@quonfig/cli 0.0.25 → 0.0.26

package/dist/commands/whoami.js

@@ -1,51 +1,138 @@
 import { BaseCommand } from '../index.js';
+import { getApiUrl } from '../util/domain-urls.js';
+import { getValidAccessToken, resolveDefaultOrgId } from '../util/get-valid-token.js';
 import { decodeJWT } from '../util/oauth-client.js';
-import { getActiveProfile, loadAuthConfig, loadTokens } from '../util/token-storage.js';
+import { tryParseWorkspacePin } from '../util/quonfig-json.js';
+import { findOrgIdBySlug, loadTokens } from '../util/token-storage.js';
 export default class Whoami extends BaseCommand {
-    static description = 'Display information about the currently logged in user';
+    static description = 'Display information about the currently logged in user and all org memberships';
     static examples = ['<%= config.bin %> <%= command.id %>'];
     async run() {
-        const authConfig = await loadAuthConfig();
-        const tokens = await loadTokens();
-        if (!authConfig || !tokens?.accessToken) {
+        const store = await loadTokens();
+        if (!store || Object.keys(store.tokensByOrg).length === 0) {
             this.log('Not logged in. Use `qfg login` to authenticate.');
-            return {
-                loggedIn: false,
-            };
+            return { loggedIn: false };
         }
-        // Get email from stored user info or decode JWT
-        let userEmail = tokens.userEmail;
-        if (!userEmail) {
+        const firstEntry = Object.values(store.tokensByOrg)[0];
+        let userEmail = firstEntry.user_email;
+        if (!userEmail && firstEntry.access_token) {
             try {
-                const payload = decodeJWT(tokens.accessToken);
+                const payload = decodeJWT(firstEntry.access_token);
                 userEmail = payload.email;
             }
             catch {
-                // If we can't decode the token, continue without email
+                // Continue without email if JWT decode fails.
             }
         }
-        // Get the active profile
-        const activeProfile = getActiveProfile();
-        const profile = authConfig.profiles[activeProfile] || authConfig.profiles[authConfig.defaultProfile || 'default'];
-        if (!profile) {
-            this.log('Not logged in. Use `qfg login` to authenticate.');
-            return {
-                loggedIn: false,
-            };
-        }
-        // Display user information
-        const workspaceSlug = profile.workspaceSlug || profile.workspaceName;
-        const orgPrefix = profile.organizationName ? `${profile.organizationName} / ` : '';
-        const workspaceDisplay = workspaceSlug ? `${orgPrefix}${workspaceSlug} (${profile.workspace})` : profile.workspace;
+        const activeOrgId = await this.resolveActiveOrgId(store.defaultOrgId);
+        const memberships = await this.fetchOrganizations();
+        const localOrgs = Object.entries(store.tokensByOrg).map(([orgId, t]) => ({
+            workosOrgId: orgId,
+            slug: t.org_slug ?? orgId,
+            name: t.org_name ?? t.org_slug ?? orgId,
+            role: '—',
+        }));
+        const merged = mergeMemberships(localOrgs, memberships);
         this.log(`Logged in as: ${userEmail || 'Unknown'}`);
-        this.log(`Workspace:    ${workspaceDisplay}`);
+        this.log('Orgs:');
+        if (merged.length === 0) {
+            this.log('  (no orgs cached — run `qfg login` to mint per-org tokens)');
+        }
+        else {
+            const labelWidth = Math.max(...merged.map((o) => o.slug.length + (o.workosOrgId === activeOrgId ? 9 : 0))) + 1;
+            for (const org of merged) {
+                const marker = org.workosOrgId === activeOrgId ? '*' : ' ';
