pinsay-cli 0.9.0 → 0.10.0

package/README.md

@@ -19,7 +19,7 @@ npx pinsay-cli init
 |---|---|
 | `npx pinsay-cli init` | Set up this repo (sign in, project, skills; Chrome extension by default) |
 | `npx pinsay-cli embed` | Put the widget in your app's code |
-| `npx pinsay-cli login` / `whoami` / `logout` | Sign in; the key is saved in this repo (`--global`: this machine); check / clear credentials |
+| `npx pinsay-cli login` / `whoami` / `logout` | Sign in; the key is saved in this repo; check (account, workspace) / clear credentials |
 | `npx pinsay-cli remove` | Remove everything PinSay added to this repo |
 | `npx pinsay-cli status` | Who you are, this folder's project, comments waiting |
 | `npx pinsay-cli open` | Open this project in the dashboard |
@@ -42,7 +42,7 @@ npx pinsay-cli init
 
 ## API keys
 
-Keys look like `pnsy_` + 40 hex characters. They resolve in this order: `PINSAY_API_KEY` env var → `.pinsay/credentials.env` → the per-machine store (`~/.config/pinsay/credentials.json`, mode 0600, never committed). `init` and `login` save the key to `.pinsay/credentials.env` (hidden from git) by default; `--global` saves to the machine store instead; `login --global` moves a repo key there.
+Keys look like `pnsy_` + 40 hex characters. They resolve in this order: `PINSAY_API_KEY` env var → `.pinsay/credentials.env` (mode 0600, hidden from git). `init` and `login` save the key in the repo; there is no machine-wide key since 0.10.0, and `npx pinsay-cli update` deletes one an older version saved (`~/.config/pinsay/credentials.json`).
 
 ## MCP (Claude Code / Cursor)
 
@@ -62,6 +62,16 @@ Full guides: https://pinsay.dev/docs/ · Issues: https://github.com/moamen-ui/pi
 
 ## Changelog
 
+### 0.10.0
+
+- The API key lives only in the repo: `--global` (login, init, logout, remove) is gone, and a key saved on the machine is no longer read.
+- `update` deletes the machine-wide key file an older version saved, and says which file it removed.
+- `whoami` shows the workspace; `status` / `apply` say "Project … not found in workspace …" instead of a generic error.
+
+### 0.9.1
+
+- `remove` works when the repo sits behind a linked or shortened path (Windows junctions / short paths).
+
 ### 0.9.0
 
 - No more `.pinsay/pinsay.sh` (old copies keep working; `remove` deletes them).

package/dist/cli.js

@@ -392,7 +392,7 @@ var init_build_constants = __esm({
   "src/build-constants.ts"() {
     "use strict";
     BUILD_DEFAULT_SERVER = true ? "https://app.pinsay.dev" : "https://app.pinsay.dev";
-    BUILD_CLI_VERSION = true ? "0.9.0" : "0.0.0-dev";
+    BUILD_CLI_VERSION = true ? "0.10.0" : "0.0.0-dev";
   }
 });
 
@@ -1424,6 +1424,10 @@ var init_api = __esm({
 });
 
 // src/errors.ts
+function projectNotFoundMessage(project, workspace) {
+  const where = workspace ? `workspace ${workspace}` : "this workspace";
+  return `Project "${project}" not found in ${where}. Sign in with an account in the project's workspace (npx pinsay-cli login), or fix the key in .pinsay/config.json.`;
+}
 function isOutage(err) {
   return err instanceof NetworkError || err instanceof ApiError && err.code >= 500;
 }
@@ -1435,6 +1439,8 @@ function hostOf(server) {
   }
 }
 function describeError(err, server) {
+  if (err instanceof ProjectNotFoundError)
+    return { code: 3, message: err.message };
   if (err instanceof NetworkError) {
     return { code: 4, message: `Can't reach ${err.host}. Check your internet connection and try again.` };
   }
@@ -1463,12 +1469,21 @@ function reportFatal(err, opts) {
   const { code, message } = describeError(err, opts.server);
   exitWithError(code, message, opts.json);
 }
-var ISSUES_URL;
+var ISSUES_URL, ProjectNotFoundError;
 var init_errors = __esm({
   "src/errors.ts"() {
     "use strict";
     init_api();
     ISSUES_URL = "https://github.com/moamen-ui/pinsay-cli/issues";
+    ProjectNotFoundError = class extends Error {
+      constructor(project, workspace) {
+        super(projectNotFoundMessage(project, workspace));
+        this.project = project;
+        this.workspace = workspace;
+        this.name = "ProjectNotFoundError";
+      }
+      code = "not_found";
+    };
   }
 });
 
