deepline 0.1.143 → 0.1.144

package/dist/cli/index.mjs

@@ -164,7 +164,15 @@ import { tmpdir as tmpdir4 } from "os";
 import { Command as Command3 } from "commander";
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  realpathSync,
+  readFileSync,
+  statSync,
+  writeFileSync
+} from "fs";
 import { homedir } from "os";
 import { dirname, join, resolve } from "path";
 
@@ -214,6 +222,22 @@ var PROD_URL = "https://code.deepline.com";
 var DEFAULT_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
 var PROJECT_DEEPLINE_ENV_FILE = ".env.deepline";
+var COWORK_IGNORED_WORKSPACE_DIRS = /* @__PURE__ */ new Set([
+  ".auto-memory",
+  ".claude",
+  ".remote-plugins",
+  "outputs",
+  "plugins",
+  "uploads"
+]);
+var COWORK_PROJECT_MARKERS = [
+  ".deepline",
+  ".env.deepline",
+  ".git",
+  "AGENTS.md",
+  "package.json",
+  "pyproject.toml"
+];
 function baseUrlSlug(baseUrl) {
   let url;
   try {
@@ -259,9 +283,124 @@ function findNearestEnvFile(name, startDir = process.cwd()) {
     current = parent;
   }
 }
-function loadProjectDeeplineEnv(startDir = process.cwd()) {
-  const filePath = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
-  return filePath ? parseEnvFile(filePath) : {};
+function isDirectory(path) {
+  try {
+    return statSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function canonicalPath(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return resolve(path);
+  }
+}
+function isTruthy(value) {
+  return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+function sessionRootFromPath(path) {
+  const trimmed = path?.trim();
+  if (!trimmed) return null;
+  const match = /^\/sessions\/[^/]+(?=\/|$)/.exec(trimmed);
+  return match?.[0] ?? null;
+}
+function coworkSessionRoot() {
+  const home = process.env.HOME?.trim();
+  const homeSessionRoot = sessionRootFromPath(home);
+  if (homeSessionRoot && isDirectory(join(homeSessionRoot, "mnt"))) {
+    return homeSessionRoot;
+  }
+  const cwdSessionRoot = sessionRootFromPath(process.cwd());
+  if (cwdSessionRoot && isDirectory(join(cwdSessionRoot, "mnt"))) {
+    return cwdSessionRoot;
+  }
+  if (isTruthy(process.env.CLAUDE_CODE_REMOTE) && home) {
+    const mountedRoot = join(home, "mnt");
+    if (isDirectory(mountedRoot)) return resolve(home);
+  }
+  return null;
+}
+function isCoworkLikeSandbox() {
+  const home = process.env.HOME?.trim();
+  return isTruthy(process.env.CLAUDE_CODE_REMOTE) || sessionRootFromPath(home) !== null || sessionRootFromPath(process.cwd()) !== null;
+}
+function coworkProjectScore(path) {
+  let score = 0;
+  for (const marker of COWORK_PROJECT_MARKERS) {
+    if (existsSync(join(path, marker))) score += 1;
+  }
+  return score;
+}
+function listCoworkWorkspaceDirCandidates() {
+  if (!isCoworkLikeSandbox()) {
+    return [];
+  }
+  const explicitProjectDir = process.env.CLAUDE_PROJECT_DIR?.trim();
+  if (explicitProjectDir && isDirectory(explicitProjectDir)) {
+    return [resolve(explicitProjectDir)];
+  }
+  const sessionRoot = coworkSessionRoot();
+  if (!sessionRoot) return [];
+  const mountedRoot = join(sessionRoot, "mnt");
+  if (!isDirectory(mountedRoot)) return [];
+  let names;
+  try {
+    names = readdirSync(mountedRoot).sort();
+  } catch {
+    return [];
+  }
+  const candidates = [];
+  for (const name of names) {
+    if (name.startsWith(".") || COWORK_IGNORED_WORKSPACE_DIRS.has(name)) {
+      continue;
+    }
+    const candidate = join(mountedRoot, name);
+    if (isDirectory(candidate)) candidates.push(candidate);
+  }
