@lotics/cli 0.35.0 → 0.36.0

package/README.md

@@ -39,42 +39,57 @@ lotics auth signup a@b.com --name "Agent"            # non-interactive
 lotics auth web
 ```
 
-**`lotics auth api-key`** — Saves an existing API key directly (e.g. one created in the Lotics web app).
+**`lotics auth api-key`** — Saves an API key (e.g. one created in the Lotics web app). The key belongs to one org, so this **registers that org as a profile** — run it once per org. Registering a second key adds a profile; it does not overwrite the first.
 
 ```bash
 lotics auth api-key                  # interactive prompt
-lotics auth api-key ltk_...          # non-interactive
+lotics auth api-key ltk_...          # registers the key's org as a profile (now active)
 ```
 
-API key is saved to the config file. Run `lotics auth logout` to remove saved credentials.
+Run `lotics auth logout [<name|id>]` to remove a profile (default: the active org), or `lotics auth logout --all` to wipe the store.
 
-Auth priority: `--api-key` flag > `LOTICS_API_KEY` env > config file.
+## Organizations
 
-### Config file location
+Each saved API key belongs to one org. Register a key per org once, then switch freely — no re-pasting:
 
-The CLI resolves `.lotics/config.json` by walking up from the current working directory — the first ancestor that has one wins, otherwise the global `~/.lotics/config.json`. A per-directory config lets a project or worktree pin its own account and workspace; commands run from a subdirectory still resolve to it.
+```bash
+lotics org                          # list saved orgs (marks the active one)
+lotics org use acme                 # switch active org by name (or org id)
+lotics org use "Acme Corp"          # names are case-insensitive
+```
+
+### Working in parallel (worktrees)
 
-Create one by passing `--local` to `lotics auth`:
+Pin a directory to its own org/workspace so a global `org use` elsewhere never disturbs it. The pin is a pointer — the key still comes from the global store, so there's nothing to paste:
 
 ```bash
 cd my-worktree
-lotics auth api-key ltk_... --local      # writes ./.lotics/config.json
-lotics workspace select wks_...          # auto-resolves to the local config
+lotics org use acme --local         # writes ./.lotics/config.json { active_org }
+lotics workspace select wks_...     # records the workspace in the local pin
 ```
 
-`.lotics/` should be gitignored. Note: an exported `LOTICS_API_KEY` overrides the config file's key.
+Each worktree resolves independently; switching the global default in another shell leaves pinned worktrees untouched. Use `lotics auth whoami` to see the active org, workspace, and which source resolved them. `.lotics/` should be gitignored.
+
+### Resolution precedence
+
+```
+--api-key flag  >  LOTICS_API_KEY env  >  LOTICS_ORG env (name|id)
+  >  local .lotics/config.json  >  global active profile
+```
+
+`LOTICS_WORKSPACE` (or `--workspace <id>` / `-w`) overrides the workspace at any level. For ephemeral or CI use, set `LOTICS_API_KEY` instead of saving anything.
 
 ## Workspaces
 
-If your organization has multiple workspaces, select one before running tools:
+Workspaces live inside the active org. If the org has more than one, select before running tools:
 
 ```bash
-lotics workspace                    # list workspaces (marks current)
-lotics workspace select wks_...     # switch to a workspace
+lotics workspace                    # list workspaces in the active org (marks current)
+lotics workspace select wks_...     # set the workspace for the active scope (pin or profile)
 lotics workspace create "Sales"     # create a new workspace (admin only)
 ```
 
-Single-workspace organizations auto-select on first use.
+Single-workspace organizations auto-select on first use. The selection is remembered per org, so switching back lands where you left off.
 
 ## CLI
 
@@ -97,8 +112,11 @@ lotics upload ./report.pdf ./data.csv ./documents/
 lotics run generate_excel_from_template '{"..."}'
 lotics download <file_id> -o ./reports/
 
-# CI / non-interactive
+# CI / non-interactive (key inline)
 LOTICS_API_KEY=ltk_... lotics run query_tables '{}'
+
+# One-off against a saved org/workspace, no switching
+LOTICS_ORG=acme LOTICS_WORKSPACE=wks_... lotics run query_tables '{}'
 ```
 