+                const label = `${org.slug}${org.workosOrgId === activeOrgId ? ' (active)' : ''}`;
+                const padded = label.padEnd(labelWidth, ' ');
+                this.log(`  ${marker} ${padded}— ${org.role}`);
+            }
+        }
         return {
-            email: userEmail,
             loggedIn: true,
-            organizationName: profile.organizationName,
-            userId: tokens.userId,
-            workspace: profile.workspace,
-            workspaceSlug,
+            email: userEmail,
+            userId: firstEntry.user_id,
+            activeOrgId,
+            orgs: merged.map((o) => ({
+                workosOrgId: o.workosOrgId,
+                slug: o.slug,
+                name: o.name,
+                role: o.role,
+                active: o.workosOrgId === activeOrgId,
+            })),
         };
     }
+    /**
+     * Pick the "active" org for display. Order:
+     *   1. QUONFIG_WORKSPACE in `org/ws` form → look up org by slug in the store.
+     *   2. The token store's defaultOrgId, if it points at an entry we have.
+     *   3. The first token entry — gives a stable marker rather than nothing.
+     */
+    async resolveActiveOrgId(defaultOrgId) {
+        const env = process.env.QUONFIG_WORKSPACE;
+        if (env) {
+            const pin = tryParseWorkspacePin(env);
+            if (pin) {
+                const store = await loadTokens();
+                if (store) {
+                    const matched = findOrgIdBySlug(store, pin.orgSlug);
+                    if (matched)
+                        return matched;
+                }
+            }
+        }
+        if (defaultOrgId)
+            return defaultOrgId;
+        return resolveDefaultOrgId().then((id) => id || undefined);
+    }
+    /**
+     * Best-effort fetch of `me.organizations` for role enrichment. Failure
+     * (network, unauthenticated) is non-fatal — whoami still works from the
+     * local store, just without role labels.
+     */
+    async fetchOrganizations() {
+        let jwt;
+        try {
+            const orgId = await resolveDefaultOrgId();
+            if (!orgId)
+                return [];
+            jwt = await getValidAccessToken(orgId, this.verboseLog);
+        }
+        catch (error) {
+            this.verboseLog('whoami: failed to mint JWT for me.organizations', { error: String(error) });
+            return [];
+        }
+        try {
+            const res = await fetch(`${getApiUrl()}/api/v1/me/organizations`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${jwt}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ json: {} }),
+            });
+            if (!res.ok) {
+                this.verboseLog('whoami: me.organizations returned non-OK', { status: res.status });
+                return [];
+            }
+            const body = (await res.json());
+            const list = (body.json ?? body);
+            return Array.isArray(list) ? list : [];
+        }
+        catch (error) {
+            this.verboseLog('whoami: me.organizations fetch failed', { error: String(error) });
+            return [];
+        }
+    }
+}
+/**
+ * Combine the locally-cached orgs (one entry per token) with the server's
+ * me.organizations response. Server data wins for slug/name/role; entries
+ * present locally but missing from the server are kept (a token cached for
+ * an org the user has since been removed from). Server-only entries are
+ * also included so the user sees all current memberships.
+ */
+function mergeMemberships(local, server) {
+    const merged = new Map();
+    for (const o of local)
+        merged.set(o.workosOrgId, o);
+    for (const o of server)
+        merged.set(o.workosOrgId, o);
+    return [...merged.values()].sort((a, b) => a.slug.localeCompare(b.slug));
 }

