deepline 0.1.136 → 0.1.138

package/dist/cli/index.js

@@ -237,6 +237,22 @@ var PROD_URL = "https://code.deepline.com";
 var DEFAULT_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
 var PROJECT_DEEPLINE_ENV_FILE = ".env.deepline";
+var COWORK_IGNORED_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
+  ".auto-memory",
+  ".claude",
+  ".remote-plugins",
+  "outputs",
+  "plugins",
+  "uploads"
+]);
+var COWORK_PROJECT_MARKERS = [
+  ".deepline",
+  ".env.deepline",
+  ".git",
+  "AGENTS.md",
+  "package.json",
+  "pyproject.toml"
+];
 function baseUrlSlug(baseUrl) {
   let url;
   try {
@@ -282,9 +298,124 @@ function findNearestEnvFile(name, startDir = process.cwd()) {
     current = parent;
   }
 }
-function loadProjectDeeplineEnv(startDir = process.cwd()) {
-  const filePath = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
-  return filePath ? parseEnvFile(filePath) : {};
+function isDirectory(path) {
+  try {
+    return (0, import_node_fs.statSync)(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function canonicalPath(path) {
+  try {
+    return (0, import_node_fs.realpathSync)(path);
+  } catch {
+    return (0, import_node_path.resolve)(path);
+  }
+}
+function isTruthy(value) {
+  return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+function sessionRootFromPath(path) {
+  const trimmed = path?.trim();
+  if (!trimmed) return null;
+  const match = /^\/sessions\/[^/]+(?=\/|$)/.exec(trimmed);
+  return match?.[0] ?? null;
+}
+function coworkSessionRoot() {
+  const home = process.env.HOME?.trim();
+  const homeSessionRoot = sessionRootFromPath(home);
+  if (homeSessionRoot && isDirectory((0, import_node_path.join)(homeSessionRoot, "mnt"))) {
+    return homeSessionRoot;
+  }
+  const cwdSessionRoot = sessionRootFromPath(process.cwd());
+  if (cwdSessionRoot && isDirectory((0, import_node_path.join)(cwdSessionRoot, "mnt"))) {
+    return cwdSessionRoot;
+  }
+  if (isTruthy(process.env.CLAUDE_CODE_REMOTE) && home) {
+    const mountedRoot = (0, import_node_path.join)(home, "mnt");
+    if (isDirectory(mountedRoot)) return (0, import_node_path.resolve)(home);
+  }
+  return null;
+}
+function isCoworkLikeSandbox() {
+  const home = process.env.HOME?.trim();
+  return isTruthy(process.env.CLAUDE_CODE_REMOTE) || sessionRootFromPath(home) !== null || sessionRootFromPath(process.cwd()) !== null;
+}
+function coworkProjectScore(path) {
+  let score = 0;
+  for (const marker of COWORK_PROJECT_MARKERS) {
+    if ((0, import_node_fs.existsSync)((0, import_node_path.join)(path, marker))) score += 1;
+  }
+  return score;
+}
+function listCoworkWorkspaceDirCandidates() {
+  if (!isCoworkLikeSandbox()) {
+    return [];
+  }
+  const explicitProjectDir = process.env.CLAUDE_PROJECT_DIR?.trim();
+  if (explicitProjectDir && isDirectory(explicitProjectDir)) {
+    return [(0, import_node_path.resolve)(explicitProjectDir)];
+  }
+  const sessionRoot = coworkSessionRoot();
+  if (!sessionRoot) return [];
+  const mountedRoot = (0, import_node_path.join)(sessionRoot, "mnt");
+  if (!isDirectory(mountedRoot)) return [];
+  let names;
+  try {
+    names = (0, import_node_fs.readdirSync)(mountedRoot).sort();
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  for (const name of names) {
+    if (name.startsWith(".") || COWORK_IGNORED_WORKSPACE_DIRS.has(name)) {
+      continue;
+    }
+    const candidate = (0, import_node_path.join)(mountedRoot, name);
+    if (isDirectory(candidate)) candidates.push(candidate);
+  }
+  if (candidates.length <= 1) return candidates;
+  const projectLike = candidates.filter(
+    (candidate) => coworkProjectScore(candidate) > 0
+  );
+  return projectLike.length > 0 ? projectLike : candidates;
+}
+function isInIgnoredCoworkMount(path) {
+  const sessionRoot = coworkSessionRoot();
+  if (!sessionRoot) return false;
+  const mountedRoot = canonicalPath((0, import_node_path.join)(sessionRoot, "mnt"));
+  const resolvedPath = canonicalPath(path);
+  const prefix = `${mountedRoot}/`;
+  if (!resolvedPath.startsWith(prefix)) return false;
+  const relativePath = resolvedPath.slice(prefix.length);
+  const mountName = relativePath.split("/")[0];
