@divergeai/cli 0.1.14 → 0.1.22

package/dist/diverge.mjs

@@ -114,17 +114,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path13) {
-      const ctrl = callVisitor(key, node, visitor, path13);
+    function visit_(key, node, visitor, path15) {
+      const ctrl = callVisitor(key, node, visitor, path15);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path13, ctrl);
-        return visit_(key, ctrl, visitor, path13);
+        replaceNode(key, path15, ctrl);
+        return visit_(key, ctrl, visitor, path15);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path13 = Object.freeze(path13.concat(node));
+          path15 = Object.freeze(path15.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path13);
+            const ci = visit_(i, node.items[i], visitor, path15);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -135,13 +135,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path13 = Object.freeze(path13.concat(node));
-          const ck = visit_("key", node.key, visitor, path13);
+          path15 = Object.freeze(path15.concat(node));
+          const ck = visit_("key", node.key, visitor, path15);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path13);
+          const cv = visit_("value", node.value, visitor, path15);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -162,17 +162,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path13) {
-      const ctrl = await callVisitor(key, node, visitor, path13);
+    async function visitAsync_(key, node, visitor, path15) {
+      const ctrl = await callVisitor(key, node, visitor, path15);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path13, ctrl);
-        return visitAsync_(key, ctrl, visitor, path13);
+        replaceNode(key, path15, ctrl);
+        return visitAsync_(key, ctrl, visitor, path15);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path13 = Object.freeze(path13.concat(node));
+          path15 = Object.freeze(path15.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path13);
+            const ci = await visitAsync_(i, node.items[i], visitor, path15);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -183,13 +183,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path13 = Object.freeze(path13.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path13);
+          path15 = Object.freeze(path15.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path15);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path13);
+          const cv = await visitAsync_("value", node.value, visitor, path15);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -216,23 +216,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path13) {
+    function callVisitor(key, node, visitor, path15) {
       if (typeof visitor === "function")
-        return visitor(key, node, path13);
+        return visitor(key, node, path15);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path13);
+        return visitor.Map?.(key, node, path15);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path13);
+        return visitor.Seq?.(key, node, path15);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path13);
+        return visitor.Pair?.(key, node, path15);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path13);
+        return visitor.Scalar?.(key, node, path15);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path13);
+        return visitor.Alias?.(key, node, path15);
       return void 0;
     }
-    function replaceNode(key, path13, node) {
-      const parent = path13[path13.length - 1];
+    function replaceNode(key, path15, node) {
+      const parent = path15[path15.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -842,10 +842,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path13, value) {
+    function collectionFromPath(schema, path15, value) {
       let v = value;
-      for (let i = path13.length - 1; i >= 0; --i) {
-        const k = path13[i];
+      for (let i = path15.length - 1; i >= 0; --i) {
+        const k = path15[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -864,7 +864,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path13) => path13 == null || typeof path13 === "object" && !!path13[Symbol.iterator]().next().done;
+    var isEmptyPath = (path15) => path15 == null || typeof path15 === "object" && !!path15[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -894,11 +894,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path13, value) {
-        if (isEmptyPath(path13))
+      addIn(path15, value) {
+        if (isEmptyPath(path15))
           this.add(value);
         else {
-          const [key, ...rest] = path13;
+          const [key, ...rest] = path15;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -912,8 +912,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path13) {
-        const [key, ...rest] = path13;
+      deleteIn(path15) {
+        const [key, ...rest] = path15;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -927,8 +927,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path13, keepScalar) {
-        const [key, ...rest] = path13;
+      getIn(path15, keepScalar) {
+        const [key, ...rest] = path15;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -946,8 +946,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path13) {
-        const [key, ...rest] = path13;
+      hasIn(path15) {
+        const [key, ...rest] = path15;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -957,8 +957,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path13, value) {
-        const [key, ...rest] = path13;
+      setIn(path15, value) {
+        const [key, ...rest] = path15;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -3473,9 +3473,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path13, value) {
+      addIn(path15, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path13, value);
+          this.contents.addIn(path15, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3550,14 +3550,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path13) {
-        if (Collection.isEmptyPath(path13)) {
+      deleteIn(path15) {
+        if (Collection.isEmptyPath(path15)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path13) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path15) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3572,10 +3572,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path13, keepScalar) {
-        if (Collection.isEmptyPath(path13))
+      getIn(path15, keepScalar) {
+        if (Collection.isEmptyPath(path15))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path13, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path15, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3586,10 +3586,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path13) {
-        if (Collection.isEmptyPath(path13))
+      hasIn(path15) {
+        if (Collection.isEmptyPath(path15))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path13) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path15) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3606,13 +3606,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path13, value) {
-        if (Collection.isEmptyPath(path13)) {
+      setIn(path15, value) {
+        if (Collection.isEmptyPath(path15)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path13), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path15), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path13, value);
+          this.contents.setIn(path15, value);
         }
       }
       /**
@@ -5572,9 +5572,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path13) => {
+    visit.itemAtPath = (cst, path15) => {
       let item = cst;
-      for (const [field, index] of path13) {
+      for (const [field, index] of path15) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5583,23 +5583,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path13) => {
-      const parent = visit.itemAtPath(cst, path13.slice(0, -1));
-      const field = path13[path13.length - 1][0];
+    visit.parentCollection = (cst, path15) => {
+      const parent = visit.itemAtPath(cst, path15.slice(0, -1));
+      const field = path15[path15.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path13, item, visitor) {
-      let ctrl = visitor(item, path13);
+    function _visit(path15, item, visitor) {
+      let ctrl = visitor(item, path15);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path13.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path15.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5610,10 +5610,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path13);
+            ctrl = ctrl(item, path15);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path13) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path15) : ctrl;
     }
     exports.visit = visit;
   }
@@ -7370,7 +7370,8 @@ var ExitCode = {
   Failure: 1,
   Pending: 3,
   Rejected: 4,
-  Expired: 5
+  Expired: 5,
+  LoginRequired: 6
 };
 var CliError = class extends Error {
   constructor(message, exitCode = ExitCode.Failure) {
@@ -7383,11 +7384,46 @@ var CliError = class extends Error {
 
 // src/commands/agents.ts
 import fs8 from "node:fs";
-import path11 from "node:path";
-import { parseArgs as parseArgs2 } from "node:util";
+import path12 from "node:path";
+import { parseArgs as parseArgs3 } from "node:util";
+
+// src/auth/oauth-client.ts
+import fs3 from "node:fs";
+import path3 from "node:path";
+
+// src/config.ts
+import os from "node:os";
+import path from "node:path";
+var DEFAULT_API_URL = "https://divergeai.net";
+var DEFAULT_CLIENT_ID = "diverge";
+function configDir(env = process.env) {
+  return env.DIVERGE_HOME?.trim() || path.join(os.homedir(), ".diverge");
+}
+function resolveApiUrl(flag, env = process.env) {
+  const chosen = flag?.trim() || env.DIVERGENT_API_URL?.trim() || DEFAULT_API_URL;
+  return chosen.replace(/\/+$/, "");
+}
+function clientId(env = process.env) {
+  return env.DIVERGENT_DIVERGE_CLIENT_ID?.trim() || DEFAULT_CLIENT_ID;
+}
+function deploymentKey(baseUrl) {
+  const url = new URL(baseUrl);
+  const pathPart = url.pathname.replace(/\/+$/, "");
+  return `${url.protocol === "http:" ? "http_" : ""}${url.host}${pathPart}`.replace(/[^A-Za-z0-9.-]/g, "_");
+}
+function tokenSource(env, baseUrl) {
+  const normalized = baseUrl.replace(/\/+$/, "");
+  const dir = path.join(configDir(env), "logins", deploymentKey(normalized));
+  return {
+    loginFile: path.join(dir, "login.json"),
+    tokensDir: path.join(dir, "tokens"),
+    baseUrl: normalized,
+    clientId: clientId(env)
+  };
+}
 
 // src/version.ts
-var VERSION = true ? "0.1.14" : "dev";
+var VERSION = true ? "0.1.22" : "dev";
 var USER_AGENT = `diverge/${VERSION}`;
 
 // src/http.ts
@@ -7397,9 +7433,13 @@ var HttpError = class extends Error {
     this.status = status2;
     this.body = body;
     this.name = "HttpError";
+    const error = body && typeof body === "object" ? body.error : void 0;
+    this.code = typeof error === "string" ? error : void 0;
   }
   status;
   body;
+  /** The OAuth error code (RFC 6749 §5.2) when the body carries one: branch on it, never on the message. */
+  code;
 };
 function errorMessageFrom(body, fallback) {
   if (body && typeof body === "object") {
@@ -7566,7 +7606,7 @@ function buildAuthorizeUrl(params) {
   url.searchParams.set("redirect_uri", params.redirectUri);
   url.searchParams.set("code_challenge", params.codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
-  url.searchParams.set("scope", params.scopes);
+  if (params.scopes) url.searchParams.set("scope", params.scopes);
   url.searchParams.set("state", params.state);
   if (params.organizationId) {
     url.searchParams.set("organization_id", params.organizationId);
@@ -7582,11 +7622,11 @@ import fs2 from "node:fs";
 
 // src/fs/atomic.ts
 import fs from "node:fs";
-import path from "node:path";
+import path2 from "node:path";
 function writeTextAtomic(filePath, text, mode = 384) {
-  const dir = path.dirname(filePath);
+  const dir = path2.dirname(filePath);
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
+  const tmp = path2.join(dir, `.${path2.basename(filePath)}.${process.pid}.${Date.now()}.tmp`);
   const fd = fs.openSync(tmp, "wx", mode);
   try {
     fs.writeFileSync(fd, text);
@@ -7607,6 +7647,23 @@ function writeJsonAtomic(filePath, value, mode = 384) {
 }
 
 // src/auth/token-cache.ts
+function loadLoginRecord(file) {
+  try {
+    const parsed = JSON.parse(fs2.readFileSync(file, "utf8"));
+    if (typeof parsed.base_url !== "string" || typeof parsed.refresh_token !== "string") return null;
+    return {
+      base_url: parsed.base_url,
+      refresh_token: parsed.refresh_token,
+      ...typeof parsed.account === "string" && parsed.account ? { account: parsed.account } : {},
+      ...typeof parsed.organization === "string" && parsed.organization ? { organization: parsed.organization } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function saveLoginRecord(file, record) {
+  writeJsonAtomic(file, record, 384);
+}
 function loadUserToken(file) {
   let text;
   try {
@@ -7619,12 +7676,7 @@ function loadUserToken(file) {
     if (typeof parsed.access_token !== "string" || typeof parsed.base_url !== "string" || typeof parsed.expires_at !== "number") {
       return null;
     }
-    return {
-      access_token: parsed.access_token,
-      refresh_token: typeof parsed.refresh_token === "string" ? parsed.refresh_token : null,
-      expires_at: parsed.expires_at,
-      base_url: parsed.base_url
-    };
+    return { access_token: parsed.access_token, expires_at: parsed.expires_at, base_url: parsed.base_url };
   } catch {
     return null;
   }
@@ -7632,14 +7684,6 @@ function loadUserToken(file) {
 function saveUserToken(file, token) {
   writeJsonAtomic(file, token, 384);
 }
-function deleteUserToken(file) {
-  try {
-    fs2.rmSync(file);
-    return true;
-  } catch {
-    return false;
-  }
-}
 function isFresh(token, freshForSeconds, nowMs = Date.now()) {
   return token.expires_at - nowMs / 1e3 > freshForSeconds;
 }
@@ -7656,7 +7700,10 @@ function tokenClaims(accessToken) {
 