package/dist/commands/workspace/bootstrap.js

@@ -4,8 +4,8 @@ import { Flags } from '@oclif/core';
 import { BaseCommand } from '../../index.js';
 import { getActiveProfile, loadAuthConfig } from '../../util/token-storage.js';
 import { mintGiteaToken } from '../../util/gitea-api.js';
-import { readWorkspaceSlug, writeWorkspaceSlug } from '../../util/quonfig-json.js';
-import { isGitRepo, hasAtLeastOneCommit, gitSetRemote, gitPushForceLease, gitPushForce, getRemoteUrl, displayUrl, } from '../../util/git-ops.js';
+import { readWorkspaceSlug, tryParseWorkspacePin, writeWorkspaceSlug } from '../../util/quonfig-json.js';
+import { isGitRepo, hasAtLeastOneCommit, gitSetRemote, gitPushForceLease, gitPushForce, getRemoteUrl, displayUrl, runGit, } from '../../util/git-ops.js';
 export default class WorkspaceBootstrap extends BaseCommand {
     static description = "Push a local git repo to Gitea as this workspace's config repository";
     static examples = [
@@ -141,21 +141,34 @@ export default class WorkspaceBootstrap extends BaseCommand {
         // we keep what is there — bootstrap is for fresh cases, not re-pinning.
         // If we do write it, commit and push so the bootstrap leaves no
         // uncommitted changes behind.
+        //
+        // The pin is stored as `<org-slug>/<workspace-slug>`. The backend's
+        // `workspaceSlug` is just the workspace component today; until the
+        // server returns the slash form, we skip the write rather than
+        // emitting a bare slug.
+        const backendPin = tryParseWorkspacePin(backendSlug);
         try {
             const existingPin = await readWorkspaceSlug(resolvedDir);
-            if (existingPin && existingPin !== backendSlug) {
+            const existingFormatted = existingPin ? `${existingPin.orgSlug}/${existingPin.workspaceSlug}` : undefined;
+            if (!backendPin) {
+                this.verboseLog('WorkspaceBootstrap', `Backend workspaceSlug "${backendSlug}" is not in <org>/<ws> form; skipping pin write.`);
+            }
+            else if (existingPin &&
+                (existingPin.orgSlug !== backendPin.orgSlug || existingPin.workspaceSlug !== backendPin.workspaceSlug)) {
+                const backendFormatted = `${backendPin.orgSlug}/${backendPin.workspaceSlug}`;
                 this.log('');
-                this.log(`Warning: quonfig.json already pins workspace "${existingPin}", but the backend says this workspace is "${backendSlug}".`);
+                this.log(`Warning: quonfig.json already pins workspace "${existingFormatted}", but the backend says this workspace is "${backendFormatted}".`);
                 this.log('Leaving the existing pin in place. If this is wrong, edit quonfig.json manually and re-run.');
             }
-            else if (existingPin === backendSlug) {
-                this.verboseLog('WorkspaceBootstrap', `quonfig.json already pinned to ${backendSlug}; no-op.`);
+            else if (existingPin) {
+                this.verboseLog('WorkspaceBootstrap', `quonfig.json already pinned to ${existingFormatted}; no-op.`);
             }
             else {
+                const backendFormatted = `${backendPin.orgSlug}/${backendPin.workspaceSlug}`;
                 this.log('');
-                this.log(`Pinning quonfig.json to workspace "${backendSlug}"...`);
-                await writeWorkspaceSlug(resolvedDir, backendSlug);
-                await this.commitAndPushPin(resolvedDir, backendSlug, flags.force);
+                this.log(`Pinning quonfig.json to workspace "${backendFormatted}"...`);
+                await writeWorkspaceSlug(resolvedDir, backendPin);
+                await this.commitAndPushPin(resolvedDir, backendFormatted, flags.force);
             }
         }
         catch (error) {
@@ -182,30 +195,24 @@ export default class WorkspaceBootstrap extends BaseCommand {
      * don't accidentally sweep in unrelated user edits.
      */
     async commitAndPushPin(dir, slug, force) {
-        const { execFile: execFileCb } = await import('node:child_process');
-        const util = await import('node:util');
-        const execFile = util.promisify(execFileCb);
         // Stage just quonfig.json so we don't accidentally commit other dirty files.
-        await execFile('git', ['-C', dir, 'add', 'quonfig.json']);
+        await runGit(['-C', dir, 'add', 'quonfig.json']);
         // If `git add` produced no staged change (e.g. content matched an earlier
         // version on disk), `git commit` would fail. Check the index first.
-        const { stdout: diffStat } = await execFile('git', ['-C', dir, 'diff', '--cached', '--name-only']);
+        const { stdout: diffStat } = await runGit(['-C', dir, 'diff', '--cached', '--name-only']);
         if (!diffStat.trim()) {
             this.verboseLog('WorkspaceBootstrap', 'quonfig.json pin matches HEAD; no commit needed.');
             return;
         }
-        await execFile('git', ['-C', dir, 'commit', '-m', `chore: pin quonfig.json to workspace "${slug}"`]);
+        await runGit(['-C', dir, 'commit', '-m', `chore: pin quonfig.json to workspace "${slug}"`]);
         // Push the new commit using the same force semantics as the main push.
         const pushArgs = ['-C', dir, 'push', 'origin', 'main'];
         pushArgs.push(force ? '--force' : '--force-with-lease');
-        await execFile('git', pushArgs);
+        await runGit(pushArgs);
         this.log(`Pushed pin commit.`);
     }
     async remoteHasCommits(repoUrl) {
-        const { execFile: execFileCb } = await import('node:child_process');
-        const util = await import('node:util');
-        const execFile = util.promisify(execFileCb);
-        const { stdout } = await execFile('git', ['ls-remote', '--heads', repoUrl]);
+        const { stdout } = await runGit(['ls-remote', '--heads', repoUrl]);
         return stdout.trim().length > 0;
     }
 }