 ## Local .xlsx and .docx authoring

package/dist/args.d.ts

@@ -21,11 +21,13 @@ export declare function parseArgs(argv: string[]): {
         output?: string;
         as?: string;
         apiKey?: string;
+        workspace?: string;
         name?: string;
         timezone?: string;
         message?: string;
         forceWorkflowSync: boolean;
         local: boolean;
+        all: boolean;
         version: boolean;
         help: boolean;
     };

package/dist/args.js

@@ -17,11 +17,13 @@ export function parseArgs(argv) {
         output: undefined,
         as: undefined,
         apiKey: undefined,
+        workspace: undefined,
         name: undefined,
         timezone: undefined,
         message: undefined,
         forceWorkflowSync: false,
         local: false,
+        all: false,
         version: false,
         help: false,
     };
@@ -49,6 +51,10 @@ export function parseArgs(argv) {
             case "--api-key":
                 flags.apiKey = argv[++i];
                 break;
+            case "--workspace":
+            case "-w":
+                flags.workspace = argv[++i];
+                break;
             case "--name":
                 flags.name = argv[++i];
                 break;
@@ -65,6 +71,9 @@ export function parseArgs(argv) {
             case "--local":
                 flags.local = true;
                 break;
+            case "--all":
+                flags.all = true;
+                break;
             case "--version":
             case "-v":
                 flags.version = true;

package/dist/args.test.js

@@ -34,4 +34,32 @@ describe("parseArgs", () => {
         expect(r.flags.forceWorkflowSync).toBe(false);
         expect(r.flags.message).toBeUndefined();
     });
+    it("parses --workspace as a value flag", () => {
+        const r = parseArgs(["run", "query_tables", "{}", "--workspace", "wsp_123"]);
+        expect(r.flags.workspace).toBe("wsp_123");
+        expect(r.command).toBe("run");
+        expect(r.subcommand).toBe("query_tables");
+        expect(r.toolArgs).toBe("{}");
+    });
+    it("parses -w as the workspace alias", () => {
+        const r = parseArgs(["run", "query_tables", "-w", "wsp_123"]);
+        expect(r.flags.workspace).toBe("wsp_123");
+    });
+    it("parses --all as a boolean flag", () => {
+        const r = parseArgs(["auth", "logout", "--all"]);
+        expect(r.flags.all).toBe(true);
+        expect(r.command).toBe("auth");
+        expect(r.subcommand).toBe("logout");
+    });
+    it("defaults workspace to undefined and all to false", () => {
+        const r = parseArgs(["org"]);
+        expect(r.flags.workspace).toBeUndefined();
+        expect(r.flags.all).toBe(false);
+    });
+    it("treats `org use <name>` as command / subcommand / positional", () => {
+        const r = parseArgs(["org", "use", "Acme Corp"]);
+        expect(r.command).toBe("org");
+        expect(r.subcommand).toBe("use");
+        expect(r.toolArgs).toBe("Acme Corp");
+    });
 });

package/dist/cli.js

@@ -3,7 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import readline from "node:readline";
 import { LoticsClient, API_BASE_URL } from "./client.js";
-import { resolveAuth, loadConfig, saveConfig, deleteConfig, getConfigPath, checkForUpdate } from "./config.js";
+import { resolveContext, deleteConfig, getConfigPath, loadGlobalConfig, saveGlobalConfig, loadLocalConfig, upsertProfile, removeProfile, setActiveOrg, setSelectedWorkspace, resolveProfileByNameOrId, checkForUpdate, } from "./config.js";
 import { VERSION } from "./version.js";
 import { appCreate, appPull, appDeploy, appDev, appSetSubdomain, appRename } from "./app_commands.js";
 import { parseArgs } from "./args.js";
@@ -24,20 +24,31 @@ Lotics is an AI-powered operations platform. Through this CLI you can:
 AUTHENTICATION
   lotics auth                          Show auth help
   lotics auth signup <email>           Create account (run "lotics auth" for details)
+  lotics auth api-key <key>            Save a key — registers its org as a profile
+
+ORGANIZATIONS
+  Each saved API key belongs to one org. Register a key per org once, then
+  switch between them with no re-pasting. Workspaces live inside an org.
+  lotics org                           List saved orgs (marks active)
+  lotics org use <name|id>             Switch the active org
+  lotics org use <name|id> --local     Pin THIS directory to an org (worktrees)
 