 // src/auth/oauth-client.ts
 var DEFAULT_EXPIRES_IN_SECONDS = 3600;
-async function postToken(baseUrl, body) {
+function loginRequired(message) {
+  return new CliError(message, ExitCode.LoginRequired);
+}
+async function postToken(baseUrl, body, refused) {
   try {
     return await fetchJson(tokenEndpoint(baseUrl), {
       method: "POST",
@@ -7664,14 +7711,13 @@ async function postToken(baseUrl, body) {
       body: JSON.stringify(body)
     });
   } catch (error) {
-    if (error instanceof HttpError) throw new CliError(`Token endpoint returned HTTP ${error.status}: ${error.message}`);
-    throw error;
+    if (error instanceof HttpError) throw refused?.(error) ?? new CliError(`Token endpoint returned HTTP ${error.status}: ${error.message}`);
+    throw new CliError(`Cannot reach ${baseUrl}: ${error instanceof Error ? error.message : String(error)}`);
   }
 }
-function cachedFrom(payload, baseUrl, previousRefresh, nowMs) {
+function accessFrom(payload, baseUrl, nowMs) {
   return {
     access_token: payload.access_token,
-    refresh_token: payload.refresh_token ?? previousRefresh,
     expires_at: nowMs / 1e3 + Number(payload.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS),
     base_url: baseUrl.replace(/\/+$/, "")
   };
@@ -7693,8 +7739,6 @@ async function login(options, deps = defaultDeps) {
       codeChallenge: challengeS256(verifier),
       scopes: options.scopes,
       state,
-      organizationId: options.organizationId,
-      selectOrganization: options.selectOrganization,
       loginHint: options.loginHint
     });
     const pending = loopback.waitForCode(state, options.timeoutMs);
@@ -7709,41 +7753,90 @@ async function login(options, deps = defaultDeps) {
       redirect_uri: loopback.redirectUri,
       code_verifier: verifier
     });
-    const token = cachedFrom(payload, options.baseUrl, null, deps.now());
-    saveUserToken(options.tokenFile, token);
-    return token;
+    if (!payload.refresh_token) throw new CliError("The platform issued no refresh token for this sign-in; run: diverge login");
+    return { refreshToken: payload.refresh_token, token: accessFrom(payload, options.baseUrl, deps.now()) };
   } finally {
     await loopback.close();
   }
 }
-async function refreshUserToken(baseUrl, clientId2, token, nowMs = Date.now(), organizationId) {
-  if (!token.refresh_token) throw new CliError("Cached login expired. Run: diverge login");
-  const payload = await postToken(baseUrl, {
-    grant_type: "refresh_token",
-    refresh_token: token.refresh_token,
-    client_id: clientId2,
-    ...organizationId ? { organization_id: organizationId } : {}
-  });
-  return cachedFrom(payload, token.base_url, token.refresh_token, nowMs);
-}
-async function bindOrganization(source, organizationId, nowMs = Date.now()) {
-  const token = loadUserToken(source.tokenFile);
-  if (!token || token.base_url !== source.baseUrl.replace(/\/+$/, "")) {
-    throw new CliError("No cached login for this deployment. Run: diverge login");
-  }
-  const bound = await refreshUserToken(source.baseUrl, source.clientId, token, nowMs, organizationId);
-  saveUserToken(source.tokenFile, bound);
-  return bound;
+async function issueToken(source, record, organizationId, nowMs = Date.now()) {
+  const payload = await postToken(
+    source.baseUrl,
+    {
+      grant_type: "refresh_token",
+      refresh_token: record.refresh_token,
+      client_id: source.clientId,
+      ...organizationId ? { organization_id: organizationId } : {}
+    },
+    (error) => {
+      if (error.code === "invalid_grant") return loginRequired(`Your diverge login is no longer valid (${error.message}). Run: diverge login`);
+      if (error.code === "invalid_scope") return new CliError(`Not granted${organizationId ? ` at organization ${organizationId}` : ""}: ${error.message}`);
+      return void 0;
+    }
+  );
+  return {
+    record: { ...record, refresh_token: payload.refresh_token ?? record.refresh_token },
+    token: accessFrom(payload, source.baseUrl, nowMs)
+  };
 }
-async function getUserToken(source, freshForSeconds = 30, nowMs = Date.now()) {
-  const token = loadUserToken(source.tokenFile);
-  if (!token || token.base_url !== source.baseUrl.replace(/\/+$/, "")) {
-    throw new CliError("No cached login for this deployment. Run: diverge login");
-  }
-  if (isFresh(token, freshForSeconds, nowMs)) return token;
-  const refreshed = await refreshUserToken(source.baseUrl, source.clientId, token, nowMs);
-  saveUserToken(source.tokenFile, refreshed);
-  return refreshed;
+function loadLogin(source) {
+  const record = loadLoginRecord(source.loginFile);
+  return record && record.base_url === source.baseUrl ? record : null;
+}
+function saveLogin(source, record) {
+  saveLoginRecord(source.loginFile, record);
+}
+function tokenFileFor(source, organizationId) {
+  return path3.join(source.tokensDir, `${organizationId ? organizationId.replace(/[^A-Za-z0-9._-]/g, "_") : "_platform"}.json`);
+}
+function saveOrganizationToken(source, organizationId, token) {
+  saveUserToken(tokenFileFor(source, organizationId), token);
+}
+function saveRotated(source, presentedRefresh, next) {
+  const current = loadLoginRecord(source.loginFile);
+  if (current && current.refresh_token !== presentedRefresh) return;
+  saveLogin(source, next);
+}
+function forgetLogin(source) {
+  fs3.rmSync(path3.dirname(source.loginFile), { recursive: true, force: true });
+}
+function noLogin(baseUrl, alternative) {
+  const command = `diverge login${baseUrl === DEFAULT_API_URL ? "" : ` --api-url ${baseUrl}`}`;
+  return loginRequired(`No cached login for ${baseUrl}. Run: ${command}${alternative ? `
+  ${alternative}` : ""}`);
+}
+function requireLogin(source) {
+  const record = loadLogin(source);
+  if (!record) throw noLogin(source.baseUrl);
+  return record;
+}
+async function useOrganization(source, organizationId, nowMs = Date.now()) {
+  const token = await getUserToken(source, { organizationId, freshForSeconds: 0, nowMs });
+  const record = requireLogin(source);
+  saveLogin(source, { ...record, organization: organizationId });
+  return token;
+}
+async function getUserToken(source, options = {}) {
+  const nowMs = options.nowMs ?? Date.now();
+  const record = requireLogin(source);
+  const organizationId = options.organizationId?.trim() || record.organization;
+  const file = tokenFileFor(source, organizationId);
+  const cached = loadUserToken(file);
+  if (cached && cached.base_url === source.baseUrl && ofThisLogin(cached, record) && isFresh(cached, options.freshForSeconds ?? 30, nowMs)) return cached;
+  const issued = await issueToken(source, record, organizationId, nowMs);
+  saveRotated(source, record.refresh_token, issued.record);
+  saveOrganizationToken(source, organizationId, issued.token);
+  return issued.token;
+}
+function ofThisLogin(token, record) {
+  return tokenClaims(token.access_token).sid === tokenClaims(record.refresh_token).sid;
+}
+function loginExpiry(record) {
+  const claims = tokenClaims(record.refresh_token);
+  return {
+    idle: typeof claims.exp === "number" ? claims.exp : null,
+    cap: typeof claims.loginEndsAt === "number" ? claims.loginEndsAt : null
+  };
 }
 async function revokeRefreshToken(baseUrl, clientId2, refreshToken) {
   const body = new URLSearchParams({ token: refreshToken, token_type_hint: "refresh_token", client_id: clientId2 });
@@ -7756,43 +7849,162 @@ async function revokeRefreshToken(baseUrl, clientId2, refreshToken) {
   if (!response.ok) throw new CliError(`Revoke endpoint returned HTTP ${response.status}`);
 }
 
-// src/config.ts
-import fs3 from "node:fs";
-import os from "node:os";
-import path2 from "node:path";
-var DEFAULT_API_URL = "https://divergeai.net";
-var DEFAULT_CLIENT_ID = "diverge";
-function configDir(env = process.env) {
-  return env.DIVERGE_HOME?.trim() || path2.join(os.homedir(), ".diverge");
+// src/commands/login.ts
+import { parseArgs } from "node:util";
+
+// src/auth/organizations.ts
+function chooseOrganization(input) {
+  const organizations = input.organizations;
+  const flag = input.flag?.trim();
+  if (flag) {
+    const match = organizations.find((organization) => organization.id === flag || organization.name.toLowerCase() === flag.toLowerCase());
+    if (match) return { kind: "chosen", organizationId: match.id, name: match.name, reason: "flag" };
+    throw new CliError(`Not one of your organizations: ${flag}. Yours: ${organizations.map((organization) => `${organization.name} (${organization.id})`).join(", ") || "none"}`);
+  }
+  const remembered = input.remembered?.trim();
+  if (remembered) {
+    const match = organizations.find((organization) => organization.id === remembered);
+    if (match) return { kind: "chosen", organizationId: match.id, name: match.name, reason: "remembered" };
+  }
+  if (organizations.length === 1) return { kind: "chosen", organizationId: organizations[0].id, name: organizations[0].name, reason: "only" };
+  if (organizations.length === 0) return { kind: "none" };
+  return { kind: "ask", options: organizations };
 }
-function tokenFile(env = process.env) {
-  return path2.join(configDir(env), "token.json");
+function organizationMenu(options) {
+  return options.map((organization, index) => `  ${index + 1}. ${organization.name} (${organization.id})`);
 }
-function configFile(env = process.env) {
-  return path2.join(configDir(env), "config.json");
+function pickFromMenu(answer, options) {
+  const trimmed = answer.trim();
+  const index = Number(trimmed);
+  if (Number.isInteger(index) && index >= 1 && index <= options.length) return options[index - 1];
+  const match = options.find((organization) => organization.id === trimmed || organization.name.toLowerCase() === trimmed.toLowerCase());
+  if (!match) throw new CliError(`Not one of the listed organizations: ${trimmed}`);
+  return match;
 }
-function readConfig(env = process.env) {
+
+// src/auth/userinfo.ts
+async function fetchUserInfo(baseUrl, accessToken) {
+  return fetchJson(userinfoEndpoint(baseUrl), { headers: { Authorization: `Bearer ${accessToken}` }, timeoutMs: 15e3 });
+}
+async function describeAccount(baseUrl, accessToken, fallbackSub, options = {}) {
   try {
-    const parsed = JSON.parse(fs3.readFileSync(configFile(env), "utf8"));
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
+    const info = await fetchUserInfo(baseUrl, accessToken);
+    return options.withSub ? `${info.email} (${info.sub})` : info.email;
+  } catch (error) {
+    return `${fallbackSub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})`;
   }
 }
-function writeConfig(config, env = process.env) {
-  writeJsonAtomic(configFile(env), config);
+
+// src/prompt.ts
+import readline from "node:readline";
+function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => rl.question(question, (answer) => {
+    rl.close();
+    resolve(answer);
+  }));
 }
-function resolveApiUrl(flag, env = process.env, config = readConfig(env)) {
-  const chosen = flag?.trim() || env.DIVERGENT_API_URL?.trim() || config.apiUrl?.trim() || DEFAULT_API_URL;
-  return chosen.replace(/\/+$/, "");
+
+// src/commands/login.ts
+var loginUsage = `diverge login [--organization-id <id|name>] [--scopes "<scopes>"] [--as <email>] [--no-browser] [--api-url <url>]
+
+Sign in through the browser, then choose where to act. The browser only
+authenticates the person; the organization is chosen here afterwards \u2014 the
+one named by --organization-id (id or name), else the last login's, else the
+only membership, else a menu. The login itself is yours, not an
+organization's; the default is a local preference.
+That is the default: commands act there unless they name another with
+--organization-id or DIVERGENT_ORG_ID. Change it with: diverge org use <id|name>.
+--as <email> names the account: the platform signs that account in instead of
+reusing whatever session the browser holds, and issues nothing to any other.
+Without --as, the account of the last login is used; switching is explicit.
+Without --scopes, the login asks for the scopes the platform registers for
+this CLI \u2014 everything it and forge use \u2014 and holds what your roles grant; a
+scope the platform adds later reaches this login on its next refresh.
+--scopes asks for less, deliberately, and the login stays that narrow.
+--api-url signs in to another deployment (a test stack, say). Each deployment
+keeps its own login, so this never replaces another one; commands reach it
+when DIVERGENT_API_URL names it.`;
+function resolveScopes(flag) {
+  const explicit = flag?.trim();
+  return explicit ? explicit.split(/\s+/).join(" ") : void 0;
 }
-function clientId(env = process.env) {
-  return env.DIVERGENT_DIVERGE_CLIENT_ID?.trim() || DEFAULT_CLIENT_ID;
+function resolveLoginHint(flag, previous) {
+  const explicit = flag?.trim().toLowerCase();
+  if (explicit) return explicit;
+  const remembered = previous.account?.trim().toLowerCase();
+  return remembered || void 0;
+}
+async function runLogin(args, io) {
+  const { values } = parseArgs({
+    args,
+    options: {
+      "organization-id": { type: "string" },
+      scopes: { type: "string" },
+      as: { type: "string" },
+      "no-browser": { type: "boolean", default: false },
+      "api-url": { type: "string" }
+    },
+    strict: true,
+    allowPositionals: false
+  });
+  const apiUrl = resolveApiUrl(values["api-url"], io.env);
+  const source = tokenSource(io.env, apiUrl);
+  const previous = loadLogin(source);
+  const loginHint = resolveLoginHint(values.as, { account: previous?.account });
+  if (loginHint) io.stdout(`Signing in as ${loginHint}${values.as ? "" : " (the last login; pass --as to switch)"}.`);
+  const scopes = resolveScopes(values.scopes);
+  io.stdout(scopes ? `Asking for scopes: ${scopes}.` : "Asking for the scopes the platform registers for this CLI.");
+  const signIn = await login({
+    baseUrl: apiUrl,
+    clientId: source.clientId,
+    scopes,
+    openBrowser: !values["no-browser"],
+    loginHint,
+    print: io.stdout
+  });
+  let info;
+  try {
+    info = await fetchUserInfo(apiUrl, signIn.token.access_token);
+  } catch (error) {
+    throw new CliError(`Signed in, but the platform could not say who or where (${error instanceof Error ? error.message : String(error)}); run: diverge login`);
+  }
+  io.stdout(`Signed in as: ${info.email}`);
+  const organizationId = await chooseDefaultOrganization(io, values["organization-id"], previous?.organization, info);
+  const issued = await issueToken(source, { base_url: source.baseUrl, refresh_token: signIn.refreshToken, account: info.email }, organizationId);
+  saveLogin(source, { ...issued.record, organization: organizationId });
+  saveOrganizationToken(source, organizationId, issued.token);
+  io.stdout(`Logged in to ${apiUrl}.`);
+  if (apiUrl !== resolveApiUrl(void 0, io.env)) io.stdout(`Commands reach this deployment with DIVERGENT_API_URL=${apiUrl}.`);
+  const granted = new Set(tokenClaims(issued.token.access_token).scopes ?? []);
+  io.stdout(`Scopes: ${[...granted].join(" ") || "none"}`);
+  const missing = (scopes ?? "").split(" ").filter((scope) => scope && !granted.has(scope));
+  if (missing.length) io.stderr(`Not granted at this organization (your roles lack them): ${missing.join(" ")}`);
+  return 0;
+}
+async function chooseDefaultOrganization(io, flag, remembered, info) {
+  let choice = chooseOrganization({ flag, remembered, organizations: info.organizations ?? [] });
+  if (choice.kind === "none") {
+    throw new CliError("You are not a member of any organization; ask an administrator to add you, then sign in again.");
+  }
+  if (choice.kind === "ask") {
+    if (!io.interactive) {
+      throw new CliError(`You may act in several organizations; pass --organization-id <id|name>:
+${organizationMenu(choice.options).join("\n")}`);
+    }
+    io.stdout("Choose the organization to act in:");
+    for (const line of organizationMenu(choice.options)) io.stdout(line);
+    const picked = pickFromMenu(await ask("Organization (number, id or name): "), choice.options);
+    choice = { kind: "chosen", organizationId: picked.id, name: picked.name, reason: "flag" };
+  }
+  const label = choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId;
+  const why = choice.reason === "remembered" ? " (the last login; pass --organization-id to switch)" : choice.reason === "only" ? " (your only organization)" : "";
+  io.stdout(`Organization: ${label}${why}`);
+  return choice.organizationId;
 }
 
