@levr-one/cli 0.12.5 → 0.12.7

package/dist/{addHandler-CAmLxnsF.js → addHandler-ybX54_3f.js}

@@ -1,10 +1,10 @@
-import { configureClient } from "./sdk-client-B4FMd_Fa.js";
-import { getApiUrl } from "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl } from "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import { fetchSites } from "./resolve-workspace-BbK3uYQc.js";
-import { describeWorkspaces, findWorkspaceByKeyOrName, isScopedMcpUrl, resolveMcpUrl, scopedMcpUrl, servedBySessionApi } from "./find-workspace-Bl4rfr73.js";
+import { fetchSites } from "./resolve-workspace-D8y7twod.js";
+import { describeWorkspaces, findWorkspaceByKeyOrName, isScopedMcpUrl, resolveMcpUrl, scopedMcpUrl, servedBySessionApi } from "./find-workspace-4Us2vEb7.js";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";

package/dist/{appendHandler-CUmlIX6q.js → appendHandler-CKkl9ymw.js}

@@ -1,12 +1,12 @@
-import { appendActualResult } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import "./resolve-token-ByZq05Us.js";
+import { appendActualResult } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import "./resolve-workspace-BbK3uYQc.js";
-import { connect } from "./connect-DVjgyfls.js";
+import "./resolve-workspace-D8y7twod.js";
+import { connect } from "./connect-yq3fGXkW.js";
 import "./sleep-CGBHjsj5.js";
-import { embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BvBSevIx.js";
+import { embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-Ba801tb6.js";
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 

package/dist/{artifact-upload-BvBSevIx.js → artifact-upload-Ba801tb6.js}

@@ -1,4 +1,4 @@
-import { uploadAttachment } from "./sdk-client-B4FMd_Fa.js";
+import { uploadAttachment } from "./sdk-client-BgzKzVIR.js";
 import { sleep } from "./sleep-CGBHjsj5.js";
 import { constants, promises, readlinkSync, realpathSync, statSync } from "node:fs";
 import path from "node:path";

package/dist/{attachHandler-DXZi2ILT.js → attachHandler-CfNvVAV2.js}

@@ -1,12 +1,12 @@
-import { appendActualResult, createComment } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import "./resolve-token-ByZq05Us.js";
+import { appendActualResult, createComment } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import "./resolve-workspace-BbK3uYQc.js";
-import { connect } from "./connect-DVjgyfls.js";
+import "./resolve-workspace-D8y7twod.js";
+import { connect } from "./connect-yq3fGXkW.js";
 import "./sleep-CGBHjsj5.js";
-import { TargetParseError, embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-BvBSevIx.js";
+import { TargetParseError, embedMarkdown, parseTarget, uploadArtifactFile } from "./artifact-upload-Ba801tb6.js";
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 

