjectBinding(process.cwd());
     const session = opts.session || detected?.binding.session || config.session;
-    let organizationId = opts.org;
-    if (!organizationId && detected?.binding.workosOrgId) {
+    const sessionName = session || "default";
+    let organizationId;
+    let orgName;
+    let writeMode = "no-write";
+    if (opts.org) {
+        organizationId = opts.org;
+        orgName = detected?.binding.orgName && detected.binding.workosOrgId === opts.org
+            ? detected.binding.orgName
+            : undefined;
+        if (opts.rebind) {
+            writeMode = "replace";
+        }
+    }
+    else if (opts.rebind) {
+        const picked = await runIdentityThenPicker(config, sessionName, {
+            currentOrgId: detected?.binding.workosOrgId ?? undefined,
+            header: detected?.binding.workosOrgId
+                ? "Switch this project to which org?"
+                : "Your organizations:",
+        });
+        if (detected?.binding.workosOrgId && detected.binding.workosOrgId === picked.workosOrgId) {
+            console.log(`Project is already bound to ${picked.name}. Nothing to change.`);
+            process.exit(0);
+        }
+        if (detected?.binding.workosOrgId) {
+            const fromLabel = detected.binding.orgName
+                ? `${detected.binding.orgName} (${detected.binding.workosOrgId})`
+                : detected.binding.workosOrgId;
+            const toLabel = `${picked.name} (${picked.workosOrgId})`;
+            if (!opts.yes) {
+                const ok = await confirm(`Change project binding from "${fromLabel}" to "${toLabel}"? [Y/n] `);
+                if (!ok) {
+                    console.log("Aborted.");
+                    process.exit(0);
+                }
+            }
+            writeMode = "replace";
+        }
+        else {
+            writeMode = "create";
+        }
+        organizationId = picked.workosOrgId;
+        orgName = picked.name;
+    }
+    else if (detected?.binding.workosOrgId) {
         organizationId = detected.binding.workosOrgId;
-        console.log(`Using org from project binding: ${organizationId}${detected.binding.orgName ? ` (${detected.binding.orgName})` : ""}`);
+        orgName = detected.binding.orgName;
+        console.log(`Using org from project binding: ${organizationId}${orgName ? ` (${orgName})` : ""}`);
+    }
+    else {
+        const picked = await runIdentityThenPicker(config, sessionName, {
+            header: "Your organizations:",
+        });
+        organizationId = picked.workosOrgId;
+        orgName = picked.name;
+        writeMode = "create";
+    }
+    if (!organizationId) {
+        console.error("Internal error: no organization resolved for login.");
+        process.exit(1);
     }
     if (detected?.binding.session && !opts.session) {
         console.log(`Using session from project binding: ${session}`);
     }
     try {
         const tokens = await login(config, session, organizationId, {
-            orgName: detected?.binding.orgName,
-            skipConfirm: opts.yes === true,
+            orgName,
+            skipConfirm: opts.yes === true || writeMode !== "no-write",
         });
         const storageName = getStorageName();
         const email = extractEmail(tokens.id_token);
-        const sessionName = session || "default";
         await saveSessionEntry(sessionName, email, credentialStorageFromConfig(config));
         const sessionLabel = session ? ` (session: ${session})` : "";
         console.log(`✓ Logged in as ${email}${sessionLabel}`);
         console.log(`✓ Credentials stored in ${storageName}`);
-        if (organizationId) {
-            console.log(`✓ JWT scoped to organization: ${organizationId}`);
-        }
+        console.log(`✓ JWT scoped to organization: ${organizationId}${orgName ? ` (${orgName})` : ""}`);
         try {
             await setupCursorWorkspace();
         }
@@ -57,14 +122,24 @@ export async function loginCommand(opts) {
         catch (err) {
             console.log(`  WARNING: Failed to update Claude Code CLI config: ${err instanceof Error ? err.message : err}`);
         }
+        if (writeMode === "create" && !opts.yes && !opts.noBind) {
+            const orgLabel = orgName ? `${orgName} (${organizationId})` : organizationId;
+            const ok = await confirm(`Bind this project to ${orgLabel}? [Y/n] `);
+            if (!ok) {
+                console.log("Login succeeded but project was not bound.");
+                await discardOauthAfterLogin({ session, config });
+                process.exit(0);
+            }
+        }
         await ensureProjectBinding({
             config,
             session: sessionName,
             accessToken: tokens.access_token,
             organizationId,
             cwd: process.cwd(),
-            autoBind: opts.bind === true,
+            autoBind: opts.bind === true || writeMode !== "no-write",
             skipBind: opts.noBind === true,
+            force: writeMode === "replace",
         });
         await tryAutoMintBindingTokenAfterLogin({
             cwd: process.cwd(),
@@ -88,3 +163,21 @@ export async function loginCommand(opts) {
         process.exit(1);
     }
 }
+async function runIdentityThenPicker(config, session, pickOpts) {
+    console.log("Opening browser to identify your account (no org scope yet)...");
+    let identity;
+    try {
+        identity = await login(config, session, undefined, { skipConfirm: true });
+    }
+    catch (err) {
+        console.error("Login failed:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+    try {
+        return await pickOrg(config, identity.access_token, pickOpts);
+    }
+    catch (err) {
+        console.error(err instanceof Error ? err.message : err);
+        process.exit(1);
+    }
+}