+  if (candidates.length <= 1) return candidates;
+  const projectLike = candidates.filter(
+    (candidate) => coworkProjectScore(candidate) > 0
+  );
+  return projectLike.length > 0 ? projectLike : candidates;
+}
+function isInIgnoredCoworkMount(path) {
+  const sessionRoot = coworkSessionRoot();
+  if (!sessionRoot) return false;
+  const mountedRoot = canonicalPath(join(sessionRoot, "mnt"));
+  const resolvedPath = canonicalPath(path);
+  const prefix = `${mountedRoot}/`;
+  if (!resolvedPath.startsWith(prefix)) return false;
+  const relativePath = resolvedPath.slice(prefix.length);
+  const mountName = relativePath.split("/")[0];
+  return mountName.startsWith(".") || COWORK_IGNORED_WORKSPACE_DIRS.has(mountName);
+}
+function detectCoworkWorkspaceDir() {
+  const candidates = listCoworkWorkspaceDirCandidates();
+  return candidates.length === 1 ? candidates[0] : null;
+}
+function loadProjectEnvCandidates(startDir = process.cwd()) {
+  const filePaths = [];
+  const sources = /* @__PURE__ */ new Map();
+  const nearestFile = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
+  if (nearestFile && !isInIgnoredCoworkMount(nearestFile)) {
+    filePaths.push(nearestFile);
+    sources.set(resolve(nearestFile), "nearest");
+  }
+  const coworkWorkspaceDir = detectCoworkWorkspaceDir();
+  if (coworkWorkspaceDir) {
+    const coworkFile = join(coworkWorkspaceDir, PROJECT_DEEPLINE_ENV_FILE);
+    if (existsSync(coworkFile) && !filePaths.some((filePath) => resolve(filePath) === resolve(coworkFile))) {
+      filePaths.push(coworkFile);
+      sources.set(resolve(coworkFile), "cowork");
+    }
+  }
+  return filePaths.map((filePath) => ({
+    filePath,
+    env: parseEnvFile(filePath),
+    source: sources.get(resolve(filePath)) ?? "nearest"
+  }));
 }
 function normalizeBaseUrl(baseUrl) {
   const trimmed = baseUrl.trim().replace(/\/+$/, "");
@@ -325,23 +464,35 @@ function loadGlobalCliEnv() {
   return loadCliEnv(PROD_URL);
 }
 function autoDetectBaseUrl() {
-  const projectEnv = loadProjectDeeplineEnv();
+  const projectEnvs = loadProjectEnvCandidates();
   const globalEnv = loadGlobalCliEnv();
-  return normalizeBaseUrl(process.env[HOST_URL_ENV] ?? "") || normalizeBaseUrl(projectEnv[HOST_URL_ENV] ?? "") || normalizeBaseUrl(globalEnv[HOST_URL_ENV] ?? "") || PROD_URL;
+  return normalizeBaseUrl(process.env[HOST_URL_ENV] ?? "") || firstNonEmpty(
+    ...projectEnvs.map(({ env }) => normalizeBaseUrl(env[HOST_URL_ENV]))
+  ) || normalizeBaseUrl(globalEnv[HOST_URL_ENV] ?? "") || PROD_URL;
 }
 function resolveApiKeyForBaseUrl(baseUrl, explicitApiKey) {
   const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
-  const projectEnv = loadProjectDeeplineEnv();
+  const projectEnvs = loadProjectEnvCandidates();
   const cliEnv = loadCliEnv(normalizedBaseUrl || baseUrl);
-  const projectBaseUrl = normalizeBaseUrl(projectEnv[HOST_URL_ENV] ?? "");
-  const projectKeyApplies = projectBaseUrl === normalizedBaseUrl;
   return firstNonEmpty(
     explicitApiKey,
     process.env[API_KEY_ENV],
-    projectKeyApplies ? projectEnv[API_KEY_ENV] : "",
+    ...projectEnvs.map(({ env }) => {
+      const projectBaseUrl = normalizeBaseUrl(env[HOST_URL_ENV] ?? "");
+      return projectBaseUrl === normalizedBaseUrl ? env[API_KEY_ENV] : "";
+    }),
     cliEnv[API_KEY_ENV]
   );
 }
+function getResolvedProjectAuthSource(baseUrl, apiKey, startDir = process.cwd()) {
+  const normalizedBaseUrl = normalizeBaseUrl(baseUrl);
+  const normalizedApiKey = apiKey.trim();
