feat(cli): resolve acting org from local git remotes

[theCodeDrift]

Gives the CLI a correct, per-repository sense of which Taskless organization it is acting as, and sends that identity on write calls — the 0.10.x org-identity contract on the client side.

Why. A Taskless user can belong to multiple orgs, but the CLI previously only knew the org from the token's numeric orgId claim, so a multi-org user was routed to whichever org their token happened to pin. The agreed design has whoami return every org with a canonical owner url, and makes it the client's job to pick the acting org by matching that url against the repo's remotes; the server authorizes the chosen org per request.

What's here

Resolution layer.

• canonicalOwnerUrl reduces a git remote to its canonical owner url (https://github.com/{owner}). It's a verbatim port of the server's shared @taskless/shared/github implementation, so the two compare by exact string equality across SSH, ssh:///git://, port, www., .git, and mixed-case forms.
• listRemoteOwnerUrls enumerates git remotes in origin → upstream → rest precedence (keeping every url of a multi-url remote), canonicalizes + dedupes, and drops non-GitHub owners.
• selectOrgForOwners / resolveCurrentOrg / resolveOrgSubject pick the acting org: the first owner url that matches a whoami org wins; the org's Taskless UUID is the subject, falling back to the token's deprecated numeric claim when nothing matches.

Send side.

• resolveIdentity now returns orgSubject (string | number); submitRule / iterateRule / reconcile send it as orgId (widened to string | number), and check sends it on reconcile.
• The server returns the same 404 organization_not_found for both "not your org" and "install doesn't cover this repo" (deliberately, to not leak org existence), so the message now names the coverage cause first, not just re-auth.
• Handles two new generation states: classifying (transient) and unsupported (terminal — the org's plan lacks the requested capability, e.g. runtime rules), surfaced with the new RULE_UNSUPPORTED code and documented in the create/improve recipes.

Types. Regenerated src/generated/api.d.ts from the live schema (which now carries the contract) and derived WhoamiOrg from it rather than hand-typing; email is now optional.

Compatibility

Additive. The token keeps its numeric orgId claim, so single-org behavior is unchanged and older clients are unaffected. End-to-end multi-org routing depends on the server-side stack (taskless#82–#85) reaching production; the whoami + reconcile pieces are already live.

Refs TSKL-245

[Copilot]

Pull request overview

Introduces a client-side “acting org” resolution layer for the CLI by matching the current repo’s git remotes to whoami orgs’ canonical owner URLs, and then uses that resolved org subject (UUID preferred, numeric claim fallback) on write-ish calls.

Changes:

• Add GitHub-remote → canonical owner URL normalization + remote enumeration with origin/upstream precedence, used to select the acting org from whoami.
• Update identity/write flows (rule create/improve and reconcile in check) to send orgSubject and handle new server statuses/errors (classifying, unsupported, RULE_UNSUPPORTED, improved org-not-found messaging).
• Add/expand Vitest coverage for org selection and remote canonicalization; update generated API types for whoami and rule status.

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/cli/test/org.test.ts	Adds tests for selecting an acting org and resolving the org subject fallback chain.
packages/cli/test/git-remote.test.ts	Adds tests for canonical owner URL normalization and remote owner URL ordering/deduping.
packages/cli/src/util/git-remote.ts	Implements canonicalOwnerUrl + remote owner enumeration (origin→upstream→rest).
packages/cli/src/types/errors.ts	Adds RULE_UNSUPPORTED error code.
packages/cli/src/help/rule-improve.txt	Documents RULE_UNSUPPORTED in JSON error output.
packages/cli/src/help/rule-create.txt	Documents RULE_UNSUPPORTED in JSON error output.
packages/cli/src/generated/api.d.ts	Updates OpenAPI-derived types (whoami org UUID/url/source; new rule statuses; reconcile endpoint).
packages/cli/src/commands/rules.ts	Sends identity.orgSubject; handles classifying + unsupported terminal state.
packages/cli/src/commands/info.ts	Aligns local type with whoami.email now being optional.
packages/cli/src/commands/check.ts	Resolves and sends org subject on reconcile requests.
packages/cli/src/auth/org.ts	Adds org selection + org-subject resolution (whoami match, claim fallback).
packages/cli/src/auth/identity.ts	Replaces orgId with orgSubject in resolved identity.
packages/cli/src/api/rules.ts	Accepts `orgId: string
packages/cli/src/api/reconcile.ts	Updates reconcile request typing/docs to accept optional org subject.
.changeset/org-subject-send.md	Adds a changeset describing org-subject sending + new statuses/errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.