@ornncompute/cli 1.0.64 → 1.0.67

package/README.md

@@ -56,6 +56,10 @@ ornn completion <bash|fish|zsh> --format human
 ornn resources
 ```
 
+The CLI uses Authorization's newest membership on every request, regardless of
+approval. `ornn context` displays that current organization; login and launch
+use the same context. Restricted operations retain their approval requirements.
+
 Advanced customer resources are registered under one noun and one verb:
 
 ```text
@@ -351,9 +355,9 @@ npm install -g @ornncompute/cli@0.2.10
 ```
 
 Both directions reuse valid `auth.json`, `config.json`, and
-`update-check.json`. `selectedOrganizationId` is an untrusted hint; the gateway
-revalidates membership. Neither direction rewrites credentials or configured
-endpoints. Rollback is unsupported from day 91. From day 91 through day 180,
+`update-check.json`. Current CLI releases ignore saved organization hints and
+use the gateway's newest membership. Neither direction rewrites credentials or
+configured endpoints. Rollback is unsupported from day 91. From day 91 through day 180,
 legacy compatibility calls return a non-forwarding `426 Upgrade Required`
 tombstone with `cli_version_unsupported`, minimum version `1.0.0`, and the
 migration URL. The legacy route surface is absent from day 181

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ornncompute/cli",
-  "version": "1.0.64",
+  "version": "1.0.67",
   "description": "Command-line interface for Ornn compute access workflows.",
   "type": "module",
   "bin": {

package/src/api-client.mjs

@@ -80,17 +80,12 @@ export async function loadRequiredSession({ env = process.env } = {}) {
 }
 export function userCredentialHeaders(session) {
   if (!session?.accessToken) return {};
-  const headers = {
+  return {
     Authorization: `Bearer ${session.accessToken}`,
-    // This marker and the organization selector grant nothing by themselves.
-    // The gateway re-resolves the bearer and replaces them with trusted scope.
+    // The gateway resolves the bearer to trusted user and organization scope.
     "X-Ornn-Credential-Type": "user",
     "X-Ornn-CLI-Version": CLI_VERSION,
   };
-  if (typeof session.selectedOrganizationId === "string" && session.selectedOrganizationId.trim()) {
-    headers["X-Organization-Id"] = session.selectedOrganizationId.trim();
-  }
-  return headers;
 }
 
 export async function cliRequest({

package/src/auth-store.mjs

@@ -134,26 +134,6 @@ export async function bindAuthUser(user, { env = process.env, expectedAccessToke
   return true;
 }
 
-export async function saveOrganizationHint(
-  selectedOrganizationId,
-  { env = process.env, expectedAccessToken } = {}
-) {
-  const session = await loadAuthSession({ env });
-  if (
-    !session?.accessToken ||
-    (expectedAccessToken && session.accessToken !== expectedAccessToken)
-  ) {
-    return null;
-  }
-  const payload = { ...session };
-  if (typeof selectedOrganizationId === "string" && selectedOrganizationId.trim()) {
-    payload.selectedOrganizationId = selectedOrganizationId.trim();
-  } else {
-    delete payload.selectedOrganizationId;
-  }
-  return writeAuthSession(payload, env);
-}
-
 function pendingString(value, field) {
   return typeof value?.[field] === "string" ? value[field].trim() : "";
 }

package/src/catalog-shell.mjs

@@ -985,6 +985,7 @@ async function executeCapability(
         `${resolveApiBaseUrl({ env: io.env })}/v1/orchestrator`)
       : undefined;
   const parsedInput = parseCapabilityInput(capability, rawInput);
+  let ownOrganizationId;
   let data;
   try {
     data = await capability.execute(
@@ -993,7 +994,7 @@ async function executeCapability(
         confirmed,
         installerBaseUrl,
         role,
-        fetch: (path, init = {}) => {
+        fetch: async (path, init = {}) => {
           if (executionRuntime?.transport) return executionRuntime.transport(path, init);
           if (audience === "admin") {
             // Shared observability capabilities use their owner namespace;
@@ -1004,6 +1005,11 @@ async function executeCapability(
                 : path;
             return adminFetch(io, endpoint, init);
           }
+          if (capability.domain === "listings" && ownOrganizationId === undefined) {
+            // Verify listing owner IDs before the request, never after a committed mutation.