@@ -1476,14 +1491,12 @@ var init_errors = __esm({
 import { promises as fs10 } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { join as join9, dirname as dirname5 } from "node:path";
+import { dirname as dirname5, join as join9 } from "node:path";
 function sourceLabel(source) {
   if (source === "env")
     return "env var";
   if (source === "repo")
     return "repo credentials.env";
-  if (source === "global")
-    return "global store";
   return "none";
 }
 function normalizeServerOrigin(server) {
@@ -1512,6 +1525,38 @@ function legacyGlobalCredentialsPath() {
     return void 0;
   return join9(configBase(), LEGACY_DIR_NAME, "credentials.json");
 }
+async function findMachineKeyFiles() {
+  const found = [];
+  const current = globalCredentialsPath();
+  try {
+    await fs10.access(current);
+    found.push(current);
+  } catch {
+  }
+  const legacy = legacyGlobalCredentialsPath();
+  if (legacy) {
+    try {
+      if (isCredentialStore(JSON.parse(await fs10.readFile(legacy, "utf8"))))
+        found.push(legacy);
+    } catch {
+    }
+  }
+  return found;
+}
+async function removeMachineKeyFiles() {
+  const removed = [];
+  for (const file of await findMachineKeyFiles()) {
+    try {
+      await fs10.rm(file);
+    } catch {
+      continue;
+    }
+    removed.push(file);
+    await fs10.rmdir(dirname5(file)).catch(() => {
+    });
+  }
+  return removed;
+}
 function globalCacheDir() {
   if (process.env.PINSAY_CONFIG_DIR)
     return join9(process.env.PINSAY_CONFIG_DIR, "cache");
@@ -1531,76 +1576,6 @@ function isCredentialStore(value) {
     (entry) => !!entry && typeof entry === "object" && typeof entry.apiKey === "string"
   );
 }
-async function readGlobalStore() {
-  let raw;
-  try {
-    raw = await fs10.readFile(globalCredentialsPath(), "utf8");
-  } catch (err) {
-    if (err?.code === "ENOENT")
-      return migrateLegacyStore();
-    return {};
-  }
-  try {
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-async function migrateLegacyStore() {
-  const legacyFile = legacyGlobalCredentialsPath();
-  if (!legacyFile)
-    return {};
-  let legacy;
-  try {
-    legacy = JSON.parse(await fs10.readFile(legacyFile, "utf8"));
-  } catch {
-    return {};
-  }
-  if (!isCredentialStore(legacy))
-    return {};
-  try {
-    await writeGlobalStore(legacy);
-  } catch {
-    return legacy;
-  }
-  await fs10.rm(legacyFile, { force: true }).catch(() => {
-  });
-  await fs10.rmdir(dirname5(legacyFile)).catch(() => {
-  });
-  return legacy;
-}
-async function writeGlobalStore(store) {
-  const file = globalCredentialsPath();
-  await fs10.mkdir(dirname5(file), { recursive: true });
-  await fs10.writeFile(file, JSON.stringify(store, null, 2) + "\n", { encoding: "utf8", mode: 384 });
-  await fs10.chmod(file, 384).catch(() => {
-  });
-}
-async function getGlobalCredential(server) {
-  const store = await readGlobalStore();
-  const origin = normalizeServerOrigin(server);
-  if (!store[origin] && origin === "https://app.pinsay.dev")
-    return store["https://api.pinsay.dev"];
-  return store[origin];
-}
-async function saveGlobalCredential(server, entry) {
-  const store = await readGlobalStore();
-  store[normalizeServerOrigin(server)] = { ...entry, savedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await writeGlobalStore(store);
-}
-async function removeGlobalCredential(server) {
-  const store = await readGlobalStore();
-  const origin = normalizeServerOrigin(server);
-  const origins = origin === "https://app.pinsay.dev" ? [origin, "https://api.pinsay.dev"] : [origin];
-  const present = origins.filter((o) => o in store);
-  if (present.length === 0)
-    return false;
-  for (const o of present)
-    delete store[o];
-  await writeGlobalStore(store);
-  return true;
-}
 async function readRepoApiKey(root) {
   try {
     const raw = await fs10.readFile(join9(root, ".pinsay", "credentials.env"), "utf8");
@@ -1622,18 +1597,13 @@ async function removeRepoCredentials(root) {
   await fs10.rm(file, { force: true });
   return true;
 }
-async function resolveApiKey(root, server) {
+async function resolveApiKey(root, _server) {
   const envKey = process.env.PINSAY_API_KEY?.trim();
   if (envKey)
     return { key: envKey, source: "env" };
   const repoKey = await readRepoApiKey(root);
   if (repoKey)
     return { key: repoKey, source: "repo" };
-  if (server) {
-    const globalEntry = await getGlobalCredential(server);
-    if (globalEntry?.apiKey)
-      return { key: globalEntry.apiKey, source: "global" };
-  }
   return { key: void 0, source: null };
 }
 async function removeStaleRepoTokenCache(root) {
@@ -1676,6 +1646,31 @@ var init_server = __esm({
   }
 });
 
