@levr-one/cli 0.11.7 → 0.11.9

package/dist/{addHandler-BqLLDeKp.js → addHandler-B_3UmMbj.js}

@@ -4,12 +4,13 @@ import "./token-refresh-DeusLK8H.js";
 import { resolveToken } from "./resolve-token-7xb7kG7h.js";
 import "./workspace-store-CnrxyYRB.js";
 import { fetchSites } from "./resolve-workspace-CStHisUb.js";
+import { describeWorkspaces, findWorkspaceByKeyOrName, isScopedMcpUrl, resolveMcpUrl, scopedMcpUrl, servedBySessionApi } from "./find-workspace-T4xuXwtS.js";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
-import { execFileSync } from "node:child_process";
 import { applyEdits, modify, parse, printParseErrorCode } from "jsonc-parser";
 import { TomlError, parse as parse$1 } from "smol-toml";
+import { execFileSync } from "node:child_process";
 
 //#region ../mcp-harnesses/dist/format/toml-render.js
 /**
@@ -2104,140 +2105,6 @@ function writeConfigAtomic(path$1, text) {
 	}
 }
 
-//#endregion
-//#region src/mcp/url.ts
-const KNOWN_MCP_URLS = {
-	"api.levr.one": "https://ai.levr.one/api/v1/mcp",
-	"api.levr.now": "https://ai.levr.now/api/v1/mcp"
-};
-/**
-* Resolve the MCP server URL: `--url` flag > `LEVR_MCP_URL` env > derived
-* from the resolved API URL (which itself honors `LEVR_URL` > the URL stored
-* at login > production default, ENG-2361). Known Levr hosts map to their
-* app-host MCP resource; anything else (localhost dev stacks, custom
-* deployments) derives `<api-url>/v1/mcp`.
-*/
-function resolveMcpUrl(flagUrl) {
-	const resolved = resolveRaw(flagUrl);
-	assertUsableMcpUrl(resolved.url, resolved.source);
-	return resolved;
-}
-function resolveRaw(flagUrl) {
-	if (flagUrl) return {
-		url: stripSlash(flagUrl),
-		source: "flag"
-	};
-	const envVar = process.env["LEVR_MCP_URL"];
-	if (envVar) return {
-		url: stripSlash(envVar),
-		source: "env:LEVR_MCP_URL"
-	};
-	const apiUrl = getApiUrl();
-	return {
-		url: knownMcpUrl(apiUrl) ?? `${apiUrl}/v1/mcp`,
-		source: `derived:${apiUrl}`
-	};
-}
-/** Name the input the user has to change, not our internal source tag. */
-function sourceLabel(source) {
-	if (source === "flag") return "--url";
-	if (source === "env:LEVR_MCP_URL") return "LEVR_MCP_URL";
-	return `the API URL (${source.slice(8)})`;
-}
-/**
-* Reject a URL that must not reach a client config or a spawned CLI (ENG-4159).
-*
-* Three things this stops:
-*
-* 1. **No scheme.** `claude mcp add --transport http --scope user levr <value>`
-*    is spawned with fixed argv since ENG-4156, so a value like `--foo` is read
-*    by that CLI as a FLAG rather than as its URL operand — argument injection.
-*    Requiring a parseable absolute URL removes the shape entirely.
-* 2. **A non-http(s) scheme.** `file:` / `javascript:` is never a valid MCP
-*    endpoint, but would be written verbatim into every client's config.
-* 3. **Embedded credentials.** `https://user:pass@host` would be written into
-*    a config file — and since ENG-4151 a config file can be `--scope project`,
-*    which the user is told to COMMIT. That turns a bad URL into a secret in
-*    git history. MCP authenticates via OAuth in the browser; credentials in
-*    the URL are never needed.
-*/
-function assertUsableMcpUrl(url, source) {
-	const from = sourceLabel(source);
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} is not a URL. Expected an absolute http(s) URL, e.g. https://ai.levr.one/api/v1/mcp`);
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} uses "${parsed.protocol}" — only http and https are supported.`);
-	if (!parsed.hostname) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} has no host.`);
-	if (parsed.username || parsed.password) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} embeds credentials. They would be written into client config files — including project-scoped ones you are told to commit. Levr authenticates in the browser; remove the user:password@ prefix.`);
-}
-/**
-* Is this MCP URL served by the API the CLI is logged in to? `--workspace`
-* and the workspace picker read that API's workspaces, so pinning a URL on
-* another server to one of them would name the wrong workspace, or none
-* (ENG-6300 D6).
-*/
-function servedBySessionApi(mcpUrl) {
-	const apiUrl = getApiUrl();
-	const derived = knownMcpUrl(apiUrl) ?? `${apiUrl}/v1/mcp`;
-	try {
-		return new URL(mcpUrl).origin === new URL(derived).origin;
