@orchagent/cli 0.3.68 → 0.3.70

package/dist/commands/agent-keys.js

@@ -15,7 +15,12 @@ const errors_1 = require("../lib/errors");
 async function resolveAgentId(config, ref) {
     const parts = ref.split('/');
     const agentName = parts.length >= 2 ? parts[1] : parts[0];
-    const agents = await (0, api_1.listMyAgents)(config);
+    const orgSlug = parts.length >= 2 ? parts[0] : undefined;
+    // Resolve workspace context from org slug or config
+    const configFile = await (0, config_1.loadConfig)();
+    const resolvedOrg = orgSlug ?? configFile.workspace ?? config.defaultOrg;
+    const workspaceId = resolvedOrg ? await (0, api_1.resolveWorkspaceIdForOrg)(config, resolvedOrg) : undefined;
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agentName);
     if (matching.length === 0) {
         throw new errors_1.CliError(`Agent '${ref}' not found. Run 'orchagent agents' to list your agents.`);

package/dist/commands/agents.js

@@ -49,7 +49,11 @@ function registerAgentsCommand(program) {
         .option('--json', 'Output raw JSON')
         .action(async (options) => {
         const config = await (0, config_1.getResolvedConfig)();
-        const agents = await (0, api_1.listMyAgents)(config);
+        // Resolve workspace context
+        const configFile = await (0, config_1.loadConfig)();
+        const orgSlug = configFile.workspace ?? config.defaultOrg;
+        const workspaceId = orgSlug ? await (0, api_1.resolveWorkspaceIdForOrg)(config, orgSlug) : undefined;
+        const agents = await (0, api_1.listMyAgents)(config, workspaceId);
         // Apply filter if provided
         const filteredAgents = options.filter
             ? agents.filter(a => a.name.toLowerCase().includes(options.filter.toLowerCase()))

package/dist/commands/delete.js

@@ -42,9 +42,11 @@ Examples:
         if (!config.apiKey) {
             throw new errors_1.CliError('Not logged in. Run `orchagent login` first.');
         }
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, ref.org);
         process.stdout.write('Finding agent...\n');
         // Find the agent by name, filtering by org if provided
-        const agents = await (0, api_1.listMyAgents)(config);
+        const agents = await (0, api_1.listMyAgents)(config, workspaceId);
         const matching = agents.filter(a => a.name === ref.agent && (!a.org_slug || a.org_slug === ref.org));
         if (matching.length === 0) {
             throw new errors_1.CliError(`Agent '${ref.org}/${ref.agent}' not found`);

package/dist/commands/info.js

@@ -49,7 +49,7 @@ async function fetchReadme(url) {
         return null;
     }
 }
-async function getAgentInfo(config, org, agent, version) {
+async function getAgentInfo(config, org, agent, version, workspaceId) {
     // Use public metadata endpoint as primary source — never blocked by download restrictions
     try {
         const publicMeta = await (0, api_1.getPublicAgent)(config, org, agent, version);
@@ -78,11 +78,11 @@ async function getAgentInfo(config, org, agent, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agent);
     if (matching.length === 0) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
@@ -123,8 +123,10 @@ function registerInfoCommand(program) {
         .action(async (agentArg, options) => {
         const config = await (0, config_1.getResolvedConfig)();
         const { org, agent, version } = (0, agent_ref_1.parseAgentRef)(agentArg);
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, org);
         // Fetch agent metadata
-        const agentData = await getAgentInfo(config, org, agent, version);
+        const agentData = await getAgentInfo(config, org, agent, version, workspaceId);
         if (options.json) {
             // Don't expose internal routing URLs in JSON output
             const output = { ...agentData };