+// src/key-scope.ts
+function scopeFromFlags(options) {
+  const raw = options["scope"];
+  if (typeof raw === "string") {
+    const value = raw.toLowerCase();
+    if (value === "global")
+      return { error: GLOBAL_KEY_REMOVED };
+    if (value !== "repo")
+      return { error: `Invalid --scope "${raw}". Valid value: repo.` };
+    return { explicitRepo: true };
+  }
+  if (options["global"] === true)
+    return { error: GLOBAL_KEY_REMOVED };
+  if (options["local-credentials"] === true)
+    return { explicitRepo: true };
+  return {};
+}
+var GLOBAL_KEY_REMOVED;
+var init_key_scope = __esm({
+  "src/key-scope.ts"() {
+    "use strict";
+    GLOBAL_KEY_REMOVED = "--global is no longer supported: the API key is saved in this repo only (.pinsay/credentials.env). Run npx pinsay-cli update to delete a machine-wide key an older version saved.";
+  }
+});
+
 // src/ui/interactive.ts
 function isInteractive(options = {}) {
   if (!process.stdin.isTTY || !process.stdout.isTTY)
@@ -2658,17 +2653,27 @@ async function fetchQueue(ctx, filter) {
       };
     });
   } catch (err) {
+    if (err instanceof ApiError && err.code === 404)
+      throw new ProjectNotFoundError(ctx.project, ctx.workspaceName);
     if (err instanceof ApiError && err.code === 403) {
       if (!warnedNonAdminFallback) {
         console.error("Note: predefined-action prompts need an admin key");
         warnedNonAdminFallback = true;
       }
       const summaryQuery = `view=summary${qs ? `&${qs.slice(1)}` : ""}`;
-      const res = await api(
-        ctx.server,
-        `/api/projects/${encodeURIComponent(ctx.project)}/comments?${summaryQuery}`,
-        { token: ctx.token }
-      );
+      let res;
+      try {
+        res = await api(
+          ctx.server,
+          `/api/projects/${encodeURIComponent(ctx.project)}/comments?${summaryQuery}`,
+          { token: ctx.token }
+        );
+      } catch (fallbackErr) {
+        if (fallbackErr instanceof ApiError && fallbackErr.code === 404) {
+          throw new ProjectNotFoundError(ctx.project, ctx.workspaceName);
+        }
+        throw fallbackErr;
+      }
       const items = res?.items ?? [];
       return items.map((item) => ({
         id: item.id,
@@ -2705,6 +2710,7 @@ var init_queue = __esm({
   "src/apply/queue.ts"() {
     "use strict";
     init_api();
+    init_errors();
     warnedNonAdminFallback = false;
   }
 });
@@ -3081,7 +3087,7 @@ async function overviewCommand(cwd2, options) {
   for (const p of projects) {
     const name = projectNames[p.key] || p.key;
     const items = await fetchQueue(
-      { server, project: p.key, token, apiKey: key, cwd: root },
+      { server, project: p.key, token, apiKey: key, cwd: root, workspaceName: me?.tenantName || void 0 },
       {}
     );
     projectsWithPending.push({
@@ -3109,8 +3115,6 @@ async function overviewCommand(cwd2, options) {
   let sourceDesc = "key from this repo";
   if (source === "env") {
     sourceDesc = "key from PINSAY_API_KEY";
-  } else if (source === "global") {
-    sourceDesc = "key from this machine";
   }
   const who = email ? `${displayName} (${email})` : displayName;
   console.log(`  Signed in   ${who} ${sym.dot} ${sourceDesc}`);
@@ -3461,7 +3465,8 @@ var init_open = __esm({
 var remove_exports = {};
 __export(remove_exports, {
   collectRemovals: () => collectRemovals,
-  removeCommand: () => removeCommand
+  removeCommand: () => removeCommand,
+  writableInsideRoot: () => writableInsideRoot
 });
 import { promises as fs25 } from "node:fs";
 import { dirname as dirname10, isAbsolute as isAbsolute5, join as join28, relative as relative10, resolve as resolve10 } from "node:path";
@@ -3489,13 +3494,14 @@ async function readIfExists(p) {
 }
 async function writableInsideRoot(root, abs) {
   try {
-    const back = relative10(resolve10(root), await fs25.realpath(abs));
+    const realRoot = await fs25.realpath(resolve10(root));
+    const back = relative10(realRoot, await fs25.realpath(abs));
     return back !== "" && !back.startsWith("..") && !isAbsolute5(back);
   } catch {
     return false;
   }
 }
-async function collectRemovals(root, opts) {
+async function collectRemovals(root) {
   const config = await readConfig(root);
   const removals = [];
   if (await pathExists(join28(root, ".pinsay"))) {
@@ -3542,9 +3548,6 @@ async function collectRemovals(root, opts) {
       }
     }
   }
-  if (opts.global) {
-    removals.push({ kind: "global-key", target: normalizeServerOrigin(opts.server) });
-  }
   const byHand = [];
   for (const appDir of appDirs) {
     for (const name of VITE_CONFIGS2) {
@@ -3583,13 +3586,11 @@ async function removeEmptyParents(root, abs) {
 }
 async function removeCommand(cwd2, options) {
   const json = options["json"] === true;
+  if (options["global"] === true)
+    exitWithError(2, GLOBAL_KEY_REMOVED, json);
   const interactive = isInteractive(options);
-  const server = resolveServer();
   const root = await findRepoRoot(cwd2);
-  const { removals, byHand, tracked } = await collectRemovals(root, {
-    global: options["global"] === true,
-    server
-  });
+  const { removals, byHand, tracked } = await collectRemovals(root);
   if (removals.length === 0) {
     if (json)
       console.log(JSON.stringify({ ok: true, removed: [] }));
@@ -3600,7 +3601,7 @@ async function removeCommand(cwd2, options) {
   if (!json) {
     console.log("Will remove:");
     for (const r of removals) {
-      const reason = r.kind === "exclude-block" || r.kind === "html-block" ? " (PinSay block)" : r.kind === "env-lines" ? " (VITE_PINSAY_* lines)" : r.kind === "global-key" ? ` (this machine's key for ${r.target})` : "";
+      const reason = r.kind === "exclude-block" || r.kind === "html-block" ? " (PinSay block)" : r.kind === "env-lines" ? " (VITE_PINSAY_* lines)" : "";
       console.log(`  ${r.target}${reason ? dim(reason) : ""}`);
     }
     if (byHand.length > 0) {
@@ -3678,8 +3679,6 @@ async function removeCommand(cwd2, options) {
       if (!abs)
         continue;
       await fs25.rm(abs, { recursive: true, force: true });
-    } else if (r.kind === "global-key") {
-      await removeGlobalCredential(server);
     }
   }
   if (json)
@@ -3695,8 +3694,7 @@ var init_remove = __esm({
     "use strict";
     init_git_exclude();
     init_config();
-    init_credentials();
-    init_server();
+    init_key_scope();
     init_errors();
     init_interactive();
     init_prompt();
@@ -4260,7 +4258,7 @@ async function runInitChecks(cwd2, overrides = {}, cliVersion = "0.0.0") {
     checks.push({
       id: "key",
       status: "error",
-      message: "No API key found (env, repo, or global store)",
+      message: "No API key found (env var or this repo)",
       hint: "Run `npx pinsay-cli login`"
     });
   } else if (!serverReachable) {
@@ -5116,25 +5114,7 @@ async function detectDesignTokens(cwd2, options) {
 