+            const session = await customerCapabilityFetch(io, "/v1/cli/session", {}, authSnapshot);
+            ownOrganizationId = session.selectedOrganization?.id ?? null;
+          }
           return customerCapabilityFetch(io, path, init, authSnapshot);
         },
         cli: {
@@ -1026,7 +1032,7 @@ async function executeCapability(
     interaction?.close();
   }
   if (audience === "customer") {
-    assertCustomerResultSafe(data, authSnapshot?.current?.selectedOrganizationId);
+    assertCustomerResultSafe(data, ownOrganizationId);
   }
   if (audience === "admin" || sessionCommand || isInteractionExecution(data)) return data;
   return {

package/src/kubernetes-commands.mjs

@@ -868,35 +868,15 @@ async function resolveLaunchReservation(context, runtime, input, accessMode) {
   return fetchReservation(context.fetch, runtime, selected, accessMode);
 }
 
-async function selectedOrganization(context, input, runtime) {
+async function selectedOrganization(context, runtime) {
   const session = context.cli?.session;
   if (!session) throw new Error("The current organization session is unavailable.");
-  let result = record(await session("context", { organization: input.organization }));
-  let data = record(result.data);
-  let selected = record(data.selected_organization);
-  if (!text(selected.id) && runtime.eligibleHuman) {
-    const choices = (Array.isArray(data.organizations) ? data.organizations : [])
-      .map(record)
-      .filter(
-        (organization) =>
-          organization.approved === true && text(organization.id) && text(organization.name)
-      )
-      .map((organization) => ({ label: text(organization.name), value: text(organization.id) }));
-    if (choices.length > 1) {
-      const answer = await runtime.ask({ label: "Organization", choices });
-      if (!answer)
-        runtime.usage("Choose an approved organization before launch.", {
-          code: "organization_required",
-        });
-      result = record(await session("context", { organization: answer }));
-      data = record(result.data);
-      selected = record(data.selected_organization);
-    }
-  }
+  const result = record(await session("context", {}));
+  const selected = record(record(result.data).selected_organization);
   const id = text(selected.id);
   const name = text(selected.name);
   if (!id || !name || selected.approved !== true) {
-    runtime.usage("Select one approved organization before launch.", {
+    runtime.usage("Your current organization must be approved before launch.", {
       code: "organization_required",
       field: "organization",
     });
@@ -934,12 +914,6 @@ function clusterMachineLaunchPreflight(runtime, input, membershipCount) {
     });
   }
   if (runtime.eligibleHuman) return;
-  if (!UUID.test(text(input.organization) ?? "")) {
-    runtime.usage("Automation requires a canonical organization ID.", {
-      code: "canonical_organization_id_required",
-      field: "organization",
-    });
-  }
   if (input.yes !== true) {
     runtime.usage("--yes is required for automation after reviewing the exact intent.", {
       code: "consent_required",
@@ -1153,7 +1127,7 @@ export async function launchClusterMode(
   clusterMachineLaunchPreflight(runtime, input, membershipCount);
   if (accessMode === "slurm") keyInputShapePreflight(input, runtime);
   const idempotencyKey = requireMutationKey(runtime, input);
-  const organization = await selectedOrganization(context, input, runtime);
+  const organization = await selectedOrganization(context, runtime);
   const keyPlan = accessMode === "slurm" ? await keyPlanFromInput(context, input, runtime) : null;
   const reservation = await resolveLaunchReservation(context, runtime, input, accessMode);