 // src/gateway/urls.ts
 var SURFACES = ["anthropic", "openai"];
-var GATEWAY_SCOPES = "mcp:read mcp:execute inference:execute";
 var INFERENCE_SCOPE = "inference:execute";
 function anthropicBaseUrl(apiUrl) {
   return `${apiUrl.replace(/\/+$/, "")}/api/plugins/inference/anthropic`;
@@ -7803,12 +8015,6 @@ function openaiBaseUrl(apiUrl) {
 function surfaceBaseUrl(apiUrl, surface) {
   return surface === "openai" ? openaiBaseUrl(apiUrl) : anthropicBaseUrl(apiUrl);
 }
-function loginServesGateway(claims, organizationId) {
-  if (!(claims.scopes ?? []).includes(INFERENCE_SCOPE)) return false;
-  const org = claims.organizationId;
-  if (!org) return false;
-  return !organizationId || org === organizationId;
-}
 
 // src/gateway/models.ts
 async function listModels(apiUrl, accessToken, surface) {
@@ -7825,35 +8031,27 @@ async function listModels(apiUrl, accessToken, surface) {
     throw error;
   }
 }
-async function ensureInferenceLogin(io, apiUrl, organizationId, openBrowser2 = true) {
-  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
-  try {
-    const cached = await getUserToken(source);
-    if (loginServesGateway(tokenClaims(cached.access_token), organizationId)) return cached;
-  } catch (error) {
-    if (!(error instanceof CliError)) throw error;
+async function ensureInferenceLogin(io, apiUrl, organizationId) {
+  const source = tokenSource(io.env, apiUrl);
+  if (!loadLogin(source)) {
+    if (!io.interactive) throw new CliError(`Not signed in to ${apiUrl}. Run: diverge login${organizationId ? ` --organization-id ${organizationId}` : ""}`);
+    await runLogin(organizationId ? ["--organization-id", organizationId] : [], io);
   }
-  if (!io.interactive) {
-    throw new CliError(`Not signed in for the gateway${organizationId ? ` at organization ${organizationId}` : ""}. Run: diverge login${organizationId ? ` --organization-id ${organizationId}` : ""}`);
+  const token = await getUserToken(source, { organizationId });
+  const claims = tokenClaims(token.access_token);
+  if (!claims.organizationId) throw new CliError("The login has no default organization; run: diverge org use <id|name>");
+  if (!(claims.scopes ?? []).includes(INFERENCE_SCOPE)) {
+    throw new CliError(`The token for organization ${claims.organizationId} carries no ${INFERENCE_SCOPE}: your roles there lack inference_models:execute, or the login asked for less (re-run: diverge login).`);
   }
-  return login({
-    baseUrl: apiUrl,
-    clientId: source.clientId,
-    scopes: GATEWAY_SCOPES,
-    organizationId,
-    selectOrganization: !organizationId,
-    openBrowser: openBrowser2,
-    tokenFile: source.tokenFile,
-    print: io.stdout
-  });
+  return token;
 }
 
 // src/agents/claude.ts
 import os2 from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 var CLAUDE_MODEL_DISCOVERY_FLAG = "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY";
 function claudeSettingsPath(scope, cwd = process.cwd()) {
-  return scope === "user" ? path3.join(os2.homedir(), ".claude", "settings.json") : path3.join(cwd, ".claude", "settings.local.json");
+  return scope === "user" ? path4.join(os2.homedir(), ".claude", "settings.json") : path4.join(cwd, ".claude", "settings.local.json");
 }
 function mergeClaudeSettings(existing, options) {
   const settings = structuredClone(existing ?? {});
@@ -7874,11 +8072,11 @@ function mergeClaudeSettings(existing, options) {
 
 // src/agents/codex.ts
 import os3 from "node:os";
-import path4 from "node:path";
+import path5 from "node:path";
 var CODEX_BLOCK_START = "# >>> divergent >>>";
 var CODEX_BLOCK_END = "# <<< divergent <<<";
 function codexConfigPath() {
-  return path4.join(os3.homedir(), ".codex", "config.toml");
+  return path5.join(os3.homedir(), ".codex", "config.toml");
 }
 var tomlString = (value) => JSON.stringify(value);
 function codexProviderToml(options) {
@@ -7894,7 +8092,7 @@ function codexProviderToml(options) {
     "",
     "[model_providers.divergent.auth]",
     `command = ${tomlString(options.self.command)}`,
-    `args = [${[...options.self.args, "token"].map(tomlString).join(", ")}]`,
+    `args = [${[...options.self.args, "token", ...options.organizationId ? ["--organization-id", options.organizationId] : []].map(tomlString).join(", ")}]`,
     "refresh_interval_ms = 600000",
     CODEX_BLOCK_END,
     ""
@@ -7919,10 +8117,10 @@ var import_yaml = __toESM(require_dist(), 1);
 import fs4 from "node:fs";
 import { createRequire } from "node:module";
 import os4 from "node:os";
-import path5 from "node:path";
+import path6 from "node:path";
 var DSH_SHIPPED_DEFAULT_MODEL = "deepseek-flash";
 function dshHome(env = process.env) {
-  return env.DSH_HOME?.trim() || path5.join(os4.homedir(), ".dsh");
+  return env.DSH_HOME?.trim() || path6.join(os4.homedir(), ".dsh");
 }
 function dshDefaultModel(models, requested) {
   if (requested) return requested;
@@ -8011,30 +8209,30 @@ var DIVERGENT_PRESET_ID = "divergent";
 var DSH_USER_PRESETS_DIR = ".agent-presets";
 function dshPackageDir(binary) {
   if (/\.(cmd|bat)$/i.test(binary)) {
-    const dir2 = path5.join(path5.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
-    return fs4.existsSync(path5.join(dir2, "package.json")) ? dir2 : null;
+    const dir2 = path6.join(path6.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
+    return fs4.existsSync(path6.join(dir2, "package.json")) ? dir2 : null;
   }
   let dir;
   try {
-    dir = path5.dirname(fs4.realpathSync(binary));
+    dir = path6.dirname(fs4.realpathSync(binary));
   } catch {
     return null;
   }
   for (; ; ) {
     try {
-      if (JSON.parse(fs4.readFileSync(path5.join(dir, "package.json"), "utf8")).name === "@deepseek-ai/dsh") return dir;
+      if (JSON.parse(fs4.readFileSync(path6.join(dir, "package.json"), "utf8")).name === "@deepseek-ai/dsh") return dir;
     } catch {
     }
-    const parent = path5.dirname(dir);
+    const parent = path6.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
 }
 function shippedPresetDir(packageDir, id = "standard") {
   try {
-    const require2 = createRequire(path5.join(packageDir, "package.json"));
-    const dir = path5.join(path5.dirname(require2.resolve("@deepseek-ai/dsh-agent-presets/package.json")), "presets", id);
-    return fs4.existsSync(path5.join(dir, "agent.cordis.yml")) ? dir : null;
+    const require2 = createRequire(path6.join(packageDir, "package.json"));
+    const dir = path6.join(path6.dirname(require2.resolve("@deepseek-ai/dsh-agent-presets/package.json")), "presets", id);
+    return fs4.existsSync(path6.join(dir, "agent.cordis.yml")) ? dir : null;
   } catch {
     return null;
   }
@@ -8071,9 +8269,9 @@ var DIVERGENT_PRESET_METADATA = [
   ""
 ].join("\n");
 function writeDivergentPreset(home, shippedDir) {
-  const dir = path5.join(home, DSH_USER_PRESETS_DIR, DIVERGENT_PRESET_ID);
-  writeTextAtomic(path5.join(dir, "agent.cordis.yml"), divergentPreset(fs4.readFileSync(path5.join(shippedDir, "agent.cordis.yml"), "utf8")), 420);
-  writeTextAtomic(path5.join(dir, "preset.yml"), DIVERGENT_PRESET_METADATA, 420);
+  const dir = path6.join(home, DSH_USER_PRESETS_DIR, DIVERGENT_PRESET_ID);
+  writeTextAtomic(path6.join(dir, "agent.cordis.yml"), divergentPreset(fs4.readFileSync(path6.join(shippedDir, "agent.cordis.yml"), "utf8")), 420);
+  writeTextAtomic(path6.join(dir, "preset.yml"), DIVERGENT_PRESET_METADATA, 420);
   return dir;
 }
 function withDivergentPresetDefault(settingsText) {
@@ -8087,9 +8285,9 @@ function withDivergentPresetDefault(settingsText) {
 
 // src/agents/opencode.ts
 import os5 from "node:os";
-import path6 from "node:path";
+import path7 from "node:path";
 function opencodeConfigPath() {
-  return path6.join(os5.homedir(), ".config", "opencode", "opencode.json");
+  return path7.join(os5.homedir(), ".config", "opencode", "opencode.json");
 }
 function mergeOpencodeConfig(existing, options) {
   const tokenEnv = options.tokenEnv ?? "DIVERGENT_TOKEN";
@@ -8106,14 +8304,14 @@ function mergeOpencodeConfig(existing, options) {
 // src/agents/run-dsh.ts
 import { spawn as spawn2 } from "node:child_process";
 import fs5 from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 function findOnPath(name, env = process.env, platform = process.platform) {
-  const dirs = (env.PATH ?? "").split(path7.delimiter).filter(Boolean);
+  const dirs = (env.PATH ?? "").split(path8.delimiter).filter(Boolean);
   const extensions = (env.PATHEXT || ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
   const candidates = platform === "win32" ? extensions.map((extension) => `${name}${extension.toLowerCase()}`) : [name];
   for (const dir of dirs) {
     for (const candidate of candidates) {
-      const full = path7.join(dir, candidate);
+      const full = path8.join(dir, candidate);
       try {
         fs5.accessSync(full, fs5.constants.X_OK);
         if (fs5.statSync(full).isFile()) return full;
@@ -8139,16 +8337,16 @@ function dshArgs(overlayPath, args) {
 }
 function dshLaunch(binary, args, platform = process.platform, execPath = process.execPath) {
   if (platform !== "win32" || !/\.(cmd|bat)$/i.test(binary)) return { command: binary, args };
-  const packageDir = path7.join(path7.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
+  const packageDir = path8.join(path8.dirname(binary), "node_modules", "@deepseek-ai", "dsh");
   let bin;
   try {
-    bin = JSON.parse(fs5.readFileSync(path7.join(packageDir, "package.json"), "utf8")).bin;
+    bin = JSON.parse(fs5.readFileSync(path8.join(packageDir, "package.json"), "utf8")).bin;
   } catch {
     throw new CliError(`${binary} is not an npm shim for @deepseek-ai/dsh (no ${packageDir}); reinstall: npm install -g @deepseek-ai/dsh`);
   }
   const script = typeof bin === "string" ? bin : typeof bin === "object" && bin !== null ? bin.dsh : void 0;
   if (typeof script !== "string") throw new CliError(`${packageDir}/package.json declares no dsh entry; reinstall: npm install -g @deepseek-ai/dsh`);
-  return { command: execPath, args: [path7.join(packageDir, script), ...args] };
+  return { command: execPath, args: [path8.join(packageDir, script), ...args] };
 }
 async function keepTokenFresh(loop) {
   let written = null;
@@ -8215,7 +8413,7 @@ function runDsh(options) {
 }
 
 // src/commands/skills.ts
-import { parseArgs } from "node:util";
+import { parseArgs as parseArgs2 } from "node:util";
 
 // src/skills/bundled.ts
 var DIVERGE_SKILL = {
@@ -8235,9 +8433,9 @@ their permissions and audit trail. Nothing runs locally; the CLI is the
 transport. Keep the catalog out of context: pull the one schema you need.
 