-	} catch {
-		return false;
-	}
-}
-/** `…/v1/mcp/w/<url_key>`: the URL already names one workspace (ENG-6300). */
-const SCOPED_SUFFIX = /\/w\/[^/]+$/;
-/** Does this MCP URL already name a workspace? */
-function isScopedMcpUrl(url) {
-	return SCOPED_SUFFIX.test(stripSlash(url));
-}
-/**
-* The MCP URL for one workspace, `<base>/w/<url_key>` (ENG-6300 D6). A base
-* that already names a workspace is an error rather than a silent re-point:
-* `--url …/w/a --workspace b` asks for two different workspaces at once.
-*/
-function scopedMcpUrl(base, urlKey) {
-	const root = stripSlash(base);
-	if (isScopedMcpUrl(root)) throw new Error(`The MCP URL ${root} already names a workspace. Drop --workspace, or pass the URL without its /w/<url_key> suffix.`);
-	return `${root}/w/${encodeURIComponent(urlKey)}`;
-}
-function knownMcpUrl(apiUrl) {
-	try {
-		return KNOWN_MCP_URLS[new URL(apiUrl).host];
-	} catch {
-		return;
-	}
-}
-function stripSlash(url) {
-	return url.replace(/\/+$/, "");
-}
-
-//#endregion
-//#region src/workspace/find-workspace.ts
-/** `  - Name (url_key)` per workspace, for error messages and hints. */
-function describeWorkspaces(sites) {
-	return sites.map((s) => `  - ${s.workspace_name} (${s.workspace_url_key})`).join("\n");
-}
-/**
-* An exact `url_key` wins; otherwise a case-insensitive name that matches
-* exactly one workspace. Anything else throws, listing the choices.
-*/
-function findWorkspaceByKeyOrName(sites, input) {
-	const wanted = input.trim();
-	if (!wanted) throw new Error("--workspace needs a workspace name or url_key.");
-	const byKey = sites.find((s) => s.workspace_url_key === wanted);
-	if (byKey) return byKey;
-	const lower = wanted.toLowerCase();
-	const byName = sites.filter((s) => s.workspace_name.toLowerCase() === lower);
-	if (byName.length === 1) return byName[0];
-	if (byName.length > 1) throw new Error(`"${wanted}" names more than one workspace. Pass its url_key instead:\n` + describeWorkspaces(byName));
-	if (sites.length === 0) throw new Error("Your account has no workspaces.");
-	throw new Error(`No workspace "${wanted}" in your account. Choose one of:\n` + describeWorkspaces(sites));
-}
-
 //#endregion
 //#region src/mcp/run.ts
 /**
@@ -2541,22 +2408,37 @@ function depsFor(entry) {
 	};
 }
 /**
+* The login that makes `--workspace <x>` work. With the hint, the login
+* skips the workspace picker for that workspace and selects it (ENG-6694).
+* Double quotes: the one quoting POSIX shells and cmd.exe both take.
+*/
+function loginCommandFor(workspace) {
+	if (workspace === void 0) return "levr auth login";
+	return `levr auth login --workspace ${/^[A-Za-z0-9_.@:/-]+$/.test(workspace) ? workspace : `"${workspace.replace(/"/g, "\\\"")}"`}`;
+}
+/**
 * The workspaces of the logged-in user. Reads the session only; it never
-* reads or changes the workspace the CLI has selected.
+* reads or changes the workspace the CLI has selected. `workspace` is the
+* `--workspace` value, for the refusal to name the exact login to run.
 */
-async function loadSites() {
+async function loadSites(workspace) {
 	let auth;
 	try {
 		auth = await resolveToken();
 	} catch (err) {
+		const cause = err instanceof Error ? err.message : "Not authenticated. Run 'levr auth login' first.";
+		if (workspace === void 0) return {
+			ok: false,
+			error: cause
+		};
 		return {
 			ok: false,
-			error: err instanceof Error ? err.message : "Not authenticated. Run 'levr auth login' first."
+			error: `${cause.replace(" or set LEVR_TOKEN environment variable", "")}\nTo pin this entry, log in naming the workspace: ${loginCommandFor(workspace)} (add --device-code on a headless machine), then re-run this command.`
 		};
 	}
 	if (auth.type === "pat") return {
 		ok: false,
-		error: "--workspace needs a login session, not a personal access token. Run 'levr auth login'."
+		error: `--workspace needs a login session, not a personal access token. Run '${loginCommandFor(workspace)}'.`
 	};
 	configureClient(auth);
 	try {
@@ -2621,7 +2503,7 @@ async function mcpAddHandler(flags) {
 			this.process.exitCode = 1;
 			return;
 		}
-		const loaded = await loadSites();
+		const loaded = await loadSites(flags.workspace);
 		if (!loaded.ok) {
 			this.logger.error(loaded.error);
 			this.process.exitCode = 1;