   const reservationId = text(reservation.id);
@@ -1321,11 +1295,7 @@ export async function launchClusterMode(
       presentation: { lines: ["No cluster was created."] },
     });
   }
-  const currentOrganization = await selectedOrganization(
-    context,
-    { organization: organization.id },
-    runtime
-  );
+  const currentOrganization = await selectedOrganization(context, runtime);
   if (currentOrganization.id !== organization.id) {
     runtime.error("The selected organization changed after review; no cluster was created.", {
       code: "organization_changed",

package/src/session-commands.mjs

@@ -1,5 +1,3 @@
-import { createInterface } from "node:readline/promises";
-
 import { CliApiError, cliRequest, resolveApiBaseUrl } from "./api-client.mjs";
 import {
   bindAuthUser,
@@ -7,7 +5,6 @@ import {
   getAuthConfigPath,
   loadAuthSession,
   saveAuthSession,
-  saveOrganizationHint,
 } from "./auth-store.mjs";
 import {
   DeviceAuthError,
@@ -17,8 +14,6 @@ import {
   waitForDeviceApproval,
 } from "./device-auth.mjs";
 
-const CANONICAL_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-
 export class SessionCommandError extends Error {
   constructor(
     message,
@@ -83,25 +78,22 @@ function positiveNumberOption(value, name, usageText) {
 
 export function parseSessionCommandInput(capabilityId, argv) {
   if (capabilityId === "identity.login") {
-    const usageText =
-      "Usage: ornn login [--organization <exact-name>] [--no-browser] [--timeout <seconds>]";
+    const usageText = "Usage: ornn login [--no-browser] [--timeout <seconds>]";
     const parsed = parseOptions(argv, {
       booleans: ["--no-browser"],
-      values: ["--auth-base", "--organization", "--poll-interval", "--timeout"],
+      values: ["--auth-base", "--poll-interval", "--timeout"],
       usageText,
     });
     return {
       authBase: parsed["auth-base"],
       noBrowser: parsed["no-browser"],
-      organization: parsed.organization,
       pollInterval: positiveNumberOption(parsed["poll-interval"], "--poll-interval", usageText),
       timeout: positiveNumberOption(parsed.timeout, "--timeout", usageText),
     };
   }
   if (capabilityId === "identity.context") {
     return parseOptions(argv, {
-      values: ["--organization"],
-      usageText: "Usage: ornn context [--organization <exact-name-or-id>]",
+      usageText: "Usage: ornn context",
     });
   }
   if (capabilityId === "identity.logout") {
@@ -142,154 +134,7 @@ function sessionContext(value) {
   };
 }
 
-async function readServerContext({ env, fetchImpl, session: suppliedSession }) {
-  const session = suppliedSession === undefined ? await loadAuthSession({ env }) : suppliedSession;
-  try {
-    return sessionContext(
-      await cliRequest({
-        endpoint: "/v1/cli/session",
-        env,
-        fetchImpl,
-        method: "GET",
-        ...(session ? { session } : {}),
-      })
-    );
-  } catch (error) {
-    if (
-      !(error instanceof CliApiError) ||
-      error.status !== 403 ||
-      !session?.accessToken ||
-      !session.selectedOrganizationId
-    ) {
-      throw error;
-    }
-    const unscopedSession = { ...session };
-    delete unscopedSession.selectedOrganizationId;
-    return sessionContext(
-      await cliRequest({
-        endpoint: "/v1/cli/session",
-        env,
-        fetchImpl,
-        method: "GET",
-        session: unscopedSession,
-      })
-    );
-  }
-}
-
-function selectionAction(machine) {
-  return {
-    type: "command",
-    command: machine
-      ? "ornn context --organization <canonical-id> --format json"
-      : "ornn context --organization <exact-name>",
-    description: machine
-      ? "Select one approved organization by canonical identifier."