 \`\`\`bash
-diverge tools list --filter <word>     # find candidates by name or capability
+diverge tools list --filter <word>     # find candidates by name or description
 diverge tools describe <tool>          # the one schema, on demand
-diverge tools call <tool> --args-file args.json   # arguments from a file (see below)
+diverge tools call <tool> --args-file args.json --json   # arguments from a file, one JSON outcome out
 diverge tools call search_online --args-json '{"query": "..."}'   # web search is a platform tool too
 \`\`\`
 
@@ -8253,20 +8451,28 @@ Write the object to a file and pass \`--args-file\`, or pipe it with
 \`--args-json -\`; both are exact on every shell. A worked call:
 
 \`\`\`bash
-diverge tools describe divix-mcp_implementation_search_source
+diverge tools describe divix-data-sync_implementation_search_source
 cat > /tmp/args.json <<'JSON'
 {"query": "cr9b5_serial", "limit": 20}
 JSON
-diverge tools call divix-mcp_implementation_search_source --args-file /tmp/args.json
+diverge tools call divix-data-sync_implementation_search_source --args-file /tmp/args.json
 \`\`\`
 
+## Read the outcome from stdout with --json
+
+\`call --json\` prints exactly one JSON object on stdout whatever happens,
+errors included: \`{"tool", "status", "result"?, "error"?, "invocationId"?,
+"decideAt"?}\`, where status is executed, pending, rejected, expired or failed.
+Parse stdout alone; stderr only carries the scope and identity lines. Without
+\`--json\`, errors are text on stderr.
+
 ## Several calls at once
 
 When a task needs a sequence of calls, write them to one file and run it
-once instead of one round trip each: \`diverge tools run calls.json\`, a JSON
+once instead of one round trip each: \`diverge tools run calls.json\` (or \`run -\` for stdin), a JSON
 array of \`{"tool": "...", "args": {...}}\` (or one per line). Calls run in
-order; each prints one JSON line of outcome; the exit code is the worst of
-them.
+order; each prints one JSON line of outcome, the same shape as \`call --json\`;
+the exit code is the worst of them.
 
 ## Exit codes are the contract
 
@@ -8284,8 +8490,11 @@ cadence). Never decide your own invocation from any surface you can drive.
 
 ## Session
 
-- \`diverge status\` says who is signed in and at which organization; every
-  call runs there. \`diverge org use <id|name>\` moves the session.
+- \`diverge status\` says who is signed in and at which organization; a call
+  that names none runs there. To act in another organization, pass
+  \`--organization-id <id>\` (or set \`DIVERGENT_ORG_ID\`) on the call; that
+  never changes the default. \`diverge org use <id|name>\` changes it for
+  every session on the machine, so leave it to the person.
 - A missing login or scope prints the command to run; \`diverge login\` opens
   the browser.
 - \`--json\` on \`list\`, \`describe\` and \`invocation\` gives raw records.
@@ -8295,22 +8504,22 @@ cadence). Never decide your own invocation from any surface you can drive.
 // src/skills/install.ts
 import fs6 from "node:fs";
 import os6 from "node:os";
-import path8 from "node:path";
+import path9 from "node:path";
 var HARNESSES = ["claude", "codex", "dsh"];
 var SKILLS_MANIFEST = ".diverge-skills.json";
 function skillsRoot(harness, env = process.env) {
   switch (harness) {
     case "claude":
-      return path8.join(env.CLAUDE_CONFIG_DIR?.trim() || path8.join(os6.homedir(), ".claude"), "skills");
+      return path9.join(env.CLAUDE_CONFIG_DIR?.trim() || path9.join(os6.homedir(), ".claude"), "skills");
     case "codex":
-      return path8.join(env.CODEX_HOME?.trim() || path8.join(os6.homedir(), ".codex"), "skills");
+      return path9.join(env.CODEX_HOME?.trim() || path9.join(os6.homedir(), ".codex"), "skills");
     case "dsh":
-      return path8.join(dshHome(env), "skills");
+      return path9.join(dshHome(env), "skills");
   }
 }
 function readSkillsManifest(root) {
   try {
-    const parsed = JSON.parse(fs6.readFileSync(path8.join(root, SKILLS_MANIFEST), "utf8"));
+    const parsed = JSON.parse(fs6.readFileSync(path9.join(root, SKILLS_MANIFEST), "utf8"));
     if (parsed && typeof parsed === "object" && typeof parsed.skills === "object") return parsed;
   } catch {
   }
@@ -8327,7 +8536,7 @@ function installSkills(root, skills, source, now = () => /* @__PURE__ */ new Dat
   const updated = [];
   for (const skill of skills) {
     if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(skill.name)) throw new Error(`skill name ${JSON.stringify(skill.name)} is not a folder name`);
-    writeTextAtomic(path8.join(root, skill.name, "SKILL.md"), skill.content, 420);
+    writeTextAtomic(path9.join(root, skill.name, "SKILL.md"), skill.content, 420);
     written.push(skill.name);
     if (!(skill.name in held)) added.push(skill.name);
     else if (held[skill.name] !== skill.updatedAt) updated.push(skill.name);
@@ -8335,7 +8544,7 @@ function installSkills(root, skills, source, now = () => /* @__PURE__ */ new Dat
   const removed = [];
   for (const name of Object.keys(previous?.skills ?? {})) {
     if (skills.some((skill) => skill.name === name)) continue;
-    fs6.rmSync(path8.join(root, name), { recursive: true, force: true });
+    fs6.rmSync(path9.join(root, name), { recursive: true, force: true });
     removed.push(name);
   }
   const manifest = {
@@ -8343,7 +8552,7 @@ function installSkills(root, skills, source, now = () => /* @__PURE__ */ new Dat
     source,
     skills: Object.fromEntries(skills.map((skill) => [skill.name, skill.updatedAt]))
   };
-  writeJsonAtomic(path8.join(root, SKILLS_MANIFEST), manifest, 420);
+  writeJsonAtomic(path9.join(root, SKILLS_MANIFEST), manifest, 420);
   return { root, written, added, updated, removed };
 }
 function skillsStatus(root, skills) {
@@ -8353,7 +8562,7 @@ function skillsStatus(root, skills) {
   const behind = [];
   const missing = [];
   for (const skill of skills) {
-    if (!(skill.name in held) || !fs6.existsSync(path8.join(root, skill.name, "SKILL.md"))) missing.push(skill.name);
+    if (!(skill.name in held) || !fs6.existsSync(path9.join(root, skill.name, "SKILL.md"))) missing.push(skill.name);
     else if (held[skill.name] !== skill.updatedAt) behind.push(skill.name);
     else current.push(skill.name);
   }
@@ -8383,10 +8592,9 @@ var skillsUsage = `diverge skills <list|install|status> [--harness claude,codex,
 A skill is a procedure over the tools it names; you get the ones whose every
 tool you may run. Re-run install after the organization changes its skills.`;
 async function installableSkillSet(apiUrl, env) {
-  const source = { tokenFile: tokenFile(env), baseUrl: apiUrl, clientId: clientId(env) };
-  const token = await getUserToken(source);
+  const token = await getUserToken(tokenSource(env, apiUrl));
   const organizationId = tokenClaims(token.access_token).organizationId;
-  if (!organizationId) throw new CliError("The login is not bound to an organization; run: diverge org use <id|name>");
+  if (!organizationId) throw new CliError("The login has no default organization; run: diverge org use <id|name>");
   const served = await fetchInstallableSkills(apiUrl, token.access_token);
   return { skills: [DIVERGE_SKILL, ...served.skills], organizationId };
 }
@@ -8408,7 +8616,7 @@ function installForHarness(io, harness, skills, apiUrl, into) {
 }
 async function runSkills(args, io) {
   const [verb, ...rest] = args;
-  const { values } = parseArgs({ args: rest, options: { harness: { type: "string" }, into: { type: "string" } }, strict: true });
+  const { values } = parseArgs2({ args: rest, options: { harness: { type: "string" }, into: { type: "string" } }, strict: true });
   const apiUrl = resolveApiUrl(void 0, io.env);
   switch (verb) {
     case "list": {
@@ -8447,9 +8655,9 @@ ${skillsUsage}`);
 
 // src/agents/rotate.ts
 import os7 from "node:os";
-import path9 from "node:path";
+import path10 from "node:path";
 function defaultTokenFilePath() {
-  return path9.join(os7.homedir(), ".divergent", "token");
+  return path10.join(os7.homedir(), ".divergent", "token");
 }
 var MIN_ROTATE_INTERVAL_SECONDS = 60;
 async function rotateTokenFile(loop) {
@@ -8465,14 +8673,14 @@ async function rotateTokenFile(loop) {
 
 // src/agents/self-command.ts
 import fs7 from "node:fs";
-import path10 from "node:path";
+import path11 from "node:path";
 function resolveSelfCommand(argv = process.argv, platform = process.platform, execPath = process.execPath) {
   const script = argv[1];
   if (!script) return { command: execPath, args: [] };
   if (platform !== "win32") {
     try {
       fs7.accessSync(script, fs7.constants.X_OK);
-      return { command: path10.resolve(script), args: [] };
+      return { command: path11.resolve(script), args: [] };
     } catch {
     }
   }
@@ -8521,7 +8729,7 @@ function syncDivergentPreset(io, binary, home) {
     return;
   }
   const dir = writeDivergentPreset(home, shipped);
-  const settingsPath = path11.join(home, "settings.yaml");
+  const settingsPath = path12.join(home, "settings.yaml");
   const settings = withDivergentPresetDefault(fs8.existsSync(settingsPath) ? fs8.readFileSync(settingsPath, "utf8") : null);
   if (settings !== null) writeTextAtomic(settingsPath, settings);
   io.stderr(`Agent preset "${DIVERGENT_PRESET_ID}" (${dir}): web sessions search through the platform${settings !== null ? "; set as the default preset in settings.yaml" : ""}.`);
@@ -8541,18 +8749,22 @@ async function overlayAndDefault(apiUrl, token, surface, io, requested) {
   const defaultModel = dshDefaultModel(models, requested);
   return { overlay: dshPatchYaml({ baseUrl: surfaceBaseUrl(apiUrl, surface), surface, models, defaultModel }), defaultModel, models };
 }
+function organizationArgs(organizationId) {
+  const trimmed = organizationId?.trim();
+  return trimmed ? ["--organization-id", trimmed] : [];
+}
 async function setup(args, io) {
   const [agent, ...rest] = args;
   const apiUrl = resolveApiUrl(void 0, io.env);
   switch (agent) {
     case "claude": {
-      const { values } = parseArgs2({ args: rest, options: { scope: { type: "string", default: "user" }, "project-id": { type: "string" }, "organization-id": { type: "string" }, "model-discovery": { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs3({ args: rest, options: { scope: { type: "string", default: "user" }, "project-id": { type: "string" }, "organization-id": { type: "string" }, "model-discovery": { type: "boolean", default: false } }, strict: true });
       if (values.scope !== "user" && values.scope !== "project") throw new CliError("--scope must be user or project");
       const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
       const file = claudeSettingsPath(values.scope);
       const { settings, warnings } = mergeClaudeSettings(readJson(file), {
         baseUrl: anthropicBaseUrl(apiUrl),
-        tokenHelper: shellCommand(resolveSelfCommand(), "token"),
+        tokenHelper: shellCommand(resolveSelfCommand(), "token", ...organizationArgs(values["organization-id"])),
         projectId: values["project-id"],
         modelDiscovery: values["model-discovery"]
       });
@@ -8563,7 +8775,7 @@ async function setup(args, io) {
       return ExitCode.Ok;
     }
     case "opencode": {
-      const { values } = parseArgs2({ args: rest, options: { surface: { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" } }, strict: true });
+      const { values } = parseArgs3({ args: rest, options: { surface: { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" } }, strict: true });
       const surface = surfaceOf(values.surface, "anthropic");
       const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
       const baseUrl = surfaceBaseUrl(apiUrl, surface);
@@ -8577,12 +8789,12 @@ async function setup(args, io) {
       writeJsonAtomic(file, mergeOpencodeConfig(readJson(file), { baseUrl, surface, models }));
       io.stdout(`OpenCode provider divergent-${surface} \u2192 ${baseUrl}. Wrote ${file}.`);
       io.stdout("Keep DIVERGENT_TOKEN fresh for the session (user tokens expire; the login refreshes):");
-      io.stdout('  export DIVERGENT_TOKEN="$(diverge token)"');
+      io.stdout(`  export DIVERGENT_TOKEN="$(${["diverge", "token", ...organizationArgs(values["organization-id"])].join(" ")})"`);
       return ExitCode.Ok;
     }
     case "codex": {
-      const { values } = parseArgs2({ args: rest, options: { "project-id": { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
-      const block = codexProviderToml({ openaiBaseUrl: openaiBaseUrl(apiUrl), self: resolveSelfCommand(), projectId: values["project-id"] });
+      const { values } = parseArgs3({ args: rest, options: { "project-id": { type: "string" }, "organization-id": { type: "string" }, config: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
+      const block = codexProviderToml({ openaiBaseUrl: openaiBaseUrl(apiUrl), self: resolveSelfCommand(), projectId: values["project-id"], organizationId: values["organization-id"] });
       if (values.print) {
         io.stdout(block.trimEnd());
         return ExitCode.Ok;
@@ -8597,7 +8809,7 @@ async function setup(args, io) {
       return ExitCode.Ok;
     }
     case "dsh": {
-      const { values } = parseArgs2({ args: rest, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" }, into: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs3({ args: rest, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" }, into: { type: "string" }, print: { type: "boolean", default: false } }, strict: true });
       const surface = surfaceOf(values.surface, "openai");
       const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
       if (!values.print) await skillsFor(io, apiUrl, "dsh");
@@ -8606,13 +8818,13 @@ async function setup(args, io) {
         io.stdout(overlay.trimEnd());
         return ExitCode.Ok;
       }
-      const file = values.into ?? path11.join(dshHome(io.env), `divergent-${surface}.yml`);
+      const file = values.into ?? path12.join(dshHome(io.env), `divergent-${surface}.yml`);
       writeTextAtomic(file, overlay);
       io.stdout(`dsh route divergent-${surface} \u2192 ${surfaceBaseUrl(apiUrl, surface)} as you, organization ${tokenClaims(token.access_token).organizationId}, default model ${defaultModel}. Wrote ${file}.`);
       io.stdout("Platform tools, web search included, are reached from dsh's shell through `diverge tools`; the installed skills say when and how. dsh's DeepSeek search is off.");
       syncDivergentPreset(io, findOnPath("dsh", io.env), dshHome(io.env));
       io.stdout("Boot a profile with the overlay and the token in its environment (user tokens expire; the login refreshes):");
-      io.stdout(`  DIVERGENT_TOKEN="$(diverge token)" dsh --profile headless --patch ${file} "<task>"`);
+      io.stdout(`  DIVERGENT_TOKEN="$(${["diverge", "token", ...organizationArgs(values["organization-id"])].join(" ")})" dsh --profile headless --patch ${file} "<task>"`);
       io.stdout(`or let the CLI keep the token fresh for the whole session:  diverge agents run dsh --surface ${surface} -- --profile web --port 3131 --no-open`);
       return ExitCode.Ok;
     }
@@ -8630,7 +8842,7 @@ ${agentsUsage}`);
   const terminator = rest.indexOf("--");
   const flags = terminator === -1 ? rest : rest.slice(0, terminator);
   const passthrough = terminator === -1 ? [] : rest.slice(terminator + 1);
-  const { values } = parseArgs2({ args: flags, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" } }, strict: true });
+  const { values } = parseArgs3({ args: flags, options: { surface: { type: "string" }, model: { type: "string" }, "organization-id": { type: "string" } }, strict: true });
   const surface = surfaceOf(values.surface, "openai");
   const apiUrl = resolveApiUrl(void 0, io.env);
   const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
@@ -8639,7 +8851,7 @@ ${agentsUsage}`);
   await skillsFor(io, apiUrl, "dsh");
   const { overlay, defaultModel } = await overlayAndDefault(apiUrl, token, surface, io, values.model);
   const home = dshHome(io.env);
-  const settingsPath = path11.join(home, "settings.yaml");
+  const settingsPath = path12.join(home, "settings.yaml");
   let pinned;
   try {
     pinned = dshSettingsDefaultModel(fs8.existsSync(settingsPath) ? fs8.readFileSync(settingsPath, "utf8") : null, surface);
@@ -8648,22 +8860,22 @@ ${agentsUsage}`);
   }
   const served = servedIds(overlay);
   if (pinned && !served.includes(pinned)) throw new CliError(stalePinMessage(settingsPath, pinned, surface, served));
-  const overlayPath = path11.join(home, `divergent-${surface}.yml`);
+  const overlayPath = path12.join(home, `divergent-${surface}.yml`);
   writeTextAtomic(overlayPath, overlay);
   syncDivergentPreset(io, binary, home);
   io.stderr(`dsh on divergent-${surface} as you (organization ${tokenClaims(token.access_token).organizationId}), default model ${defaultModel}`);
   if (passthrough.length === 0) io.stderr('Starting the web UI; open the URL dsh prints. For one task without the UI: diverge agents run dsh -- "<task>"');
-  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
+  const source = tokenSource(io.env, apiUrl);
   return runDsh({
     binary,
     overlayPath,
-    credentialsPath: path11.join(home, ".credentials.yaml"),
+    credentialsPath: path12.join(home, ".credentials.yaml"),
     args: passthrough,
     env: io.env,
     initialToken: token.access_token,
     freshToken: async () => {
       try {
-        return (await getUserToken(source, 120)).access_token;
+        return (await getUserToken(source, { freshForSeconds: 120, organizationId: values["organization-id"] })).access_token;
       } catch (error) {
         io.stderr(`warning: could not refresh the platform token: ${error instanceof Error ? error.message : String(error)}`);
         return null;
@@ -8672,7 +8884,7 @@ ${agentsUsage}`);
   });
 }
 async function status(args, io) {
-  const { values } = parseArgs2({ args, options: { "organization-id": { type: "string" } }, strict: true });
+  const { values } = parseArgs3({ args, options: { "organization-id": { type: "string" } }, strict: true });
   const apiUrl = resolveApiUrl(void 0, io.env);
   const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
   const claims = tokenClaims(token.access_token);
@@ -8686,19 +8898,19 @@ async function status(args, io) {
   return ExitCode.Ok;
 }
 async function rotate(args, io) {
-  const { values } = parseArgs2({ args, options: { into: { type: "string" }, interval: { type: "string", default: "600" }, once: { type: "boolean", default: false }, "organization-id": { type: "string" } }, strict: true });
+  const { values } = parseArgs3({ args, options: { into: { type: "string" }, interval: { type: "string", default: "600" }, once: { type: "boolean", default: false }, "organization-id": { type: "string" } }, strict: true });
   const interval = Number(values.interval);
   if (!Number.isFinite(interval) || interval <= 0) throw new CliError("--interval must be a positive number of seconds");
   const apiUrl = resolveApiUrl(void 0, io.env);
   const token = await ensureInferenceLogin(io, apiUrl, values["organization-id"]);
-  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
+  const source = tokenSource(io.env, apiUrl);
   const tokenFilePath = values.into ?? defaultTokenFilePath();
   io.stderr(`Keeping ${tokenFilePath} fresh as you (organization ${tokenClaims(token.access_token).organizationId})`);
   return rotateTokenFile({
     tokenFile: tokenFilePath,
     intervalSeconds: interval,
     once: values.once,
-    freshToken: async () => (await getUserToken(source, Math.max(interval, 60) + 60)).access_token,
+    freshToken: async () => (await getUserToken(source, { freshForSeconds: Math.max(interval, 60) + 60, organizationId: values["organization-id"] })).access_token,
     report: (line) => io.stderr(line),
     sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
   });
@@ -8731,184 +8943,30 @@ ${agentsUsage}`);
   }
 }
 
