@divergeai/cli 0.1.2 → 0.1.4

package/README.md

@@ -5,7 +5,7 @@ model gateway, and call platform tools as yourself.
 
 ```bash
 npm install -g @divergeai/cli
-diverge login                        # opens the browser; choose your organization
+diverge login                        # browser sign-in; the organization is chosen afterwards in the CLI
 diverge agents setup claude          # Claude Code on the gateway
 diverge agents run dsh -- --profile web --port 3131 --no-open
 diverge tools list --organization-id <id>
@@ -16,8 +16,11 @@ Node 22 or later. Linux and macOS are supported; Windows is best-effort.
 ## Sign in
 
 `diverge login` runs the browser sign-in (authorization code with PKCE on a
-loopback listener). A login serves exactly one organization: without
-`--organization-id` the platform asks you to choose. The login is cached in
+loopback listener). The browser only authenticates you; the organization is
+chosen afterwards in the CLI, never through the browser: `--organization-id
+<id|name>` if given, else the last login's, else your only membership, else a
+menu. The login is bound to that organization on the platform, and `diverge
+org use <id|name>` switches without a browser. The login is cached in
 `~/.diverge/token.json` (mode 0600), refreshes itself, and `diverge logout`
 revokes it on the platform before forgetting it.
 

package/dist/diverge.mjs

@@ -7387,7 +7387,7 @@ import path10 from "node:path";
 import { parseArgs } from "node:util";
 
 // src/version.ts
-var VERSION = true ? "0.1.2" : "dev";
+var VERSION = true ? "0.1.4" : "dev";
 var USER_AGENT = `diverge/${VERSION}`;
 
 // src/http.ts
@@ -7436,11 +7436,23 @@ async function fetchJson(url, init = {}) {
 
 // src/auth/browser.ts
 import { spawn } from "node:child_process";
-function openBrowser(url, env = process.env, platform = process.platform) {
+function openerCommand(url, env = process.env, platform = process.platform) {
   const custom = env.BROWSER?.trim();
-  const [command, args] = custom ? [custom, [url]] : platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  if (custom) return { command: custom, args: [url] };
+  if (platform === "darwin") return { command: "open", args: [url] };
+  if (platform === "win32") {
+    return { command: "cmd", args: ["/c", "start", '""', `"${url.replace(/&/g, "^&")}"`], windowsVerbatimArguments: true };
+  }
+  return { command: "xdg-open", args: [url] };
+}
+function openBrowser(url, env = process.env, platform = process.platform) {
+  const opener = openerCommand(url, env, platform);
   try {
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    const child = spawn(opener.command, opener.args, {
+      detached: true,
+      stdio: "ignore",
+      ...opener.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}
+    });
     child.on("error", () => {
     });
     child.unref();
@@ -7686,15 +7698,25 @@ async function login(options, deps = defaultDeps) {
     await loopback.close();
   }
 }
-async function refreshUserToken(baseUrl, clientId2, token, nowMs = Date.now()) {
+async function refreshUserToken(baseUrl, clientId2, token, nowMs = Date.now(), organizationId) {
   if (!token.refresh_token) throw new CliError("Cached login expired. Run: diverge login");
   const payload = await postToken(baseUrl, {
     grant_type: "refresh_token",
     refresh_token: token.refresh_token,
-    client_id: clientId2
+    client_id: clientId2,
+    ...organizationId ? { organization_id: organizationId } : {}
   });
   return cachedFrom(payload, token.base_url, token.refresh_token, nowMs);
 }
+async function bindOrganization(source, organizationId, nowMs = Date.now()) {
+  const token = loadUserToken(source.tokenFile);
+  if (!token || token.base_url !== source.baseUrl.replace(/\/+$/, "")) {
+    throw new CliError("No cached login for this deployment. Run: diverge login");
+  }
+  const bound = await refreshUserToken(source.baseUrl, source.clientId, token, nowMs, organizationId);