 USAGE
   1. lotics auth signup <email>        Create account or authenticate
-  2. lotics workspace                  Check current workspace (auto-selects if only one)
-  3. lotics tools                      List available tools by category
-  4. lotics tools <name>               Show tool description and full input schema
-  5. lotics run <tool> '<json>'        Execute a tool with JSON arguments
+  2. lotics org                        See saved orgs / which one is active
+  3. lotics workspace                  Check current workspace (auto-selects if only one)
+  4. lotics tools                      List available tools by category
+  5. lotics tools <name>               Show tool description and full input schema
+  6. lotics run <tool> '<json>'        Execute a tool with JSON arguments
 
   Always inspect the schema (step 4) before calling a tool.
   Tools are grouped by category (tables, records, views, etc.).
   Query tools return IDs used as arguments to other tools.
 
 COMMANDS
-  lotics workspace                     List workspaces (marks current)
+  lotics org                           List saved orgs (marks active)
+  lotics org use <name|id> [--local]   Switch active org (--local pins this dir)
+  lotics workspace                     List workspaces in the active org (marks current)
   lotics workspace select <id>         Switch to a different workspace
   lotics workspace create <name>       Create a new workspace (admin only)
   lotics tools                         List all available tools
@@ -68,15 +79,23 @@ FLAGS
   --timeout <ms>     Timeout for tool execution (default: 60000)
   -o <path>          Output dir for downloads
   --as <name>        Override upload filename
-  --api-key <key>    API key (overrides saved config and LOTICS_API_KEY)
-  --local            (lotics auth) Save credentials to ./.lotics/config.json
+  --api-key <key>    One-off API key (overrides saved config + env)
+  --workspace <id>   One-off workspace override (alias: -w)
+  --local            Pin the current directory (lotics org use / auth api-key)
+  --all              (lotics auth logout) Remove every saved credential
   --version          Show version
 
 CONFIG
-  Credentials resolve from a .lotics/config.json found by walking up from the
-  current directory, else the global ~/.lotics/config.json. Run "lotics auth
-  api-key <key> --local" inside a directory (e.g. a worktree) to pin it to its
-  own account and workspace.
+  API keys are stored once per org in the global ~/.lotics/config.json as named
+  profiles. Switch with "lotics org use <name|id>" — no re-pasting. A directory
+  (e.g. a git worktree) can pin its own org/workspace with "lotics org use
+  <name|id> --local", which writes a .lotics/config.json pointer (the key is
+  resolved from the global store) — so a global switch never disturbs it.
+
+  Resolution precedence (highest first):
+    --api-key flag  >  LOTICS_API_KEY env  >  LOTICS_ORG env  >
+    local .lotics/config.json  >  global active profile
+  LOTICS_WORKSPACE (or --workspace) overrides the workspace at any level.
 
 OUTPUT
   Default output is a compact text summary optimized for AI agents —
@@ -105,25 +124,27 @@ function printAuthHelp() {
     console.log(`Authentication commands:
 
   lotics auth signup <email>           Create account, org, workspace, and API key
-  lotics auth api-key [key]            Save an existing API key (e.g. from the web app)
+  lotics auth api-key [key]            Save an API key — registers its org as a profile
   lotics auth web                      Send a magic link email to access the web app
-  lotics auth whoami                   Show the current account's name, email, and organization
-  lotics auth logout                   Remove saved credentials
+  lotics auth whoami                   Show the active account, org, workspace, and source
+  lotics auth logout [<name|id>]       Remove a saved credential (default: the active org,
+                                       or unpin the current directory)
+  lotics auth logout --all             Remove every saved credential
 
 Auth flags:
-  --local                Save credentials to ./.lotics/config.json (this directory)
-                         instead of the global ~/.lotics — applies to signup + api-key
+  --local                Pin the current directory instead of the global store.
+                         signup/api-key write a self-contained ./.lotics/config.json
+                         (inline key) — for a hermetic worktree or CI.
   --name <name>          (signup) Display name (defaults to email prefix)
   --timezone <timezone>  (signup) Workspace timezone (defaults to UTC, e.g. Asia/Ho_Chi_Minh)
 
-Signup sends a magic link email so you can access the Lotics web app.
-Use lotics auth web to request a new magic link at any time.
+API keys are stored once per org as named profiles in ~/.lotics/config.json.
+Registering a second key adds a profile — it does not overwrite the first.
+Switch active org with "lotics org use <name|id>".
 