-// src/commands/login.ts
-import { parseArgs as parseArgs3 } from "node:util";
-
-// src/auth/organizations.ts
-function chooseOrganization(input) {
-  const memberships = input.memberships;
-  const flag = input.flag?.trim();
-  if (flag) {
-    const match = memberships.find((organization) => organization.id === flag || organization.name.toLowerCase() === flag.toLowerCase());
-    if (match) return { kind: "chosen", organizationId: match.id, name: match.name, reason: "flag" };
-    if (input.platformActor) return { kind: "chosen", organizationId: flag, reason: "flag" };
-    throw new CliError(`Not one of your organizations: ${flag}. Yours: ${memberships.map((organization) => `${organization.name} (${organization.id})`).join(", ") || "none"}`);
-  }
-  const remembered = input.remembered?.trim();
-  if (remembered) {
-    const match = memberships.find((organization) => organization.id === remembered);
-    if (match) return { kind: "chosen", organizationId: match.id, name: match.name, reason: "remembered" };
-    if (input.platformActor) return { kind: "chosen", organizationId: remembered, reason: "remembered" };
-  }
-  if (memberships.length === 1) return { kind: "chosen", organizationId: memberships[0].id, name: memberships[0].name, reason: "only" };
-  if (memberships.length === 0) return { kind: "none" };
-  return { kind: "ask", options: memberships };
-}
-function organizationMenu(options) {
-  return options.map((organization, index) => `  ${index + 1}. ${organization.name} (${organization.id})`);
-}
-function pickFromMenu(answer, options) {
-  const trimmed = answer.trim();
-  const index = Number(trimmed);
-  if (Number.isInteger(index) && index >= 1 && index <= options.length) return options[index - 1];
-  const match = options.find((organization) => organization.id === trimmed || organization.name.toLowerCase() === trimmed.toLowerCase());
-  if (!match) throw new CliError(`Not one of the listed organizations: ${trimmed}`);
-  return match;
-}
-
-// src/auth/userinfo.ts
-async function fetchUserInfo(baseUrl, accessToken) {
-  return fetchJson(userinfoEndpoint(baseUrl), { headers: { Authorization: `Bearer ${accessToken}` }, timeoutMs: 15e3 });
-}
-async function describeAccount(baseUrl, accessToken, fallbackSub, options = {}) {
-  try {
-    const info = await fetchUserInfo(baseUrl, accessToken);
-    return options.withSub ? `${info.email} (${info.sub})` : info.email;
-  } catch (error) {
-    return `${fallbackSub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})`;
-  }
-}
-
-// src/prompt.ts
-import readline from "node:readline";
-function ask(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
-  return new Promise((resolve) => rl.question(question, (answer) => {
-    rl.close();
-    resolve(answer);
-  }));
-}
-
-// src/commands/login.ts
-var DEFAULT_SCOPES = "mcp:read mcp:execute inference:execute";
-var loginUsage = `diverge login [--organization-id <id|name>] [--scopes "<scopes>"] [--as <email>] [--no-browser] [--api-url <url>]
-
-Sign in through the browser, then choose where to act. The browser only
-authenticates the person; the organization is chosen here afterwards \u2014 the
-one named by --organization-id (id or name), else the last login's, else the
-only membership, else a menu \u2014 and the login is bound to it on the platform.
-Switch later with: diverge org use <id|name>.
---as <email> names the account: the platform signs that account in instead of
-reusing whatever session the browser holds, and issues nothing to any other.
-Without --as, the account of the last login is used; switching is explicit.
-Without --scopes, the scopes of the last login are asked for again; a first
-login asks for the CLI's own (mcp:read mcp:execute inference:execute).`;
-function resolveScopes(flag, config) {
-  const explicit = flag?.trim();
-  if (explicit) return explicit.split(/\s+/).join(" ");
-  const remembered = config.scopes?.trim();
-  return remembered ? remembered.split(/\s+/).join(" ") : DEFAULT_SCOPES;
-}
-function resolveLoginHint(flag, config) {
-  const explicit = flag?.trim().toLowerCase();
-  if (explicit) return explicit;
-  const remembered = config.account?.trim().toLowerCase();
-  return remembered || void 0;
-}
-async function runLogin(args, io) {
-  const { values } = parseArgs3({
-    args,
-    options: {
-      "organization-id": { type: "string" },
-      scopes: { type: "string" },
-      as: { type: "string" },
-      "no-browser": { type: "boolean", default: false },
-      "api-url": { type: "string" }
-    },
-    strict: true,
-    allowPositionals: false
-  });
-  const config = readConfig(io.env);
-  const apiUrl = resolveApiUrl(values["api-url"], io.env, config);
-  if (values["api-url"]) writeConfig({ ...config, apiUrl }, io.env);
-  const loginHint = resolveLoginHint(values.as, config);
-  if (loginHint) io.stdout(`Signing in as ${loginHint}${values.as ? "" : " (the last login; pass --as to switch)"}.`);
-  const scopes = resolveScopes(values.scopes, config);
-  io.stdout(`Asking for scopes: ${scopes}${values.scopes ? "" : config.scopes ? " (the last login; pass --scopes to change)" : ""}.`);
-  const token = await login({
-    baseUrl: apiUrl,
-    clientId: clientId(io.env),
-    scopes,
-    openBrowser: !values["no-browser"],
-    tokenFile: tokenFile(io.env),
-    loginHint,
-    print: io.stdout
-  });
-  const claims = tokenClaims(token.access_token);
-  let info;
-  try {
-    info = await fetchUserInfo(apiUrl, token.access_token);
-  } catch (error) {
-    throw new CliError(`Signed in, but the platform could not say who or where (${error instanceof Error ? error.message : String(error)}); run: diverge login`);
-  }
-  io.stdout(`Signed in as: ${info.email}`);
-  const bound = await bindChosenOrganization(io, apiUrl, values["organization-id"], config.organization, info);
-  const remaining = Math.max(0, Math.round(bound.token.expires_at - Date.now() / 1e3));
-  io.stdout(`Logged in to ${apiUrl}; token cached (${remaining}s to expiry, auto-refreshes).`);
-  writeConfig({ ...readConfig(io.env), account: info.email, scopes, organization: bound.organizationId }, io.env);
-  const granted = new Set(tokenClaims(bound.token.access_token).scopes ?? []);
-  const missing = scopes.split(" ").filter((scope) => scope && !granted.has(scope));
-  if (missing.length) io.stderr(`Not granted at this organization (your roles lack them): ${missing.join(" ")}`);
-  return 0;
-}
-async function bindChosenOrganization(io, apiUrl, flag, remembered, info) {
-  const memberships = info.organizations ?? [];
-  let choice = chooseOrganization({ flag, remembered, memberships, platformActor: info.platformActor });
-  if (choice.kind === "none") {
-    throw new CliError("You are not a member of any organization; ask an administrator to add you, then sign in again.");
-  }
-  if (choice.kind === "ask") {
-    if (!io.interactive) {
-      throw new CliError(`You belong to several organizations; pass --organization-id <id|name>:
-${organizationMenu(choice.options).join("\n")}`);
-    }
-    io.stdout("Choose the organization to act in:");
-    for (const line of organizationMenu(choice.options)) io.stdout(line);
-    const picked = pickFromMenu(await ask("Organization (number, id or name): "), choice.options);
-    choice = { kind: "chosen", organizationId: picked.id, name: picked.name, reason: "flag" };
-  }
-  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
-  const token = await bindOrganization(source, choice.organizationId);
-  const label = choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId;
-  const why = choice.reason === "remembered" ? " (the last login; pass --organization-id to switch)" : choice.reason === "only" ? " (your only organization)" : "";
-  io.stdout(`Organization: ${label}${why}`);
-  return { organizationId: choice.organizationId, token };
-}
-
 // src/commands/org.ts
 import { parseArgs as parseArgs4 } from "node:util";
 var orgUsage = `diverge org [use <id|name>]
 