package/dist/cli.js

@@ -224,7 +224,7 @@ Examples:
 		aliases: { y: "yes" }
 	},
 	loader: async () => {
-		const { mcpAddHandler } = await import("./addHandler-CAmLxnsF.js");
+		const { mcpAddHandler } = await import("./addHandler-ybX54_3f.js");
 		return mcpAddHandler;
 	}
 });
@@ -273,7 +273,7 @@ Examples:
 		aliases: { d: "device-code" }
 	},
 	loader: async () => {
-		const { loginHandler } = await import("./loginHandler-C9Oi92IY.js");
+		const { loginHandler } = await import("./loginHandler-PbKmDAGo.js");
 		return loginHandler;
 	}
 });
@@ -292,7 +292,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { logoutHandler } = await import("./logoutHandler-Cf5aI1wq.js");
+		const { logoutHandler } = await import("./logoutHandler-DxnzGPYx.js");
 		return logoutHandler;
 	}
 });
@@ -312,7 +312,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { statusHandler } = await import("./statusHandler-BQXn93-r.js");
+		const { statusHandler } = await import("./statusHandler-Dnnh80ZN.js");
 		return statusHandler;
 	}
 });
@@ -367,7 +367,7 @@ levr attach --manifest or later uploads.`
 			"workspace-id": {
 				kind: "parsed",
 				parse: String,
-				brief: "Workspace ID (required for multi-workspace JWT auth)",
+				brief: "Workspace ID: needed with a login token and several workspaces; a personal access token is bound to its own",
 				placeholder: "uuid",
 				optional: true
 			},
@@ -441,7 +441,7 @@ levr attach --manifest or later uploads.`
 		}
 	},
 	loader: async () => {
-		const { pushHandler } = await import("./pushHandler-NvZYBz-H.js");
+		const { pushHandler } = await import("./pushHandler-BulraEwP.js");
 		return pushHandler;
 	}
 });
@@ -482,7 +482,7 @@ Examples:
 			"workspace-id": {
 				kind: "parsed",
 				parse: String,
-				brief: "Workspace ID (required for multi-workspace JWT auth)",
+				brief: "Workspace ID: needed with a login token and several workspaces; a personal access token is bound to its own",
 				placeholder: "uuid",
 				optional: true
 			},
@@ -561,7 +561,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { importHandler } = await import("./importHandler-BhOznIQW.js");
+		const { importHandler } = await import("./importHandler-bYBWYC_0.js");
 		return importHandler;
 	}
 });
@@ -582,7 +582,7 @@ Examples:
 	},
 	parameters: {},
 	loader: async () => {
-		const { listHandler } = await import("./listHandler-DjWj1D3H.js");
+		const { listHandler } = await import("./listHandler-Du_YGzre.js");
 		return listHandler;
 	}
 });
@@ -620,7 +620,7 @@ Examples:
 		flags: {}
 	},
 	loader: async () => {
-		const { selectHandler } = await import("./selectHandler-CrLuGY3d.js");
+		const { selectHandler } = await import("./selectHandler-C0gs-Q70.js");
 		return selectHandler;
 	}
 });
@@ -695,7 +695,7 @@ Examples:
 		}
 	} },
 	loader: async () => {
-		const { gatesRefsHandler } = await import("./refsHandler-DtcceTRP.js");
+		const { gatesRefsHandler } = await import("./refsHandler--ySvLjmX.js");
 		return gatesRefsHandler;
 	}
 });
@@ -745,7 +745,7 @@ Examples:
 			"workspace-id": {
 				kind: "parsed",
 				parse: String,
-				brief: "Workspace ID (required for multi-workspace JWT auth)",
+				brief: "Workspace ID: needed with a login token and several workspaces; a personal access token is bound to its own",
 				placeholder: "uuid",
 				optional: true
 			},
@@ -776,7 +776,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { gatesRunHandler } = await import("./runHandler-CTfUyBNW.js");
+		const { gatesRunHandler } = await import("./runHandler-B-u-0eRk.js");
 		return gatesRunHandler;
 	}
 });
@@ -842,7 +842,7 @@ Examples:
 			"workspace-id": {
 				kind: "parsed",
 				parse: String,
-				brief: "Workspace ID (required for multi-workspace JWT auth)",
+				brief: "Workspace ID: needed with a login token and several workspaces; a personal access token is bound to its own",
 				placeholder: "uuid",
 				optional: true
 			},
@@ -889,7 +889,7 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { attachHandler } = await import("./attachHandler-DXZi2ILT.js");
+		const { attachHandler } = await import("./attachHandler-CfNvVAV2.js");
 		return attachHandler;
 	}
 });
@@ -924,7 +924,7 @@ Examples:
 			"workspace-id": {
 				kind: "parsed",
 				parse: String,
-				brief: "Workspace ID (required for multi-workspace JWT auth)",
+				brief: "Workspace ID: needed with a login token and several workspaces; a personal access token is bound to its own",
 				placeholder: "uuid",
 				optional: true
 			},
@@ -965,14 +965,14 @@ Examples:
 		}
 	},
 	loader: async () => {
-		const { resultAppendHandler } = await import("./appendHandler-CUmlIX6q.js");
+		const { resultAppendHandler } = await import("./appendHandler-CKkl9ymw.js");
 		return resultAppendHandler;
 	}
 });
 
 //#endregion
 //#region package.json
-var version = "0.12.5";
+var version = "0.12.7";
 
 //#endregion
 //#region src/app.ts

package/dist/{connect-DVjgyfls.js → connect-yq3fGXkW.js}

@@ -1,12 +1,13 @@
-import { client, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
-import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
+import { client, configureClient } from "./sdk-client-BgzKzVIR.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
+import { resolveWorkspaceFor } from "./resolve-workspace-D8y7twod.js";
 