-Auth priority: --api-key flag > LOTICS_API_KEY env > config file.
-Config file: .lotics/config.json found by walking up from the current directory,
-else ~/.lotics/config.json. A per-directory config pins a project or worktree to
-its own account and workspace; --local creates one. Note: an exported
-LOTICS_API_KEY env var overrides the config file's key.`);
+Resolution precedence (highest first):
+  --api-key flag > LOTICS_API_KEY env > LOTICS_ORG env > local .lotics/config.json
+  > global active profile. LOTICS_WORKSPACE / --workspace override the workspace.`);
 }
 function readStdin() {
     return new Promise((resolve, reject) => {
@@ -179,17 +200,25 @@ async function handleSignup(positionalEmail, flags) {
         }
         process.exit(1);
     }
-    const scope = flags.local ? "local" : "auto";
-    const existing = loadConfig(scope) ?? {};
-    saveConfig({
-        ...existing,
-        api_key: data.api_key,
-        email: data.email,
-        workspace_id: data.workspace_id,
-    }, scope);
+    const apiKey = data.api_key;
+    const orgId = data.organization_id;
+    const workspaceId = data.workspace_id;
+    // The org is created with the display name; mirror the server's email-prefix
+    // default when none was supplied. Use `||` (not `??`) so an empty-string name
+    // falls through exactly as the server's `if (name)` truthiness check does.
+    const orgName = name || email.split("@")[0];
+    // The key always lives in the global store as a profile; --local additionally
+    // pins this directory to it (a pointer), instead of making it the global default.
+    upsertProfile(orgId, { api_key: apiKey, org_name: orgName, workspace_id: workspaceId });
+    const existing = loadGlobalConfig() ?? {};
+    saveGlobalConfig({ ...existing, email });
+    setActiveOrg(orgId, flags.local ? "local" : "global");
     console.error(`Account created. You can now use the CLI.`);
-    console.error(`  Email:  ${data.email}`);
-    console.error(`  Config: ${getConfigPath(scope)}`);
+    console.error(`  Email:  ${email}`);
+    console.error(`  Org:    ${orgName} (${orgId})`);
+    console.error(flags.local
+        ? `  Pinned this directory: ${getConfigPath("local")}`
+        : `  Saved to the "${orgName}" profile in ~/.lotics (now active)`);
     console.error(`\nCheck your email for a magic link to access the Lotics web app.`);
     console.error(`Run "lotics auth web" to request a new link at any time.`);
 }
@@ -200,27 +229,24 @@ async function handleSetup(providedKey, local) {
         process.exit(1);
     }
     const client = new LoticsClient({ apiKey });
-    let email;
+    let info;
     try {
-        const info = await client.whoami();
-        email = info.email;
+        info = await client.whoami();
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
         console.error(`Authentication failed: ${message}`);
         process.exit(1);
     }
-    const scope = local ? "local" : "auto";
-    const existing = loadConfig(scope) ?? {};
-    const newConfig = { ...existing, api_key: apiKey, email };
-    // Auto-resolve workspace
+    // Auto-resolve workspace (only when the org has exactly one).
+    let workspaceId;
     try {
         const workspaces = await client.listWorkspaces();
         if (workspaces.length === 1) {
-            newConfig.workspace_id = workspaces[0].id;
+            workspaceId = workspaces[0].id;
         }
         else if (workspaces.length > 1) {
-            console.error(`\nMultiple workspaces found. Run "lotics workspace select <id>" to choose one:`);
+            console.error(`\nMultiple workspaces in ${info.organization_name}. Run "lotics workspace select <id>" to choose one:`);
             printWorkspaceList(workspaces);
         }
     }
@@ -228,29 +254,51 @@ async function handleSetup(providedKey, local) {
         const msg = error instanceof Error ? error.message : String(error);
         console.error(`Warning: could not resolve workspace: ${msg}`);
     }
-    saveConfig(newConfig, scope);
-    console.error("Authenticated.");
-    console.error(`  Config: ${getConfigPath(scope)}`);
+    // The key always lives in the global store as a profile; --local additionally
+    // pins this directory to it (a pointer), instead of making it the global default.