-Without a verb: the organizations you may act in, the bound one marked.
-use <id|name>: bind the login to that organization on the platform, without a
-browser; every later command acts there. A platform actor may name an
-organization they are not a member of.`;
+Without a verb: the organizations you may act in, the default marked.
+use <id|name>: make it the default \u2014 where every command that names no
+organization acts, in every shell on this machine that shares the login. It
+is a local preference: the platform is asked only for a token there, which
+proves you may act in it. For one command, pass --organization-id <id> (or
+set DIVERGENT_ORG_ID) instead. A platform actor may act in, and so sees, every
+organization.`;
 async function runOrg(args, io) {
   const { positionals } = parseArgs4({ args, options: {}, strict: true, allowPositionals: true });
-  const apiUrl = resolveApiUrl(void 0, io.env);
-  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
-  const token = await getUserToken(source);
-  const info = await fetchUserInfo(apiUrl, token.access_token);
-  const memberships = info.organizations ?? [];
-  const current = tokenClaims(token.access_token).organizationId ?? void 0;
+  const source = tokenSource(io.env, resolveApiUrl(void 0, io.env));
+  const info = await fetchUserInfo(source.baseUrl, (await getUserToken(source)).access_token);
+  const organizations = info.organizations ?? [];
+  const current = requireLogin(source).organization;
   const verb = positionals[0];
   if (!verb) {
-    if (memberships.length === 0 && !current) {
+    if (organizations.length === 0) {
       io.stdout("You are not a member of any organization.");
       return 0;
     }
-    for (const organization of memberships) io.stdout(`${organization.id === current ? "*" : " "} ${organization.name} (${organization.id})`);
-    if (current && !memberships.some((organization) => organization.id === current)) io.stdout(`* ${current} (not a membership; acting as the platform)`);
+    for (const organization of organizations) io.stdout(`${organization.id === current ? "*" : " "} ${organization.name} (${organization.id})`);
     return 0;
   }
   if (verb !== "use") throw new CliError(`Unknown verb: ${verb}
@@ -8916,35 +8974,37 @@ async function runOrg(args, io) {
 ${orgUsage}`);
   const target = positionals[1];
   if (!target) throw new CliError("org use needs an organization id or name");
-  const choice = chooseOrganization({ flag: target, memberships, platformActor: info.platformActor });
+  const choice = chooseOrganization({ flag: target, organizations });
   if (choice.kind !== "chosen") throw new CliError("org use needs an organization id or name");
-  const bound = await bindOrganization(source, choice.organizationId);
-  writeConfig({ ...readConfig(io.env), organization: choice.organizationId }, io.env);
-  io.stdout(`Organization: ${choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId}; scopes ${(tokenClaims(bound.access_token).scopes ?? []).join(" ") || "none"}`);
+  const token = await useOrganization(source, choice.organizationId);
+  io.stdout(`Default organization: ${choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId}; scopes ${(tokenClaims(token.access_token).scopes ?? []).join(" ") || "none"}`);
   return 0;
 }
 
 // src/commands/logout.ts
-var logoutUsage = "diverge logout\n\nRevoke the login's session on the platform and forget it locally.";
+var logoutUsage = "diverge logout\n\nRevoke this deployment's login on the platform and forget it locally, with every token issued from it. Logins to other deployments are kept.";
 async function runLogout(_args, io) {
-  const file = tokenFile(io.env);
-  const token = loadUserToken(file);
+  const source = tokenSource(io.env, resolveApiUrl(void 0, io.env));
+  const token = loadLogin(source);
   if (!token) {
-    io.stdout("Not logged in.");
+    io.stdout(`Not logged in to ${source.baseUrl}.`);
     return 0;
   }
   if (token.refresh_token) {
     try {
-      await revokeRefreshToken(token.base_url, clientId(io.env), token.refresh_token);
+      await revokeRefreshToken(source.baseUrl, source.clientId, token.refresh_token);
     } catch (error) {
-      io.stderr(`warning: could not revoke the session on ${token.base_url}: ${error instanceof Error ? error.message : String(error)}`);
+      io.stderr(`warning: could not revoke the session on ${source.baseUrl}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
-  deleteUserToken(file);
-  io.stdout(`Logged out of ${token.base_url}${token.base_url === resolveApiUrl(void 0, io.env) ? "" : " (a different deployment than the configured one)"}.`);
+  forgetLogin(source);
+  io.stdout(`Logged out of ${source.baseUrl}.`);
   return 0;
 }
 
+// src/commands/status.ts
+import path13 from "node:path";
+
 // src/tools/settings.ts
 var BRIDGE_SCOPES = "mcp:read mcp:execute";
 var LOGIN_HINT = "diverge login";
@@ -8952,21 +9012,19 @@ function loadToolsSettings(options, env = process.env) {
   const apiUrl = resolveApiUrl(void 0, env);
   const projectId = options.projectId?.trim() || env.DIVERGENT_PROJECT_ID?.trim() || void 0;
   let organizationId = options.organizationId?.trim() || env.DIVERGENT_ORG_ID?.trim() || "";
-  const cached = loadUserToken(tokenFile(env));
-  if (cached && cached.base_url === apiUrl) {
-    organizationId ||= tokenClaims(cached.access_token).organizationId?.trim() || "";
-    if (!organizationId) throw new CliError(`The login carries no organization. Pass --organization-id or sign in to one:  ${LOGIN_HINT} --organization-id <id>`);
+  const cached = loadLogin(tokenSource(env, apiUrl));
+  if (cached) {
+    organizationId ||= cached.organization ?? "";
+    if (!organizationId) throw new CliError(`The login has no default organization. Pass --organization-id or choose one:  diverge org use <id|name>`);
     return { apiUrl, organizationId, projectId, mode: "operator", clientId: clientId(env) };
   }
-  if (!organizationId) throw new CliError("No organization configured. Pass --organization-id or set DIVERGENT_ORG_ID.");
   const serviceClientId = env.DIVERGENT_CLIENT_ID?.trim() ?? "";
   const serviceClientSecret = env.DIVERGENT_CLIENT_SECRET?.trim() ?? "";
   const delegatedUserId = env.DIVERGENT_USER_ID?.trim() ?? "";
   if (!serviceClientId || !serviceClientSecret) {
-    throw new CliError(`Not signed in for ${apiUrl} and no service credentials configured.
-  Sign in as yourself:  ${LOGIN_HINT}
-  Or set DIVERGENT_CLIENT_ID and DIVERGENT_CLIENT_SECRET.`);
+    throw noLogin(apiUrl, "Or, unattended, set DIVERGENT_CLIENT_ID, DIVERGENT_CLIENT_SECRET, DIVERGENT_USER_ID and DIVERGENT_ORG_ID.");
   }
+  if (!organizationId) throw new CliError("Service credentials act in the organization named: pass --organization-id or set DIVERGENT_ORG_ID.");
   if (!delegatedUserId) {
     throw new CliError(`DIVERGENT_USER_ID is required for service-credential execution: tools run under that human's RBAC, and without it the service account executes app-only, which governed tools deliberately restrict.
   Signing in as yourself avoids this entirely:  ${LOGIN_HINT}`);
@@ -8984,10 +9042,9 @@ function actingAsLine(settings, env = process.env) {
   actingAs ??= (async () => {
     let accessToken;
     try {
-      accessToken = (await getUserToken({ tokenFile: tokenFile(env), baseUrl: settings.apiUrl, clientId: settings.clientId })).access_token;
+      accessToken = (await getUserToken(tokenSource(env, settings.apiUrl))).access_token;
     } catch (error) {
-      const sub = tokenClaims(loadUserToken(tokenFile(env))?.access_token ?? "").sub;
-      return `Acting as: ${sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})`;
+      return `Acting as: unknown user (email unavailable: ${error instanceof Error ? error.message : String(error)})`;
     }
     return `Acting as: ${await describeAccount(settings.apiUrl, accessToken, tokenClaims(accessToken).sub)}`;
   })();
@@ -9007,54 +9064,73 @@ function describeToolExecution(env = process.env) {
 var statusUsage = "diverge status\n\nShow the deployment, the cached login, whose account it is, what it carries, and who a tool call would run as. One request: the account behind the login.";
 async function runStatus(_args, io) {
   const apiUrl = resolveApiUrl(void 0, io.env);
+  const source = tokenSource(io.env, apiUrl);
   io.stdout(`diverge ${VERSION}`);
   io.stdout(`Deployment: ${apiUrl}`);
-  io.stdout(`State: ${configDir(io.env)}`);
-  const token = loadUserToken(tokenFile(io.env));
-  if (!token) {
-    io.stdout("Not logged in. Run: diverge login");
+  io.stdout(`State: ${path13.dirname(source.loginFile)}`);
+  const record = loadLogin(source);
+  if (!record) {
+    io.stdout(`Not logged in. Run: diverge login${apiUrl === DEFAULT_API_URL ? "" : ` --api-url ${apiUrl}`}`);
     io.stdout(describeToolExecution(io.env));
     return 1;
   }
-  const claims = tokenClaims(token.access_token);
-  const remaining = Math.round(token.expires_at - Date.now() / 1e3);
-  const mismatch = token.base_url !== apiUrl ? ` (for ${token.base_url}, not the configured deployment)` : "";
-  io.stdout(`Login: ${isFresh(token, 0) ? `valid for ${remaining}s` : "expired (auto-refreshes)"}; refresh token ${token.refresh_token ? "present" : "absent"}${mismatch}`);
-  const account = await signedInAs(token, io);
+  io.stdout(`Login: ${describeSignIn(record)}`);
+  const account = await signedInAs(source);
   io.stdout(`Signed in as: ${account.line}`);
-  const organization = account.organizations?.find((candidate) => candidate.id === claims.organizationId);
-  io.stdout(`Organization: ${claims.organizationId ? `${organization ? `${organization.name} (${claims.organizationId})` : claims.organizationId}` : "none (run: diverge org use <id|name>)"}`);
-  io.stdout(`Scopes: ${(claims.scopes ?? []).join(" ") || "none"}`);
+  const organization = account.organizations?.find((candidate) => candidate.id === record.organization);
+  io.stdout(`Organization: ${record.organization ? `${organization ? `${organization.name} (${record.organization})` : record.organization} (the default; commands may name another)` : "none (run: diverge org use <id|name>)"}`);
+  io.stdout(`Scopes: ${account.scopes ?? "unknown"}`);
   io.stdout(describeToolExecution(io.env));
   return 0;
 }
-async function signedInAs(cached, io) {
-  const sub = tokenClaims(cached.access_token).sub;
+async function signedInAs(source) {
   let accessToken;
   try {
-    accessToken = (await getUserToken({ tokenFile: tokenFile(io.env), baseUrl: cached.base_url, clientId: clientId(io.env) })).access_token;
+    accessToken = (await getUserToken(source)).access_token;
   } catch (error) {
-    return { line: `${sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})` };
+    return { line: `unknown (${error instanceof Error ? error.message : String(error)})` };
   }
+  const claims = tokenClaims(accessToken);
+  const scopes = (claims.scopes ?? []).join(" ") || "none";
   try {
-    const info = await fetchUserInfo(cached.base_url, accessToken);
-    return { line: `${info.email} (${info.sub})`, organizations: info.organizations };
+    const info = await fetchUserInfo(source.baseUrl, accessToken);
+    return { line: `${info.email} (${info.sub})`, organizations: info.organizations, scopes };
   } catch (error) {
-    return { line: `${sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})` };
+    return { line: `${claims.sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})`, scopes };
   }
 }
+function describeSignIn(record, nowMs = Date.now()) {
+  const { idle, cap } = loginExpiry(record);
+  if (idle === null) return "refresh token present";
+  const at = (seconds) => new Date(seconds * 1e3).toISOString().replace(/\.\d{3}Z$/, "Z");
+  const left = (seconds) => {
+    const remaining = seconds - nowMs / 1e3;
+    const hours = Math.floor(remaining / 3600);
+    return hours >= 24 ? `${Math.floor(hours / 24)}d ${hours % 24}h` : `${hours}h ${Math.floor(remaining % 3600 / 60)}m`;
+  };
+  if (idle <= nowMs / 1e3) return `sign-in expired at ${at(idle)} (run: diverge login)`;
+  const idleLine = `renews while used; idle until ${at(idle)} (${left(idle)} left)`;
+  if (cap === null || cap <= idle) return cap === null ? idleLine : `ends ${at(idle)} (${left(idle)} left; 30-day limit, run: diverge login then)`;
+  return `${idleLine}; ends at the latest ${at(cap)} (${left(cap)} left)`;
+}
 
 // src/commands/token.ts
-var tokenUsage = "diverge token\n\nPrint a fresh access token and nothing else: the credential helper for Claude Code and Codex.";
-async function runToken(_args, io) {
-  const apiUrl = resolveApiUrl(void 0, io.env);
-  const token = await getUserToken({ tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) });
+import { parseArgs as parseArgs5 } from "node:util";
+var tokenUsage = `diverge token [--organization-id <id>]
+
+Print a fresh access token and nothing else: the credential helper for Claude
+Code, Codex and forge. The token is for the organization named by
+--organization-id or DIVERGENT_ORG_ID, else the login's default.`;
+async function runToken(args, io) {
+  const { values } = parseArgs5({ args, options: { "organization-id": { type: "string" } }, strict: true, allowPositionals: false });
+  const organizationId = values["organization-id"]?.trim() || io.env.DIVERGENT_ORG_ID?.trim() || void 0;
+  const token = await getUserToken(tokenSource(io.env, resolveApiUrl(void 0, io.env)), { organizationId });
   io.stdout(token.access_token);
   return 0;
 }
 