 // src/commands/init.ts
 init_credentials();
-
-// src/key-scope.ts
-function scopeFromFlags(options) {
-  const raw = options["scope"];
-  if (typeof raw === "string") {
-    const value = raw.toLowerCase();
-    if (value !== "global" && value !== "repo") {
-      return { error: `Invalid --scope "${raw}". Valid values: global, repo.` };
-    }
-    return { scope: value };
-  }
-  if (options["global"] === true)
-    return { scope: "global" };
-  if (options["local-credentials"] === true)
-    return { scope: "repo" };
-  return {};
-}
-
-// src/commands/init.ts
+init_key_scope();
 init_server();
 init_errors();
 init_style();
@@ -5466,18 +5446,13 @@ function accountText(plan) {
     if (account.keySaved === "repo") {
       return `${account.displayName} \xB7 key saved in this repo (.pinsay/credentials.env, hidden from git)`;
     }
-    if (account.keySaved === "global") {
-      return `${account.displayName} \xB7 key saved on this machine (${account.globalPath})`;
-    }
     if (account.existingSource === "env")
       return `${account.displayName} \xB7 key from PINSAY_API_KEY`;
-    if (account.existingSource === "global")
-      return `${account.displayName} \xB7 key already saved on this machine`;
     return `${account.displayName} \xB7 key already saved in this repo`;
   }
   if (account.kind === "pending")
     return "you'll sign in in your browser";
-  const where = account.source === "env" ? "PINSAY_API_KEY" : account.source === "repo" ? "this repo" : "this machine";
+  const where = account.source === "env" ? "PINSAY_API_KEY" : "this repo";
   return `key found (${where}), not checked in a dry run`;
 }
 function sharedText(plan) {
@@ -5713,21 +5688,14 @@ async function decideWidget(cwd2, options, config, ctx) {
   const w = await findExistingWidget(cwd2, config.htmlPath);
   return w ? { widget: { kind: "already", file: w.file } } : { widget: { kind: "extension" } };
 }
-function keyPlacement(session, saveGlobal) {
-  if (session.origin === "env" || session.origin === "repo" || session.origin === "global")
+function keyPlacement(session) {
+  if (session.origin === "env" || session.origin === "repo")
     return "existing";
-  return saveGlobal ? "global" : "repo";
+  return "repo";
 }
-async function saveKey(cwd2, server, session, keySaved, project) {
-  if (keySaved === "repo") {
+async function saveKey(cwd2, session, keySaved, project) {
+  if (keySaved === "repo")
     await writeCredentials(cwd2, session.key, project ? { project } : {});
-  } else if (keySaved === "global") {
-    await saveGlobalCredential(server, {
-      apiKey: session.key,
-      email: session.me.email,
-      displayName: session.me.displayName
-    });
-  }
 }
 async function readStackNames(cwd2) {
   const pkgStr = await fs17.readFile(join17(cwd2, "package.json"), "utf8").catch(() => "{}");
@@ -5764,7 +5732,6 @@ async function initCommand(cwd2, options = {}) {
   const scopeResult = scopeFromFlags(options);
   if (scopeResult.error)
     exitWithError(2, scopeResult.error, json);
-  const saveGlobal = scopeResult.scope === "global";
   const shareResult = shareFromFlags(options);
   if (shareResult.error)
     exitWithError(2, shareResult.error, json);
@@ -5826,7 +5793,6 @@ async function initCommand(cwd2, options = {}) {
       product,
       pathFlag,
       configIsMulti,
-      saveGlobal,
       share: shareResult.share,
       wantEmbed,
       notes
@@ -5850,7 +5816,7 @@ async function initCommand(cwd2, options = {}) {
     const files2 = [
       ".pinsay/config.json",
       ".pinsay/stack.json",
-      ...account.kind === "pending" && !saveGlobal ? [".pinsay/credentials.env"] : [],
+      ...account.kind === "pending" ? [".pinsay/credentials.env"] : [],
       ...widget2.kind === "embed" ? widget2.files : [],
       ".git/info/exclude (PinSay block)"
     ];
@@ -5887,7 +5853,7 @@ async function initCommand(cwd2, options = {}) {
   });
   if (!json)
     console.log(`${green(sym.check)} Signed in as ${session.me.displayName}`);
-  const keySaved = keyPlacement(session, saveGlobal);
+  const keySaved = keyPlacement(session);
   if (isJoin && configIsMulti) {
     await handleMultiJoin({
       cwd: cwd2,
@@ -5961,8 +5927,7 @@ async function initCommand(cwd2, options = {}) {
       kind: "signed-in",
       displayName: session.me.displayName,
       keySaved,
-      existingSource: session.origin === "env" || session.origin === "repo" || session.origin === "global" ? session.origin : void 0,
-      globalPath: globalCredentialsPath()
+      existingSource: session.origin === "env" || session.origin === "repo" ? session.origin : void 0
     },
     widget,
     skills,
@@ -6029,7 +5994,7 @@ async function initCommand(cwd2, options = {}) {
   let htmlPath;
   if (keySaved !== "existing") {
     progress.step("Saving your key");
-    await saveKey(cwd2, server, session, keySaved, project.key);
+    await saveKey(cwd2, session, keySaved, project.key);
     if (keySaved === "repo")
       filesMod.push(".pinsay/credentials.env");
   }
@@ -6255,12 +6220,11 @@ function planAccount(session, keySaved) {
     kind: "signed-in",
     displayName: session.me.displayName,
     keySaved,
-    existingSource: session.origin === "env" || session.origin === "repo" || session.origin === "global" ? session.origin : void 0,
-    globalPath: globalCredentialsPath()
+    existingSource: session.origin === "env" || session.origin === "repo" ? session.origin : void 0
   };
 }
 async function multiDryRun(args) {