 //#region src/utils/connect.ts
 /**
 * Authenticate the SDK client for a command (ENG-6164): resolve the token,
-* and for a JWT the workspace. Reports the failure and sets exit code 1;
-* returns false when the command must stop.
+* then the workspace — looked up for a JWT, taken from an explicit flag or
+* `LEVR_WORKSPACE_ID` for a PAT (ENG-6068). Reports the failure and sets exit
+* code 1; returns false when the command must stop.
 */
 async function connect(ctx, workspaceIdFlag) {
 	let auth;
@@ -18,9 +19,9 @@ async function connect(ctx, workspaceIdFlag) {
 		return false;
 	}
 	configureClient(auth);
-	if (auth.type === "jwt") try {
-		const ws = await resolveWorkspace(workspaceIdFlag);
-		client.setConfig({
+	try {
+		const ws = await resolveWorkspaceFor(auth, workspaceIdFlag);
+		if (ws) client.setConfig({
 			...client.getConfig(),
 			workspaceId: ws.workspaceId
 		});

package/dist/{find-workspace-Bl4rfr73.js → find-workspace-4Us2vEb7.js}

@@ -1,4 +1,4 @@
-import { getApiUrl } from "./env-CvjMSRd7.js";
+import { getApiUrl } from "./env-DjeRwmZ7.js";
 
 //#region src/mcp/url.ts
 const KNOWN_MCP_URLS = {

package/dist/{importHandler-BhOznIQW.js → importHandler-bYBWYC_0.js}

@@ -1,9 +1,9 @@
-import { authGetProfileV1, client, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import { getApiUrl, getTeamId } from "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { authGetProfileV1, client, configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl, getTeamId } from "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
+import { resolveWorkspaceFor } from "./resolve-workspace-D8y7twod.js";
 import chalk from "chalk";
 import { createReadStream } from "node:fs";
 import { basename } from "node:path";
@@ -373,16 +373,16 @@ async function importHandler(flags, file) {
 		this.logger.debug(`Auth: ${auth.type.toUpperCase()}`);
 		this.logger.debug(`API:  ${getApiUrl()}`);
 	}
-	if (auth.type === "jwt") {
+	{
 		let workspace;
 		try {
-			workspace = await resolveWorkspace.call(this, flags["workspace-id"]);
+			workspace = await resolveWorkspaceFor(auth, flags["workspace-id"]);
 		} catch (err) {
 			this.logger.error(err instanceof Error ? err.message : "Could not resolve the workspace.");
 			this.process.exitCode = 1;
 			return;
 		}
-		configureClient(auth, workspace.workspaceId);
+		if (workspace) configureClient(auth, workspace.workspaceId);
 	}
 	let teamId;
 	try {

package/dist/{listHandler-DjWj1D3H.js → listHandler-Du_YGzre.js}

@@ -1,7 +1,7 @@
-import { authGetSitesV1, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import { loadWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/commands/workspace/listHandler.ts

package/dist/{loginHandler-C9Oi92IY.js → loginHandler-PbKmDAGo.js}

@@ -1,9 +1,9 @@
-import { configureClient } from "./sdk-client-B4FMd_Fa.js";
-import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-CvjMSRd7.js";
+import { configureClient } from "./sdk-client-BgzKzVIR.js";
+import { CLI_CLIENT_ID, getApiUrl, getAuthUrl, setSessionApiUrl, writeCredentials } from "./env-DjeRwmZ7.js";
 import { saveWorkspace } from "./workspace-store-Bmw104Qa.js";
-import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-BbK3uYQc.js";
+import { autoSelectWorkspace, fetchSites } from "./resolve-workspace-D8y7twod.js";
 import { sleep } from "./sleep-CGBHjsj5.js";
-import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-Bl4rfr73.js";
+import { findWorkspaceByKeyOrName, looksLikeUrlKey, resolveMcpUrl, scopedMcpUrl } from "./find-workspace-4Us2vEb7.js";
 import chalk from "chalk";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";

package/dist/{logoutHandler-Cf5aI1wq.js → logoutHandler-DxnzGPYx.js}

@@ -1,4 +1,4 @@
-import { deleteCredentials, getPatToken } from "./env-CvjMSRd7.js";
+import { deleteCredentials, getPatToken } from "./env-DjeRwmZ7.js";
 import { clearWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/commands/auth/logoutHandler.ts