 // src/commands/tools.ts
-import { parseArgs as parseArgs5 } from "node:util";
+import { parseArgs as parseArgs6 } from "node:util";
 
 // src/mcp/bridge.ts
 import readline2 from "node:readline";
@@ -9078,26 +9154,26 @@ var ToolsClient = class {
   serviceToken = null;
   async token() {
     if (this.settings.mode === "operator") {
-      try {
-        return (await getUserToken({ tokenFile: tokenFile(this.env), baseUrl: this.settings.apiUrl, clientId: this.settings.clientId })).access_token;
-      } catch (error) {
-        throw new CliError(`${error instanceof Error ? error.message : String(error)}
-  Sign in with:  ${LOGIN_HINT}`);
-      }
+      return (await getUserToken(tokenSource(this.env, this.settings.apiUrl), { organizationId: this.settings.organizationId })).access_token;
     }
     if (this.serviceToken && Date.now() < this.serviceToken.expiresAtMs) return this.serviceToken.value;
-    const response = await this.fetchImpl(tokenEndpoint(this.settings.apiUrl), {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT },
-      body: JSON.stringify({
-        grant_type: "client_credentials",
-        client_id: this.settings.serviceClientId,
-        client_secret: this.settings.serviceClientSecret,
-        scopes: BRIDGE_SCOPES,
-        organization_id: this.settings.organizationId
-      }),
-      signal: AbortSignal.timeout(3e4)
-    });
+    let response;
+    try {
+      response = await this.fetchImpl(tokenEndpoint(this.settings.apiUrl), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "User-Agent": USER_AGENT },
+        body: JSON.stringify({
+          grant_type: "client_credentials",
+          client_id: this.settings.serviceClientId,
+          client_secret: this.settings.serviceClientSecret,
+          scopes: BRIDGE_SCOPES,
+          organization_id: this.settings.organizationId
+        }),
+        signal: AbortSignal.timeout(3e4)
+      });
+    } catch (error) {
+      throw new CliError(`Cannot reach ${this.settings.apiUrl}: ${error instanceof Error ? error.message : String(error)}`);
+    }
     if (!response.ok) throw new CliError(`Token acquisition failed (${response.status}): ${(await response.text()).slice(0, 400)}`);
     const body = await response.json();
     if (!body.access_token) throw new CliError("Token response contained no access_token");
@@ -9110,10 +9186,10 @@ var ToolsClient = class {
     if (this.settings.mode === "service") headers["x-divergent-user-id"] = this.settings.delegatedUserId;
     return headers;
   }
-  scoped(path13) {
+  scoped(path15) {
     const query = new URLSearchParams({ organizationId: this.settings.organizationId });
     if (this.settings.projectId) query.set("projectId", this.settings.projectId);
-    return `${this.settings.apiUrl}${path13}?${query.toString()}`;
+    return `${this.settings.apiUrl}${path15}?${query.toString()}`;
   }
   async send(method, url, body) {
     return this.request(method, url, body, void 0);
@@ -9125,9 +9201,10 @@ var ToolsClient = class {
    */
   async request(method, url, body, refused) {
     for (let attempt = 1; attempt <= 2; attempt += 1) {
+      const headers = await this.headers();
       let response;
       try {
-        response = await this.fetchImpl(url, { method, headers: await this.headers(), body: body === void 0 ? void 0 : JSON.stringify(body), signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+        response = await this.fetchImpl(url, { method, headers, body: body === void 0 ? void 0 : JSON.stringify(body), signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
       } catch (error) {
         throw new CliError(`Cannot reach ${this.settings.apiUrl}: ${error instanceof Error ? error.message : String(error)}`);
       }
@@ -9159,8 +9236,32 @@ var ToolsClient = class {
     const body = await this.send("GET", this.scoped("/api/plugins/functions/tools"));
     return body.tools ?? [];
   }
-  callTool(name, args) {
-    return this.send("POST", this.scoped("/api/plugins/functions/tools/execute"), { toolName: name, arguments: args ?? {} });
+  /**
+   * One tool, looked up at its source when the catalog does not list it yet —
+   * a tool deployed after its server's catalog was read. A 404 is an answer.
+   */
+  describeTool(name) {
+    return this.request("GET", this.scoped(`/api/plugins/functions/tools/${encodeURIComponent(name)}`), void 0, (status2, text) => {
+      if (status2 !== 404) return void 0;
+      try {
+        const parsed = JSON.parse(text);
+        if (typeof parsed.error === "string" && parsed.error) return { notFound: parsed.error };
+      } catch {
+      }
+      return { notFound: `No tool named '${name}' is available.` };
+    });
+  }
+  /**
+   * One call. The platform answers a completed call with its invocation
+   * envelope, `{status: 'succeeded', invocationId?, result}`; the tool's own
+   * payload is `result` inside it. Every caller wants the payload, so it is
+   * unwrapped here, once — a pending approval passes through as it is.
+   */
+  async callTool(name, args) {
+    const body = await this.send("POST", this.scoped("/api/plugins/functions/tools/execute"), { toolName: name, arguments: args ?? {} });
+    const outcome = body.result;
+    if (outcome?.status !== "succeeded") return body;
+    return { ...body, result: outcome.result };
   }
   /** The read half of raise-and-read (ADR 0047); anyone but the raiser sees a 404. */
   getInvocation(invocationId) {
@@ -9382,7 +9483,7 @@ async function waitForInvocation(id, options, deps) {
 
 // src/tools/call-args.ts
 import fs9 from "node:fs";
-function resolveCallArgs(options, readStdin = () => fs9.readFileSync(0, "utf8")) {
+async function resolveCallArgs(options, stdin = readStdin) {
   if (options.argsJson !== void 0 && options.argsJson !== "{}" && options.argsFile !== void 0) {
     throw new CliError("give the arguments once: --args-json or --args-file");
   }
@@ -9397,7 +9498,7 @@ function resolveCallArgs(options, readStdin = () => fs9.readFileSync(0, "utf8"))
     }
   } else if (options.argsJson === "-") {
     source = "--args-json - (stdin)";
-    text = readStdin();
+    text = await stdin();
   } else {
     source = "--args-json";
     text = options.argsJson ?? "{}";
@@ -9411,6 +9512,11 @@ function resolveCallArgs(options, readStdin = () => fs9.readFileSync(0, "utf8"))
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new CliError(`${source} must be a JSON object`);
   return parsed;
 }
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
 
 // src/tools/batch.ts
 function parseBatch(text) {
@@ -9445,21 +9551,29 @@ async function runOne(entry, deps) {
   if (body.success === false) return { tool: entry.tool, status: "failed", error: body.error || "Tool execution failed" };
   if (!isPending(body.result)) return { tool: entry.tool, status: "executed", result: body.result ?? null };
   const pending = { tool: entry.tool, status: "pending", invocationId: body.result.invocationId, decideAt: deps.decideAt(body.result) };
+  deps.onPending?.(body.result);
   if (!deps.waitFor) return pending;
   const settled = await deps.waitFor(body.result);
-  switch (settled?.status) {
+  return (settled && outcomeOf(entry.tool, pending.invocationId, settled)) ?? pending;
+}
+function outcomeOf(tool, invocationId, invocation) {
+  switch (invocation.status) {
     case "succeeded":
-      return { tool: entry.tool, status: "executed", result: settled.result ?? null, invocationId: pending.invocationId };
+      return { tool, status: "executed", result: invocation.result ?? null, invocationId };
     case "rejected":
-      return { tool: entry.tool, status: "rejected", invocationId: pending.invocationId, error: settled.decisionReason ?? void 0 };
+      return { tool, status: "rejected", invocationId, error: invocation.decisionReason ?? void 0 };
     case "expired":
-      return { tool: entry.tool, status: "expired", invocationId: pending.invocationId };
+      return { tool, status: "expired", invocationId };
     case "failed":
-      return { tool: entry.tool, status: "failed", invocationId: pending.invocationId, error: settled.errorMessage || "execution failed" };
+      return { tool, status: "failed", invocationId, error: invocation.errorMessage || "execution failed" };
     default:
-      return pending;
+      return null;
   }
 }
+function readBackOutcomeOf(tool, invocationId, invocation) {
+  if (PENDING_INVOCATION_STATUSES.includes(invocation.status ?? "")) return { tool, status: "pending", invocationId };
+  return outcomeOf(tool, invocationId, invocation);
+}
 function worstExitCode(outcomes) {
   const has = (status2) => outcomes.some((outcome) => outcome.status === status2);
   if (has("failed")) return ExitCode.Failure;
@@ -9478,6 +9592,10 @@ function matchesCapability(selector, capability) {
   if (selector === capability) return true;
   return selector.endsWith("*") && capability.startsWith(selector.slice(0, -1));
 }
+function matchesFilter(filter, tool) {
+  const needle = filter.toLowerCase();
+  return tool.name.toLowerCase().includes(needle) || (tool.description ?? "").toLowerCase().includes(needle);
+}
 function formatToolList(tools) {
   if (tools.length === 0) return ["No tools available."];
   const nameWidth = Math.max(...tools.map((tool) => tool.name.length));
@@ -9536,38 +9654,29 @@ function formatPending(result, apiUrl, organizationId) {
   lines.push(`Read the outcome later:  diverge tools invocation ${result.invocationId} --organization-id ${organizationId}`);
   return lines;
 }
-function settledOutcome(invocation) {
-  switch (invocation.status) {
-    case "succeeded":
-      return { stdout: JSON.stringify(invocation.result ?? null, null, 2), exitCode: ExitCode.Ok };
-    case "rejected":
-      return { stderr: `Rejected by the operator${invocation.decisionReason ? `: ${invocation.decisionReason}` : "."}`, exitCode: ExitCode.Rejected };
-    case "expired":
-      return { stderr: "Expired before anyone decided. Raise a fresh call; the old id is final.", exitCode: ExitCode.Expired };
-    case "failed":
-      throw new CliError(`Approved, but execution failed: ${invocation.errorMessage || "unknown error"}`);
-    default:
-      throw new CliError(`Unexpected invocation status: ${invocation.status}`);
-  }
-}
 
 // src/commands/tools.ts
 var toolsUsage = `diverge tools <list|capabilities|describe|call|run|invocation|bridge> [--organization-id <id>] [--project-id <id>] ...
 
-  list         [--filter <substring>] [--capability <selector>] [--json]
+  list         [--filter <text>] [--capability <selector>] [--json]
+               --filter matches tool names and descriptions, ignoring case
   capabilities [--json]
   describe <name> [--json]
-  call <name> [--args-json '{...}' | --args-json - | --args-file <path>] [--wait] [--timeout <seconds>]
+  call <name> [--args-json '{...}' | --args-json - | --args-file <path>] [--wait] [--timeout <seconds>] [--json]
                arguments inline, from stdin (-), or from a file: PowerShell strips quotes inside inline JSON
-  run <file>  [--wait] [--timeout <seconds>]
+               --json prints exactly one JSON object on stdout, errors included:
+               {tool, status: executed|pending|rejected|expired|failed, result?, error?, invocationId?, decideAt?}
+  run <file|->  [--wait] [--timeout <seconds>]
                several calls from one file (a JSON array of {tool, args}, or one per line), in order,
                one JSON line of outcome each; exit code is the worst: 1 failed, 4 rejected, 5 expired, 3 pending
   invocation <id> [--wait] [--timeout <seconds>] [--json]
+               --json prints the invocation record; the exit code is call's for the same status
   bridge       [--tools <name,name>]   (stdio MCP server; the allowlist keeps a harness to the tools it was given)
 