-  const { cwd: cwd2, config, options, server, json, interactive, product, pathFlag, configIsMulti, saveGlobal, wantEmbed } = args;
+  const { cwd: cwd2, config, options, server, json, interactive, product, pathFlag, configIsMulti, wantEmbed } = args;
   const flagTool = typeof options["tool"] === "string" ? options["tool"] : void 0;
   const resolved = await resolveApiKey(cwd2, server);
   const account = resolved.key && resolved.source ? { kind: "found", source: resolved.source } : { kind: "pending" };
@@ -6268,7 +6232,7 @@ async function multiDryRun(args) {
   const tool = tools[0];
   const names = pathFlag ? await readAppStackNames(cwd2, [pathFlag]) : await readAppStackNames(cwd2, listProjects(config).map((p) => p.path));
   const shared2 = args.share !== void 0 ? { decided: true, share: args.share, saved: false, ...names, aiTools: tools } : typeof config.shareStack === "boolean" ? { decided: true, share: config.shareStack, saved: true, ...names, aiTools: tools } : interactive ? { decided: false, share: true, saved: false, ...names, aiTools: tools } : { decided: true, share: true, saved: false, ...names, aiTools: tools };
-  const keyFile = account.kind === "pending" && !saveGlobal ? [".pinsay/credentials.env"] : [];
+  const keyFile = account.kind === "pending" ? [".pinsay/credentials.env"] : [];
   let plan;
   let projectLine;
   if (pathFlag) {
@@ -6483,7 +6447,7 @@ async function handleMultiJoin(args) {
   const progress = createProgress(labels.length, progressMode(isJson));
   if (keySaved !== "existing") {
     progress.step("Saving your key");
-    await saveKey(cwd2, server, session, keySaved);
+    await saveKey(cwd2, session, keySaved);
   }
   const skillWarnings = [];
   const hide = [];
@@ -6653,7 +6617,7 @@ async function handleMultiProjectSetup(args) {
   const progress = createProgress(labels.length, progressMode(isJson));
   if (keySaved !== "existing") {
     progress.step("Saving your key");
-    await saveKey(cwd2, server, session, keySaved);
+    await saveKey(cwd2, session, keySaved);
   }
   const skillWarnings = [];
   const hide = [];
@@ -6955,6 +6919,7 @@ init_repo_paths();
 init_server();
 init_git_exclude();
 init_style();
+init_credentials();
 function sourceFor(path) {
   if (path.includes("pinsay-init"))
     return "/pinsay-init.md";
@@ -6978,6 +6943,17 @@ async function updateCommand(cwd2, options) {
   const note = pinsayShNote(cwd2);
   if (note)
     console.log(dim(note));
+  if (options.check) {
+    for (const f of await findMachineKeyFiles())
+      console.log(`machine-wide key found: ${f} (update deletes it)`);
+  } else {
+    const removedKeys = await removeMachineKeyFiles();
+    for (const f of removedKeys)
+      console.log(`removed machine-wide key ${f}`);
+    if (removedKeys.length > 0 && !(await resolveApiKey(cwd2)).key) {
+      console.log("This repo has no key of its own yet. Sign in for it: npx pinsay-cli login");
+    }
+  }
   const config = await readConfig(cwd2);
   const server = (options.server || resolveServer()).replace(/\/$/, "");
   if (!config.project && !isMultiProject(config)) {
@@ -8016,7 +7992,7 @@ init_projection();
 init_server();
 async function exitIfWorkspaceFrozen(server, token) {
   if (!token)
-    return;
+    return void 0;
   try {
     const me = await api(server, "/api/auth/me", { token });
     if (me?.workspaceDeletionScheduledFor) {
@@ -8030,7 +8006,9 @@ async function exitIfWorkspaceFrozen(server, token) {
       );
       process.exit(2);
     }
+    return me?.tenantName || void 0;
   } catch {
+    return void 0;
   }
 }
 async function checkMetaAndNotify(server, config, root, parsed) {
@@ -8112,13 +8090,14 @@ async function applyCommand(cwd2, parsed, positionals = []) {
     );
     process.exit(3);
   }
-  await exitIfWorkspaceFrozen(server, token);
+  const workspaceName = await exitIfWorkspaceFrozen(server, token);
   const clientCtx = {
     server,
     project,
     token,
     apiKey,
-    cwd: root
+    cwd: root,
+    workspaceName
   };
   if (parsed["mark"] !== void 0) {
     const markVal2 = parsed["mark"];
@@ -8244,7 +8223,7 @@ async function applyAllProjects(root, cwd2, config, server, parsed) {
     );
     process.exit(3);
   }
-  await exitIfWorkspaceFrozen(server, token);
+  const workspaceName = await exitIfWorkspaceFrozen(server, token);
   const projects = listProjects(config);
   const plan = parsed["plan"] === true;
   const status = typeof parsed["status"] === "string" ? parsed["status"] : void 0;
@@ -8252,7 +8231,7 @@ async function applyAllProjects(root, cwd2, config, server, parsed) {
   if (parsed["json"] === true && !plan) {
     const all = [];
     for (const p of projects) {
-      const clientCtx = { server, project: p.key, token, apiKey, cwd: root };
+      const clientCtx = { server, project: p.key, token, apiKey, cwd: root, workspaceName };
       const items = await fetchQueue(clientCtx, { status, environment });
       all.push({ project: p.key, path: p.path, items: items.map((item) => toAiCommentView(item)) });
     }
@@ -8261,7 +8240,7 @@ async function applyAllProjects(root, cwd2, config, server, parsed) {
   }
   const sections = [];
   for (const p of projects) {
-    const clientCtx = { server, project: p.key, token, apiKey, cwd: root };
+    const clientCtx = { server, project: p.key, token, apiKey, cwd: root, workspaceName };
     const result = await runApply({ plan, status, environment }, clientCtx);
     sections.push(`# Project: ${p.key} (${p.path})
 