-      : "Select one approved organization by its exact displayed name.",
-  };
-}
-
-function findApprovedOrganization(organizations, selector, machine) {
-  if (machine && !CANONICAL_ID.test(selector)) {
-    throw new SessionCommandError(
-      "Automation must select an organization by canonical identifier.",
-      {
-        action: selectionAction(true),
-        code: "organization_id_required",
-        exitCode: 2,
-      }
-    );
-  }
-  const matches = organizations.filter((candidate) =>
-    machine ? candidate.id === selector : candidate.id === selector || candidate.name === selector
-  );
-  if (matches.length === 0) {
-    throw new SessionCommandError("The requested organization is not a current membership.", {
-      action: selectionAction(machine),
-      code: "organization_not_available",
-      exitCode: 5,
-    });
-  }
-  if (matches.length > 1) {
-    throw new SessionCommandError(
-      "More than one organization has that name; select by canonical identifier.",
-      {
-        action: selectionAction(true),
-        code: "organization_ambiguous",
-        exitCode: 2,
-      }
-    );
-  }
-  if (!matches[0].approved) {
-    throw new SessionCommandError(`Organization ${matches[0].name} is not approved.`, {
-      code: "organization_not_approved",
-      exitCode: 5,
-    });
-  }
-  return matches[0];
-}
-
-async function promptForOrganization(organizations, { stdin, stdout }) {
-  stdout.write("Choose an approved organization by typing its exact name:\n");
-  for (const candidate of organizations) stdout.write(`  ${candidate.name}\n`);
-  const readline = createInterface({ input: stdin, output: stdout, terminal: false });
-  try {
-    return await readline.question("Organization: ");
-  } finally {
-    readline.close();
-  }
-}
-
-function updateSnapshotOrganization(sessionSnapshot, selectedOrganizationId) {
-  if (!sessionSnapshot?.current) return;
-  const next = { ...sessionSnapshot.current };
-  if (selectedOrganizationId) next.selectedOrganizationId = selectedOrganizationId;
-  else delete next.selectedOrganizationId;
-  sessionSnapshot.current = next;
-}
-
-async function selectAndRevalidate(
-  selector,
-  context,
-  { env, fetchImpl, machine, sessionSnapshot }
-) {
-  const selected = findApprovedOrganization(context.organizations, selector, machine);
-  const expectedAccessToken = sessionSnapshot?.current?.accessToken;
-  await saveOrganizationHint(selected.id, { env, expectedAccessToken });
-  updateSnapshotOrganization(sessionSnapshot, selected.id);
-  const revalidated = await readServerContext({
-    env,
-    fetchImpl,
-    session: sessionSnapshot?.current,
-  });
-  if (revalidated.selected_organization?.id !== selected.id) {
-    await saveOrganizationHint(null, { env, expectedAccessToken });
-    updateSnapshotOrganization(sessionSnapshot, null);
-    throw new SessionCommandError(
-      "Organization membership changed before selection could be verified.",
-      {
-        action: selectionAction(machine),
-        code: "organization_membership_changed",
-        exitCode: 5,
-      }
-    );
-  }
-  return revalidated;
-}
-
-async function resolveContext(
-  input,
-  {
-    eligibleHuman,
-    env,
-    fetchImpl,
-    machine,
-    promptIfMultiple = false,
-    sessionSnapshot,
-    stdin,
-    stdout,
-  }
-) {
+async function context({ env, fetchImpl, sessionSnapshot }) {
   const localSession =
     sessionSnapshot?.current === undefined
       ? await loadAuthSession({ env })
@@ -297,83 +142,28 @@ async function resolveContext(
   if (sessionSnapshot && sessionSnapshot.current === undefined) {
     sessionSnapshot.current = localSession;
   }
-  let context = await readServerContext({ env, fetchImpl, session: localSession });
-  await bindAuthUser(context.user, {
+  const data = sessionContext(
+    await cliRequest({
+      endpoint: "/v1/cli/session",
+      env,
+      fetchImpl,
+      method: "GET",
+      session: localSession,
+    })
+  );
+  await bindAuthUser(data.user, {
     env,
     expectedAccessToken: localSession?.accessToken,
   });
-  if (sessionSnapshot?.current && context.user?.id) {
+  if (sessionSnapshot?.current && data.user?.id) {
     sessionSnapshot.current = {