 Discover and execute platform tools as yourself. A write that needs a human is
 persisted as a pending invocation, decided in Compass, and read back here by
-id. Exit codes: 0 executed, 3 pending, 4 rejected, 5 expired.`;
+id. Exit codes, the same for call, run and invocation, --json or not:
+0 executed, 1 failed, 3 pending, 4 rejected, 5 expired.`;
 var SCOPE_OPTIONS = { "organization-id": { type: "string" }, "project-id": { type: "string" } };
 async function client(values, io) {
   const settings = loadToolsSettings({ organizationId: values["organization-id"], projectId: values["project-id"] }, io.env);
@@ -9575,14 +9684,72 @@ async function client(values, io) {
   io.stderr(await actingAsLine(settings, io.env));
   return { settings, client: new ToolsClient(settings, io.env) };
 }
-function emit(io, outcome) {
-  if (outcome.stdout !== void 0) io.stdout(outcome.stdout);
-  if (outcome.stderr !== void 0) io.stderr(outcome.stderr);
-  return outcome.exitCode;
-}
 var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var CALL_OPTIONS = { ...SCOPE_OPTIONS, "args-json": { type: "string" }, "args-file": { type: "string" }, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } };
+function timeoutOf(seconds) {
+  const timeoutMs = Number(seconds) * 1e3;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) throw new CliError("--timeout must be a number of seconds");
+  return timeoutMs;
+}
+function waiter(tools, timeoutMs) {
+  return async (pending) => {
+    const invocation = await waitForInvocation(pending.invocationId ?? "", { pollAfterMs: pending.pollAfterMs, timeoutMs }, { getInvocation: (id) => tools.getInvocation(id), sleep: realSleep, now: Date.now });
+    return PENDING_INVOCATION_STATUSES.includes(invocation.status ?? "") ? null : invocation;
+  };
+}
+async function call(rest, io) {
+  const json = rest.includes("--json");
+  let tool = "";
+  let waited = "";
+  let outcome;
+  try {
+    const { values, positionals } = parseArgs6({ args: rest, options: CALL_OPTIONS, strict: true, allowPositionals: true });
+    tool = positionals[0] ?? "";
+    if (!tool) throw new CliError("call needs a tool name");
+    const args = await resolveCallArgs({ argsJson: values["args-json"], argsFile: values["args-file"] });
+    const timeoutMs = timeoutOf(values.timeout);
+    if (values.wait) waited = values.timeout;
+    const { settings, client: tools } = await client(values, io);
+    outcome = await runOne({ tool, args }, {
+      callTool: (name, callArgs) => tools.callTool(name, callArgs),
+      decideAt: (pending) => `${settings.apiUrl}${pending.approvalUrl ?? ""}`,
+      ...json ? {} : { onPending: (pending) => formatPending(pending, settings.apiUrl, settings.organizationId).forEach((line) => io.stdout(line)) },
+      ...values.wait ? { waitFor: waiter(tools, timeoutMs) } : {}
+    });
+  } catch (error) {
+    if (!json) throw error;
+    outcome = { tool, status: "failed", error: error instanceof Error ? error.message : String(error) };
+  }
+  if (json) io.stdout(JSON.stringify(outcome, null, 2));
+  else printOutcome(outcome, waited, io);
+  return worstExitCode([outcome]);
+}
+function printOutcome(outcome, waited, io) {
+  switch (outcome.status) {
+    case "executed":
+      io.stdout(JSON.stringify(outcome.result ?? null, null, 2));
+      return;
+    case "pending":
+      if (waited) io.stderr(`Still waiting on the operator after ${waited}s; the invocation remains open.`);
+      return;
+    case "rejected":
+      io.stderr(`Rejected by the operator${outcome.error ? `: ${outcome.error}` : "."}`);
+      return;
+    case "expired":
+      io.stderr("Expired before anyone decided. Raise a fresh call; the old id is final.");
+      return;
+    case "failed":
+      throw new CliError(outcome.invocationId ? `Approved, but execution failed: ${outcome.error}` : outcome.error || "Tool execution failed");
+  }
+}
 function toolsVerbUsage(verb) {
-  const lines = toolsUsage.split("\n").filter((line) => line.trimStart().startsWith(`${verb} `));
+  const lines = [];
+  let inVerb = false;
+  for (const line of toolsUsage.split("\n")) {
+    if (/^ {2}\S/.test(line)) inVerb = line.trimStart().startsWith(`${verb} `);
+    else if (!/^ {3,}\S/.test(line)) inVerb = false;
+    if (inVerb) lines.push(line);
+  }
   return lines.length ? `diverge tools ${verb} ...
 
 ${lines.join("\n")}
@@ -9597,17 +9764,17 @@ async function runTools(args, io) {
   }
   switch (verb) {
     case "list": {
-      const { values } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, filter: { type: "string" }, capability: { type: "string" }, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, filter: { type: "string" }, capability: { type: "string" }, json: { type: "boolean", default: false } }, strict: true });
       const { client: tools } = await client(values, io);
       let list = await tools.listTools();
-      if (values.filter) list = list.filter((tool) => tool.name.includes(values.filter));
+      if (values.filter) list = list.filter((tool) => matchesFilter(values.filter, tool));
       if (values.capability) list = list.filter((tool) => matchesCapability(values.capability, tool.capability));
       if (values.json) io.stdout(JSON.stringify(list, null, 2));
       else for (const line of formatToolList(list)) io.stdout(line);
       return ExitCode.Ok;
     }
     case "capabilities": {
-      const { values } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true });
       const { client: tools } = await client(values, io);
       const list = await tools.listTools();
       if (values.json) io.stdout(JSON.stringify(capabilityClusters(list), null, 2));
@@ -9615,89 +9782,63 @@ async function runTools(args, io) {
       return ExitCode.Ok;
     }
     case "describe": {
-      const { values, positionals } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
       const name = positionals[0];
       if (!name) throw new CliError("describe needs a tool name");
       const { settings, client: tools } = await client(values, io);
-      const list = await tools.listTools();
-      const tool = list.find((entry) => entry.name === name);
-      if (!tool) {
-        const close = list.filter((entry) => entry.name.includes(name)).map((entry) => entry.name).slice(0, 5);
-        throw new CliError(`No tool named '${name}' is available.${close.length ? ` Did you mean: ${close.join(", ")}?` : ""}`);
+      const described = await tools.describeTool(name);
+      if ("notFound" in described) {
+        const close = (await tools.listTools()).filter((entry) => entry.name.includes(name)).map((entry) => entry.name).slice(0, 5);
+        throw new CliError(`${described.notFound}${close.length ? `
+  Did you mean: ${close.join(", ")}?` : ""}`);
       }
+      const { tool } = described;
       if (values.json) io.stdout(JSON.stringify(tool, null, 2));
       else for (const line of formatDescribe(tool, settings.organizationId)) io.stdout(line);
       return ExitCode.Ok;
     }
-    case "call": {
-      const { values, positionals } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, "args-json": { type: "string" }, "args-file": { type: "string" }, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
-      const name = positionals[0];
-      if (!name) throw new CliError("call needs a tool name");
-      const parsedArgs = resolveCallArgs({ argsJson: values["args-json"], argsFile: values["args-file"] });
-      const timeoutMs = Number(values.timeout) * 1e3;
-      if (!Number.isFinite(timeoutMs) || timeoutMs < 0) throw new CliError("--timeout must be a number of seconds");
-      const { settings, client: tools } = await client(values, io);
-      const body = await tools.callTool(name, parsedArgs);
-      if (body.success === false) throw new CliError(body.error || "Tool execution failed");
-      if (!isPending(body.result)) {
-        io.stdout(JSON.stringify(body.result ?? null, null, 2));
-        return ExitCode.Ok;
-      }
-      for (const line of formatPending(body.result, settings.apiUrl, settings.organizationId)) io.stdout(line);
-      if (!values.wait) return ExitCode.Pending;
-      const invocation = await waitForInvocation(body.result.invocationId ?? "", { pollAfterMs: body.result.pollAfterMs, timeoutMs }, { getInvocation: (id) => tools.getInvocation(id), sleep: realSleep, now: Date.now });
-      if (PENDING_INVOCATION_STATUSES.includes(invocation.status ?? "")) {
-        io.stderr(`Still ${invocation.status} after ${values.timeout}s; the invocation remains open.`);
-        return ExitCode.Pending;
-      }
-      return emit(io, settledOutcome(invocation));
-    }
+    case "call":
+      return call(rest, io);
     case "run": {
-      const { values, positionals } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
       const file = positionals[0];
-      if (!file) throw new CliError("run needs a file of calls");
+      if (!file) throw new CliError("run needs a file of calls, or - for stdin");
       let entries;
       try {
-        entries = parseBatch(fs10.readFileSync(file, "utf8"));
+        entries = parseBatch(file === "-" ? await readStdin() : fs10.readFileSync(file, "utf8"));
       } catch (error) {
         throw new CliError(`${file}: ${error instanceof Error ? error.message : String(error)}`);
       }
-      const timeoutMs = Number(values.timeout) * 1e3;
-      if (!Number.isFinite(timeoutMs) || timeoutMs < 0) throw new CliError("--timeout must be a number of seconds");
+      const timeoutMs = timeoutOf(values.timeout);
       const { settings, client: tools } = await client(values, io);
       const { exitCode } = await runBatch(entries, {
         callTool: (tool, args2) => tools.callTool(tool, args2),
         decideAt: (pending) => `${settings.apiUrl}${pending.approvalUrl ?? ""}`,
         onOutcome: (outcome) => io.stdout(JSON.stringify(outcome)),
-        ...values.wait ? {
-          waitFor: async (pending) => {
-            const invocation = await waitForInvocation(pending.invocationId ?? "", { pollAfterMs: pending.pollAfterMs, timeoutMs }, { getInvocation: (id) => tools.getInvocation(id), sleep: realSleep, now: Date.now });
-            return PENDING_INVOCATION_STATUSES.includes(invocation.status ?? "") ? null : invocation;
-          }
-        } : {}
+        ...values.wait ? { waitFor: waiter(tools, timeoutMs) } : {}
       });
       return exitCode;
     }
     case "invocation": {
-      const { values, positionals } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
       const id = positionals[0];
       if (!id) throw new CliError("invocation needs an id");
       const { client: tools } = await client(values, io);
       let invocation;
       if (values.wait) invocation = await waitForInvocation(id, { timeoutMs: Number(values.timeout) * 1e3 }, { getInvocation: (target) => tools.getInvocation(target), sleep: realSleep, now: Date.now });
       else invocation = (await tools.getInvocation(id)).invocation ?? {};
+      const outcome = readBackOutcomeOf(invocation.toolName ?? "", id, invocation);
       if (values.json) {
         io.stdout(JSON.stringify(invocation, null, 2));
-        return ExitCode.Ok;
-      }
-      if (PENDING_INVOCATION_STATUSES.includes(invocation.status ?? "")) {
-        io.stdout(`${invocation.status}: waiting on the operator (expires ${invocation.expiresAt}).`);
-        return ExitCode.Pending;
+        return outcome ? worstExitCode([outcome]) : ExitCode.Failure;
       }
-      return emit(io, settledOutcome(invocation));
+      if (!outcome) throw new CliError(`Unexpected invocation status: ${invocation.status}`);
+      if (outcome.status === "pending") io.stdout(`${invocation.status}: waiting on the operator (expires ${invocation.expiresAt}).`);
+      else printOutcome(outcome, "", io);
+      return worstExitCode([outcome]);
     }
     case "bridge": {
-      const { values } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS, tools: { type: "string" } }, strict: true });
+      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS, tools: { type: "string" } }, strict: true });
       const { client: tools } = await client(values, io);
       const allow = (values.tools ?? "").split(",").map((name) => name.trim()).filter(Boolean);
       return serveBridge(new BridgeServer(tools, { tools: allow }), process.stdin, process.stdout);
@@ -9711,7 +9852,7 @@ ${toolsUsage}`);
 
 // src/commands/plugins.ts
 import fs11 from "node:fs";
-import { parseArgs as parseArgs6 } from "node:util";
+import { parseArgs as parseArgs7 } from "node:util";
 var pluginsUsage = `diverge plugins <validate|publish|list|retire> [--organization-id <id>] ...
 
   validate <manifest.json>            (dry run: the platform's full validation, nothing stored)
@@ -9755,7 +9896,8 @@ function formatPlugin(plugin) {
   return [
     `${plugin.pluginId}@${plugin.version}  ${plugin.name}  (${parent}; runtime ${plugin.runtimeType}; digest ${plugin.digest.slice(0, 12)})`,
     `  tools: ${plugin.toolNames.length ? plugin.toolNames.join(", ") : "none"}`,
-    ...plugin.resourceNames.length ? [`  resources: ${plugin.resourceNames.join(", ")}`] : []
+    ...plugin.resourceNames.length ? [`  resources: ${plugin.resourceNames.join(", ")}`] : [],
+    ...plugin.refusals?.length ? ["  NOT SERVED: the platform refuses this version; publish a fixed one:", ...plugin.refusals.map((reason) => `    - ${reason}`)] : []
   ];
 }
 function pluginsVerbUsage(verb) {
@@ -9774,7 +9916,7 @@ async function runPlugins(args, io) {
   }
   switch (verb) {
     case "validate": {
-      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const manifest = readManifest(positionals[0]);
       const tools = await client2(values, io);
       const outcome = await tools.publishPlugin(manifest, { dryRun: true });
@@ -9791,7 +9933,7 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "publish": {
-      const { values, positionals } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const manifest = readManifest(positionals[0]);
       const tools = await client2(values, io);
       const outcome = await tools.publishPlugin(manifest, { dryRun: false });
@@ -9809,7 +9951,7 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "list": {
-      const { values } = parseArgs6({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs7({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
       const tools = await client2(values, io);
       const plugins = await tools.listPlugins();
       if (values.json) io.stdout(JSON.stringify(plugins, null, 2));
@@ -9818,7 +9960,7 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "retire": {
-      const { values, positionals } = parseArgs6({ args: rest, options: SCOPE_OPTIONS2, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs7({ args: rest, options: SCOPE_OPTIONS2, allowPositionals: true, strict: true });
       const pluginId = positionals[0];
       if (!pluginId) throw new CliError(`A plugin id is required.
 
@@ -9841,11 +9983,11 @@ import { spawn as spawn4 } from "node:child_process";
 // src/update-notice.ts
 import { spawn as spawn3 } from "node:child_process";
 import fs12 from "node:fs";
-import path12 from "node:path";
+import path14 from "node:path";
 var UPDATE_CHECK_FILE = "update-check.json";
 var UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function updateCheckFile(env) {
-  return path12.join(configDir(env), UPDATE_CHECK_FILE);
+  return path14.join(configDir(env), UPDATE_CHECK_FILE);
 }
 function readUpdateCheck(env) {
   try {
@@ -9965,7 +10107,7 @@ function usage() {
     ...lines,
     "",
     "Run `diverge <command> --help` for its options.",
-    "Environment: DIVERGENT_API_URL (deployment), DIVERGE_HOME (state directory, default ~/.diverge), DIVERGENT_ORG_ID and DIVERGENT_PROJECT_ID (tool scope)."
+    "Environment: DIVERGENT_API_URL (deployment; production when unset), DIVERGE_HOME (state directory, default ~/.diverge), DIVERGENT_ORG_ID and DIVERGENT_PROJECT_ID (the organization and project a command acts in)."
   ].join("\n");
 }
 async function run2(argv, io) {