package/dist/commands/install.js

@@ -29,7 +29,7 @@ function parseAgentRef(value) {
     }
     throw new errors_1.CliError('Invalid agent reference. Use org/agent or agent format.');
 }
-async function downloadAgentWithFallback(config, org, name, version) {
+async function downloadAgentWithFallback(config, org, name, version, workspaceId) {
     // Fetch public metadata first to check if paid
     let publicMeta;
     try {
@@ -48,12 +48,12 @@ async function downloadAgentWithFallback(config, org, name, version) {
     if (publicMeta && (0, pricing_1.isPaidAgent)(publicMeta)) {
         // Paid agent - check if owner
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (publicMeta.org_id && callerOrg.id === publicMeta.org_id) ||
                 (publicMeta.org_slug && callerOrg.slug === publicMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint with full prompt
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === name);
                 if (matching.length > 0) {
                     let targetAgent;
@@ -90,12 +90,12 @@ async function downloadAgentWithFallback(config, org, name, version) {
     if (publicMeta && publicMeta.allow_local_download === false) {
         // Check if owner (can bypass)
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (publicMeta.org_id && callerOrg.id === publicMeta.org_id) ||
                 (publicMeta.org_slug && callerOrg.slug === publicMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === name);
                 if (matching.length > 0) {
                     let targetAgent;
@@ -128,11 +128,11 @@ async function downloadAgentWithFallback(config, org, name, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
     }
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === name);
     if (matching.length === 0) {
         throw new api_1.ApiError(`Agent '${org}/${name}@${version}' not found`, 404);
@@ -232,11 +232,13 @@ Note: Paid agents cannot be installed locally - they run on server only.
             throw new errors_1.CliError(errMsg);
         }
         result.scope = scope;
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
         // Download agent
         log(`Fetching ${org}/${parsed.name}@${parsed.version}...\n`);
         let agent;
         try {
-            agent = await downloadAgentWithFallback(resolved, org, parsed.name, parsed.version);
+            agent = await downloadAgentWithFallback(resolved, org, parsed.name, parsed.version, workspaceId);
         }
         catch (err) {
             if (jsonMode) {

package/dist/commands/pull.js

@@ -58,7 +58,7 @@ function commandForEntrypoint(entrypoint) {
     return `python ${entrypoint}`;
 }
 // ─── Agent Resolution ───────────────────────────────────────────────────────
-async function resolveAgent(config, org, agent, version) {
+async function resolveAgent(config, org, agent, version, workspaceId) {
     // 1. Try public download endpoint
     try {
         const data = await (0, api_1.publicRequest)(config, `/public/agents/${org}/${agent}/${version}/download`);
@@ -96,7 +96,7 @@ async function resolveAgent(config, org, agent, version) {
             if (errorCode === 'PAID_AGENT_SERVER_ONLY' || errorCode === 'DOWNLOAD_DISABLED') {
                 // Try authenticated owner path
                 if (config.apiKey) {
-                    const ownerData = await tryOwnerFallback(config, org, agent, version);
+                    const ownerData = await tryOwnerFallback(config, org, agent, version, workspaceId);
                     if (ownerData)
                         return { ...ownerData, source: 'owner_authenticated' };
                 }
@@ -117,19 +117,19 @@ async function resolveAgent(config, org, agent, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const data = await resolveFromMyAgents(config, agent, version, org);
+    const data = await resolveFromMyAgents(config, agent, version, org, workspaceId);
     if (!data) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
     return { ...data, source: 'private_authenticated' };
 }
-async function tryOwnerFallback(config, org, agent, version) {
+async function tryOwnerFallback(config, org, agent, version, workspaceId) {
     try {
-        const myAgents = await (0, api_1.listMyAgents)(config);
+        const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
         let match;
         if (version === 'latest') {
             match = myAgents
@@ -148,8 +148,8 @@ async function tryOwnerFallback(config, org, agent, version) {
         return null;
     }
 }
-async function resolveFromMyAgents(config, agent, version, org) {
-    const agents = await (0, api_1.listMyAgents)(config);
+async function resolveFromMyAgents(config, agent, version, org, workspaceId) {
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agent && a.org_slug === org);
     if (matching.length === 0)
         return null;
@@ -361,9 +361,11 @@ Examples:
             throw new errors_1.CliError('Missing org. Use org/agent[@version] format, or set a default org with:\n' +
                 '  orch config set default-org <org>');
         }
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(config, org);
         write(`Resolving ${org}/${parsed.agent}@${parsed.version}...\n`);
         // Resolve agent data
-        const data = await resolveAgent(config, org, parsed.agent, parsed.version);
+        const data = await resolveAgent(config, org, parsed.agent, parsed.version, workspaceId);
         // Reject skills
         if (canonicalType(data.type) === 'skill') {
             throw new errors_1.CliError("This is a skill. Use 'orch skill install <ref>' instead.");