+    upsertProfile(info.organization_id, {
+        api_key: apiKey,
+        org_name: info.organization_name,
+        workspace_id: workspaceId,
+    });
+    const existing = loadGlobalConfig() ?? {};
+    saveGlobalConfig({ ...existing, email: info.email });
+    setActiveOrg(info.organization_id, local ? "local" : "global");
+    if (local) {
+        console.error(`Authenticated as ${info.email} in ${info.organization_name}.`);
+        console.error(`  Pinned this directory: ${getConfigPath("local")}`);
+    }
+    else {
+        console.error(`Authenticated as ${info.email} in ${info.organization_name} (now active).`);
+        console.error(`  Saved to the "${info.organization_name}" profile in ~/.lotics`);
+    }
 }
 function requireClient(flags) {
-    const auth = resolveAuth(flags);
-    if (!auth) {
-        console.error('Not authenticated. Run "lotics auth signup" or set LOTICS_API_KEY.');
+    const ctx = resolveContext(flags);
+    if (!ctx) {
+        console.error('Not authenticated. Run "lotics auth signup", "lotics auth api-key <key>", or set LOTICS_API_KEY.');
         process.exit(1);
     }
-    const config = loadConfig();
-    return new LoticsClient({ apiKey: auth.apiKey, workspaceId: config?.workspace_id });
+    return { client: new LoticsClient({ apiKey: ctx.apiKey, workspaceId: ctx.workspaceId }), ctx };
 }
+const SOURCE_LABELS = {
+    flag: "--api-key flag",
+    env_key: "LOTICS_API_KEY env",
+    env_org: "LOTICS_ORG env",
+    local_pointer: "local .lotics/config.json (pin)",
+    global_profile: "global active profile",
+};
 function printWorkspaceList(workspaces, currentId) {
     for (const ws of workspaces) {
         const marker = ws.id === currentId ? " (current)" : "";
         console.error(`  ${ws.id}  ${ws.name}  ${ws.timezone}  ${ws.default_currency}${marker}`);
     }
 }
-async function resolveWorkspace(client) {
-    const config = loadConfig();
-    if (config?.workspace_id)
+async function resolveWorkspace(client, ctx) {
+    if (ctx.workspaceId) {
+        client.setWorkspaceId(ctx.workspaceId);
         return;
+    }
     let workspaces;
     try {
         workspaces = await client.listWorkspaces();
@@ -265,8 +313,9 @@ async function resolveWorkspace(client) {
         process.exit(1);
     }
     if (workspaces.length === 1) {
-        const existing = config ?? {};
-        saveConfig({ ...existing, workspace_id: workspaces[0].id });
+        // Persist the auto-resolution where the credential lives; null means it
+        // came from --api-key/env with no profile, so it's an in-memory selection.
+        setSelectedWorkspace(workspaces[0].id);
         client.setWorkspaceId(workspaces[0].id);
         return;
     }
@@ -320,33 +369,66 @@ async function main() {
             return;
         }
         if (subcommand === "whoami") {
-            const auth = resolveAuth(flags);
-            if (!auth) {
-                console.error('Not authenticated. Run "lotics auth signup" or set LOTICS_API_KEY.');
+            const ctx = resolveContext(flags);
+            if (!ctx) {
+                console.error('Not authenticated. Run "lotics auth signup", "lotics auth api-key <key>", or set LOTICS_API_KEY.');
                 process.exit(1);
             }
-            const client = new LoticsClient({ apiKey: auth.apiKey });
+            const client = new LoticsClient({ apiKey: ctx.apiKey });
             const info = await client.whoami();
-            const existing = loadConfig() ?? {};
-            saveConfig({ ...existing, email: info.email });
+            const existing = loadGlobalConfig() ?? {};
+            saveGlobalConfig({ ...existing, email: info.email });
             if (flags.json) {
-                console.log(JSON.stringify(info, null, 2));
+                console.log(JSON.stringify({ ...info, workspace_id: ctx.workspaceId ?? null, source: ctx.source }, null, 2));
             }
             else {
-                console.log(`Name:    ${info.name}`);
-                console.log(`Email:   ${info.email}`);
-                console.log(`Org:     ${info.organization_name} (${info.organization_id})`);
+                console.log(`Name:       ${info.name}`);
+                console.log(`Email:      ${info.email}`);