package/dist/{pushHandler-NvZYBz-H.js → pushHandler-BulraEwP.js}

@@ -1,11 +1,11 @@
-import { client, configureClient, uploadImport } from "./sdk-client-B4FMd_Fa.js";
-import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { client, configureClient, uploadImport } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl, getAutomationSourceIdOverride, getSourceOverride, getTeamId } from "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
+import { resolveWorkspaceFor } from "./resolve-workspace-D8y7twod.js";
 import "./sleep-CGBHjsj5.js";
-import { resolveArtifactPath, uploadArtifactFile } from "./artifact-upload-BvBSevIx.js";
+import { resolveArtifactPath, uploadArtifactFile } from "./artifact-upload-Ba801tb6.js";
 import { readFileSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 import { execSync } from "node:child_process";
@@ -474,13 +474,15 @@ async function pushHandler(flags, file) {
 		this.logger.debug(`Auth: ${auth.type.toUpperCase()}`);
 		this.logger.debug(`API:  ${getApiUrl()}`);
 	}
-	if (auth.type === "jwt") try {
-		const ws = await resolveWorkspace(flags["workspace-id"]);
-		client.setConfig({
-			...client.getConfig(),
-			workspaceId: ws.workspaceId
-		});
-		if (flags.verbose) this.logger.debug(`Workspace: ${ws.workspaceId} (${ws.source})`);
+	try {
+		const ws = await resolveWorkspaceFor(auth, flags["workspace-id"]);
+		if (ws) {
+			client.setConfig({
+				...client.getConfig(),
+				workspaceId: ws.workspaceId
+			});
+			if (flags.verbose) this.logger.debug(`Workspace: ${ws.workspaceId} (${ws.source})`);
+		} else if (flags.verbose) this.logger.debug("Workspace: the token's own");
 	} catch (err) {
 		this.logger.error(err instanceof Error ? err.message : "Workspace resolution failed.");
 		this.process.exitCode = 1;

package/dist/{refsHandler-DtcceTRP.js → refsHandler--ySvLjmX.js}

@@ -156,9 +156,11 @@ function notFound(filesScanned, tsConfigPath) {
 * interpret. The gate framework exists to make "verified" and "not verified"
 * distinguishable, and an OOM is neither.
 *
-* 8000 sits above the largest legitimate single scope in this repo
-* (`apps/backender` at 6,314, which resolves comfortably) and below the
-* whole-repo set that does not. Override deliberately with `--max-files` if a
+* 10,000 sits above the largest legitimate single scope in this repo and below
+* the whole-repo set that does not. `apps/backender/src` was 6,314 files when
+* the cap was 8000, and reached 8,016 with ENG-6802, which made every gate
+* scoped to it refuse. It counts test files even when `includeTests` is off
+* (about 1,100 of them); excluding those is a separate follow-up. Override deliberately with `--max-files` if a
 * genuinely larger scope is ever needed — and expect to raise Node's heap with
 * `NODE_OPTIONS=--max-old-space-size=...` at the same time.
 *
@@ -168,7 +170,7 @@ function notFound(filesScanned, tsConfigPath) {
 * would change verdicts for reasons that have nothing to do with the code.
 * (Moved from `scripts/gates/symbol-referenced.lib.ts`, ENG-7284 D5.)
 */
-const DEFAULT_MAX_FILES = 8e3;
+const DEFAULT_MAX_FILES = 1e4;
 /** Thrown when the requested scope holds more files than the resolver will load. */
 var ScopeTooBroadError = class extends Error {
 	fileCount;

package/dist/{resolve-token-ByZq05Us.js → resolve-token-DKEXT7SA.js}

@@ -1,5 +1,5 @@
-import { getApiUrl, getPatToken, readCredentials } from "./env-CvjMSRd7.js";
-import { isTokenExpired, refreshToken } from "./token-refresh-CJB7Qlxy.js";
+import { classifyToken, isTokenExpired, refreshToken } from "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl, getPatToken, readCredentials } from "./env-DjeRwmZ7.js";
 