package/dist/cli.js

@@ -209,7 +209,7 @@ Examples:
 		aliases: { y: "yes" }
 	},
 	loader: async () => {
-		const { mcpAddHandler } = await import("./addHandler-BqLLDeKp.js");
+		const { mcpAddHandler } = await import("./addHandler-B_3UmMbj.js");
 		return mcpAddHandler;
 	}
 });
@@ -225,9 +225,13 @@ By default, opens a browser for PKCE-based authentication.
 For headless environments (SSH, containers), use --device-code
 to authenticate via a code displayed in the terminal.
 
+With --workspace, the login selects that workspace for the CLI, and a
+url_key also skips the workspace picker in the browser.
+
 Examples:
-  levr auth login                 # Browser-based PKCE login
-  levr auth login --device-code   # Device flow for SSH/headless`
+  levr auth login                   # Browser-based PKCE login
+  levr auth login --device-code     # Device flow for SSH/headless
+  levr auth login --workspace acme  # Skip the picker; select acme`
 	},
 	parameters: {
 		flags: {
@@ -242,12 +246,19 @@ Examples:
 				brief: "API base URL (default: https://api.levr.one)",
 				placeholder: "url",
 				optional: true
+			},
+			workspace: {
+				kind: "parsed",
+				parse: String,
+				brief: "Workspace to select, by url_key or name (a url_key also skips the workspace picker)",
+				placeholder: "url_key|name",
+				optional: true
 			}
 		},
 		aliases: { d: "device-code" }
 	},
 	loader: async () => {
-		const { loginHandler } = await import("./loginHandler-DzyfdKc2.js");
+		const { loginHandler } = await import("./loginHandler-DE0L1ehF.js");
 		return loginHandler;
 	}
 });
@@ -266,7 +277,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { logoutHandler } = await import("./logoutHandler-TSQlZGpU.js");
+		const { logoutHandler } = await import("./logoutHandler-S4TFYFwz.js");
 		return logoutHandler;
 	}
 });
@@ -286,7 +297,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-B_xmACZl.js");
+		const { statusHandler } = await import("./statusHandler-BNiWlC7e.js");
 		return statusHandler;
 	}
 });
@@ -415,7 +426,7 @@ levr attach --manifest or later uploads.`
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-DRFf9Zeu.js");
+		const { pushHandler } = await import("./pushHandler-DdNyVQ5t.js");
 		return pushHandler;
 	}
 });
@@ -535,7 +546,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { importHandler } = await import("./importHandler-D2_Ol-Vp.js");
+		const { importHandler } = await import("./importHandler-zw5GKb-S.js");
 		return importHandler;
 	}
 });
@@ -556,7 +567,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-hmLz8zm8.js");
+		const { listHandler } = await import("./listHandler-YA-0RkwS.js");
 		return listHandler;
 	}
 });
@@ -594,7 +605,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-DNb1KJvM.js");
+		const { selectHandler } = await import("./selectHandler-Cejme5nY.js");
 		return selectHandler;
 	}
 });
@@ -611,7 +622,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { currentHandler } = await import("./currentHandler-B_sWXNeW.js");
+		const { currentHandler } = await import("./currentHandler-u89l068v.js");
 		return currentHandler;
 	}
 });
@@ -680,7 +691,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { gatesRunHandler } = await import("./runHandler-9tfiD3ZK.js");
+		const { gatesRunHandler } = await import("./runHandler-BFDjtxbt.js");
 		return gatesRunHandler;
 	}
 });
@@ -869,14 +880,14 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { resultAppendHandler } = await import("./appendHandler-9WDDNkkA.js");
+		const { resultAppendHandler } = await import("./appendHandler-KVsJMxpX.js");
 		return resultAppendHandler;
 	}
 });
 
