fix: require OID when using --check-perm in auth whoami

limacharlie/commands/auth.py

@@ -270,6 +270,11 @@ def logout(ctx: click.Context, environment: str | None) -> None:
 @pass_context
 def whoami(ctx: click.Context, show_perms: bool, check_perm: str | None) -> None:
     client = _get_client(ctx)
+    # --check-perm requires a real OID — fail early before the fallback.
+    if check_perm is not None and client.oid is None:
+        raise click.UsageError(
+            "--check-perm requires an OID to be specified (use --oid or set the LC_OID environment variable)"
+        )
     # whoami works without a specific org — fall back to "-" if no OID resolved.
     if client.oid is None:
         client = _get_client(ctx, oid_override="-")

tests/unit/test_cli_commands.py

@@ -266,6 +266,17 @@ def test_whoami_check_perm_in_user_perms(self, mock_org_cls, mock_client_cls):
         parsed = json.loads(result.output)
         assert parsed["has_perm"] is True
 
+    @patch("limacharlie.commands.auth.Client")
+    def test_whoami_check_perm_requires_oid(self, mock_client_cls):
+        mock_client = MagicMock()
+        mock_client.oid = None
+        mock_client_cls.return_value = mock_client
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--output", "json", "auth", "whoami", "--check-perm", "ai_agent.operate"])
+        assert result.exit_code != 0
+        assert "--check-perm requires an OID" in result.output
+
     @patch("limacharlie.commands.auth.Client")
     def test_auth_test_success(self, mock_client_cls):
         mock_client = MagicMock()