+  return mountName.startsWith(".") || COWORK_IGNORED_WORKSPACE_DIRS.has(mountName);
+}
+function detectCoworkWorkspaceDir() {
+  const candidates = listCoworkWorkspaceDirCandidates();
+  return candidates.length === 1 ? candidates[0] : null;
+}
+function loadProjectEnvCandidates(startDir = process.cwd()) {
+  const filePaths = [];
+  const sources = /* @__PURE__ */ new Map();
+  const nearestFile = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
+  if (nearestFile && !isInIgnoredCoworkMount(nearestFile)) {
+    filePaths.push(nearestFile);
+    sources.set((0, import_node_path.resolve)(nearestFile), "nearest");
+  }
+  const coworkWorkspaceDir = detectCoworkWorkspaceDir();
+  if (coworkWorkspaceDir) {
+    const coworkFile = (0, import_node_path.join)(coworkWorkspaceDir, PROJECT_DEEPLINE_ENV_FILE);
+    if ((0, import_node_fs.existsSync)(coworkFile) && !filePaths.some((filePath) => (0, import_node_path.resolve)(filePath) === (0, import_node_path.resolve)(coworkFile))) {
+      filePaths.push(coworkFile);
+      sources.set((0, import_node_path.resolve)(coworkFile), "cowork");
+    }
+  }
+  return filePaths.map((filePath) => ({
+    filePath,
+    env: parseEnvFile(filePath),
+    source: sources.get((0, import_node_path.resolve)(filePath)) ?? "nearest"
+  }));
 }
 function normalizeBaseUrl(baseUrl) {
   const trimmed = baseUrl.trim().replace(/\/+$/, "");
@@ -348,23 +479,35 @@ function loadGlobalCliEnv() {
   return loadCliEnv(PROD_URL);
 }
 function autoDetectBaseUrl() {
-  const projectEnv = loadProjectDeeplineEnv();
+  const projectEnvs = loadProjectEnvCandidates();
   const globalEnv = loadGlobalCliEnv();
-  return normalizeBaseUrl(process.env[HOST_URL_ENV] ?? "") || normalizeBaseUrl(projectEnv[HOST_URL_ENV] ?? "") || normalizeBaseUrl(globalEnv[HOST_URL_ENV] ?? "") || PROD_URL;
+  return normalizeBaseUrl(process.env[HOST_URL_ENV] ?? "") || firstNonEmpty(
+    ...projectEnvs.map(({ env }) => normalizeBaseUrl(env[HOST_URL_ENV]))
+  ) || normalizeBaseUrl(globalEnv[HOST_URL_ENV] ?? "") || PROD_URL;
 }
 function resolveApiKeyForBaseUrl(baseUrl, explicitApiKey) {
   const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
-  const projectEnv = loadProjectDeeplineEnv();
+  const projectEnvs = loadProjectEnvCandidates();
   const cliEnv = loadCliEnv(normalizedBaseUrl || baseUrl);
-  const projectBaseUrl = normalizeBaseUrl(projectEnv[HOST_URL_ENV] ?? "");
-  const projectKeyApplies = projectBaseUrl === normalizedBaseUrl;
   return firstNonEmpty(
     explicitApiKey,
     process.env[API_KEY_ENV],
-    projectKeyApplies ? projectEnv[API_KEY_ENV] : "",
+    ...projectEnvs.map(({ env }) => {
+      const projectBaseUrl = normalizeBaseUrl(env[HOST_URL_ENV] ?? "");
+      return projectBaseUrl === normalizedBaseUrl ? env[API_KEY_ENV] : "";
+    }),
     cliEnv[API_KEY_ENV]
   );
 }
+function getResolvedProjectAuthSource(baseUrl, apiKey, startDir = process.cwd()) {
+  const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+  const normalizedApiKey = apiKey.trim();
+  if (!normalizedBaseUrl || !normalizedApiKey) return null;
+  return loadProjectEnvCandidates(startDir).find(({ env }) => {
+    const projectBaseUrl = normalizeBaseUrl(env[HOST_URL_ENV] ?? "");
+    return projectBaseUrl === normalizedBaseUrl && (env[API_KEY_ENV] ?? "").trim() === normalizedApiKey;
+  }) ?? null;
+}
 function resolveConfig(options) {
   const baseUrl = normalizeBaseUrl(
     options?.baseUrl?.trim() || autoDetectBaseUrl()
@@ -387,6 +530,69 @@ function resolveConfig(options) {
     maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES
   };
 }
+function mergeProjectEnvFile(filePath, values) {
+  const existing = parseEnvFile(filePath);
+  const merged = { ...existing, ...values };
+  const dir = (0, import_node_path.dirname)(filePath);
+  if (!(0, import_node_fs.existsSync)(dir)) (0, import_node_fs.mkdirSync)(dir, { recursive: true });
+  ensureProjectEnvIsIgnored(dir);
+  const allowedKeys = /* @__PURE__ */ new Set([HOST_URL_ENV, API_KEY_ENV]);
+  const lines = Object.entries(merged).filter(([key, value]) => allowedKeys.has(key) && value !== "").map(([key, value]) => `${key}=${value}`);