 //#endregion
 //#region package.json
-var version = "0.11.7";
+var version = "0.11.9";
 
 //#endregion
 //#region src/app.ts

package/dist/find-workspace-T4xuXwtS.js

@@ -0,0 +1,147 @@
+import { getApiUrl } from "./env-CdwyPHGV.js";
+
+//#region src/mcp/url.ts
+const KNOWN_MCP_URLS = {
+	"api.levr.one": "https://ai.levr.one/api/v1/mcp",
+	"api.levr.now": "https://ai.levr.now/api/v1/mcp"
+};
+/**
+* Resolve the MCP server URL: `--url` flag > `LEVR_MCP_URL` env > derived
+* from the resolved API URL (which itself honors `LEVR_URL` > the URL stored
+* at login > production default, ENG-2361). Known Levr hosts map to their
+* app-host MCP resource; anything else (localhost dev stacks, custom
+* deployments) derives `<api-url>/v1/mcp`.
+*/
+function resolveMcpUrl(flagUrl) {
+	const resolved = resolveRaw(flagUrl);
+	assertUsableMcpUrl(resolved.url, resolved.source);
+	return resolved;
+}
+function resolveRaw(flagUrl) {
+	if (flagUrl) return {
+		url: stripSlash(flagUrl),
+		source: "flag"
+	};
+	const envVar = process.env["LEVR_MCP_URL"];
+	if (envVar) return {
+		url: stripSlash(envVar),
+		source: "env:LEVR_MCP_URL"
+	};
+	const apiUrl = getApiUrl();
+	return {
+		url: knownMcpUrl(apiUrl) ?? `${apiUrl}/v1/mcp`,
+		source: `derived:${apiUrl}`
+	};
+}
+/** Name the input the user has to change, not our internal source tag. */
+function sourceLabel(source) {
+	if (source === "flag") return "--url";
+	if (source === "env:LEVR_MCP_URL") return "LEVR_MCP_URL";
+	return `the API URL (${source.slice(8)})`;
+}
+/**
+* Reject a URL that must not reach a client config or a spawned CLI (ENG-4159).
+*
+* Three things this stops:
+*
+* 1. **No scheme.** `claude mcp add --transport http --scope user levr <value>`
+*    is spawned with fixed argv since ENG-4156, so a value like `--foo` is read
+*    by that CLI as a FLAG rather than as its URL operand — argument injection.
+*    Requiring a parseable absolute URL removes the shape entirely.
+* 2. **A non-http(s) scheme.** `file:` / `javascript:` is never a valid MCP
+*    endpoint, but would be written verbatim into every client's config.
+* 3. **Embedded credentials.** `https://user:pass@host` would be written into
+*    a config file — and since ENG-4151 a config file can be `--scope project`,
+*    which the user is told to COMMIT. That turns a bad URL into a secret in
+*    git history. MCP authenticates via OAuth in the browser; credentials in
+*    the URL are never needed.
+*/
+function assertUsableMcpUrl(url, source) {
+	const from = sourceLabel(source);
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} is not a URL. Expected an absolute http(s) URL, e.g. https://ai.levr.one/api/v1/mcp`);
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} uses "${parsed.protocol}" — only http and https are supported.`);
+	if (!parsed.hostname) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} has no host.`);
+	if (parsed.username || parsed.password) throw new Error(`Invalid MCP URL from ${from}: ${JSON.stringify(url)} embeds credentials. They would be written into client config files — including project-scoped ones you are told to commit. Levr authenticates in the browser; remove the user:password@ prefix.`);
+}
+/**