+                console.log(`Org:        ${info.organization_name} (${info.organization_id})`);
+                console.log(`Workspace:  ${ctx.workspaceId ?? "(none selected)"}`);
+                console.log(`Source:     ${SOURCE_LABELS[ctx.source]}`);
             }
-            console.error(`Config:  ${getConfigPath()}`);
             return;
         }
         if (subcommand === "logout") {
-            deleteConfig();
-            console.error("Logged out. Credentials removed.");
+            const local = loadLocalConfig();
+            // Bare logout inside a pinned directory just unpins it.
+            if (local && !flags.all && !toolArgs) {
+                deleteConfig();
+                console.error("Removed the local pin for this directory.");
+                return;
+            }
+            if (flags.all) {
+                const g = loadGlobalConfig();
+                saveGlobalConfig({ last_update_check: g?.last_update_check, latest_version: g?.latest_version });
+                console.error("Removed all saved credentials.");
+                return;
+            }
+            const g = loadGlobalConfig() ?? {};
+            const profiles = g.profiles ?? {};
+            let resolved;
+            if (toolArgs) {
+                resolved = resolveProfileByNameOrId(profiles, toolArgs);
+            }
+            else if (g.active_org && profiles[g.active_org]) {
+                resolved = [g.active_org, profiles[g.active_org]];
+            }
+            else {
+                resolved = null;
+            }
+            if (!resolved) {
+                console.error(toolArgs
+                    ? `No saved credential matches "${toolArgs}".`
+                    : 'No active credential to remove. Pass an org name/id, or use --all.');
+                process.exit(1);
+            }
+            const [orgId, profile] = resolved;
+            removeProfile(orgId);
+            console.error(`Removed the "${profile.org_name}" credential (${orgId}).`);
             return;
         }
         if (subcommand === "web") {
-            const client = requireClient(flags);
+            const { client } = requireClient(flags);
             const { email } = await client.login();
             console.error(`Magic link sent to ${email}. Check your email to access the Lotics web app.`);
             return;
@@ -366,6 +448,63 @@ async function main() {
         await runDocxCommand(subcommand, toolArgs, restArgs);
         return;
     }
+    // --- lotics org [list | use <name|id> [--local]] — credential store, config-only ---
+    if (command === "org") {
+        const global = loadGlobalConfig() ?? {};
+        const profiles = global.profiles ?? {};
+        const local = loadLocalConfig();
+        if (subcommand === "use") {
+            if (!toolArgs) {
+                console.error("Usage: lotics org use <name|id> [--local]");
+                process.exit(1);
+            }
+            const resolved = resolveProfileByNameOrId(profiles, toolArgs);
+            if (!resolved) {
+                console.error(`No saved credential for "${toolArgs}". Run "lotics auth api-key <key>" while authenticated to that org, or "lotics org" to list.`);
+                process.exit(1);
+            }
+            const [orgId, profile] = resolved;
+            if (flags.local) {
+                setActiveOrg(orgId, "local");
+                console.error(`Pinned this directory to ${profile.org_name} (${orgId}).`);
+            }
+            else {
+                setActiveOrg(orgId, "global");
+                console.error(`Switched active org to ${profile.org_name} (${orgId}).`);
+                if (local?.active_org) {
+                    console.error("Note: a local pin (.lotics/config.json) overrides the global default in this directory. Use --local to change the pin here.");
+                }
+            }
+            return;
+        }
+        if (subcommand && subcommand !== "list") {
+            console.error(`Unknown org subcommand: ${subcommand}`);
+            console.error("Usage: lotics org [list | use <name|id> [--local]]");
+            process.exit(1);
+        }
+        const orgIds = Object.keys(profiles);
+        if (orgIds.length === 0) {
+            console.error('No saved orgs. Run "lotics auth api-key <key>" to add one.');