package/dist/commands/workspace/create.d.ts

@@ -11,6 +11,17 @@ export default class WorkspaceCreate extends BaseCommand {
         org: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
     };
     run(): Promise<JsonObj | void>;
+    /**
+     * Pick the org for the new workspace from the per-org token store.
+     *
+     * - 0 orgs → "No orgs found. Run `qfg login` first."
+     * - 1 org → auto-select that org's workosOrgId.
+     * - 2+ orgs → require `--org <slug-or-uuid>`. Slug is matched against
+     *   `org_slug` in the token store; UUID is matched against the token
+     *   store key. Either way the org must exist locally — we never invent
+     *   an orgId we don't have a token for.
+     */
+    private resolveOrgFromTokens;
     /**
      * oRPC surfaces structured errors as {json: {code, message, ...}} or
      * {error: {...}}. Extract the message for display; fall back to raw

package/dist/commands/workspace/create.js

@@ -2,6 +2,8 @@ import { Args, Flags } from '@oclif/core';
 import { BaseCommand } from '../../index.js';
 import { getApiUrl } from '../../util/domain-urls.js';
 import { getValidAccessToken } from '../../util/get-valid-token.js';
+import { findOrgIdBySlug, loadTokens } from '../../util/token-storage.js';
+const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 /**
  * Slugify matches the UI's rules exactly (see
  * app-quonfig/src/app/(app)/workspaces/new/page.tsx): lowercase, any
@@ -44,31 +46,26 @@ export default class WorkspaceCreate extends BaseCommand {
         if (!slug) {
             return this.err(`"${args.slug}" does not produce a valid slug. Use letters, numbers, or hyphens.`);
         }
-        // Resolve auth via the same path every other command uses. We
-        // don't require an active-workspace profile (AuthConfig) — the
-        // whole point of this command is to create one — but we do need a
-        // valid bearer token / API key.
+        // workspace create has no workspace context to lean on, so it can't go
+        // through the org/ws resolver. Pick the org directly from the token
+        // store: 1 org → auto, 2+ orgs → require --org, 0 orgs → not logged in.
+        const orgResolution = await this.resolveOrgFromTokens(flags.org);
+        if ('error' in orgResolution)
+            return this.err(orgResolution.error);
+        const { workosOrgId, orgSlug } = orgResolution;
         let accessToken;
         try {
-            accessToken = await getValidAccessToken();
+            accessToken = await getValidAccessToken(workosOrgId);
         }
         catch {
             return this.err('Not logged in. Run `qfg login` first.');
         }
         const apiUrl = getApiUrl();
-        const body = { slug };
+        const body = { slug, organizationId: workosOrgId };
         if (flags.name)
             body.name = flags.name;
-        if (flags.org) {
-            // Accept either a UUID (from the API) or a human-readable slug.
-            // The server resolves the slug to the local org UUID.
-            const uuidPattern = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
-            if (uuidPattern.test(flags.org)) {
-                body.organizationId = flags.org;
-            }
-            else {
-                body.organizationSlug = flags.org;
-            }
+        if (orgSlug) {
+            this.log(`Creating workspace in org: ${orgSlug}`);
         }
         this.verboseLog('WorkspaceCreate', { apiUrl, body });
         let res;
@@ -134,6 +131,49 @@ export default class WorkspaceCreate extends BaseCommand {
             environments: created.environments,
         };
     }
+    /**
+     * Pick the org for the new workspace from the per-org token store.
+     *
+     * - 0 orgs → "No orgs found. Run `qfg login` first."
+     * - 1 org → auto-select that org's workosOrgId.
+     * - 2+ orgs → require `--org <slug-or-uuid>`. Slug is matched against
+     *   `org_slug` in the token store; UUID is matched against the token
+     *   store key. Either way the org must exist locally — we never invent
+     *   an orgId we don't have a token for.
+     */
+    async resolveOrgFromTokens(flagOrg) {
+        const store = await loadTokens();
+        if (!store || Object.keys(store.tokensByOrg).length === 0) {
+            return { error: 'No orgs found. Run `qfg login` first.' };
+        }
+        const entries = Object.entries(store.tokensByOrg);
+        if (flagOrg) {
+            if (UUID_PATTERN.test(flagOrg)) {
+                const tokens = store.tokensByOrg[flagOrg];
+                if (!tokens) {
+                    return { error: `Org \`${flagOrg}\` not found in your token store. Run \`qfg login\` to refresh your org list.` };
+                }
+                return { workosOrgId: flagOrg, orgSlug: tokens.org_slug };
+            }
+            const matchedId = findOrgIdBySlug(store, flagOrg);
+            if (!matchedId) {
+                return { error: `Org \`${flagOrg}\` not found in your token store. Run \`qfg login\` to refresh your org list.` };
+            }
+            return { workosOrgId: matchedId, orgSlug: flagOrg };
+        }
+        if (entries.length === 1) {
+            const [orgId, tokens] = entries[0];
+            return { workosOrgId: orgId, orgSlug: tokens.org_slug };
+        }
+        const slugList = entries
+            .map(([, tokens]) => tokens.org_slug)
+            .filter((s) => Boolean(s))
+            .join(', ');
+        const orgList = slugList || entries.map(([orgId]) => orgId).join(', ');
+        return {
+            error: `You are a member of multiple orgs. Specify --org <org-slug> to indicate which org to create the workspace in. Your orgs: ${orgList}.`,
+        };
+    }
     /**
      * oRPC surfaces structured errors as {json: {code, message, ...}} or
      * {error: {...}}. Extract the message for display; fall back to raw

