replicas-cli 0.2.543 → 0.2.545

package/README.md

@@ -36,7 +36,7 @@ Display current authenticated user.
 Display current organization.
 
 ### `replicas org switch`
-Switch between organizations.
+Choose the organization used by organization-scoped commands. The selection persists across sessions.
 
 ### `replicas connect <workspace-name>`
 Connect to a workspace via SSH.

package/dist/index.cjs

@@ -7408,10 +7408,15 @@ function writeConfig(config3) {
     throw error51;
   }
 }
-function deleteConfig() {
-  if (import_fs.default.existsSync(CONFIG_FILE)) {
-    import_fs.default.unlinkSync(CONFIG_FILE);
-  }
+function clearAuthentication() {
+  const config3 = readConfig();
+  if (!config3) return;
+  writeConfig({
+    ...config3,
+    access_token: "",
+    refresh_token: "",
+    expires_at: 0
+  });
 }
 function isAuthenticated() {
   const config3 = readConfig();
@@ -7431,6 +7436,7 @@ function setOrganizationId(organizationId) {
     throw new Error("No config file found. Please login first.");
   }
   config3.organization_id = organizationId;
+  config3.organization_selection_confirmed = true;
   writeConfig(config3);
 }
 function clearOrganizationId() {
@@ -7439,12 +7445,20 @@ function clearOrganizationId() {
     return;
   }
   delete config3.organization_id;
+  delete config3.organization_selection_confirmed;
   writeConfig(config3);
 }
 function getOrganizationId() {
   const config3 = readConfig();
   return config3?.organization_id || null;
 }
+function getConfirmedOrganizationId() {
+  const config3 = readConfig();
+  return config3?.organization_selection_confirmed === true ? config3.organization_id || null : null;
+}
+function isOrganizationSelectionConfirmed() {
+  return readConfig()?.organization_selection_confirmed === true;
+}
 function setIdeCommand(ideCommand) {
   const config3 = readConfig();
   if (!config3) {
@@ -7553,7 +7567,7 @@ async function refreshToken() {
 }
 async function getValidToken() {
   const config3 = readConfig();
-  if (!config3) {
+  if (!config3?.access_token) {
     throw new NotAuthenticatedError();
   }
   if (isTokenExpired(config3.expires_at)) {
@@ -24378,7 +24392,7 @@ var headlessFilesystemAgentResultSchema = external_exports.object({
 });
 
 // ../shared/src/cli-version.ts
-var CLI_VERSION = "0.2.543";
+var CLI_VERSION = "0.2.545";
 
 // ../shared/src/version.ts
 function compareVersions(v1, v2) {
@@ -26924,45 +26938,7 @@ async function readSseStream(body, onEvent, shouldContinue = () => true) {
 // src/lib/monolith-url.ts
 var MONOLITH_URL = process.env.REPLICAS_MONOLITH_URL || process.env.MONOLITH_URL || "https://api.tryreplicas.com";
 