+            return;
+        }
+        // The active org in THIS directory: a local pin wins over the global default.
+        const effectiveActive = local?.active_org ?? global.active_org;
+        if (flags.json) {
+            console.log(JSON.stringify(orgIds.map((id) => ({
+                org_id: id,
+                org_name: profiles[id].org_name,
+                workspace_id: profiles[id].workspace_id ?? null,
+                active: id === effectiveActive,
+            })), null, 2));
+        }
+        else {
+            for (const id of orgIds) {
+                const marker = id === effectiveActive ? " (active)" : "";
+                console.log(`${id}  ${profiles[id].org_name}${marker}`);
+            }
+        }
+        return;
+    }
     // --- Validate command before auth ---
     if (command !== "tools" && command !== "upload" && command !== "run" && command !== "download" && command !== "workspace" && command !== "app") {
         console.error(`Unknown command: ${command}`);
@@ -405,11 +544,11 @@ async function main() {
         console.error('Downloads every file on the given file field into the output dir.');
         process.exit(1);
     }
-    const client = requireClient(flags);
+    const { client, ctx } = requireClient(flags);
     // lotics workspace / lotics workspace list / lotics workspace select <id>
     if (command === "workspace") {
         const workspaces = await client.listWorkspaces();
-        const config = loadConfig();
+        const currentWorkspaceId = ctx.workspaceId;
         if (subcommand === "select") {
             const targetId = toolArgs;
             if (!targetId) {
@@ -419,12 +558,16 @@ async function main() {
             const target = workspaces.find((ws) => ws.id === targetId);
             if (!target) {
                 console.error(`Workspace not found: ${targetId}\n\nAvailable workspaces:`);
-                printWorkspaceList(workspaces, config?.workspace_id);
+                printWorkspaceList(workspaces, currentWorkspaceId);
                 process.exit(1);
             }
-            const existing = config ?? {};
-            saveConfig({ ...existing, workspace_id: target.id });
-            console.error(`Switched to workspace: ${target.name} (${target.id})`);
+            const written = setSelectedWorkspace(target.id);
+            if (!written) {
+                console.error(`Switched to ${target.name} (${target.id}) for this command, but it could not be saved — credentials came from --api-key/LOTICS_API_KEY with no saved profile. Run "lotics auth api-key <key>" to persist a default.`);
+                return;
+            }
+            const where = written.scope === "local" ? " (pinned to this directory)" : "";
+            console.error(`Switched to workspace: ${target.name} (${target.id})${where}`);
             return;
         }
         if (subcommand === "create") {
@@ -435,8 +578,7 @@ async function main() {
             }
             const timezone = flags.timezone;
             const created = await client.createWorkspace({ name, timezone });
-            const existing = config ?? {};
-            saveConfig({ ...existing, workspace_id: created.id });
+            setSelectedWorkspace(created.id);
             client.setWorkspaceId(created.id);
             if (flags.json) {
                 console.log(JSON.stringify(created, null, 2));
@@ -462,16 +604,17 @@ async function main() {
             }
             else {
                 for (const ws of workspaces) {
-                    const marker = ws.id === config?.workspace_id ? " (current)" : "";
+                    const marker = ws.id === currentWorkspaceId ? " (current)" : "";
                     console.log(`${ws.id}  ${ws.name}  ${ws.timezone}  ${ws.default_currency}${marker}`);
                 }
             }
         }
-        console.error(`Config: ${getConfigPath()}`);
+        if (ctx.orgName)
+            console.error(`Org: ${ctx.orgName}`);
         return;
     }
     // Ensure workspace is resolved for all remaining commands
-    await resolveWorkspace(client);
+    await resolveWorkspace(client, ctx);
     // lotics app create / pull / deploy
     if (command === "app") {
         if (subcommand === "create") {