From 666951e32ff1d987172bccba72a88d18a39a22c0 Mon Sep 17 00:00:00 2001
From: Ilyaas Kapadia <86218345+IlyaasK@users.noreply.github.com>
Date: Thu, 6 Aug 2026 16:30:18 -0400
Subject: [PATCH] fix(cli): require project IDs for request scoping

Document the global project selector truthfully and use the SDK's canonical project option so request scoping continues to match the ID-only API header contract.
---
 README.md        | 3 ++-
 cmd/root.go      | 4 ++--
 cmd/root_test.go | 8 ++++----
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index c54f458c..409d0e09 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,7 @@ Create an API key from the [Kernel dashboard](https://dashboard.onkernel.com).
 - `--version`, `-v` - Print the CLI version
 - `--no-color` - Disable color output
 - `--log-level <level>` - Set log level (trace, debug, info, warn, error, fatal, print)
+- `--project <project-id>` - Scope requests to a project ID (or set `KERNEL_PROJECT` to a project ID)
 
 ## JSON Output
 
@@ -621,7 +622,7 @@ Automated authentication for web services. The `run` command orchestrates the fu
 - `kernel api-keys create` - Create a new API key
   - `--name <name>` - API key name (required)
   - `--days-to-expire <days>` - Number of days until expiry (1-3650); omit for never
-  - `--project-id <project_id>` - Create a project-scoped API key for this project ID; omit for org-wide. This is different from global `--project`, which only scopes the CLI request.
+  - `--project-id <project_id>` - Create a project-scoped API key for this project ID; omit for org-wide. This is different from global `--project`, which scopes the CLI request to a project ID.
   - `--output json`, `-o json` - Output raw JSON object, including the one-time plaintext key
 
 - `kernel api-keys list` - List API keys
diff --git a/cmd/root.go b/cmd/root.go
index aae35062..d1ef4e8a 100644
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -116,7 +116,7 @@ func init() {
 	rootCmd.PersistentFlags().BoolP("version", "v", false, "Print the CLI version")
 	rootCmd.PersistentFlags().BoolP("no-color", "", false, "Disable color output")
 	rootCmd.PersistentFlags().String("log-level", "warn", "Set the log level (trace, debug, info, warn, error, fatal, print)")
-	rootCmd.PersistentFlags().String("project", "", "Project ID or name to scope all requests to (or set KERNEL_PROJECT env var)")
+	rootCmd.PersistentFlags().String("project", "", "Project ID to scope all requests to (or set KERNEL_PROJECT to a project ID)")
 	rootCmd.SilenceUsage = true
 	rootCmd.SilenceErrors = true
 	cobra.OnInitialize(initConfig)
@@ -143,7 +143,7 @@ func init() {
 		projectVal = resolveProjectSelection(projectVal)
 
 		if projectVal != "" {
-			clientOpts = append(clientOpts, option.WithHeader("X-Kernel-Project-Id", projectVal))
+			clientOpts = append(clientOpts, option.WithProjectID(projectVal))
 		}
 
 		client, err := auth.GetAuthenticatedClient(clientOpts...)
diff --git a/cmd/root_test.go b/cmd/root_test.go
index 57cd1925..4a284334 100644
--- a/cmd/root_test.go
+++ b/cmd/root_test.go
@@ -80,13 +80,13 @@ func TestIsAuthExempt(t *testing.T) {
 
 func TestResolveProjectSelection(t *testing.T) {
 	t.Run("flag value wins over env var", func(t *testing.T) {
-		t.Setenv("KERNEL_PROJECT", "env-project")
-		assert.Equal(t, "flag-project", resolveProjectSelection("flag-project"))
+		t.Setenv("KERNEL_PROJECT", "env-project-id")
+		assert.Equal(t, "flag-project-id", resolveProjectSelection("flag-project-id"))
 	})
 
 	t.Run("env var used when no flag", func(t *testing.T) {
-		t.Setenv("KERNEL_PROJECT", "env-project")
-		assert.Equal(t, "env-project", resolveProjectSelection(""))
+		t.Setenv("KERNEL_PROJECT", "env-project-id")
+		assert.Equal(t, "env-project-id", resolveProjectSelection(""))
 	})
 
 	t.Run("empty when no flag or env var", func(t *testing.T) {