Summary
syllable users me is supposed to return the authenticated user. When the local config doesn't have an email set (no syllable setup field), it instead returns whatever user happens to come back first from the org's user list — not the API key's owner.
Repro (v1.5.1)
$ syllable --org sandbox users me
Hint: configure your email in `syllable setup` for an exact lookup.
FIELD VALUE
ID 333
Email [email protected] ← not me
Name Christopher Bergt
Role Admin
Status invited
I'm authenticated as [email protected]. The hint warns that lookup is approximate, but the result is genuinely a different user.
Why this matters
users me is the natural way to script "what role/permissions does my key have." Returning someone else's account silently is worse than returning nothing, because callers can build assumptions on it (e.g., "I see I'm Admin → write commands should work").
Suggested fix
Use the API-key identity as the source of truth (the platform must already know who an API key belongs to), or fail loudly with Error: configure email via 'syllable setup' to use 'users me' and exit non-zero. Don't return another user.
Caught during v1.5.1 QA.
Summary
syllable users meis supposed to return the authenticated user. When the local config doesn't have an email set (nosyllable setupfield), it instead returns whatever user happens to come back first from the org's user list — not the API key's owner.Repro (v1.5.1)
I'm authenticated as
[email protected]. The hint warns that lookup is approximate, but the result is genuinely a different user.Why this matters
users meis the natural way to script "what role/permissions does my key have." Returning someone else's account silently is worse than returning nothing, because callers can build assumptions on it (e.g., "I see I'm Admin → write commands should work").Suggested fix
Use the API-key identity as the source of truth (the platform must already know who an API key belongs to), or fail loudly with
Error: configure email via 'syllable setup' to use 'users me'and exit non-zero. Don't return another user.Caught during v1.5.1 QA.