package/dist/commands/workspace/switch.d.ts

@@ -7,4 +7,14 @@ export default class WorkspaceSwitch extends BaseCommand {
     static description: string;
     static examples: string[];
     run(): Promise<JsonObj | void>;
+    /**
+     * Resolve the user's positional arg against the candidate list.
+     *
+     * - `org/ws` form (preferred) → match by both org slug and workspace slug.
+     * - UUID → workspaceId match (kept for back-compat with scripts that
+     *   pass IDs straight through). Bare slug is rejected with the same
+     *   migration message used elsewhere in the CLI.
+     */
+    private matchByArg;
+    private fetchAllWorkspaces;
 }

package/dist/commands/workspace/switch.js

@@ -3,78 +3,52 @@ import { select } from '@inquirer/prompts';
 import { BaseCommand } from '../../index.js';
 import { getApiUrl } from '../../util/domain-urls.js';
 import { getValidAccessToken } from '../../util/get-valid-token.js';
-import { loadAuthConfig, saveAuthConfig } from '../../util/token-storage.js';
+import { tryParseWorkspacePin } from '../../util/quonfig-json.js';
+import { findOrgIdBySlug, loadAuthConfig, loadTokens, saveAuthConfig } from '../../util/token-storage.js';
 const UUID_PATTERN = /^[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}$/i;
 export default class WorkspaceSwitch extends BaseCommand {
     static args = {
         slug: Args.string({
-            description: 'Workspace slug (or UUID) to switch to. Omit for an interactive picker.',
+            description: 'Workspace pin in `<org-slug>/<workspace-slug>` form. Omit for an interactive picker.',
             required: false,
         }),
     };
-    static description = 'Switch to a different workspace';
-    static examples = ['<%= config.bin %> <%= command.id %>', '<%= config.bin %> <%= command.id %> my-workspace-slug'];
+    static description = 'Switch the saved default profile to a different (org, workspace) pair';
+    static examples = ['<%= config.bin %> <%= command.id %>', '<%= config.bin %> <%= command.id %> acme/production'];
     async run() {
         const { args } = await this.parse(WorkspaceSwitch);
-        // Get a valid token — refresh silently if needed, error if not logged in
+        const store = await loadTokens();
+        if (!store || Object.keys(store.tokensByOrg).length === 0) {
+            return this.err('Not logged in. Run `qfg login` first.');
+        }
+        const orgEntries = Object.entries(store.tokensByOrg);
+        const firstOrgId = orgEntries[0][0];
         let accessToken;
         try {
-            accessToken = await getValidAccessToken();
+            accessToken = await getValidAccessToken(firstOrgId, this.verboseLog);
         }
         catch {
             return this.err('Not logged in. Run `qfg login` first.');
         }
-        const authConfig = await loadAuthConfig();
-        if (!authConfig) {
-            return this.err('Not logged in. Run `qfg login` first.');
-        }
-        // Fetch all workspaces the user has access to
-        const apiUrl = getApiUrl();
-        let candidates = [];
-        try {
-            const res = await fetch(`${apiUrl}/api/v1/userWorkspaces/list`, {
-                method: 'POST',
-                headers: {
-                    Authorization: `Bearer ${accessToken}`,
-                    'Content-Type': 'application/json',
-                },
-                body: JSON.stringify({ json: {} }),
-            });
-            if (!res.ok) {
-                return this.err(`Failed to fetch workspaces (${res.status}). Try \`qfg login\` to re-authenticate.`);
-            }
-            const body = (await res.json());
-            const all = (body.json ?? body);