+  (0, import_node_fs.writeFileSync)(filePath, `${lines.join("\n")}
+`, "utf-8");
+}
+function ensureProjectEnvIsIgnored(dir) {
+  const gitignorePath = (0, import_node_path.join)(dir, ".gitignore");
+  const entry = PROJECT_DEEPLINE_ENV_FILE;
+  const existing = (0, import_node_fs.existsSync)(gitignorePath) ? (0, import_node_fs.readFileSync)(gitignorePath, "utf-8") : "";
+  const alreadyIgnored = existing.split(/\r?\n/).map((line) => line.trim()).some((line) => line === entry || line === `/${entry}`);
+  if (alreadyIgnored) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  (0, import_node_fs.writeFileSync)(gitignorePath, `${existing}${prefix}${entry}
+`, "utf-8");
+}
+function saveProjectDeeplineEnvValues(values, startDir = process.cwd()) {
+  const target = resolveProjectPinTarget(startDir);
+  if (!target.ok) {
+    throw new ConfigError(
+      `Cowork project folder is ambiguous. Candidate folders: ${target.candidates.join(
+        ", "
+      )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder before running this command.`
+    );
+  }
+  const filePath = (0, import_node_path.join)(target.dir, PROJECT_DEEPLINE_ENV_FILE);
+  mergeProjectEnvFile(filePath, values);
+  return [filePath];
+}
+function resolveProjectPinTarget(startDir = process.cwd()) {
+  const nearestFile = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
+  if (nearestFile && !isInIgnoredCoworkMount(nearestFile)) {
+    return { ok: true, dir: (0, import_node_path.dirname)(nearestFile), source: "nearest" };
+  }
+  const coworkCandidates = listCoworkWorkspaceDirCandidates();
+  if (coworkCandidates.length === 1) {
+    return { ok: true, dir: coworkCandidates[0], source: "cowork" };
+  }
+  if (coworkCandidates.length > 1) {
+    const resolvedStartDir = canonicalPath(startDir);
+    const cwdCandidate = coworkCandidates.find((candidate) => {
+      const resolvedCandidate = canonicalPath(candidate);
+      return resolvedStartDir === resolvedCandidate || resolvedStartDir.startsWith(`${resolvedCandidate}/`);
+    });
+    if (cwdCandidate) {
+      return { ok: true, dir: cwdCandidate, source: "cowork" };
+    }
+    return {
+      ok: false,
+      reason: "ambiguous_cowork_project",
+      candidates: coworkCandidates
+    };
+  }
+  return { ok: true, dir: (0, import_node_path.resolve)(startDir), source: "cwd" };
+}
+function getActiveProjectAuthSource(startDir = process.cwd()) {
+  return loadProjectEnvCandidates(startDir)[0] ?? null;
+}
 
 // src/http.ts
 var import_node_fs2 = require("fs");
@@ -413,10 +619,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.136",
+  version: "0.1.138",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.136",
+    latest: "0.1.138",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -507,7 +713,7 @@ function normalizeAgentRuntime(value) {
   if (explicit === "gemini_cli") return "gemini";
   return EXPLICIT_AGENT_RUNTIMES.has(explicit) ? explicit : null;
 }
-function isCoworkLikeSandbox() {
+function isCoworkLikeSandbox2() {
   const pluginMode = truthyEnv("DEEPLINE_PLUGIN_MODE");
   const claudeRemote = truthyEnv("CLAUDE_CODE_REMOTE");
   const projectDir = Boolean(process.env.CLAUDE_PROJECT_DIR?.trim());
@@ -520,7 +726,7 @@ function detectAgentRuntime(options = {}) {
   const explicit = normalizeAgentRuntime(process.env.DEEPLINE_AGENT_RUNTIME);
   if (explicit) return explicit;
   if (process.env.CODEX_THREAD_ID?.trim()) return "codex";
-  if (options.detectCowork !== false && isCoworkLikeSandbox()) {
+  if (options.detectCowork !== false && isCoworkLikeSandbox2()) {
     return "claude_cowork";
   }
   if (process.env.CLAUDECODE?.trim() === "1") return "claude_code";
@@ -986,7 +1192,7 @@ function sleep(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 function withCoworkNetworkHint(message) {
-  if (!isCoworkLikeSandbox() || message.includes(COWORK_NETWORK_HINT)) {
+  if (!isCoworkLikeSandbox2() || message.includes(COWORK_NETWORK_HINT)) {
     return message;
   }
   return `${message}
@@ -18465,6 +18671,15 @@ Examples:
 async function fetchOrganizations(http, apiKey) {
   return http.post("/api/v2/auth/cli/organizations", { api_key: apiKey });
 }