+  saveUserToken(source.tokenFile, bound);
+  return bound;
+}
 async function getUserToken(source, freshForSeconds = 30, nowMs = Date.now()) {
   const token = loadUserToken(source.tokenFile);
   if (!token || token.base_url !== source.baseUrl.replace(/\/+$/, "")) {
@@ -8344,6 +8366,38 @@ ${agentsUsage}`);
 // src/commands/login.ts
 import { parseArgs as parseArgs2 } from "node:util";
 
+// src/auth/organizations.ts
+function chooseOrganization(input) {
+  const memberships = input.memberships;
+  const flag = input.flag?.trim();
+  if (flag) {
+    const match = memberships.find((organization) => organization.id === flag || organization.name.toLowerCase() === flag.toLowerCase());
+    if (match) return { kind: "chosen", organizationId: match.id, name: match.name, reason: "flag" };
+    if (input.platformActor) return { kind: "chosen", organizationId: flag, reason: "flag" };
+    throw new CliError(`Not one of your organizations: ${flag}. Yours: ${memberships.map((organization) => `${organization.name} (${organization.id})`).join(", ") || "none"}`);
+  }
+  const remembered = input.remembered?.trim();
+  if (remembered) {
+    const match = memberships.find((organization) => organization.id === remembered);
+    if (match) return { kind: "chosen", organizationId: match.id, name: match.name, reason: "remembered" };
+    if (input.platformActor) return { kind: "chosen", organizationId: remembered, reason: "remembered" };
+  }
+  if (memberships.length === 1) return { kind: "chosen", organizationId: memberships[0].id, name: memberships[0].name, reason: "only" };
+  if (memberships.length === 0) return { kind: "none" };
+  return { kind: "ask", options: memberships };
+}
+function organizationMenu(options) {
+  return options.map((organization, index) => `  ${index + 1}. ${organization.name} (${organization.id})`);
+}
+function pickFromMenu(answer, options) {
+  const trimmed = answer.trim();
+  const index = Number(trimmed);
+  if (Number.isInteger(index) && index >= 1 && index <= options.length) return options[index - 1];
+  const match = options.find((organization) => organization.id === trimmed || organization.name.toLowerCase() === trimmed.toLowerCase());
+  if (!match) throw new CliError(`Not one of the listed organizations: ${trimmed}`);
+  return match;
+}
+
 // src/auth/userinfo.ts
 async function fetchUserInfo(baseUrl, accessToken) {
   return fetchJson(userinfoEndpoint(baseUrl), { headers: { Authorization: `Bearer ${accessToken}` }, timeoutMs: 15e3 });
@@ -8357,12 +8411,25 @@ async function describeAccount(baseUrl, accessToken, fallbackSub, options = {})
   }
 }
 
+// src/prompt.ts
+import readline from "node:readline";
+function ask(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  return new Promise((resolve) => rl.question(question, (answer) => {
+    rl.close();
+    resolve(answer);
+  }));
+}
+
 // src/commands/login.ts
 var DEFAULT_SCOPES = "mcp:read mcp:execute inference:execute";
-var loginUsage = `diverge login [--organization-id <id>] [--scopes "<scopes>"] [--as <email>] [--no-browser] [--api-url <url>]
+var loginUsage = `diverge login [--organization-id <id|name>] [--scopes "<scopes>"] [--as <email>] [--no-browser] [--api-url <url>]
 
-Sign in through the browser. Without --organization-id the platform asks you to
-choose one; a login serves exactly one organization. --api-url is remembered.
+Sign in through the browser, then choose where to act. The browser only
+authenticates the person; the organization is chosen here afterwards \u2014 the
+one named by --organization-id (id or name), else the last login's, else the
+only membership, else a menu \u2014 and the login is bound to it on the platform.
+Switch later with: diverge org use <id|name>.
 --as <email> names the account: the platform signs that account in instead of
 reusing whatever session the browser holds, and issues nothing to any other.
 Without --as, the account of the last login is used; switching is explicit.