-            candidates = Array.isArray(all) ? all : [];
-        }
-        catch (error) {
-            return this.err(`Failed to fetch workspaces: ${String(error)}`);
-        }
+        const candidates = await this.fetchAllWorkspaces(accessToken);
         if (candidates.length === 0) {
             return this.err('No workspaces found for your account.');
         }
-        // Pick workspace: positional arg → interactive picker → auto-select if only one
         let match;
         if (args.slug) {
-            const found = UUID_PATTERN.test(args.slug)
-                ? candidates.find((w) => w.workspaceId === args.slug)
-                : candidates.find((w) => w.workspaceSlug === args.slug);
-            if (!found) {
-                const available = candidates.map((w) => w.workspaceSlug).join(', ') || '(none)';
-                return this.err(`Workspace "${args.slug}" not found. Available: ${available}.`);
-            }
-            match = found;
+            const found = this.matchByArg(args.slug, candidates, store);
+            if ('error' in found)
+                return this.err(found.error);
+            match = found.match;
         }
         else if (candidates.length === 1) {
             match = candidates[0];
-            this.log(`Only one workspace available: ${match.organizationName} / ${match.workspaceSlug}`);
+            const pin = pinFor(match);
+            this.log(`Only one workspace available: ${pin}`);
         }
         else {
             const chosen = await select({
-                choices: candidates.map((w) => ({
-                    name: `${w.organizationName} / ${w.workspaceSlug}`,
-                    value: w.workspaceId,
-                })),
+                choices: candidates.map((w) => ({ name: pinFor(w), value: w.workspaceId })),
                 message: 'Select workspace:',
             });
             const found = candidates.find((w) => w.workspaceId === chosen);
@@ -82,10 +56,12 @@ export default class WorkspaceSwitch extends BaseCommand {
                 return this.err('No workspace selected.');
             match = found;
         }
-        // Save as the default profile
+        const authConfig = (await loadAuthConfig()) ?? { profiles: {}, defaultProfile: 'default' };
         const defaultProfile = authConfig.defaultProfile || 'default';
+        const orgSlug = match.organizationSlug ?? slugFromName(match.organizationName) ?? match.workosOrgId;
         await saveAuthConfig({
             ...authConfig,
+            defaultProfile,
             profiles: {
                 ...authConfig.profiles,
                 [defaultProfile]: {
@@ -93,17 +69,89 @@ export default class WorkspaceSwitch extends BaseCommand {
                     workspaceName: match.workspaceSlug,
                     workspaceSlug: match.workspaceSlug,
                     organizationName: match.organizationName,
+                    organizationSlug: orgSlug,
+                    workosOrgId: match.workosOrgId,
                 },
             },
         });
-        this.log(`\nSwitched to: ${match.organizationName} / ${match.workspaceSlug}`);
+        const pin = `${orgSlug}/${match.workspaceSlug}`;
+        this.log(`\nSwitched to: ${pin}`);
         this.log(`\nTo use this workspace in a project, add to your .env:`);
-        this.log(`  QUONFIG_WORKSPACE=${match.workspaceSlug}`);
+        this.log(`  QUONFIG_WORKSPACE=${pin}`);
         return {
-            organizationName: match.organizationName,
             success: true,
+            activeWorkspace: pin,
+            organizationName: match.organizationName,
+            organizationSlug: orgSlug,
+            workosOrgId: match.workosOrgId,
             workspaceId: match.workspaceId,