+function normalizeAuthScope(value) {
+  if (!value) return "auto";
+  if (value === "auto" || value === "folder" || value === "global") {
+    return value;
+  }
+  throw new Error(
+    `Invalid --auth-scope "${value}". Expected one of: auto, folder, global.`
+  );
+}
 function orgListLines(orgs) {
   return orgs.map((org, index) => {
     const current = org.is_current ? " (current)" : "";
@@ -18472,6 +18687,90 @@ function orgListLines(orgs) {
     return `${index + 1}. ${org.name}${role}${current}`;
   });
 }
+function redactApiKey(value) {
+  if (!value) return null;
+  if (value.length <= 10) return `${value.slice(0, 3)}...`;
+  return `${value.slice(0, 8)}...${value.slice(-4)}`;
+}
+function processEnvValue(name) {
+  return process.env[name]?.trim() ?? "";
+}
+function resolveOrgSwitchAuthTarget(scope, config) {
+  const activeProject = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey
+  );
+  const folderTarget = resolveProjectPinTarget();
+  const globalOverrideWarning = activeProject && scope === "global" ? [
+    `Folder auth in ${activeProject.filePath} overrides global auth for commands run here.`
+  ] : [];
+  if (scope === "folder") {
+    if (!folderTarget.ok) {
+      throw new Error(
+        `Cowork project folder is ambiguous. Candidate folders: ${folderTarget.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder before running this command.`
+      );
+    }
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "explicit_folder",
+      source: folderTarget.source,
+      warnings: []
+    };
+  }
+  if (scope === "global") {
+    return {
+      kind: "global",
+      requested_scope: scope,
+      effective_scope: "global",
+      reason: "explicit_global",
+      warnings: globalOverrideWarning
+    };
+  }
+  if (activeProject) {
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "existing_folder_auth",
+      source: activeProject.source,
+      warnings: []
+    };
+  }
+  if (folderTarget.ok && folderTarget.source === "cowork") {
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "detected_cowork_project",
+      source: "cowork",
+      warnings: []
+    };
+  }
+  if (!folderTarget.ok) {
+    return {
+      kind: "global",
+      requested_scope: scope,
+      effective_scope: "global",
+      reason: "ambiguous_cowork_fell_back_global",
+      warnings: [
+        `Cowork project folder is ambiguous, so global auth was updated. Candidate folders: ${folderTarget.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder to update folder auth.`
+      ]
+    };
+  }
+  return {
+    kind: "global",
+    requested_scope: scope,
+    effective_scope: "global",
+    reason: "default_global",
+    warnings: []
+  };
+}
 async function handleOrgList(options) {
   const config = resolveConfig();
   const http = new HttpClient(config);
@@ -18491,7 +18790,89 @@ async function handleOrgList(options) {
     { json: options.json }
   );
 }
+async function handleOrgStatus(options) {
+  const config = resolveConfig();
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  const current = payload.organizations.find((org) => org.is_current) ?? payload.organizations.find((org) => org.org_id === payload.current_org_id) ?? null;
+  const projectCandidate = getActiveProjectAuthSource();
+  const activeProject = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey
+  );
+  const folderTarget = resolveProjectPinTarget();
+  const hostPath = hostEnvFilePath(config.baseUrl);
+  const envApiKey = processEnvValue(API_KEY_ENV);
+  const envHostUrl = processEnvValue(HOST_URL_ENV);
+  const authSource = envApiKey ? {
+    scope: "env",
+    source: "process",
+    path: null,
+    api_key: redactApiKey(envApiKey),
+    host: envHostUrl || null,
+    overrides_global: true,
+    overrides_folder: Boolean(projectCandidate)
+  } : activeProject ? {
+    scope: "folder",
+    source: activeProject.source,
+    path: activeProject.filePath,
+    api_key: redactApiKey(activeProject.env.DEEPLINE_API_KEY),
+    overrides_global: true
+  } : {
+    scope: "global",
+    source: "host",
+    path: hostPath,
+    api_key: redactApiKey(config.apiKey),
+    overrides_global: false
+  };