-// src/lib/api.ts
-async function buildOrgAuthHeaders() {
-  const extraHeaders = {};
-  if (isAgentMode()) {
-    const agent = readAgentConfig();
-    if (!agent) {
-      throw new Error("Agent mode config is incomplete");
-    }
-    extraHeaders["X-Workspace-Id"] = agent.workspace_id;
-    return { bearer: agent.engine_secret, extraHeaders };
-  }
-  const bearer = await getValidToken();
-  const organizationId = getOrganizationId();
-  if (!organizationId) {
-    throw new Error(
-      'No organization selected. Please run "replicas org switch" to select an organization.'
-    );
-  }
-  extraHeaders["Replicas-Org-Id"] = organizationId;
-  return { bearer, extraHeaders };
-}
-async function authenticatedFetch(url2, options) {
-  const token = await getValidToken();
-  if (!token) {
-    throw new Error("No access token available");
-  }
-  return apiFetch(url2, {
-    "Authorization": `Bearer ${token}`,
-    ...options?.headers || {}
-  }, options);
-}
-async function orgAuthenticatedFetch(url2, options) {
-  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
-  return apiFetch(url2, {
-    "Authorization": `Bearer ${bearer}`,
-    ...extraHeaders,
-    ...options?.headers || {}
-  }, options);
-}
+// src/lib/authenticated-api.ts
 var ApiError = class extends Error {
   constructor(message, status) {
     super(message);
@@ -26975,39 +26951,24 @@ async function throwResponseError(response) {
   throw new ApiError(error51.error || `Request failed with status ${response.status}`, response.status);
 }
 async function apiFetch(url2, headers, options) {
-  const requestHeaders = {
-    "Content-Type": "application/json",
-    ...headers
-  };
-  const absoluteUrl = `${MONOLITH_URL}${url2}`;
-  const requestInit = {
+  const requestHeaders = new Headers({ "Content-Type": "application/json", ...headers });
+  new Headers(options?.headers).forEach((value, key) => requestHeaders.set(key, value));
+  const response = await fetchWithRedirects(`${MONOLITH_URL}${url2}`, {
     ...options,
     headers: requestHeaders,
     body: options?.body !== void 0 ? JSON.stringify(options.body) : void 0
-  };
-  const response = await fetchWithRedirects(absoluteUrl, requestInit);
+  });
   if (!response.ok) {
     await throwResponseError(response);
   }
   return response.json();
 }
-async function orgAuthenticatedSseStream(url2, options) {
-  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
-  const response = await fetch(`${MONOLITH_URL}${url2}`, {
-    method: "POST",
-    headers: {
-      "Authorization": `Bearer ${bearer}`,
-      "Content-Type": "application/json",
-      "Accept": "text/event-stream",
-      ...extraHeaders
-    },
-    body: JSON.stringify(options.body)
-  });
-  if (!response.ok || !response.body) {
-    await throwResponseError(response);
-    return;
+async function authenticatedFetch(url2, options) {
+  const token = await getValidToken();
+  if (!token) {
+    throw new Error("No access token available");
   }
-  await readSseStream(response.body, options.onEvent);
+  return apiFetch(url2, { Authorization: `Bearer ${token}` }, options);
 }
 
 // src/lib/organization.ts
@@ -27018,7 +26979,11 @@ async function fetchOrganizations() {
   return response.organizations;
 }
 async function fetchActiveRole() {
-  return orgAuthenticatedFetch("/v1/organization/membership").then((response) => response.role).catch(() => null);
+  const organizationId = getConfirmedOrganizationId();
+  if (!organizationId) return null;
+  return authenticatedFetch("/v1/organization/membership", {
+    headers: { "Replicas-Org-Id": organizationId }
+  }).then((response) => response.role).catch(() => null);
 }