 //#region src/auth/resolve-token.ts
 /**
@@ -16,7 +16,8 @@ var CredentialsMismatchError = class extends Error {
 };
 /**
 * Resolve auth token in priority order:
-* 1. LEVR_TOKEN env var (PAT) — long-lived, no refresh
+* 1. LEVR_TOKEN env var — a PAT or an OAuth access token, told apart by
+*    shape (ENG-6068); never refreshed
 * 2. Stored credentials (JWT) — auto-refresh if expired
 * 3. Error — not authenticated
 */
@@ -24,7 +25,8 @@ async function resolveToken() {
 	const pat = getPatToken();
 	if (pat) return {
 		token: pat,
-		type: "pat"
+		type: classifyToken(pat),
+		source: "env"
 	};
 	let creds = readCredentials();
 	if (creds) {
@@ -38,7 +40,8 @@ async function resolveToken() {
 		}
 		return {
 			token: creds.access_token,
-			type: "jwt"
+			type: "jwt",
+			source: "stored"
 		};
 	}
 	throw new Error("Not authenticated. Run 'levr auth login' or set LEVR_TOKEN environment variable.");

package/dist/{resolve-workspace-BbK3uYQc.js → resolve-workspace-D8y7twod.js}

@@ -1,4 +1,4 @@
-import { authGetSitesV1 } from "./sdk-client-B4FMd_Fa.js";
+import { authGetSitesV1 } from "./sdk-client-BgzKzVIR.js";
 import { clearWorkspace, loadWorkspace, saveWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/workspace/resolve-workspace.ts
@@ -40,7 +40,8 @@ async function autoSelectWorkspace() {
 	};
 	return { kind: "none" };
 }
-async function resolveWorkspace(flagValue) {
+async function resolveWorkspace(flagValue, options = {}) {
+	const persist = options.persist ?? true;
 	let sites = null;
 	const getSites = async () => {
 		if (!sites) sites = await fetchSites();
@@ -61,7 +62,7 @@ async function resolveWorkspace(flagValue) {
 			source: "env"
 		};
 	}
-	const cached = loadWorkspace();
+	const cached = persist ? loadWorkspace() : null;
 	if (cached) {
 		if ((await getSites()).some((site) => site.workspace_id === cached)) return {
 			workspaceId: cached,
@@ -73,7 +74,7 @@ async function resolveWorkspace(flagValue) {
 	if (s.length === 0) throw new Error("No workspaces available.");
 	if (s.length === 1) {
 		const single = s[0];
-		saveWorkspace(single.workspace_id);
+		if (persist) saveWorkspace(single.workspace_id);
 		return {
 			workspaceId: single.workspace_id,
 			source: "auto"
@@ -84,6 +85,37 @@ async function resolveWorkspace(flagValue) {
 	const overflow = s.length > maxList ? `\n  ... and ${s.length - maxList} more` : "";
 	throw new Error(`Multiple workspaces. Select one:\n${list}${overflow}\n\nRun: levr workspace select <id>`);
 }
+/**
+* The workspace a command runs in, for whichever credential it holds —
+* [issue:ENG-6068].
+*
+* A JWT is not bound to a workspace, so one is resolved the usual way: the
+* flag, `LEVR_WORKSPACE_ID`, the cached selection, then auto-select, each
+* validated against the sites the account can see.
+*
+* A personal access token IS bound to one workspace, and the server scopes
+* every request by it. An explicit `--workspace-id` or `LEVR_WORKSPACE_ID` is
+* still sent as `Workspace-Id` — the server refuses one that is not the
+* token's — but nothing is looked up or cached, and with neither set the
+* answer is null: the token's own workspace applies. Until ENG-6068 both were
+* silently dropped for every `LEVR_TOKEN`, including an OAuth access token,
+* which was classified as a PAT by where it came from and has no workspace to
+* fall back to. An OAuth token from LEVR_TOKEN is not the login session, so
+* the saved workspace choice is left alone for it (`persist: false`).
+*/
+async function resolveWorkspaceFor(auth, flagValue) {
+	if (auth.type === "jwt") return resolveWorkspace(flagValue, { persist: auth.source !== "env" });
+	if (flagValue) return {
+		workspaceId: flagValue,
+		source: "flag"
+	};
+	const envWs = process.env["LEVR_WORKSPACE_ID"];
+	if (envWs) return {
+		workspaceId: envWs,
+		source: "env"
+	};
+	return null;
+}
 