       ...sessionSnapshot.current,
-      user: { ...(sessionSnapshot.current.user ?? {}), ...context.user },
-    };
-  }
-  const localHint = localSession?.selectedOrganizationId;
-  const hintIsCurrent =
-    context.selected_organization && context.selected_organization.id === localHint;
-  if (localHint && !hintIsCurrent) {
-    await saveOrganizationHint(null, {
-      env,
-      expectedAccessToken: localSession?.accessToken,
-    });
-    updateSnapshotOrganization(sessionSnapshot, null);
-  }
-
-  const selectionRuntime = { env, fetchImpl, machine, sessionSnapshot };
-  if (input.organization) {
-    return {
-      context: await selectAndRevalidate(input.organization, context, selectionRuntime),
-      action: null,
-      exitCode: 0,
-      outcome: { class: "ready", phase: "complete" },
+      user: { ...(sessionSnapshot.current.user ?? {}), ...data.user },
     };
   }
 
-  if (hintIsCurrent) {
-    return {
-      context,
-      action: null,
-      exitCode: 0,
-      outcome: { class: "ready", phase: "complete" },
-    };
-  }
-
-  const approved = context.organizations.filter((candidate) => candidate.approved);
-  if (approved.length === 1) {
-    context = await selectAndRevalidate(approved[0].id, context, {
-      ...selectionRuntime,
-      machine: true,
-    });
-    return {
-      context,
-      action: null,
-      exitCode: 0,
-      outcome: { class: "ready", phase: "complete" },
-    };
-  }
-  if (approved.length > 1 && promptIfMultiple && eligibleHuman) {
-    const answer = await promptForOrganization(approved, { stdin, stdout });
-    context = await selectAndRevalidate(answer, context, {
-      ...selectionRuntime,
-      machine: false,
-    });
-    return {
-      context,
-      action: null,
-      exitCode: 0,
-      outcome: { class: "ready", phase: "complete" },
-    };
-  }
-  if (approved.length > 1) {
-    return {
-      context,
-      action: selectionAction(machine),
-      exitCode: 3,
-      outcome: { class: "action_required", phase: "organization_selection" },
-    };
-  }
   return {
-    context,
+    data,
     action: null,
     exitCode: 0,
     outcome: { class: "ready", phase: "complete" },
@@ -485,26 +275,8 @@ async function login(input, runtime) {
 
   await saveAuthSession(session, { env: runtime.env });
   runtime.stderr.write(`\nSession saved to ${getAuthConfigPath(runtime.env)}\n`);
-  const resolved = await resolveContext(
-    { organization: input.organization },
-    { ...runtime, machine: false, promptIfMultiple: true }
-  );
-  return {
-    data: { ...resolved.context, session_saved: true },
-    action: resolved.action,
-    exitCode: resolved.exitCode,
-    outcome: resolved.outcome,
-  };
-}
-
-async function context(input, runtime) {
-  const resolved = await resolveContext(input, { ...runtime, promptIfMultiple: false });
-  return {
-    data: resolved.context,
-    action: resolved.action,
-    exitCode: resolved.exitCode,
-    outcome: resolved.outcome,
-  };
+  const resolved = await context(runtime);
+  return { ...resolved, data: { ...resolved.data, session_saved: true } };
 }
 
 async function logout(runtime) {
@@ -559,7 +331,7 @@ async function logout(runtime) {
 
 export async function executeSessionCommand(command, input, runtime) {
   if (command === "login") return login(input, runtime);
-  if (command === "context") return context(input, runtime);
+  if (command === "context") return context(runtime);
   if (command === "logout") return logout(runtime);
   throw new CliApiError(`Unsupported session capability: ${command}`);
 }

package/src/vm-commands.mjs

@@ -408,39 +408,25 @@ function machineMutationPreflight(input, interaction, { requireYes = true } = {}
   }
 }
 
-async function selectedOrganization(context, input, interaction) {
+async function selectedOrganization(context, interaction, expectedId) {
   const session = context.cli?.session;
   if (!session) throw new Error("The current organization session is unavailable.");
-  let result = record(await session("context", { organization: input.organization }));
-  let data = record(result.data);
-  let selected = record(data.selected_organization);
-  if (!text(selected.id) && interaction.eligibleHuman) {