             workspaceSlug: match.workspaceSlug,
         };
     }
+    /**
+     * Resolve the user's positional arg against the candidate list.
+     *
+     * - `org/ws` form (preferred) → match by both org slug and workspace slug.
+     * - UUID → workspaceId match (kept for back-compat with scripts that
+     *   pass IDs straight through). Bare slug is rejected with the same
+     *   migration message used elsewhere in the CLI.
+     */
+    matchByArg(arg, candidates, store) {
+        if (UUID_PATTERN.test(arg)) {
+            const found = candidates.find((w) => w.workspaceId === arg);
+            if (!found)
+                return { error: `Workspace UUID "${arg}" not found among your accessible workspaces.` };
+            return { match: found };
+        }
+        const pin = tryParseWorkspacePin(arg);
+        if (!pin) {
+            return {
+                error: 'Workspace argument must be in `<org-slug>/<workspace-slug>` form (e.g. acme/production). ' +
+                    'Bare workspace slugs are no longer accepted.',
+            };
+        }
+        const orgId = findOrgIdBySlug(store, pin.orgSlug);
+        if (!orgId) {
+            return { error: `No token found for org \`${pin.orgSlug}\`. Run \`qfg login\` to add this org.` };
+        }
+        const found = candidates.find((w) => w.workosOrgId === orgId && w.workspaceSlug === pin.workspaceSlug);
+        if (!found) {
+            const inOrg = candidates.filter((w) => w.workosOrgId === orgId).map((w) => w.workspaceSlug);
+            const available = inOrg.length > 0 ? inOrg.join(', ') : '(none)';
+            return {
+                error: `Workspace "${pin.workspaceSlug}" not found in org "${pin.orgSlug}". Available: ${available}.`,
+            };
+        }
+        return { match: found };
+    }
+    async fetchAllWorkspaces(accessToken) {
+        try {
+            const res = await fetch(`${getApiUrl()}/api/v1/userWorkspaces/list`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify({ json: {} }),
+            });
+            if (!res.ok) {
+                throw new Error(`Failed to fetch workspaces (${res.status}). Try \`qfg login\` to re-authenticate.`);
+            }
+            const body = (await res.json());
+            const all = (body.json ?? body);
+            return Array.isArray(all) ? all : [];
+        }
+        catch (error) {
+            throw new Error(`Failed to fetch workspaces: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+function pinFor(w) {
+    const orgSlug = w.organizationSlug ?? slugFromName(w.organizationName) ?? w.workosOrgId;
+    return `${orgSlug}/${w.workspaceSlug}`;
+}
+function slugFromName(name) {
+    if (!name)
+        return undefined;
+    return name
+        .toLowerCase()
+        .replaceAll(/[^\da-z]+/g, '-')
+        .replaceAll(/^-|-$/g, '');
 }

package/dist/commands/workspace.d.ts

@@ -4,5 +4,19 @@ export default class Workspace extends BaseCommand {
     static description: string;
     static examples: string[];
     run(): Promise<JsonObj | void>;
+    /**
+     * Pin the default-profile workspaceId to org/ws form by looking it up in
+     * the workspaces list. Returns undefined if the auth config is empty or
+     * the saved workspace doesn't appear in the listing.
+     */
+    private profilePin;
+    /**
+     * QUONFIG_WORKSPACE wins over the default profile (matches the resolution
+     * order in get-client.ts/resolve-workspace.ts). Bare slugs are ignored
+     * here — the status command does NOT throw on a stale env-var, just
+     * shows the default profile instead.
+     */
+    private activePin;
+    private fetchWorkspaces;
     private runApiKeyMode;
 }