 //#endregion
-export { autoSelectWorkspace, fetchSites, resolveWorkspace };
+export { autoSelectWorkspace, fetchSites, resolveWorkspaceFor };

package/dist/{runHandler-CTfUyBNW.js → runHandler-B-u-0eRk.js}

@@ -1,10 +1,10 @@
 import { executeInspect } from "./inspect-BbL7kDe-.js";
-import { client, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { client, configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import "./workspace-store-Bmw104Qa.js";
-import { resolveWorkspace } from "./resolve-workspace-BbK3uYQc.js";
+import { resolveWorkspaceFor } from "./resolve-workspace-D8y7twod.js";
 import { existsSync } from "node:fs";
 import { constants as constants$1 } from "node:os";
 import { spawnSync } from "node:child_process";
@@ -365,6 +365,15 @@ function delay(ms) {
 
 //#endregion
 //#region src/commands/gates/runHandler.ts
+/** The server's own words for a failed SDK call, for an error line. */
+function describeSdkError(error) {
+	if (typeof error === "string") return error.length > 200 ? `${error.slice(0, 200)}…` : error;
+	if (!error || typeof error !== "object") return "request failed";
+	const e = error;
+	const message = Array.isArray(e.message) ? e.message.map(String).join("; ") : typeof e.message === "string" ? e.message : typeof e.error === "string" ? e.error : "";
+	const text = [typeof e.statusCode === "number" ? `HTTP ${e.statusCode}` : "", message].filter(Boolean).join(": ") || "request failed";
+	return text.length > 200 ? `${text.slice(0, 200)}…` : text;
+}
 /** ENG-6070 review R5 M3 — dead gates are named, with their remedy. */
 function printDeadGates(out, dead) {
 	for (const d of dead ?? []) out(`  DEAD ${d.test_name ? `"${d.test_name}"` : d.link_id}${d.required === false ? " (advisory)" : ""}: ${d.reason === "test_deleted" ? "its test was deleted" : "the gate was removed"}${d.remedy ? ` — ${d.remedy}` : ""}`);
@@ -431,13 +440,15 @@ async function gatesRunHandler(flags, issue) {
 	};
 	if (flags.ci) setCiHeaders(null);
 	let workspaceId;
-	if (auth.type === "jwt") try {
-		const ws = await resolveWorkspace(flags["workspace-id"]);
-		workspaceId = ws.workspaceId;
-		client.setConfig({
-			...client.getConfig(),
-			workspaceId: ws.workspaceId
-		});
+	try {
+		const ws = await resolveWorkspaceFor(auth, flags["workspace-id"]);
+		if (ws) {
+			workspaceId = ws.workspaceId;
+			client.setConfig({
+				...client.getConfig(),
+				workspaceId: ws.workspaceId
+			});
+		}
 	} catch (err) {
 		this.logger.error(err instanceof Error ? err.message : "Workspace resolution failed.");
 		this.process.exitCode = 1;
@@ -451,7 +462,8 @@ async function gatesRunHandler(flags, issue) {
 		} });
 		const row = found.data?.data?.[0];
 		if (found.error || !row) {
-			this.logger.error(`Issue ${issue} not found in this workspace.`);
+			const where = workspaceId ? `workspace ${workspaceId}` : "the token's workspace";
+			this.logger.error(found.error ? `Could not look up issue ${issue} in ${where} (${describeSdkError(found.error)}).` : `Issue ${issue} not found in ${where}.`);
 			this.process.exitCode = 1;
 			return;
 		}

package/dist/{sdk-client-B4FMd_Fa.js → sdk-client-BgzKzVIR.js}

@@ -1,4 +1,4 @@
-import { getApiUrl } from "./env-CvjMSRd7.js";
+import { getApiUrl } from "./env-DjeRwmZ7.js";
 
 //#region ../sdk-public/dist/runtime/client.js
 function createInterceptorManager() {

package/dist/{selectHandler-CrLuGY3d.js → selectHandler-C0gs-Q70.js}

@@ -1,7 +1,7 @@
-import { authGetSitesV1, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import "./env-CvjMSRd7.js";
-import "./token-refresh-CJB7Qlxy.js";
-import { resolveToken } from "./resolve-token-ByZq05Us.js";
+import { authGetSitesV1, configureClient } from "./sdk-client-BgzKzVIR.js";
+import "./token-refresh-BpFuU4Ij.js";
+import "./env-DjeRwmZ7.js";
+import { resolveToken } from "./resolve-token-DKEXT7SA.js";
 import { saveWorkspace } from "./workspace-store-Bmw104Qa.js";
 