+  const folderTargetPayload = folderTarget.ok ? {
+    ok: true,
+    source: folderTarget.source,
+    dir: folderTarget.dir,
+    env_path: `${folderTarget.dir}/.env.deepline`
+  } : {
+    ok: false,
+    reason: folderTarget.reason,
+    candidates: folderTarget.candidates
+  };
+  const lines = [
+    `Organization: ${current?.name ?? "(unknown)"}`,
+    `Host: ${config.baseUrl}`,
+    `Auth scope: ${authSource.scope}`
+  ];
+  if (authSource.path) {
+    lines.push(`Auth file: ${authSource.path}`);
+  } else {
+    lines.push(`Auth source: ${API_KEY_ENV} process environment`);
+  }
+  if (envApiKey) {
+    lines.push(`${API_KEY_ENV} overrides saved auth for this process.`);
+  } else if (activeProject) {
+    lines.push("Global auth is overridden in this folder.");
+  }
+  printCommandEnvelope(
+    {
+      ok: true,
+      host: config.baseUrl,
+      organization: current,
+      current_org_id: payload.current_org_id,
+      auth_source: authSource,
+      host_env_path: hostPath,
+      folder_target: folderTargetPayload,
+      next: {
+        set_auto: "deepline org set <org>",
+        set_folder: "deepline org set <org> --auth-scope folder",
+        set_global: "deepline org set <org> --auth-scope global"
+      },
+      render: {
+        sections: [{ title: "org status", lines }]
+      }
+    },
+    { json: options.json }
+  );
+}
 async function handleOrgSwitch(selection, options) {
+  const authScope = normalizeAuthScope(options.authScope);
   const config = resolveConfig();
   const http = new HttpClient(config);
   const payload = await fetchOrganizations(http, config.apiKey);
@@ -18499,7 +18880,10 @@ async function handleOrgSwitch(selection, options) {
     printCommandEnvelope(
       {
         ...payload,
-        next: { switch: "deepline org switch <number>" },
+        next: { set: "deepline org set <number>" },
+        deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+        replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+        warnings: options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
         render: {
           sections: [
             {
@@ -18507,7 +18891,7 @@ async function handleOrgSwitch(selection, options) {
               lines: orgListLines(payload.organizations)
             }
           ],
-          actions: [{ label: "Run", command: "deepline org switch <number>" }]
+          actions: [{ label: "Run", command: "deepline org set <number>" }]
         }
       },
       { json: options.json }
@@ -18530,16 +18914,56 @@ async function handleOrgSwitch(selection, options) {
   if (!target) {
     throw new Error("Could not resolve the selected organization.");
   }
+  const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
   if (target.is_current) {
+    let project_env_paths2 = [];
+    if (authTarget.kind === "folder") {
+      project_env_paths2 = saveProjectDeeplineEnvValues({
+        DEEPLINE_HOST_URL: config.baseUrl,
+        DEEPLINE_API_KEY: config.apiKey
+      });
+    } else {
+      saveHostEnvValues(config.baseUrl, {
+        DEEPLINE_HOST_URL: config.baseUrl,
+        DEEPLINE_API_KEY: config.apiKey
+      });
+    }
+    const renderLines2 = [`Already on ${target.name}.`];
+    for (const projectPath of project_env_paths2) {
+      renderLines2.push(`Saved folder auth in ${projectPath}`);
+    }
+    if (authTarget.kind === "global") {
+      renderLines2.push(`Saved global auth in ${hostEnvFilePath(config.baseUrl)}`);
+    }
+    renderLines2.push(
+      `Scope: ${authTarget.requested_scope} -> ${authTarget.effective_scope} (${authTarget.reason})`
+    );
+    if (options.deprecatedSwitch) {
+      renderLines2.push("Warning: org switch is deprecated; use org set.");
+    }
+    for (const warning of authTarget.warnings) {
+      renderLines2.push(`Warning: ${warning}`);
+    }
+    const warnings2 = [
+      ...options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+      ...authTarget.warnings
+    ];
     printCommandEnvelope(
       {
         ok: true,
         unchanged: true,
         organization: target,
+        requested_auth_scope: authTarget.requested_scope,