@@ -14688,8 +14667,8 @@ init_git_exclude();
 import { existsSync as existsSync7 } from "node:fs";
 import { join as join26 } from "node:path";
 import { execFileSync as execFileSync2 } from "node:child_process";
-init_credentials();
 init_prompt();
+init_key_scope();
 init_server();
 init_device_login();
 init_errors();
@@ -14708,11 +14687,13 @@ async function loginCommand(cwd2, options = {}) {
   if (flags.error)
     exitWithError(2, flags.error, json);
   const root = await findRepoRoot(cwd2);
+  const inRepo = existsSync7(join26(root, ".pinsay")) || inGitRepo(root);
+  if (!inRepo && !flags.explicitRepo) {
+    exitWithError(2, "Run this inside your project's repo: the key is saved there (.pinsay/credentials.env).", json);
+  }
   const server = resolveServer();
   const branding = await getBranding(server);
   const product = branding.productName;
-  const inRepo = existsSync7(join26(root, ".pinsay")) || inGitRepo(root);
-  const scope = flags.scope ?? (inRepo ? "repo" : "global");
   let flagKey = typeof options["key"] === "string" ? options["key"].trim() : "";
   if (options["key"] === true) {
     if (!process.stdin.isTTY)
@@ -14721,24 +14702,6 @@ async function loginCommand(cwd2, options = {}) {
     if (!flagKey)
       exitWithError(2, noKeyMessage(product), json);
   }
-  if (scope === "global" && !flagKey) {
-    const repoKey = await readRepoApiKey(root);
-    if (repoKey) {
-      try {
-        const { me } = await exchangeKey(server, repoKey);
-        await saveGlobalCredential(server, { apiKey: repoKey, email: me.email, displayName: me.displayName });
-        await removeRepoCredentials(root);
-        done(
-          json,
-          { server, scope: "global", moved: true, displayName: me.displayName, email: me.email },
-          `${green(sym.check)} Moved your key to this machine's store (${globalCredentialsPath()}). Every repo on this machine can use it now.`
-        );
-      } catch (err) {
-        if (!(err instanceof InvalidKeyError))
-          throw err;
-      }
-    }
-  }
   let key;
   let displayName;
   let email;
@@ -14766,23 +14729,15 @@ async function loginCommand(cwd2, options = {}) {
   }
   closePrompts();
   const who = displayName ? `${displayName}${email ? ` (${email})` : ""}` : email ?? "you";
-  if (scope === "repo") {
-    await writeCredentials(root, key);
-    const hideWarnings = formatHideWarnings(await hidePinsayFiles(root));
-    if (!json)
-      for (const line of hideWarnings)
-        console.error(line);
-    done(
-      json,
-      { server, scope: "repo", moved: false, displayName, email },
-      `${green(sym.check)} Signed in as ${who}. Key saved in this repo (.pinsay/credentials.env, hidden from git).`
-    );
-  }
-  await saveGlobalCredential(server, { apiKey: key, email, displayName });
+  await writeCredentials(root, key);
+  const hideWarnings = formatHideWarnings(await hidePinsayFiles(root));
+  if (!json)
+    for (const line of hideWarnings)
+      console.error(line);
   done(
     json,
-    { server, scope: "global", moved: false, displayName, email },
-    inRepo || flags.scope === "global" ? `${green(sym.check)} Signed in as ${who}. Key saved on this machine (${globalCredentialsPath()}) for every repo.` : `${green(sym.check)} Signed in as ${who}. No repo here, so the key is saved on this machine (${globalCredentialsPath()}) for every repo.`
+    { server, scope: "repo", moved: false, displayName, email },
+    `${green(sym.check)} Signed in as ${who}. Key saved in this repo (.pinsay/credentials.env, hidden from git).`
   );
 }
 function done(json, payload, message) {
@@ -14796,35 +14751,33 @@ function done(json, payload, message) {
 // src/commands/logout.ts
 init_config();
 init_credentials();
+init_key_scope();
 init_server();
+init_errors();
 init_style();
 var ENV_KEY_MESSAGE = "Your key comes from the PINSAY_API_KEY variable. Unset it to sign out.";
 async function logoutCommand(cwd2, options = {}) {
   const json = options["json"] === true;
+  const flags = scopeFromFlags(options);
+  if (flags.error)
+    exitWithError(2, flags.error, json);
   const server = resolveServer();
   const origin = normalizeServerOrigin(server);
   const root = await findRepoRoot(cwd2);
-  const finish = (source, removed2, message) => {
+  const finish = (source, removed, message) => {
     if (json)
-      console.log(JSON.stringify({ ok: true, server: origin, source, removed: removed2 }));
+      console.log(JSON.stringify({ ok: true, server: origin, source, removed }));
     else
       console.log(message);
     process.exit(0);
   };
-  const isGlobal = options["global"] === true || String(options["scope"] ?? "").toLowerCase() === "global";
-  if (!isGlobal && process.env.PINSAY_API_KEY?.trim()) {
+  if (process.env.PINSAY_API_KEY?.trim())
     finish("env", false, ENV_KEY_MESSAGE);
+  if (await readRepoApiKey(root)) {
+    const removed = await removeRepoCredentials(root);
+    finish("repo", removed, `${green(sym.check)} Signed out: removed this repo's key (.pinsay/credentials.env).`);
   }
-  if (!isGlobal && await readRepoApiKey(root)) {
-    const removed2 = await removeRepoCredentials(root);
-    finish("repo", removed2, `${green(sym.check)} Signed out: removed this repo's key (.pinsay/credentials.env).`);
-  }
-  const removed = await removeGlobalCredential(server);
-  finish(
-    "global",
-    removed,
-    removed ? `${green(sym.check)} Removed the saved key for ${origin} from this machine.` : `No saved key for ${origin} on this machine.`
-  );
+  finish("repo", false, "No key saved in this repo.");
 }
 