+* Is this MCP URL served by the API the CLI is logged in to? `--workspace`
+* and the workspace picker read that API's workspaces, so pinning a URL on
+* another server to one of them would name the wrong workspace, or none
+* (ENG-6300 D6).
+*/
+function servedBySessionApi(mcpUrl) {
+	const apiUrl = getApiUrl();
+	const derived = knownMcpUrl(apiUrl) ?? `${apiUrl}/v1/mcp`;
+	try {
+		return new URL(mcpUrl).origin === new URL(derived).origin;
+	} catch {
+		return false;
+	}
+}
+/** `…/v1/mcp/w/<url_key>`: the URL already names one workspace (ENG-6300). */
+const SCOPED_SUFFIX = /\/w\/[^/]+$/;
+/** Does this MCP URL already name a workspace? */
+function isScopedMcpUrl(url) {
+	return SCOPED_SUFFIX.test(stripSlash(url));
+}
+/**
+* The MCP URL for one workspace, `<base>/w/<url_key>` (ENG-6300 D6). A base
+* that already names a workspace is an error rather than a silent re-point:
+* `--url …/w/a --workspace b` asks for two different workspaces at once.
+*/
+function scopedMcpUrl(base, urlKey) {
+	const root = stripSlash(base);
+	if (isScopedMcpUrl(root)) throw new Error(`The MCP URL ${root} already names a workspace. Drop --workspace, or pass the URL without its /w/<url_key> suffix.`);
+	return `${root}/w/${encodeURIComponent(urlKey)}`;
+}
+function knownMcpUrl(apiUrl) {
+	try {
+		return KNOWN_MCP_URLS[new URL(apiUrl).host];
+	} catch {
+		return;
+	}
+}
+function stripSlash(url) {
+	return url.replace(/\/+$/, "");
+}
+
+//#endregion
+//#region src/workspace/find-workspace.ts
+/** The url_key syntax the backend and auth-web accept (reserved keys aside). */
+const URL_KEY_SYNTAX = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
+/**
+* Could this `--workspace` value be a url_key? Only a url_key can name a
+* workspace before a session exists, so only one can skip the login picker
+* (ENG-6694); a name is resolved once the token has arrived.
+*/
+function looksLikeUrlKey(input) {
+	return input.length <= 100 && URL_KEY_SYNTAX.test(input);
+}
+/** `  - Name (url_key)` per workspace, for error messages and hints. */
+function describeWorkspaces(sites) {
+	return sites.map((s) => `  - ${s.workspace_name} (${s.workspace_url_key})`).join("\n");
+}
+/**
+* An exact `url_key` wins; otherwise a case-insensitive name that matches
+* exactly one workspace. Anything else throws, listing the choices.
+*/
+function findWorkspaceByKeyOrName(sites, input) {
+	const wanted = input.trim();
+	if (!wanted) throw new Error("--workspace needs a workspace name or url_key.");
+	const byKey = sites.find((s) => s.workspace_url_key === wanted);
+	if (byKey) return byKey;
+	const lower = wanted.toLowerCase();
+	const byName = sites.filter((s) => s.workspace_name.toLowerCase() === lower);
+	if (byName.length === 1) return byName[0];
+	if (byName.length > 1) throw new Error(`"${wanted}" names more than one workspace. Pass its url_key instead:\n` + describeWorkspaces(byName));
+	if (sites.length === 0) throw new Error("Your account has no workspaces.");
+	throw new Error(`No workspace "${wanted}" in your account. Choose one of:\n` + describeWorkspaces(sites));
+}
+
+//#endregion
+export { describeWorkspaces, findWorkspaceByKeyOrName, isScopedMcpUrl, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl, servedBySessionApi };