package/dist/commands/run.js

@@ -407,7 +407,7 @@ async function buildInjectedPayload(options) {
     return { body: JSON.stringify(merged), sourceLabel };
 }
 // ─── Local execution helpers ────────────────────────────────────────────────
-async function downloadAgent(config, org, agent, version) {
+async function downloadAgent(config, org, agent, version, workspaceId) {
     // Try public endpoint first
     try {
         return await (0, api_1.publicRequest)(config, `/public/agents/${org}/${agent}/${version}/download`);
@@ -421,7 +421,7 @@ async function downloadAgent(config, org, agent, version) {
                 // Try owner path if authenticated
                 if (config.apiKey) {
                     try {
-                        const myAgents = await (0, api_1.listMyAgents)(config);
+                        const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                         const matchingAgent = myAgents.find(a => a.name === agent && a.version === version && a.org_slug === org);
                         if (matchingAgent) {
                             // Owner! Fetch from authenticated endpoint
@@ -470,12 +470,12 @@ async function downloadAgent(config, org, agent, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
     }
     // Find agent in user's list
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === agent);
     if (matching.length === 0) {
         throw new api_1.ApiError(`Agent '${org}/${agent}@${version}' not found`, 404);
@@ -1616,7 +1616,9 @@ async function executeCloud(agentRef, file, options) {
     if (!org) {
         throw new errors_1.CliError('Missing org. Use org/agent or set default org.');
     }
-    const agentMeta = await (0, api_1.getAgentWithFallback)(resolved, org, parsed.agent, parsed.version);
+    // Resolve workspace context for the target org
+    const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
+    const agentMeta = await (0, api_1.getAgentWithFallback)(resolved, org, parsed.agent, parsed.version, workspaceId);
     const cloudType = canonicalAgentType(agentMeta.type);
     const cloudEngine = resolveExecutionEngine({
         type: agentMeta.type,
@@ -1630,22 +1632,19 @@ async function executeCloud(agentRef, file, options) {
         const agentRequiredSecrets = agentMeta.required_secrets;
         if (agentRequiredSecrets?.length) {
             try {
-                const wsSlug = configFile.workspace;
-                if (wsSlug) {
-                    const { workspaces } = await (0, api_1.request)(resolved, 'GET', '/workspaces');
-                    const ws = workspaces.find((w) => w.slug === wsSlug);
-                    if (ws) {
-                        const secretsResult = await (0, api_1.request)(resolved, 'GET', `/workspaces/${ws.id}/secrets`);
-                        const existingNames = new Set(secretsResult.secrets.map((s) => s.name));
-                        const missing = agentRequiredSecrets.filter((s) => !existingNames.has(s));
-                        if (missing.length > 0) {
-                            throw new errors_1.CliError(`Agent requires secrets not found in workspace '${wsSlug}':\n` +
-                                missing.map((s) => `  - ${s}`).join('\n') + '\n\n' +
-                                `Set them before running:\n` +
-                                missing.map((s) => `  orch secrets set ${s} <value>`).join('\n') + '\n\n' +
-                                `Secrets are injected as environment variables into the agent sandbox.\n` +
-                                `View existing secrets: orch secrets list`);
-                        }
+                // Use already-resolved workspaceId (or fall back to config workspace slug)
+                const wsId = workspaceId ?? (configFile.workspace ? (await (0, api_1.resolveWorkspaceIdForOrg)(resolved, configFile.workspace)) : undefined);
+                if (wsId) {
+                    const secretsResult = await (0, api_1.request)(resolved, 'GET', `/workspaces/${wsId}/secrets`);
+                    const existingNames = new Set(secretsResult.secrets.map((s) => s.name));
+                    const missing = agentRequiredSecrets.filter((s) => !existingNames.has(s));
+                    if (missing.length > 0) {
+                        throw new errors_1.CliError(`Agent requires secrets not found in workspace '${org}':\n` +
+                            missing.map((s) => `  - ${s}`).join('\n') + '\n\n' +
+                            `Set them before running:\n` +
+                            missing.map((s) => `  orch secrets set ${s} <value>`).join('\n') + '\n\n' +
+                            `Secrets are injected as environment variables into the agent sandbox.\n` +
+                            `View existing secrets: orch secrets list`);
                     }
                 }
             }
@@ -1661,7 +1660,7 @@ async function executeCloud(agentRef, file, options) {
     if ((0, pricing_1.isPaidAgent)(agentMeta)) {
         let isOwner = false;
         try {
-            const callerOrg = await (0, api_1.getOrg)(resolved);
+            const callerOrg = await (0, api_1.getOrg)(resolved, workspaceId);
             const agentOrgId = agentMeta.org_id;
             const agentOrgSlug = agentMeta.org_slug;
             if (agentOrgId && callerOrg.id === agentOrgId) {
@@ -1714,6 +1713,9 @@ async function executeCloud(agentRef, file, options) {
         'X-CLI-Version': package_json_1.default.version,
         'X-OrchAgent-Client': 'cli',
     };
+    if (workspaceId) {
+        headers['X-Workspace-Id'] = workspaceId;
+    }
     if (options.tenant) {
         headers['X-OrchAgent-Tenant'] = options.tenant;
     }
@@ -2299,10 +2301,12 @@ async function executeLocal(agentRef, args, options) {
     if (!org) {
         throw new errors_1.CliError('Missing org. Use org/agent format.');
     }
+    // Resolve workspace context for the target org
+    const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
     // Download agent definition with spinner
     const agentData = await (0, spinner_1.withSpinner)(`Downloading ${org}/${parsed.agent}@${parsed.version}...`, async () => {
         try {
-            return await downloadAgent(resolved, org, parsed.agent, parsed.version);
+            return await downloadAgent(resolved, org, parsed.agent, parsed.version, workspaceId);
         }
         catch (err) {
             const agentMeta = await (0, api_1.getPublicAgent)(resolved, org, parsed.agent, parsed.version);