 // src/commands/whoami.ts
@@ -14841,33 +14794,31 @@ async function whoamiCommand(cwd2, options = {}) {
     if (isJson) {
       console.log(JSON.stringify({ ok: false, server, source: null }));
     } else {
-      console.error(`No API key found for ${server} (checked env var, repo, and global store).`);
+      console.error(`No API key found for ${server} (checked PINSAY_API_KEY and this repo's .pinsay/credentials.env).`);
       console.error("Run `npx pinsay-cli login` to sign in.");
     }
     process.exit(3);
   }
   let displayName;
   let email;
+  let workspace;
   try {
     const login = await api(server, "/api/auth/login-with-key", { method: "POST", body: { apiKey: key } });
     if (login?.status === "ok" && login.token) {
-      const me = login.user ?? await api(server, "/api/auth/me", { token: login.token });
-      displayName = me?.displayName;
-      email = me?.email;
+      const me = await api(server, "/api/auth/me", { token: login.token });
+      displayName = me?.displayName || void 0;
+      email = me?.email || void 0;
+      workspace = me?.tenantName || void 0;
     }
   } catch {
   }
-  if (source === "global" && (!displayName || !email)) {
-    const cached = await getGlobalCredential(server);
-    displayName = displayName ?? cached?.displayName;
-    email = email ?? cached?.email;
-  }
   if (isJson) {
-    console.log(JSON.stringify({ ok: true, server, displayName, email, source }));
+    console.log(JSON.stringify({ ok: true, server, displayName, email, workspace: workspace ?? null, source }));
     process.exit(0);
   }
   const who = displayName ? `${displayName}${email ? ` (${email})` : ""}` : email ?? "unknown user";
-  console.log(`${server} \u2014 ${who} \u2014 key source: ${sourceLabel(source)}`);
+  const where = workspace ? ` \u2014 workspace: ${workspace}` : "";
+  console.log(`${server} \u2014 ${who}${where} \u2014 key source: ${sourceLabel(source)}`);
   process.exit(0);
 }
 