@@ -8404,29 +8471,90 @@ async function runLogin(args, io) {
     baseUrl: apiUrl,
     clientId: clientId(io.env),
     scopes,
-    organizationId: values["organization-id"],
-    selectOrganization: !values["organization-id"],
     openBrowser: !values["no-browser"],
     tokenFile: tokenFile(io.env),
     loginHint,
     print: io.stdout
   });
   const claims = tokenClaims(token.access_token);
-  const remaining = Math.max(0, Math.round(token.expires_at - Date.now() / 1e3));
-  io.stdout(`Logged in to ${apiUrl} for organization ${claims.organizationId ?? "none"}; token cached (${remaining}s to expiry, auto-refreshes).`);
-  let account;
+  let info;
   try {
-    account = (await fetchUserInfo(apiUrl, token.access_token)).email ?? void 0;
+    info = await fetchUserInfo(apiUrl, token.access_token);
   } catch (error) {
-    io.stderr(`Signed in as: ${claims.sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})`);
+    throw new CliError(`Signed in, but the platform could not say who or where (${error instanceof Error ? error.message : String(error)}); run: diverge login`);
   }
-  if (account) io.stdout(`Signed in as: ${account}`);
-  writeConfig({ ...readConfig(io.env), ...account ? { account } : {}, scopes }, io.env);
+  io.stdout(`Signed in as: ${info.email}`);
+  const bound = await bindChosenOrganization(io, apiUrl, values["organization-id"], config.organization, info);
+  const remaining = Math.max(0, Math.round(bound.token.expires_at - Date.now() / 1e3));
+  io.stdout(`Logged in to ${apiUrl}; token cached (${remaining}s to expiry, auto-refreshes).`);
+  writeConfig({ ...readConfig(io.env), account: info.email, scopes, organization: bound.organizationId }, io.env);
   const granted = new Set(claims.scopes ?? []);
   const missing = scopes.split(" ").filter((scope) => scope && !granted.has(scope));
   if (missing.length) io.stderr(`Not granted at this organization (your roles lack them): ${missing.join(" ")}`);
   return 0;
 }
+async function bindChosenOrganization(io, apiUrl, flag, remembered, info) {
+  const memberships = info.organizations ?? [];
+  let choice = chooseOrganization({ flag, remembered, memberships, platformActor: info.platformActor });
+  if (choice.kind === "none") {
+    throw new CliError("You are not a member of any organization; ask an administrator to add you, then sign in again.");
+  }
+  if (choice.kind === "ask") {
+    if (!io.interactive) {
+      throw new CliError(`You belong to several organizations; pass --organization-id <id|name>:
+${organizationMenu(choice.options).join("\n")}`);
+    }
+    io.stdout("Choose the organization to act in:");
+    for (const line of organizationMenu(choice.options)) io.stdout(line);
+    const picked = pickFromMenu(await ask("Organization (number, id or name): "), choice.options);
+    choice = { kind: "chosen", organizationId: picked.id, name: picked.name, reason: "flag" };
+  }
+  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
+  const token = await bindOrganization(source, choice.organizationId);
+  const label = choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId;
+  const why = choice.reason === "remembered" ? " (the last login; pass --organization-id to switch)" : choice.reason === "only" ? " (your only organization)" : "";
+  io.stdout(`Organization: ${label}${why}`);
+  return { organizationId: choice.organizationId, token };
+}
+
+// src/commands/org.ts
+import { parseArgs as parseArgs3 } from "node:util";
+var orgUsage = `diverge org [use <id|name>]
+
+Without a verb: the organizations you may act in, the bound one marked.
+use <id|name>: bind the login to that organization on the platform, without a
+browser; every later command acts there. A platform actor may name an
+organization they are not a member of.`;
+async function runOrg(args, io) {
+  const { positionals } = parseArgs3({ args, options: {}, strict: true, allowPositionals: true });
+  const apiUrl = resolveApiUrl(void 0, io.env);
+  const source = { tokenFile: tokenFile(io.env), baseUrl: apiUrl, clientId: clientId(io.env) };
+  const token = await getUserToken(source);
+  const info = await fetchUserInfo(apiUrl, token.access_token);
+  const memberships = info.organizations ?? [];
+  const current = tokenClaims(token.access_token).organizationId ?? void 0;
+  const verb = positionals[0];
+  if (!verb) {
+    if (memberships.length === 0 && !current) {
+      io.stdout("You are not a member of any organization.");
+      return 0;
+    }
+    for (const organization of memberships) io.stdout(`${organization.id === current ? "*" : " "} ${organization.name} (${organization.id})`);
+    if (current && !memberships.some((organization) => organization.id === current)) io.stdout(`* ${current} (not a membership; acting as the platform)`);
+    return 0;
+  }
+  if (verb !== "use") throw new CliError(`Unknown verb: ${verb}
+
+${orgUsage}`);
+  const target = positionals[1];
+  if (!target) throw new CliError("org use needs an organization id or name");