 async function setActiveOrganization(organizationId) {
   const organizations = await fetchOrganizations();
@@ -27031,7 +26996,14 @@ async function setActiveOrganization(organizationId) {
 async function findActiveOrganization() {
   const organizations = await fetchOrganizations();
   const currentId = getOrganizationId();
-  return { organizations, organization: organizations.find((org2) => org2.id === currentId) ?? null };
+  const storedOrganization = organizations.find((org2) => org2.id === currentId) ?? null;
+  if (currentId && !storedOrganization) {
+    clearOrganizationId();
+  }
+  return {
+    organizations,
+    organization: isOrganizationSelectionConfirmed() ? storedOrganization : null
+  };
 }
 async function promptForOrganization(organizations, currentId) {
   const { organizationId } = await (0, import_prompts3.default)({
@@ -27046,30 +27018,30 @@ async function promptForOrganization(organizations, currentId) {
   });
   return organizations.find((org2) => org2.id === organizationId) ?? null;
 }
-async function ensureOrganization(options = {}) {
+async function ensureOrganizationSelection(options = {}) {
   const { organizations, organization } = await findActiveOrganization();
   if (organizations.length === 0) {
     throw new Error("You are not a member of any organization. Please contact support.");
   }
   if (organization) {
-    return { organization, total: organizations.length, role: await fetchActiveRole() };
+    return { organization, total: organizations.length };
   }
-  const canAsk = options.interactive === true && organizations.length > 1 && !!process.stdin.isTTY;
+  const canAsk = options.interactive === true && !!process.stdin.isTTY;
   if (canAsk) {
     const chosen = await promptForOrganization(organizations, null);
     if (!chosen) {
-      clearOrganizationId();
-      return { organization: null, total: organizations.length, role: null };
+      return { organization: null, total: organizations.length };
     }
     setOrganizationId(chosen.id);
-    return { organization: chosen, total: organizations.length, role: await fetchActiveRole() };
+    return { organization: chosen, total: organizations.length };
   }
-  const [newestOrganization] = organizations;
-  setOrganizationId(newestOrganization.id);
+  return { organization: null, total: organizations.length };
+}
+async function ensureOrganization(options = {}) {
+  const selection = await ensureOrganizationSelection(options);
   return {
-    organization: newestOrganization,
-    total: organizations.length,
-    role: await fetchActiveRole()
+    ...selection,
+    role: selection.organization ? await fetchActiveRole() : null
   };
 }
 async function resolveActiveOrganization() {
@@ -27124,7 +27096,7 @@ async function resolveAuthFlowTarget(identity) {
   }
   const [replicasAccount, active] = await Promise.all([
     getCurrentUser().then((user) => user.email).catch(() => null),
-    resolveActiveOrganization()
+    ensureOrganization({ interactive: true })
   ]);
   return {
     ...identity,
@@ -27320,6 +27292,7 @@ async function loginCommand() {
           refresh_token: refreshToken2,
           expires_at: parseInt(expiresAt, 10),
           organization_id: existingConfig?.organization_id,
+          organization_selection_confirmed: existingConfig?.organization_selection_confirmed,
           ide_command: existingConfig?.ide_command
         };
         try {
@@ -27408,7 +27381,7 @@ function logoutCommand() {
     console.log(import_chalk3.default.yellow("You are not logged in."));
     return;
   }
-  deleteConfig();
+  clearAuthentication();
   console.log(import_chalk3.default.green("\u2713 Successfully logged out!"));
 }
 