 //#region src/commands/workspace/selectHandler.ts
@@ -19,6 +19,11 @@ async function selectHandler(_flags, workspaceId) {
 		this.process.exitCode = 1;
 		return;
 	}
+	if (auth.source === "env") {
+		this.logger.error("LEVR_TOKEN is set: a workspace selected here would be saved for your login session, not for that token. Pass --workspace-id or set LEVR_WORKSPACE_ID instead.");
+		this.process.exitCode = 1;
+		return;
+	}
 	configureClient(auth);
 	const result = await authGetSitesV1();
 	if (result.error) {

package/dist/{statusHandler-BQXn93-r.js → statusHandler-Dnnh80ZN.js}

@@ -1,6 +1,6 @@
-import { authGetProfileV1, configureClient } from "./sdk-client-B4FMd_Fa.js";
-import { getApiUrl, getPatToken, readCredentials } from "./env-CvjMSRd7.js";
-import { isTokenExpired } from "./token-refresh-CJB7Qlxy.js";
+import { authGetProfileV1, configureClient } from "./sdk-client-BgzKzVIR.js";
+import { classifyToken, isTokenExpired } from "./token-refresh-BpFuU4Ij.js";
+import { getApiUrl, getPatToken, readCredentials } from "./env-DjeRwmZ7.js";
 import chalk from "chalk";
 
 //#region src/commands/auth/statusHandler.ts
@@ -8,8 +8,10 @@ async function statusHandler() {
 	const apiUrl = getApiUrl();
 	const pat = getPatToken();
 	if (pat) {
-		if (await checkApiReachable(pat, "pat")) {
-			this.process.stdout.write(`${chalk.green("ok")}    Authenticated via LEVR_TOKEN (PAT)\n`);
+		const type = classifyToken(pat);
+		const kind = type === "pat" ? "personal access token" : "OAuth access token";
+		if (await checkApiReachable(pat, type)) {
+			this.process.stdout.write(`${chalk.green("ok")}    Authenticated via LEVR_TOKEN (${kind})\n`);
 			this.process.stdout.write(`  API:  ${apiUrl} (reachable)\n`);
 		} else {
 			this.process.stdout.write(`${chalk.yellow("warn")}  LEVR_TOKEN is set but API is unreachable\n`);

package/dist/{token-refresh-CJB7Qlxy.js → token-refresh-BpFuU4Ij.js}

@@ -1,5 +1,29 @@
-import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./env-CvjMSRd7.js";
+import { CLI_CLIENT_ID, deleteCredentials, getApiUrl, writeCredentials } from "./env-DjeRwmZ7.js";
 
+//#region src/auth/token-shape.ts
+/**
+* Classify a bearer token by its SHAPE — [issue:ENG-6068].
+*
+* The server decides how to verify a token by looking at the token, not at
+* where it came from (`isPersonalAccessToken` in the backend's auth
+* middleware): a Levr personal access token starts with `tq_`, and anything
+* else is handed to the JWT verifier. `LEVR_TOKEN` carries either kind — a
+* PAT minted in Settings, or an OAuth access token a device-code login
+* printed for CI — so the CLI must apply the same rule. Until ENG-6068 every
+* `LEVR_TOKEN` was called a PAT, and the JWT-only steps (resolving
+* `--workspace-id` / `LEVR_WORKSPACE_ID`, `levr workspace list|select`) were
+* silently skipped for an OAuth token, which has no workspace of its own.
+*
+* Leaf module on purpose: no imports, so `resolve-token`, the handlers and
+* their tests can all read it without pulling in credentials or the SDK.
+*/
+const PAT_PREFIX = "tq_";
+/** `tq_…` is a personal access token; everything else is treated as a JWT. */
+function classifyToken(token) {
+	return token.startsWith(PAT_PREFIX) ? "pat" : "jwt";
+}
+
+//#endregion
 //#region src/auth/token-refresh.ts
 const REFRESH_BUFFER_MS = 300 * 1e3;
 /**
@@ -45,4 +69,4 @@ async function refreshToken(creds) {
 }
 
 //#endregion
-export { isTokenExpired, refreshToken };
+export { classifyToken, isTokenExpired, refreshToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@levr-one/cli",
-  "version": "0.12.5",
+  "version": "0.12.7",
   "description": "The command-line interface for Levr",
   "type": "module",
   "license": "MIT",