-    const choices = (Array.isArray(data.organizations) ? data.organizations : [])
-      .map(record)
-      .filter(
-        (organization) =>
-          organization.approved === true && text(organization.id) && text(organization.name)
-      )
-      .map((organization) => ({ label: text(organization.name), value: text(organization.id) }));
-    if (choices.length > 1) {
-      const answer = await interaction.ask({ label: "Organization", choices });
-      if (!answer)
-        interaction.usage("Choose an approved organization before launch.", {
-          code: "organization_required",
-        });
-      result = record(await session("context", { organization: answer }));
-      data = record(result.data);
-      selected = record(data.selected_organization);
-    }
-  }
+  const result = record(await session("context", {}));
+  const selected = record(record(result.data).selected_organization);
   const id = text(selected.id);
   const name = text(selected.name);
   if (!id || !name || selected.approved !== true) {
-    interaction.usage("Select one approved organization before launch.", {
+    interaction.usage("Your current organization must be approved before launch.", {
       code: "organization_required",
       field: "organization",
     });
   }
+  if (expectedId && id !== expectedId) {
+    interaction.error("Your organization changed; review the launch again before continuing.", {
+      code: "organization_changed",
+      exitCode: 2,
+    });
+  }
   return { id, name };
 }
 
@@ -820,7 +806,6 @@ function launchInputPreflight(input, interaction) {
   const target = text(input.reservation) ?? text(positionals[0]);
   if (interaction.eligibleHuman && !interaction.machine) return;
   requireCanonical(interaction, target, "reservation", "Capacity reservation");
-  requireCanonical(interaction, input.organization, "organization", "Organization");
   const keyRef = text(input.keyId) ?? text(input.key);
   const suppliedPublicKey = text(input.publicKey) ?? text(input.publicKeyFile);
   if (!keyRef && !suppliedPublicKey) {
@@ -912,13 +897,14 @@ function launchOwnerSnapshot(machines) {
 function withAuthoritativeUsername(input, _machines, interaction) {
   const requested = text(input.username);
   if (requested && requested !== "tenant") {
-    interaction.usage("Linux login is always tenant; --username cannot request another name.", {
-      code: "launch_username_unsupported",
-    });
+    interaction.usage(UNSUPPORTED_USERNAME_MESSAGE, { code: "launch_username_unsupported" });
   }
-  return { ...input, username: "tenant" };
+  return input;
 }
 
+const UNSUPPORTED_USERNAME_MESSAGE =
+  "--username cannot choose the Linux login; the machine reports its own login.";
+
 function validatedMachine(machines, key, input, interaction, expectedMode = "vm") {
   if (!machines.length) return null;
   if (machines.length !== 1) {
@@ -940,9 +926,7 @@ function validatedMachine(machines, key, input, interaction, expectedMode = "vm"
   }
   const username = text(input.username);
   if (username && username !== "tenant") {
-    interaction.usage("Linux login is always tenant; --username cannot request another name.", {
-      code: "launch_username_unsupported",
-    });
+    interaction.usage(UNSUPPORTED_USERNAME_MESSAGE, { code: "launch_username_unsupported" });
   }
   const fingerprintValue = text(key.fingerprint);
   const assigned = Array.isArray(machine.authorized_key_fingerprints)
@@ -1072,7 +1056,7 @@ export const vmLaunchModeHandler = {
   async launch({ context, input, interaction }) {
     launchInputPreflight(input, interaction);
     input = await normalizePublicKeyInput(input);
-    const organization = await selectedOrganization(context, input, interaction);
+    const organization = await selectedOrganization(context, interaction);
     const reservation = await resolveReservation(context, input, interaction, "vm");
     const reservationId = resourceId(reservation);
     const keyPlan = await keyPlanFromInput(context, input, interaction);
@@ -1123,6 +1107,7 @@ export const vmLaunchModeHandler = {
       });
     }
 
+    await selectedOrganization(context, interaction, organization.id);
     const currentReservation = assertActiveReservation(
       await context.fetch(
