lua init / lua agents fail: "Lua returned an authorization resource for the wrong organization"

[nzwi263]

Environment

• lua-cli version: 3.29.0 (latest)
• Node.js: v26.7.0
• OS: macOS 26.5.1 (arm64)
• Auth: typed personal API key (api_…)

Steps to reproduce

1. lua auth configure --api-key <key> (typed personal key, resolveCredentialOperationalContext → typed-personal)
2. Run lua init (or lua agents)

Expected behavior

Org/agent listing succeeds; lua init proceeds to scaffold the project.

Actual behavior

❌ Error during initialization: Lua returned an authorization resource for the wrong organization.
    at withErrorHandling (file:///Users/nzwi/.local/lib/node_modules/lua-cli/dist/index.js:4399:11)

lua agents fails identically.

Root cause

GET /admin/me/authorization/orgs/{orgId}/resources?kind=agent now returns platform-level agents with orgId: null mixed in with org-scoped agents. In listTypedCredentialOrganizations, the resource loop does a strict comparison with no null guard:

for (const resource of result.data.resources) {
  if (resource.orgId !== org.orgId) {   // null !== orgId  →  throws
    throw new Error("Lua returned an authorization resource for the wrong organization.");
  }
  ...
}

Evidence (API response, redacted key)

GET /admin/me/authorization → one org: 7a44c537-b906-4d6c-b0ef-217418be9bde.

GET /admin/me/authorization/orgs/7a44c537-b906-4d6c-b0ef-217418be9bde/resources?kind=agent&limit=100 returns:

{
  "orgId": "7a44c537-b906-4d6c-b0ef-217418be9bde",
  "resources": [
    {
      "resourceType": "agent",
      "resourceId": "designer_designer",
      "kind": "agent",
      "orgId": null,                      // ← triggers the bug
      "visibility": "platform",
      "discoveredVia": "platform-allowlist",
      "rostered": false,
      "name": "Designer"
    },
    {
      "resourceType": "agent",
      "resourceId": "designer_7a44c537-b906-4d6c-b0ef-217418be9bde",
      "kind": "agent",
      "orgId": "7a44c537-b906-4d6c-b0ef-217418be9bde",
      "visibility": "public",
      "name": "Designer"
    }
  ]
}

Suggested fix

Skip or otherwise tolerate resources with orgId: null (platform-allowlisted agents), e.g.:

for (const resource of result.data.resources) {
  if (resource.orgId === null) continue;
  if (resource.orgId !== org.orgId) {
    throw new Error("Lua returned an authorization resource for the wrong organization.");
  }
  ...
}

(Or the backend should exclude non-org-bound resources from the org-scoped endpoint.)

Workaround

Patch dist/index.js locally to skip null-orgId resources (verified working, but overwritten by lua update/reinstall).