+  if (!normalizedBaseUrl || !normalizedApiKey) return null;
+  return loadProjectEnvCandidates(startDir).find(({ env }) => {
+    const projectBaseUrl = normalizeBaseUrl(env[HOST_URL_ENV] ?? "");
+    return projectBaseUrl === normalizedBaseUrl && (env[API_KEY_ENV] ?? "").trim() === normalizedApiKey;
+  }) ?? null;
+}
 function resolveConfig(options) {
   const baseUrl = normalizeBaseUrl(
     options?.baseUrl?.trim() || autoDetectBaseUrl()
@@ -364,6 +515,69 @@ function resolveConfig(options) {
     maxRetries: options?.maxRetries ?? DEFAULT_MAX_RETRIES
   };
 }
+function mergeProjectEnvFile(filePath, values) {
+  const existing = parseEnvFile(filePath);
+  const merged = { ...existing, ...values };
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  ensureProjectEnvIsIgnored(dir);
+  const allowedKeys = /* @__PURE__ */ new Set([HOST_URL_ENV, API_KEY_ENV]);
+  const lines = Object.entries(merged).filter(([key, value]) => allowedKeys.has(key) && value !== "").map(([key, value]) => `${key}=${value}`);
+  writeFileSync(filePath, `${lines.join("\n")}
+`, "utf-8");
+}
+function ensureProjectEnvIsIgnored(dir) {
+  const gitignorePath = join(dir, ".gitignore");
+  const entry = PROJECT_DEEPLINE_ENV_FILE;
+  const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
+  const alreadyIgnored = existing.split(/\r?\n/).map((line) => line.trim()).some((line) => line === entry || line === `/${entry}`);
+  if (alreadyIgnored) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  writeFileSync(gitignorePath, `${existing}${prefix}${entry}
+`, "utf-8");
+}
+function saveProjectDeeplineEnvValues(values, startDir = process.cwd()) {
+  const target = resolveProjectPinTarget(startDir);
+  if (!target.ok) {
+    throw new ConfigError(
+      `Cowork project folder is ambiguous. Candidate folders: ${target.candidates.join(
+        ", "
+      )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder before running this command.`
+    );
+  }
+  const filePath = join(target.dir, PROJECT_DEEPLINE_ENV_FILE);
+  mergeProjectEnvFile(filePath, values);
+  return [filePath];
+}
+function resolveProjectPinTarget(startDir = process.cwd()) {
+  const nearestFile = findNearestEnvFile(PROJECT_DEEPLINE_ENV_FILE, startDir);
+  if (nearestFile && !isInIgnoredCoworkMount(nearestFile)) {
+    return { ok: true, dir: dirname(nearestFile), source: "nearest" };
+  }
+  const coworkCandidates = listCoworkWorkspaceDirCandidates();
+  if (coworkCandidates.length === 1) {
+    return { ok: true, dir: coworkCandidates[0], source: "cowork" };
+  }
+  if (coworkCandidates.length > 1) {
+    const resolvedStartDir = canonicalPath(startDir);
+    const cwdCandidate = coworkCandidates.find((candidate) => {
+      const resolvedCandidate = canonicalPath(candidate);
+      return resolvedStartDir === resolvedCandidate || resolvedStartDir.startsWith(`${resolvedCandidate}/`);
+    });
+    if (cwdCandidate) {
+      return { ok: true, dir: cwdCandidate, source: "cowork" };
+    }
+    return {
+      ok: false,
+      reason: "ambiguous_cowork_project",
+      candidates: coworkCandidates
+    };
+  }
+  return { ok: true, dir: resolve(startDir), source: "cwd" };
+}
+function getActiveProjectAuthSource(startDir = process.cwd()) {
+  return loadProjectEnvCandidates(startDir)[0] ?? null;
+}
 
 // src/http.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
@@ -390,10 +604,10 @@ var SDK_RELEASE = {
   // 0.1.108 ships explicit dataset column/tool recompute policy and removes
   // the SDK enrich generator's one-second stale policy.