package/dist/commands/scan/index.js

@@ -126,6 +126,7 @@ function appTypeToTargetType(appType) {
             return "ai_chat";
         case "rest_api":
             return "api";
+        case "application":
         case "ad_hoc_url":
             return "web_app";
         default:

package/dist/internal/org-picker.d.ts

@@ -0,0 +1,11 @@
+import type { ZivisConfig } from "@zivis/mcp/types";
+import { type OrgInfo } from "./orgs.js";
+export interface PickOrgOpts {
+    currentOrgId?: string;
+    header?: string;
+    promptText?: string;
+}
+export interface PickedOrg extends OrgInfo {
+    workosOrgId: string;
+}
+export declare function pickOrg(config: ZivisConfig, identityAccessToken: string, opts?: PickOrgOpts): Promise<PickedOrg>;

package/dist/internal/org-picker.js

@@ -0,0 +1,34 @@
+import * as readline from "node:readline/promises";
+import { fetchUserOrgs } from "./orgs.js";
+export async function pickOrg(config, identityAccessToken, opts = {}) {
+    const all = await fetchUserOrgs(config, identityAccessToken);
+    const eligible = all.filter((o) => typeof o.workosOrgId === "string" && o.workosOrgId.length > 0);
+    if (eligible.length === 0) {
+        throw new Error("No active organizations available for this account. " +
+            "Ask an org admin to invite you, or contact support.");
+    }
+    if (eligible.length === 1) {
+        const only = eligible[0];
+        console.log(`One organization available: ${only.name}`);
+        return only;
+    }
+    console.log("");
+    console.log(opts.header ?? "Your organizations:");
+    eligible.forEach((o, i) => {
+        const marker = opts.currentOrgId && o.workosOrgId === opts.currentOrgId ? " (current)" : "";
+        console.log(`  ${i + 1}. ${o.name}${marker}`);
+    });
+    const promptText = opts.promptText ?? `\nSelect org [1-${eligible.length}]: `;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = (await rl.question(promptText)).trim();
+        const idx = Number.parseInt(answer, 10) - 1;
+        if (Number.isNaN(idx) || idx < 0 || idx >= eligible.length) {
+            throw new Error("Invalid selection.");
+        }
+        return eligible[idx];
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/internal/target-auth/workos.js

@@ -54,12 +54,20 @@ function tokensFromResponse(d, prevRefresh) {
         obtained_at: Date.now(),
     };
 }
+function escapeHtml(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
 function htmlPage(success, msg = "") {
     const title = success ? "Authenticated" : "Auth failed";
     const color = success ? "#00d4aa" : "#ff5252";
     return `<!DOCTYPE html><html><head><title>${title}</title></head>
 <body style="font-family:system-ui;text-align:center;padding:50px;background:#0f0f1a;color:#fff;">
-<h1 style="color:${color};">${title}</h1><p>${msg}</p>
+<h1 style="color:${color};">${title}</h1><p>${escapeHtml(msg)}</p>
 <p>You can close this window.</p><script>setTimeout(()=>window.close(),1500);</script>
 </body></html>`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zivis/cli",
-  "version": "0.1.0-alpha.39",
+  "version": "0.1.0-alpha.40",
   "description": "ZIVIS CLI — threat modeling, scans, and MCP server for IDE integration",
   "license": "Apache-2.0",
   "homepage": "https://zivis.ai",
@@ -20,7 +20,7 @@
     "LICENSE"
   ],
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -32,7 +32,7 @@
     "ignore": "^7.0.5",
     "open": "^10.1.0",
     "web-tree-sitter": "^0.26.8",
-    "@zivis/mcp": "0.1.0-alpha.26"
+    "@zivis/mcp": "0.1.5"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",