+  const choice = chooseOrganization({ flag: target, memberships, platformActor: info.platformActor });
+  if (choice.kind !== "chosen") throw new CliError("org use needs an organization id or name");
+  const bound = await bindOrganization(source, choice.organizationId);
+  writeConfig({ ...readConfig(io.env), organization: choice.organizationId }, io.env);
+  io.stdout(`Organization: ${choice.name ? `${choice.name} (${choice.organizationId})` : choice.organizationId}; scopes ${(tokenClaims(bound.access_token).scopes ?? []).join(" ") || "none"}`);
+  return 0;
+}
 
 // src/commands/logout.ts
 var logoutUsage = "diverge logout\n\nRevoke the login's session on the platform and forget it locally.";
@@ -8524,8 +8652,10 @@ async function runStatus(_args, io) {
   const remaining = Math.round(token.expires_at - Date.now() / 1e3);
   const mismatch = token.base_url !== apiUrl ? ` (for ${token.base_url}, not the configured deployment)` : "";
   io.stdout(`Login: ${isFresh(token, 0) ? `valid for ${remaining}s` : "expired (auto-refreshes)"}; refresh token ${token.refresh_token ? "present" : "absent"}${mismatch}`);
-  io.stdout(`Signed in as: ${await signedInAs(token, io)}`);
-  io.stdout(`Organization: ${claims.organizationId ?? "none (sign in again to choose one)"}`);
+  const account = await signedInAs(token, io);
+  io.stdout(`Signed in as: ${account.line}`);
+  const organization = account.organizations?.find((candidate) => candidate.id === claims.organizationId);
+  io.stdout(`Organization: ${claims.organizationId ? `${organization ? `${organization.name} (${claims.organizationId})` : claims.organizationId}` : "none (run: diverge org use <id|name>)"}`);
   io.stdout(`Scopes: ${(claims.scopes ?? []).join(" ") || "none"}`);
   io.stdout(describeToolExecution(io.env));
   return 0;
@@ -8536,9 +8666,14 @@ async function signedInAs(cached, io) {
   try {
     accessToken = (await getUserToken({ tokenFile: tokenFile(io.env), baseUrl: cached.base_url, clientId: clientId(io.env) })).access_token;
   } catch (error) {
-    return `${sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})`;
+    return { line: `${sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})` };
+  }
+  try {
+    const info = await fetchUserInfo(cached.base_url, accessToken);
+    return { line: `${info.email} (${info.sub})`, organizations: info.organizations };
+  } catch (error) {
+    return { line: `${sub ?? "unknown user"} (email unavailable: ${error instanceof Error ? error.message : String(error)})` };
   }
-  return describeAccount(cached.base_url, accessToken, sub, { withSub: true });
 }
 
 // src/commands/token.ts
@@ -8551,10 +8686,10 @@ async function runToken(_args, io) {
 }
 
 // src/commands/tools.ts
-import { parseArgs as parseArgs3 } from "node:util";
+import { parseArgs as parseArgs4 } from "node:util";
 
 // src/mcp/bridge.ts
-import readline from "node:readline";
+import readline2 from "node:readline";
 
 // src/tools/client.ts
 var PENDING_INVOCATION_STATUSES = ["pending", "approved", "executing"];
@@ -8831,7 +8966,7 @@ var BridgeServer = class {
   }
 };
 async function serveBridge(server, input, output) {
-  const lines = readline.createInterface({ input, crlfDelay: Infinity });
+  const lines = readline2.createInterface({ input, crlfDelay: Infinity });
   for await (const raw of lines) {
     const line = raw.trim();
     if (!line) continue;
@@ -8998,7 +9133,7 @@ async function runTools(args, io) {
   }
   switch (verb) {
     case "list": {
-      const { values } = parseArgs3({ args: rest, options: { ...SCOPE_OPTIONS, filter: { type: "string" }, capability: { type: "string" }, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS, filter: { type: "string" }, capability: { type: "string" }, json: { type: "boolean", default: false } }, strict: true });
       const { client: tools } = await client(values, io);
       let list = await tools.listTools();
       if (values.filter) list = list.filter((tool) => tool.name.includes(values.filter));
@@ -9008,7 +9143,7 @@ async function runTools(args, io) {
       return ExitCode.Ok;
     }
     case "capabilities": {
-      const { values } = parseArgs3({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true });
       const { client: tools } = await client(values, io);
       const list = await tools.listTools();
       if (values.json) io.stdout(JSON.stringify(capabilityClusters(list), null, 2));
@@ -9016,7 +9151,7 @@ async function runTools(args, io) {
       return ExitCode.Ok;
     }
     case "describe": {
-      const { values, positionals } = parseArgs3({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
       const name = positionals[0];
       if (!name) throw new CliError("describe needs a tool name");
       const { settings, client: tools } = await client(values, io);
@@ -9031,7 +9166,7 @@ async function runTools(args, io) {
       return ExitCode.Ok;
     }
     case "call": {