+        effective_auth_scope: authTarget.effective_scope,
+        auth_scope_reason: authTarget.reason,
+        auth_scope: authTarget.effective_scope,
+        host_env_path: authTarget.kind === "global" ? hostEnvFilePath(config.baseUrl) : null,
+        project_env_paths: project_env_paths2,
+        deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+        replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+        warnings: warnings2,
         render: {
-          sections: [
-            { title: "org switch", lines: [`Already on ${target.name}.`] }
-          ]
+          sections: [{ title: "org set", lines: renderLines2 }]
         }
       },
       { json: options.json }
@@ -18550,26 +18974,61 @@ async function handleOrgSwitch(selection, options) {
     api_key: config.apiKey,
     org_id: target.org_id
   });
-  saveHostEnvValues(config.baseUrl, {
-    DEEPLINE_API_KEY: switched.api_key,
-    DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
-    DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
-  });
+  let project_env_paths = [];
+  if (authTarget.kind === "folder") {
+    project_env_paths = saveProjectDeeplineEnvValues({
+      DEEPLINE_HOST_URL: config.baseUrl,
+      DEEPLINE_API_KEY: switched.api_key
+    });
+  } else {
+    saveHostEnvValues(config.baseUrl, {
+      DEEPLINE_HOST_URL: config.baseUrl,
+      DEEPLINE_API_KEY: switched.api_key,
+      DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
+      DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
+    });
+  }
   const { api_key: _apiKey, ...publicSwitched } = switched;
+  const renderLines = [`Switched to ${switched.org_name}.`];
+  if (authTarget.kind === "folder") {
+    for (const projectPath of project_env_paths) {
+      renderLines.push(`Saved folder auth in ${projectPath}`);
+    }
+  } else {
+    renderLines.push(`Saved global auth in ${hostEnvFilePath(config.baseUrl)}`);
+  }
+  renderLines.push(
+    `Scope: ${authTarget.requested_scope} -> ${authTarget.effective_scope} (${authTarget.reason})`
+  );
+  if (options.deprecatedSwitch) {
+    renderLines.push("Warning: org switch is deprecated; use org set.");
+  }
+  for (const warning of authTarget.warnings) {
+    renderLines.push(`Warning: ${warning}`);
+  }
+  const warnings = [
+    ...options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+    ...authTarget.warnings
+  ];
   printCommandEnvelope(
     {
       ok: true,
-      host_env_path: hostEnvFilePath(config.baseUrl),
+      host_env_path: authTarget.kind === "global" ? hostEnvFilePath(config.baseUrl) : null,
+      project_env_paths,
       ...publicSwitched,
       api_key_saved: true,
+      requested_auth_scope: authTarget.requested_scope,
+      effective_auth_scope: authTarget.effective_scope,
+      auth_scope_reason: authTarget.reason,
+      auth_scope: authTarget.effective_scope,
+      deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+      replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+      warnings,
       render: {
         sections: [
           {
-            title: "org switch",
-            lines: [
-              `Switched to ${switched.org_name}.`,
-              `Saved host auth in ${hostEnvFilePath(config.baseUrl)}`
-            ]
+            title: "org set",
+            lines: renderLines
           }
         ]
       }
@@ -18585,6 +19044,7 @@ async function handleOrgCreate(name, options) {
     name
   });
   saveHostEnvValues(config.baseUrl, {
+    DEEPLINE_HOST_URL: config.baseUrl,
     DEEPLINE_API_KEY: created.api_key,
     DEEPLINE_ACTIVE_ORG_ID: created.org_id,
     DEEPLINE_ACTIVE_ORG_NAME: created.org_name
@@ -18614,18 +19074,20 @@ async function handleOrgCreate(name, options) {
   );
 }
 function registerOrgCommands(program) {
-  const org = program.command("org").description("List, create, and switch organizations.").addHelpText(
+  const org = program.command("org").description("List, create, and set organizations.").addHelpText(
     "after",
     `
 Notes:
-  Organizations are workspaces. Switching organizations mutates the saved host
-  auth file so later CLI commands target the selected workspace.