package/dist/{loginHandler-DzyfdKc2.js → loginHandler-DE0L1ehF.js}

@@ -1,12 +1,13 @@
 import { configureClient } from "./sdk-client-DYv-0CfA.js";
 import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-CdwyPHGV.js";
-import "./workspace-store-CnrxyYRB.js";
-import { autoSelectWorkspace } from "./resolve-workspace-CStHisUb.js";
+import { saveWorkspace } from "./workspace-store-CnrxyYRB.js";
+import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-CStHisUb.js";
 import { sleep } from "./sleep-BpJ39Ypm.js";
+import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-T4xuXwtS.js";
 import chalk from "chalk";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
-import { URL } from "node:url";
+import { URL as URL$1 } from "node:url";
 
 //#region src/auth/pkce.ts
 /**
@@ -103,7 +104,7 @@ function startCallbackServer(options = {}) {
 		rejectCode = reject;
 	});
 	const server = createServer((req, res) => {
-		const url = new URL(req.url ?? "/", `http://127.0.0.1`);
+		const url = new URL$1(req.url ?? "/", `http://127.0.0.1`);
 		if (url.pathname === "/callback") {
 			const code = url.searchParams.get("code");
 			const error = url.searchParams.get("error");
@@ -225,20 +226,21 @@ function formatCountdown(ms) {
 async function loginHandler(flags) {
 	await performLogin(this, {
 		deviceCode: flags["device-code"],
-		url: flags.url
+		url: flags.url,
+		workspace: flags.workspace
 	});
 }
 /**
 * Run the login flow (PKCE or device code). Reusable outside the Stricli
-* handler (levr init composes it). Returns true on success; on failure the
-* error has been printed and `exitCode` set.
+* handler. Returns true on success; on failure the error has been printed
+* and `exitCode` set.
 */
 async function performLogin(ctx, options) {
 	if (options.url) setSessionApiUrl(options.url);
-	if (options.deviceCode) return deviceCodeLogin(ctx);
-	return pkceLogin(ctx);
+	if (options.deviceCode) return deviceCodeLogin(ctx, options.workspace);
+	return pkceLogin(ctx, options.workspace);
 }
-async function pkceLogin(ctx) {
+async function pkceLogin(ctx, workspace) {
 	const apiUrl = getApiUrl();
 	let authUrl;
 	try {
@@ -248,6 +250,12 @@ async function pkceLogin(ctx) {
 		ctx.process.exitCode = 1;
 		return false;
 	}
+	let resource;
+	if (workspace !== void 0 && looksLikeUrlKey(workspace)) try {
+		resource = scopedMcpUrl(resolveMcpUrl().url, workspace);
+	} catch (err) {
+		ctx.logger.debug(`Workspace picker not skipped: ${err instanceof Error ? err.message : String(err)}`);
+	}
 	const codeVerifier = generateCodeVerifier();
 	const codeChallenge = generateCodeChallenge(codeVerifier);
 	const state = randomBytes(16).toString("hex");
@@ -265,6 +273,7 @@ async function pkceLogin(ctx) {
 		scope: "read:own write:own",
 		state
 	});
+	if (resource) params.append("resource", resource);
 	const authorizeUrl = `${authUrl}/auth/oauth/authorize?${params.toString()}`;
 	ctx.process.stdout.write("Opening browser to authenticate...\n\n");
 	ctx.process.stdout.write(`  If the browser doesn't open, visit:\n  ${chalk.cyan(authorizeUrl)}\n\n`);
@@ -306,7 +315,7 @@ async function pkceLogin(ctx) {
 			const errBody = await tokenRes.text();
 			throw new Error(`Token exchange failed (${tokenRes.status}): ${errBody}`);
 		}
-		return await saveTokensAndFinish(ctx, await tokenRes.json());
+		return await saveTokensAndFinish(ctx, await tokenRes.json(), workspace);