-      const { values, positionals } = parseArgs3({ args: rest, options: { ...SCOPE_OPTIONS, "args-json": { type: "string", default: "{}" }, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS, "args-json": { type: "string", default: "{}" }, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" } }, strict: true, allowPositionals: true });
       const name = positionals[0];
       if (!name) throw new CliError("call needs a tool name");
       let parsedArgs;
@@ -9060,7 +9195,7 @@ async function runTools(args, io) {
       return emit(io, settledOutcome(invocation));
     }
     case "invocation": {
-      const { values, positionals } = parseArgs3({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
+      const { values, positionals } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS, wait: { type: "boolean", default: false }, timeout: { type: "string", default: "600" }, json: { type: "boolean", default: false } }, strict: true, allowPositionals: true });
       const id = positionals[0];
       if (!id) throw new CliError("invocation needs an id");
       const { client: tools } = await client(values, io);
@@ -9078,7 +9213,7 @@ async function runTools(args, io) {
       return emit(io, settledOutcome(invocation));
     }
     case "bridge": {
-      const { values } = parseArgs3({ args: rest, options: { ...SCOPE_OPTIONS, tools: { type: "string" } }, strict: true });
+      const { values } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS, tools: { type: "string" } }, strict: true });
       const { client: tools } = await client(values, io);
       const allow = (values.tools ?? "").split(",").map((name) => name.trim()).filter(Boolean);
       return serveBridge(new BridgeServer(tools, { tools: allow }), process.stdin, process.stdout);
@@ -9092,7 +9227,7 @@ ${toolsUsage}`);
 
 // src/commands/plugins.ts
 import fs7 from "node:fs";
-import { parseArgs as parseArgs4 } from "node:util";
+import { parseArgs as parseArgs5 } from "node:util";
 var pluginsUsage = `diverge plugins <validate|publish|list|retire> [--organization-id <id>] ...
 
   validate <manifest.json>            (dry run: the platform's full validation, nothing stored)
@@ -9155,7 +9290,7 @@ async function runPlugins(args, io) {
   }
   switch (verb) {
     case "validate": {
-      const { values, positionals } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const manifest = readManifest(positionals[0]);
       const tools = await client2(values, io);
       const outcome = await tools.publishPlugin(manifest, { dryRun: true });
@@ -9172,7 +9307,7 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "publish": {
-      const { values, positionals } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, allowPositionals: true, strict: true });
       const manifest = readManifest(positionals[0]);
       const tools = await client2(values, io);
       const outcome = await tools.publishPlugin(manifest, { dryRun: false });
@@ -9190,7 +9325,7 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "list": {
-      const { values } = parseArgs4({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
+      const { values } = parseArgs5({ args: rest, options: { ...SCOPE_OPTIONS2, json: { type: "boolean", default: false } }, strict: true });
       const tools = await client2(values, io);
       const plugins = await tools.listPlugins();
       if (values.json) io.stdout(JSON.stringify(plugins, null, 2));
@@ -9199,7 +9334,7 @@ async function runPlugins(args, io) {
       return ExitCode.Ok;
     }
     case "retire": {
-      const { values, positionals } = parseArgs4({ args: rest, options: SCOPE_OPTIONS2, allowPositionals: true, strict: true });
+      const { values, positionals } = parseArgs5({ args: rest, options: SCOPE_OPTIONS2, allowPositionals: true, strict: true });
       const pluginId = positionals[0];
       if (!pluginId) throw new CliError(`A plugin id is required.
 
@@ -9269,6 +9404,7 @@ var COMMANDS = [
   { name: "login", summary: "Sign in through the browser", usage: loginUsage, run: runLogin },
   { name: "logout", summary: "Revoke the login and forget it", usage: logoutUsage, run: runLogout },
   { name: "status", summary: "Show the deployment and the cached login", usage: statusUsage, run: runStatus },
+  { name: "org", summary: "Show or switch the organization the login acts in", usage: orgUsage, run: runOrg },
   { name: "token", summary: "Print a fresh access token", usage: tokenUsage, run: runToken },
   { name: "agents", summary: "Point a coding agent at the model gateway (setup, run, status)", usage: agentsUsage, run: runAgents },
   { name: "tools", summary: "Discover and execute platform tools; raise and read approvals", usage: toolsUsage, run: runTools },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@divergeai/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Divergent platform CLI: sign in, wire coding agents to the inference gateway, call platform tools",
   "license": "UNLICENSED",
   "type": "module",