package/dist/commands/schedule.js

@@ -143,8 +143,8 @@ function registerScheduleCommand(program) {
         }
         const workspaceId = await resolveWorkspaceId(config, options.workspace);
         const ref = (0, agent_ref_1.parseAgentRef)(agentArg);
-        // Resolve agent to get the ID
-        const agent = await (0, api_2.getAgentWithFallback)(config, ref.org, ref.agent, ref.version);
+        // Resolve agent to get the ID (pass workspace context for private agents)
+        const agent = await (0, api_2.getAgentWithFallback)(config, ref.org, ref.agent, ref.version, workspaceId);
         // Parse input data
         let inputData;
         if (options.input) {

package/dist/commands/skill.js

@@ -88,7 +88,7 @@ function parseSkillRef(value) {
     }
     throw new errors_1.CliError('Invalid skill reference. Use org/skill or skill format.');
 }
-async function downloadSkillWithFallback(config, org, skill, version) {
+async function downloadSkillWithFallback(config, org, skill, version, workspaceId) {
     // Fetch metadata first to check if paid
     let skillMeta;
     try {
@@ -114,12 +114,12 @@ async function downloadSkillWithFallback(config, org, skill, version) {
     if (skillMeta && (0, pricing_1.isPaidAgent)(skillMeta)) {
         // Paid skill - check ownership
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (skillMeta.org_id && callerOrg.id === skillMeta.org_id) ||
                 (skillMeta.org_slug && callerOrg.slug === skillMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint with full content
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === skill && a.type === 'skill');
                 if (matching.length > 0) {
                     let targetAgent;
@@ -162,12 +162,12 @@ async function downloadSkillWithFallback(config, org, skill, version) {
     // Check if download is disabled (server-only skill)
     if (skillMeta && skillMeta.allow_local_download === false) {
         if (config.apiKey) {
-            const callerOrg = await (0, api_1.getOrg)(config);
+            const callerOrg = await (0, api_1.getOrg)(config, workspaceId);
             const isOwner = (skillMeta.org_id && callerOrg.id === skillMeta.org_id) ||
                 (skillMeta.org_slug && callerOrg.slug === skillMeta.org_slug);
             if (isOwner) {
                 // Owner - fetch from authenticated endpoint
-                const myAgents = await (0, api_1.listMyAgents)(config);
+                const myAgents = await (0, api_1.listMyAgents)(config, workspaceId);
                 const matching = myAgents.filter(a => a.name === skill && a.type === 'skill');
                 if (matching.length > 0) {
                     let targetAgent;
@@ -221,12 +221,12 @@ async function downloadSkillWithFallback(config, org, skill, version) {
     if (!config.apiKey) {
         throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
     }
-    const userOrg = await (0, api_1.getOrg)(config);
+    const userOrg = await (0, api_1.getOrg)(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
     }
     // Find skill in user's list
-    const agents = await (0, api_1.listMyAgents)(config);
+    const agents = await (0, api_1.listMyAgents)(config, workspaceId);
     const matching = agents.filter(a => a.name === skill && a.type === 'skill');
     if (matching.length === 0) {
         throw new api_1.ApiError(`Skill '${org}/${skill}@${version}' not found`, 404);
@@ -420,10 +420,12 @@ Instructions and guidance for AI agents...
         }
         result.skill = `${org}/${parsed.skill}`;
         result.version = parsed.version;
+        // Resolve workspace context for the target org
+        const workspaceId = await (0, api_1.resolveWorkspaceIdForOrg)(resolved, org);
         // Download skill (tries public first, falls back to authenticated for private)
         let skillData;
         try {
-            skillData = await downloadSkillWithFallback(resolved, org, parsed.skill, parsed.version);
+            skillData = await downloadSkillWithFallback(resolved, org, parsed.skill, parsed.version, workspaceId);
         }
         catch (err) {
             if (jsonMode) {