@@ -14903,6 +14854,7 @@ function parseArgs(args) {
     // 0.9.0
     "embed",
     "global",
+    // rejected since 0.10.0 (key-scope.ts); kept so it never takes the next argument
     "share-stack",
     "no-share-stack",
     "no-color",
@@ -14940,7 +14892,7 @@ var HELP = `Usage: npx pinsay-cli <command> [options]
 Set up
   init      Set up this repo (sign in, project, skills)
   embed     Put the widget in your app's code
-  login     Sign in; the key is saved in this repo (--global: this machine)
+  login     Sign in; the key is saved in this repo
   logout    Remove the key this repo uses
   remove    Remove everything PinSay added to this repo
 Daily
@@ -14952,10 +14904,10 @@ Daily
   reply     Reply to a comment
 Tools
   doctor    Check this install and fix what it can
-  update    Refresh the AI skills
+  update    Refresh the AI skills; delete an old machine-wide key
   map       Rebuild the source map without a build
   mcp       Start the MCP server for AI tools
-  whoami    Show the signed-in account and where the key came from
+  whoami    Show the signed-in account, workspace and key source
 
 Run npx pinsay-cli <command> --help for examples.
 Flags: --no-color  No colours or styling (also NO_COLOR=1)
@@ -14986,7 +14938,6 @@ var HELP_TEXTS = {
       ["--dry-run", "Show the plan; write and send nothing"],
       ["--path <app>", "The app folder, in a repo with several apps"],
       ["--key <key>", "Sign in with this key instead of the browser"],
-      ["--global", "Save the key on this machine (repo is the default)"],
       ["--no-browser", "Print the sign-in link; don't open a browser"],
       ["--tool <tool>", "AI tool for the skills (asked when omitted)"],
       ["--skills-dir <path>", "Where the skills are installed"],
@@ -14999,7 +14950,7 @@ var HELP_TEXTS = {
       ["--no-share-stack", "Share nothing about this app's stack"],
       ["--delivery <embed|extension>", "How reviewers open the widget", true],
       ["--no-inject", "Skip injection (use --embed or --html)", true],
-      ["--scope <global|repo>", "Where the key is saved (--global is the new spelling)", true],
+      ["--scope repo", "Old spelling; the key is always saved in this repo", true],
       ["--local-credentials", "Alias of --scope repo", true],
       ["--no-color", "No colours or styling (also NO_COLOR=1)"]
     ],
@@ -15038,45 +14989,39 @@ var HELP_TEXTS = {
     ]
   },
   login: {
-    purpose: "Sign in; the key is saved in this repo (--global: this machine)",
+    purpose: "Sign in; the key is saved in this repo",
     usage: "npx pinsay-cli login [options]",
     common: [
       ["--key <key>", "Validate a pasted key; skip the browser"],
-      ["--global", "Save the key on this machine, not this repo"],
       ["--no-browser", "Print the sign-in link; don't open a browser"],
       ["--json", "Machine-readable output"]
     ],
     all: [
       ["--key <key>", "Validate a pasted key; skip the browser"],
-      ["--global", "Save the key on this machine, not this repo"],
       ["--no-browser", "Print the sign-in link; don't open a browser"],
       ["--json", "Machine-readable output"],
-      ["--scope <global|repo>", "Where to save the key, without asking", true],
+      ["--scope repo", "Old spelling; the key is always saved in this repo", true],
       ["--local-credentials", "Alias of --scope repo", true],
       ["--no-color", "No colours or styling (also NO_COLOR=1)"]
     ],
     examples: [
       ["npx pinsay-cli login", "Open the browser; save the key in this repo"],
-      ["npx pinsay-cli login --global", "Save the key on this machine"],
       ["npx pinsay-cli login --key <key>", "Save a pasted key; no browser"]
     ]
   },
   logout: {
-    purpose: "Remove the key this repo uses",
+    purpose: "Remove this repo's key",
     usage: "npx pinsay-cli logout [options]",
     common: [
-      ["--global", "Remove this machine's saved key instead"],
       ["--json", "Emit { ok, server, source, removed } as JSON"]
     ],
     all: [
-      ["--global", "Remove this machine's saved key instead"],
       ["--json", "Emit { ok, server, source, removed } as JSON"],
-      ["--scope <global|repo>", "Old spelling; only global changes anything", true],
       ["--no-color", "No colours or styling (also NO_COLOR=1)"]
     ],
     examples: [
       ["npx pinsay-cli logout", "Remove this repo's key"],
-      ["npx pinsay-cli logout --global", "Also remove this machine's key"]
+      ["npx pinsay-cli update", "Also delete an old machine-wide key"]
     ]
   },
   remove: {
@@ -15085,20 +15030,17 @@ var HELP_TEXTS = {
     common: [
       ["--dry-run", "Show what would be removed; delete nothing"],
       ["-y, --yes", "Remove without asking"],
-      ["--global", "Also remove this machine's saved key"],
       ["--json", "Machine-readable output"]
     ],
     all: [
       ["--dry-run", "Show what would be removed; delete nothing"],
       ["-y, --yes", "Remove without asking"],
-      ["--global", "Also remove this machine's saved key"],
       ["--json", "Machine-readable output"],
       ["--no-color", "No colours or styling (also NO_COLOR=1)"]
     ],
     examples: [
       ["npx pinsay-cli remove --dry-run", "Show what would be removed"],
-      ["npx pinsay-cli remove --yes", "Remove without asking"],
-      ["npx pinsay-cli remove --global", "Also remove this machine's key"]
+      ["npx pinsay-cli remove --yes", "Remove without asking"]
     ]
   },
   status: {
@@ -15264,7 +15206,7 @@ var HELP_TEXTS = {
     ]
   },
   update: {
-    purpose: "Refresh the AI skills",
+    purpose: "Refresh the AI skills; delete an old machine-wide key",
     usage: "npx pinsay-cli update [options]",
     common: [
       ["--check", "Report what is out of date; write nothing"]
@@ -15313,13 +15255,13 @@ var HELP_TEXTS = {
     ]
   },
   whoami: {
-    purpose: "Show the signed-in account and where the key came from",
+    purpose: "Show the signed-in account, workspace and key source",
     usage: "npx pinsay-cli whoami [options]",
     common: [
-      ["--json", "Emit { ok, server, displayName, email, source } as JSON"]
+      ["--json", "Emit { ok, server, displayName, email, workspace, source } as JSON"]
     ],
     all: [
-      ["--json", "Emit { ok, server, displayName, email, source } as JSON"],
+      ["--json", "Emit { ok, server, displayName, email, workspace, source } as JSON"],
       ["--no-color", "No colours or styling (also NO_COLOR=1)"]
     ],
     examples: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pinsay-cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Click-to-comment feedback for your web app: install the widget, then turn pending comments into AI apply prompts.",
   "type": "module",
   "license": "MIT",