         `/v1/workflows/commerce/reservations/${encodeURIComponent(reservationId)}`
@@ -1214,9 +1199,7 @@ export const vmLaunchModeHandler = {
           resourceId(key),
           "--idempotency-key",
           idempotencyKey,
-          ...(interaction.machine
-            ? ["--organization", resourceId(organization), "--yes", "--no-wait", "--format", "json"]
-            : []),
+          ...(interaction.machine ? ["--yes", "--no-wait", "--format", "json"] : []),
         ].join(" ");
         return uncertainMutationFailure(interaction, error, {
           data: {
@@ -1684,8 +1667,6 @@ function workspaceResumeCommand(input, goal, facts, id, interaction, localResume
     goal.reservationId,
     "--mode",
     "bare-metal",
-    "--organization",
-    goal.organizationId,
     "--key",
     goal.keyId,
     "--network",
@@ -1892,6 +1873,7 @@ async function launchDurableBareMetalWorkspace({
     });
   }
 
+  await selectedOrganization(context, interaction, organization.id);
   const [currentReservationValue, currentKeyPlan, currentFacts] = await Promise.all([
     context.fetch(`/v1/workflows/commerce/reservations/${encodeURIComponent(reservationId)}`),
     keyPlanFromInput(context, input, interaction),
@@ -2246,6 +2228,7 @@ export const bareMetalLaunchModeHandler = {
   mode: "bare-metal",
   async launch({ context, input, interaction }) {
     const durableWorkspace = workspaceIntentRequested(input);
+    let resumeOrganizationId;
     if (durableWorkspace && input.resume === true) {
       if (!interaction.eligibleHuman || interaction.machine) {
         interaction.usage("--resume without a value requires an eligible interactive terminal.", {
@@ -2256,7 +2239,6 @@ export const bareMetalLaunchModeHandler = {
       const hasConflictingIntent =
         (input.$positionals?.length ?? 0) > 0 ||
         [
-          input.organization,
           input.reservation,
           input.reservationId,
           input.key,
@@ -2295,6 +2277,7 @@ export const bareMetalLaunchModeHandler = {
           field: "resume",
         });
       }
+      resumeOrganizationId = remembered.organizationId;
       input = {
         ...input,
         $positionals: [remembered.reservationId],
@@ -2302,7 +2285,6 @@ export const bareMetalLaunchModeHandler = {
         key: remembered.keyId,
         mountAccess: remembered.mountAccess,
         network: remembered.networkId,
-        organization: remembered.organizationId,
         resume: remembered.id,
         username: remembered.username ?? undefined,
         volume: remembered.volumeId,
@@ -2323,7 +2305,7 @@ export const bareMetalLaunchModeHandler = {
     }
     launchInputPreflight(input, interaction);
     input = await normalizePublicKeyInput(input);
-    const organization = await selectedOrganization(context, input, interaction);
+    const organization = await selectedOrganization(context, interaction, resumeOrganizationId);
     const reservation = await resolveReservation(context, input, interaction, "bare-metal");
     const reservationId = resourceId(reservation);
     const keyPlan = await keyPlanFromInput(context, input, interaction);
@@ -2398,6 +2380,7 @@ export const bareMetalLaunchModeHandler = {
         fetchAssignedKeys(context, reservationId),
         fetchMachines(context, reservationId),
       ]);
+    await selectedOrganization(context, interaction, organization.id);
     const currentReservation = assertActiveReservation(
       currentReservationValue,
       reservationId,
@@ -2481,9 +2464,7 @@ export const bareMetalLaunchModeHandler = {
           resourceId(key),
           "--idempotency-key",
           idempotencyKey,
-          ...(interaction.machine
-            ? ["--organization", resourceId(organization), "--yes", "--no-wait", "--format", "json"]
-            : []),
+          ...(interaction.machine ? ["--yes", "--no-wait", "--format", "json"] : []),
         ].join(" ");
         return uncertainMutationFailure(interaction, error, {
           data: {

package/vendor/capabilities/capabilities/compute.js

@@ -16,7 +16,6 @@ export const launchInput = z
     network: z.string().optional(),
     noWait: z.boolean().optional(),
     nodes: z.union([z.string(), z.number()]).optional(),
-    organization: z.string().optional(),