@@ -27476,6 +27449,54 @@ async function connectSSH(token, host, proxyCommand) {
 var import_chalk5 = __toESM(require("chalk"));
 var import_prompts5 = __toESM(require("prompts"));
 
+// src/lib/api.ts
+async function buildOrgAuthHeaders() {
+  const extraHeaders = {};
+  if (isAgentMode()) {
+    const agent = readAgentConfig();
+    if (!agent) {
+      throw new Error("Agent mode config is incomplete");
+    }
+    extraHeaders["X-Workspace-Id"] = agent.workspace_id;
+    return { bearer: agent.engine_secret, extraHeaders };
+  }
+  const bearer = await getValidToken();
+  const selectedId = getConfirmedOrganizationId();
+  const organizationId = selectedId ?? (await ensureOrganizationSelection({ interactive: true })).organization?.id;
+  if (!organizationId) {
+    throw new Error(
+      'No organization selected. Please run "replicas org switch" to select an organization.'
+    );
+  }
+  extraHeaders["Replicas-Org-Id"] = organizationId;
+  return { bearer, extraHeaders };
+}
+async function orgAuthenticatedFetch(url2, options) {
+  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
+  return apiFetch(url2, {
+    "Authorization": `Bearer ${bearer}`,
+    ...extraHeaders
+  }, options);
+}
+async function orgAuthenticatedSseStream(url2, options) {
+  const { bearer, extraHeaders } = await buildOrgAuthHeaders();
+  const response = await fetch(`${MONOLITH_URL}${url2}`, {
+    method: "POST",
+    headers: {
+      "Authorization": `Bearer ${bearer}`,
+      "Content-Type": "application/json",
+      "Accept": "text/event-stream",
+      ...extraHeaders
+    },
+    body: JSON.stringify(options.body)
+  });
+  if (!response.ok || !response.body) {
+    await throwResponseError(response);
+    return;
+  }
+  await readSseStream(response.body, options.onEvent);
+}
+
 // src/lib/git.ts
 var import_child_process2 = require("child_process");
 var import_path2 = __toESM(require("path"));
@@ -27770,7 +27791,7 @@ async function orgCommand() {
     process.exit(1);
   }
   try {
-    const currentOrgId = getOrganizationId();
+    const currentOrgId = getConfirmedOrganizationId();
     const organizations = await fetchOrganizations();
     if (!currentOrgId) {
       console.log(import_chalk8.default.yellow("\n  No organization selected."));
@@ -27779,6 +27800,7 @@ async function orgCommand() {
     }
     const currentOrg = organizations.find((org2) => org2.id === currentOrgId);
     if (!currentOrg) {
+      clearOrganizationId();
       console.log(import_chalk8.default.yellow("\n  The selected organization is no longer available to you."));
       console.log(import_chalk8.default.gray('  Run "replicas org switch" to select another.\n'));
       return;
@@ -27813,7 +27835,7 @@ async function orgSwitchCommand() {
       console.log(import_chalk8.default.gray("  Please contact support.\n"));
       return;
     }
-    const currentOrgId = getOrganizationId();
+    const currentOrgId = getConfirmedOrganizationId();
     let selectedId = organizations[0].id;
     if (organizations.length > 1) {
       const chosen = await promptForOrganization(organizations, currentOrgId);
@@ -28062,7 +28084,7 @@ async function runCodexOAuthFlow(totalSteps) {
 // src/lib/credential-upload.ts
 var import_chalk10 = __toESM(require("chalk"));
 var UPLOAD_STEPS = 1;
-async function withAuthRecovery(operation, assertStillApproved) {
+async function withAuthRecovery(operation, afterReauthentication) {
   try {
     return { result: await operation(), reauthenticated: false };
   } catch (error51) {
@@ -28073,8 +28095,8 @@ async function withAuthRecovery(operation, assertStillApproved) {
     console.log(import_chalk10.default.yellow(`
   ${message}`));
     await loginCommand();
-    await assertStillApproved();
-    console.log(import_chalk10.default.gray("  Retrying credential upload..."));
+    await afterReauthentication?.();
+    console.log(import_chalk10.default.gray("  Retrying..."));
     return { result: await operation(), reauthenticated: true };
   }
 }
@@ -28101,7 +28123,7 @@ async function runCredentialAuthFlow(options, flow) {
     if (options.org === true && options.user === true) {
       throw new Error("Pass either --org or --user, not both.");
     }
-    const target = await resolveAuthFlowTarget(identity);
+    const { result: target } = await withAuthRecovery(() => resolveAuthFlowTarget(identity));
     if (!isUserScoped && !target.organization) {
       throw new Error(
         "Could not determine which organization to save to. Re-run the command, or use --user to save to your personal account."
@@ -30841,6 +30863,38 @@ function parseBooleanOption(value) {
 }
 var program = new import_commander.Command();
 program.name("replicas").description("CLI for managing Replicas workspaces").version(CLI_VERSION);
+var organizationOptionalCommands = /* @__PURE__ */ new Set([
+  "computer",
+  "claude-auth",
+  "codex-auth",
+  "config",
+  "init",
+  "login",
+  "logout",
+  "media",
+  "mothership",
+  "org",
+  "service",
+  "whoami"
+]);
+program.hook("preAction", async (_command, actionCommand) => {
+  let rootCommand = actionCommand;
+  while (rootCommand.parent && rootCommand.parent !== program) {
+    rootCommand = rootCommand.parent;
+  }
+  if (isAgentMode() || !isAuthenticated() || organizationOptionalCommands.has(rootCommand.name())) return;
+  try {
+    const { organization } = await ensureOrganizationSelection({ interactive: true });
+    if (!organization) {
+      throw new Error('No organization selected. Run "replicas org switch" to select one.');
+    }
+  } catch (error51) {
+    console.error(import_chalk22.default.red(`
+\u2717 ${error51 instanceof Error ? error51.message : "Unknown error"}
+`));
+    process.exit(1);
+  }
+});
 function registerSlackCommands(parent) {
   const slack = parent.command("slack").description("Manage Slack thread routing");
   const slackThread = slack.command("thread").description("Attach or switch the Slack thread that routes to a workspace");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-cli",
-  "version": "0.2.543",
+  "version": "0.2.545",
   "description": "CLI for managing Replicas workspaces - SSH into cloud dev environments with automatic port forwarding",
   "main": "dist/index.cjs",
   "bin": {