+  Organizations are workspaces. By default, switching updates the auth scope
+  that will affect later commands from this folder.
 
 Examples:
   deepline org list --json
+  deepline org status --json
   deepline org create Acme --json
-  deepline org switch 2
-  deepline org switch --org-id org_123 --json
+  deepline org set 2
+  deepline org set 2 --auth-scope folder
+  deepline org set --org-id org_123 --json
 `
   );
   org.command("list").description("List your organizations.").addHelpText(
@@ -18652,21 +19114,65 @@ Examples:
   deepline org create "Acme Sales" --json
 `
   ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgCreate);
-  org.command("switch [selection]").description(
-    "Switch to another organization and save the new API key in the host auth file."
-  ).addHelpText(
+  org.command("status").description("Show the current organization and auth source.").addHelpText(
     "after",
     `
 Notes:
-  Mutates the saved host auth file. Selection can be a list number, exact
-  organization name, or organization id. Without a selection, prints choices.
+  Read-only. Shows whether commands resolve auth from process env, a folder
+  .env.deepline file, or global host auth.
+
+Examples:
+  deepline org status
+  deepline org status --json
+`
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgStatus);
+  const addOrgSetOptions = (command) => command.option("--org-id <id>", "Set using an explicit organization id").option(
+    "--auth-scope <scope>",
+    "Where to save auth: auto, folder, or global",
+    "auto"
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped");
+  addOrgSetOptions(
+    org.command("set [selection]").description("Set the organization for the selected auth scope.").addHelpText(
+      "after",
+      `
+Notes:
+  Selection can be a list number, exact organization name, or organization id.
+  Without a selection, prints choices. The default --auth-scope auto updates
+  the folder auth file when one controls this command, updates the detected
+  Cowork project folder when present, and otherwise updates global host auth.
+
+Examples:
+  deepline org set
+  deepline org set 2
+  deepline org set 2 --auth-scope folder
+  deepline org set 2 --auth-scope global
+  deepline org set --org-id org_123 --json
+`
+    )
+  ).action(handleOrgSwitch);
+  addOrgSetOptions(
+    org.command("switch [selection]").description(
+      "Deprecated alias for org set. Set the organization for the selected auth scope."
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  Deprecated alias. Use deepline org set instead. The default --auth-scope auto
+  updates the folder auth file when one controls this command, updates the
+  detected Cowork project folder when present, and otherwise updates global host
+  auth.
 
 Examples:
   deepline org switch
   deepline org switch 2
+  deepline org switch 2 --auth-scope folder
+  deepline org switch 2 --auth-scope global
   deepline org switch --org-id org_123 --json
 `
-  ).option("--org-id <id>", "Switch using an explicit organization id").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgSwitch);
+    )
+  ).action(
+    (selection, options) => handleOrgSwitch(selection, { ...options, deprecatedSwitch: true })
+  );
 }
 
 // src/cli/commands/quickstart.ts
@@ -21619,34 +22125,6 @@ async function fetchV1SkillNames(baseUrl) {
 function buildSdkSkillNames(v1SkillNames) {
   return sortedUniqueSkillNames(v1SkillNames);
 }
-async function fetchSkillsUpdate(baseUrl, localVersion) {
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), CHECK_TIMEOUT_MS2);
-  try {
-    const response = await fetch(new URL("/api/v2/cli/update-check", baseUrl), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        skills: {
-          version: localVersion
-        }
-      }),
-      signal: controller.signal
-    });
-    if (!response.ok) return null;
-    const data = await response.json().catch(() => null);
-    const skills = data?.skills;
-    if (!skills) return null;
-    return {
-      needsUpdate: skills.needs_update === true,
-      remoteVersion: typeof skills.remote?.version === "string" ? skills.remote.version.trim() : ""
-    };
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timeout);
-  }
-}
 function buildSkillsInstallArgs(baseUrl, skillNames = DEFAULT_SDK_SKILL_NAMES) {