package/dist/lib/api.js

@@ -51,6 +51,7 @@ exports.downloadCodeBundle = downloadCodeBundle;
 exports.uploadCodeBundle = uploadCodeBundle;
 exports.getMyAgent = getMyAgent;
 exports.getAgentWithFallback = getAgentWithFallback;
+exports.resolveWorkspaceIdForOrg = resolveWorkspaceIdForOrg;
 exports.downloadCodeBundleAuthenticated = downloadCodeBundleAuthenticated;
 exports.checkAgentDelete = checkAgentDelete;
 exports.deleteAgent = deleteAgent;
@@ -290,8 +291,11 @@ async function updateOrg(config, payload) {
 async function getPublicAgent(config, org, agent, version) {
     return publicRequest(config, `/public/agents/${org}/${agent}/${version}`);
 }
-async function listMyAgents(config) {
-    return request(config, 'GET', '/agents');
+async function listMyAgents(config, workspaceId) {
+    const headers = {};
+    if (workspaceId)
+        headers['X-Workspace-Id'] = workspaceId;
+    return request(config, 'GET', '/agents', { headers });
 }
 async function createAgent(config, data, workspaceId) {
     const headers = { 'Content-Type': 'application/json' };
@@ -354,8 +358,8 @@ async function uploadCodeBundle(config, agentId, bundlePath, entrypoint, workspa
 /**
  * Get single agent by name/version from authenticated endpoint.
  */
-async function getMyAgent(config, agentName, version) {
-    const agents = await listMyAgents(config);
+async function getMyAgent(config, agentName, version, workspaceId) {
+    const agents = await listMyAgents(config, workspaceId);
     const matching = agents.filter(a => a.name === agentName);
     if (matching.length === 0)
         return null;
@@ -367,7 +371,7 @@ async function getMyAgent(config, agentName, version) {
 /**
  * Try public endpoint first, fallback to authenticated for private agents.
  */
-async function getAgentWithFallback(config, org, agentName, version) {
+async function getAgentWithFallback(config, org, agentName, version, workspaceId) {
     try {
         return await getPublicAgent(config, org, agentName, version);
     }
@@ -378,16 +382,31 @@ async function getAgentWithFallback(config, org, agentName, version) {
     if (!config.apiKey) {
         throw new ApiError(`Agent '${org}/${agentName}@${version}' not found`, 404);
     }
-    const userOrg = await getOrg(config);
+    const userOrg = await getOrg(config, workspaceId);
     if (userOrg.slug !== org) {
         throw new ApiError(`Agent '${org}/${agentName}@${version}' not found`, 404);
     }
-    const myAgent = await getMyAgent(config, agentName, version);
+    const myAgent = await getMyAgent(config, agentName, version, workspaceId);
     if (!myAgent) {
         throw new ApiError(`Agent '${org}/${agentName}@${version}' not found`, 404);
     }
     return myAgent;
 }
+/**
+ * Resolve a workspace ID from an org slug.
+ * Returns undefined for personal orgs or if unauthenticated.
+ */
+async function resolveWorkspaceIdForOrg(config, orgSlug) {
+    if (!config.apiKey)
+        return undefined;
+    try {
+        const { workspaces } = await request(config, 'GET', '/workspaces');
+        return workspaces.find(w => w.slug === orgSlug)?.id;
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Download a tool bundle for a private agent using authenticated endpoint.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchagent/cli",
-  "version": "0.3.68",
+  "version": "0.3.70",
   "description": "Command-line interface for orchagent — deploy and run AI agents for your team",
   "license": "MIT",
   "author": "orchagent <hello@orchagent.io>",