     publicKey: z.string().optional(),
     publicKeyFile: z.string().optional(),
     reservation: z.string().optional(),
@@ -141,7 +140,7 @@ export const launchCapability = cliOnly({
             order: 2,
             outcome: "Launch one reviewed VM, Bare Metal machine, Kubernetes cluster, or Slurm cluster from active reserved capacity, including a declared durable Bare Metal workspace.",
             human: "ornn launch [<capacity-reservation>] --mode vm|bare-metal|kubernetes|slurm [--key <ssh-key>]; Bare Metal may add --network shared --volume <managed-volume> --mount-access read-only|read-write; Kubernetes/Slurm prompt for missing --network public|private and --nodes <membership-count>, and may add running VMs with --vms <vm-ids>",
-            automation: "ornn launch <canonical-reservation-id> --mode vm|bare-metal|kubernetes|slurm --organization <id> --yes --idempotency-key <key> --format json; VM/Bare Metal/Slurm require --key <canonical-key-id>; Bare Metal may add --network shared --volume <canonical-volume-id> --mount-access read-only|read-write; Kubernetes/Slurm require --network public|private --nodes <membership-count> --machines <canonical-machine-ids>, and may add --vms <canonical-vm-ids> (with --nodes 0 for a cluster of VMs only)",
+            automation: "ornn launch <canonical-reservation-id> --mode vm|bare-metal|kubernetes|slurm --yes --idempotency-key <key> --format json; VM/Bare Metal/Slurm require --key <canonical-key-id>; Bare Metal may add --network shared --volume <canonical-volume-id> --mount-access read-only|read-write; Kubernetes/Slurm require --network public|private --nodes <membership-count> --machines <canonical-machine-ids>, and may add --vms <canonical-vm-ids> (with --nodes 0 for a cluster of VMs only)",
             acceptedReferences: [
                 "canonical capacity-reservation ID",
                 "canonical eligible machine IDs",

package/vendor/capabilities/capabilities/identity.js

@@ -1,11 +1,9 @@
 import { z } from "zod";
 import { defineCapability } from "../capability.js";
 const emptyInput = z.object({});
-const contextInput = z.object({ organization: z.string().min(1).optional() });
 const loginInput = z.object({
     authBase: z.string().min(1).optional(),
     noBrowser: z.boolean().optional(),
-    organization: z.string().min(1).optional(),
     pollInterval: z.number().positive().optional(),
     timeout: z.number().positive().optional(),
 });
@@ -30,7 +28,7 @@ export const loginCapability = defineCapability({
             category: "session",
             arguments: "semantic",
             outcome: "Authenticate in a browser and return to the terminal.",
-            human: "ornn login [--organization <exact-name>] [--no-browser] [--timeout <seconds>]",
+            human: "ornn login [--no-browser] [--timeout <seconds>]",
             automation: "ornn login --format json",
             resumableStates: ["browser authorization"],
             related: ["context", "logout"],
@@ -45,10 +43,10 @@ export const contextCapability = defineCapability({
     id: "identity.context",
     domain: "identity",
     roles: ["user"],
-    description: "Show and select the current server-verified organization context.",
+    description: "Show the current server-verified organization context.",
     mutation: "read",
     http: { method: "GET", path: "/v1/cli/session" },
-    input: contextInput,
+    input: emptyInput,
     cli: {
         command: ["context"],
         vnext: {
@@ -56,12 +54,8 @@ export const contextCapability = defineCapability({
             category: "session",
             arguments: "semantic",
             outcome: "Show the current user, selected organization, approval, and available organizations.",
-            human: "ornn context [--organization <exact-name-or-id>]",
-            automation: "ornn context --organization <canonical-id> --format json",
-            acceptedReferences: [
-                "exact organization name (human)",
-                "canonical organization ID (automation)",
-            ],
+            human: "ornn context",
+            automation: "ornn context --format json",
             related: ["login", "logout"],
             order: 2,
         },