   return buildSkillsAddArgs(baseUrl, sortedUniqueSkillNames(skillNames));
 }
@@ -21787,6 +22265,12 @@ function writeSdkSkillsStatusLine(line) {
   process.stderr.write(`${line}
 `);
 }
+function skillsStaleHintLine(update) {
+  if (!update?.needs_update || !update.remote.version) {
+    return null;
+  }
+  return "Deepline agent skills are out of date. Run `deepline update` to sync.";
+}
 async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
   if (attemptedSync || shouldSkipSkillsSync()) return;
   attemptedSync = true;
@@ -21794,14 +22278,11 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
   if (usingPluginSkills) {
     return;
   }
-  const localVersion = readSdkSkillsLocalVersion(baseUrl);
-  const update = options.update === void 0 ? await fetchSkillsUpdate(baseUrl, localVersion) : options.update ? {
-    needsUpdate: options.update.needs_update,
-    remoteVersion: options.update.remote.version
-  } : null;
-  if (!update?.needsUpdate || !update.remoteVersion) {
+  const update = options.update ?? null;
+  if (!update?.needs_update || !update.remote.version) {
     return;
   }
+  const remoteVersion = update.remote.version;
   const remoteSkillNames = await fetchV1SkillNames(baseUrl);
   const skillNames = buildSdkSkillNames(
     remoteSkillNames.length > 0 ? remoteSkillNames : DEFAULT_SDK_SKILL_NAMES
@@ -21811,11 +22292,17 @@ async function syncSdkSkillsIfNeeded(baseUrl, options = {}) {
   const installed = await runSkillsInstall(baseUrl, skillNames);
   if (!installed) return;
   runLegacySkillsCleanup();
-  writeLocalSkillsVersion(baseUrl, update.remoteVersion);
+  writeLocalSkillsVersion(baseUrl, remoteVersion);
   writeSdkSkillsStatusLine("Deepline agent skills are up to date.");
 }
 
 // src/cli/commands/update.ts
+async function resolveSkillsVerdictFromCompat(baseUrl) {
+  const { response } = await checkSdkCompatibility(baseUrl, {
+    skillsVersion: readSdkSkillsLocalVersion(baseUrl)
+  });
+  return response?.skills ?? null;
+}
 var NPM_SDK_INSTALL_COMMON_FLAGS = ["--no-audit", "--no-fund"];
 var NPM_SDK_GLOBAL_INSTALL_FLAGS = [
   "--no-audit",
@@ -22254,6 +22741,7 @@ async function runUpdateCommand(options, dependencies = {}) {
   const detectBaseUrl = dependencies.detectBaseUrl ?? autoDetectBaseUrl;
   const resolvePlan = dependencies.resolvePlan ?? resolveUpdatePlan;
   const runPlan = dependencies.runPlan ?? runUpdatePlan;
+  const resolveSkillsVerdict = dependencies.resolveSkillsVerdict ?? resolveSkillsVerdictFromCompat;
   const syncSkills = dependencies.syncSkillsIfNeeded ?? syncSdkSkillsIfNeeded;
   const stderr = dependencies.stderr ?? process.stderr;
   const plan = resolvePlan();
@@ -22298,7 +22786,9 @@ async function runUpdateCommand(options, dependencies = {}) {
   if (updateExitCode !== 0) {
     return updateExitCode;
   }
-  await syncSkills(normalizeBaseUrl3(detectBaseUrl()));
+  const updatedBaseUrl = normalizeBaseUrl3(detectBaseUrl());
+  const skillsUpdate = await resolveSkillsVerdict(updatedBaseUrl);
+  await syncSkills(updatedBaseUrl, { update: skillsUpdate });
   return 0;
 }
 function registerUpdateCommand(program) {
@@ -23015,7 +23505,7 @@ Exit codes:
     const baseUrl = autoDetectBaseUrl().replace(/\/$/, "");
     const compatibilityCommand = compatibilityCommandPath(actionCommand) || actionCommand.name();
     const shouldDeferSkillsSync = shouldDeferSkillsSyncForCommand();
-    const skillsVersion = shouldDeferSkillsSync ? void 0 : readSdkSkillsLocalVersion(baseUrl);
+    const skillsVersion = readSdkSkillsLocalVersion(baseUrl);
     const compatibility = await traceCliSpan(
       "cli.sdk_compatibility",
       {
@@ -23051,8 +23541,14 @@ Exit codes:
     if (printStartupPhase) {
       progress?.phase("checking sdk skills");
     }
-    if (!shouldDeferSkillsSync) {
-      const skillsUpdate = compatibility.response && Object.prototype.hasOwnProperty.call(compatibility.response, "skills") ? compatibility.response.skills ?? null : void 0;
+    const skillsUpdate = compatibility.response?.skills ?? null;
+    if (shouldDeferSkillsSync) {
+      const hint = skillsStaleHintLine(skillsUpdate);
+      if (hint && !process.argv.includes("--json")) {
+        process.stderr.write(`${hint}
+`);
+      }
+    } else {
       await traceCliSpan(
         "cli.sdk_skills_sync",
         { baseUrl },