 	} catch (err) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Token exchange failed.");
@@ -314,10 +323,16 @@ async function pkceLogin(ctx) {
 		return false;
 	}
 }
-async function deviceCodeLogin(ctx) {
+async function deviceCodeLogin(ctx, workspace) {
 	try {
 		const device = await requestDeviceCode();
-		ctx.process.stdout.write(`\nVisit: ${chalk.cyan(device.verification_uri)}\n`);
+		let visit = device.verification_uri;
+		if (workspace !== void 0 && looksLikeUrlKey(workspace)) try {
+			const url = new URL(device.verification_uri);
+			url.searchParams.set("workspace", workspace);
+			visit = url.toString();
+		} catch {}
+		ctx.process.stdout.write(`\nVisit: ${chalk.cyan(visit)}\n`);
 		ctx.process.stdout.write(`Enter code: ${chalk.bold.yellow(device.user_code)}\n\n`);
 		const deviceDeadline = Date.now() + device.expires_in * 1e3;
 		const deviceTimer = setInterval(() => {
@@ -337,7 +352,7 @@ async function deviceCodeLogin(ctx) {
 			throw err;
 		}
 		clearInterval(deviceTimer);
-		return await saveTokensAndFinish(ctx, tokenData);
+		return await saveTokensAndFinish(ctx, tokenData, workspace);
 	} catch (err) {
 		ctx.process.stdout.write("\n");
 		ctx.logger.error(err instanceof Error ? err.message : "Device flow failed.");
@@ -345,7 +360,7 @@ async function deviceCodeLogin(ctx) {
 		return false;
 	}
 }
-async function saveTokensAndFinish(ctx, tokenData) {
+async function saveTokensAndFinish(ctx, tokenData, workspace) {
 	const apiUrl = getApiUrl();
 	configureClient({
 		token: tokenData.access_token,
@@ -358,6 +373,26 @@ async function saveTokensAndFinish(ctx, tokenData) {
 		ctx.process.exitCode = 1;
 		return false;
 	}
+	let selected;
+	if (workspace !== void 0) {
+		let sites;
+		try {
+			sites = await fetchSites();
+		} catch (err) {
+			ctx.process.stdout.write("\n");
+			ctx.logger.error(`${err instanceof Error ? err.message : "Could not list your workspaces."}\nNothing was saved. Try again.`);
+			ctx.process.exitCode = 1;
+			return false;
+		}
+		try {
+			selected = findWorkspaceByKeyOrName(sites, workspace);
+		} catch (err) {
+			ctx.process.stdout.write("\n");
+			ctx.logger.error(`${err instanceof Error ? err.message : "Unknown workspace."}\nNothing was saved. Run 'levr auth login --workspace <url_key>' with one of them, or 'levr auth login' to choose later.`);
+			ctx.process.exitCode = 1;
+			return false;
+		}
+	}
 	writeCredentials({
 		version: 1,
 		api_url: apiUrl,
@@ -373,6 +408,11 @@ async function saveTokensAndFinish(ctx, tokenData) {
 	ctx.process.stdout.write(` ${chalk.green("done")}\n\n`);
 	ctx.logger.success(`Logged in as ${chalk.bold(user.email)}`);
 	ctx.process.stdout.write("Credentials saved.\n");
+	if (selected) {
+		saveWorkspace(selected.workspace_id);
+		ctx.process.stdout.write(`Workspace: ${chalk.bold(selected.workspace_name)} (${selected.workspace_url_key})\n`);
+		return true;
+	}
 	const wsResult = await autoSelectWorkspace();
 	if (wsResult.kind === "single") ctx.process.stdout.write(`Workspace: ${chalk.bold(wsResult.workspaceName)}\n`);
 	else if (wsResult.kind === "multiple") ctx.process.stdout.write(`\n${wsResult.count} workspaces available. Run ${chalk.cyan("'levr workspace list'")} to see them.\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.11.7",
+  "version": "0.11.9",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",