   // 0.1.110 ships authored V2 prebuilts and required top-level play descriptions.
-  version: "0.1.143",
+  version: "0.1.144",
   apiContract: "2026-06-dataset-column-cell-stale-hard-cutover",
   supportPolicy: {
-    latest: "0.1.143",
+    latest: "0.1.144",
     minimumSupported: "0.1.53",
     deprecatedBelow: "0.1.53",
     commandMinimumSupported: [
@@ -484,7 +698,7 @@ function normalizeAgentRuntime(value) {
   if (explicit === "gemini_cli") return "gemini";
   return EXPLICIT_AGENT_RUNTIMES.has(explicit) ? explicit : null;
 }
-function isCoworkLikeSandbox() {
+function isCoworkLikeSandbox2() {
   const pluginMode = truthyEnv("DEEPLINE_PLUGIN_MODE");
   const claudeRemote = truthyEnv("CLAUDE_CODE_REMOTE");
   const projectDir = Boolean(process.env.CLAUDE_PROJECT_DIR?.trim());
@@ -497,7 +711,7 @@ function detectAgentRuntime(options = {}) {
   const explicit = normalizeAgentRuntime(process.env.DEEPLINE_AGENT_RUNTIME);
   if (explicit) return explicit;
   if (process.env.CODEX_THREAD_ID?.trim()) return "codex";
-  if (options.detectCowork !== false && isCoworkLikeSandbox()) {
+  if (options.detectCowork !== false && isCoworkLikeSandbox2()) {
     return "claude_cowork";
   }
   if (process.env.CLAUDECODE?.trim() === "1") return "claude_code";
@@ -963,7 +1177,7 @@ function sleep(ms) {
   return new Promise((resolve13) => setTimeout(resolve13, ms));
 }
 function withCoworkNetworkHint(message) {
-  if (!isCoworkLikeSandbox() || message.includes(COWORK_NETWORK_HINT)) {
+  if (!isCoworkLikeSandbox2() || message.includes(COWORK_NETWORK_HINT)) {
     return message;
   }
   return `${message}
@@ -7017,9 +7231,9 @@ import { createHash as createHash2 } from "crypto";
 import {
   existsSync as existsSync6,
   readFileSync as readFileSync6,
-  readdirSync,
-  realpathSync,
-  statSync as statSync2,
+  readdirSync as readdirSync2,
+  realpathSync as realpathSync2,
+  statSync as statSync3,
   writeFileSync as writeFileSync8
 } from "fs";
 import { basename, dirname as dirname6, join as join5, resolve as resolve7 } from "path";
@@ -7030,7 +7244,7 @@ import {
   closeSync,
   openSync,
   readSync,
-  statSync,
+  statSync as statSync2,
   writeFileSync as writeFileSync7
 } from "fs";
 import { isAbsolute, relative, resolve as resolve6 } from "path";
@@ -7463,7 +7677,7 @@ function inferCsvColumnSpecs(headers, rows) {
 }
 function readCsvSample(csvPath) {
   const resolvedPath = resolve6(csvPath);
-  const size = statSync(resolvedPath).size;
+  const size = statSync2(resolvedPath).size;
   const fd = openSync(resolvedPath, "r");
   const byteLength = Math.min(size, CSV_HEADER_SAMPLE_BYTES);
   const buffer = Buffer.alloc(byteLength);
@@ -9499,7 +9713,7 @@ function preflightLocalFileInputs(runtimeInput) {
     }
     let stat2;
     try {
-      stat2 = statSync2(absolutePath);
+      stat2 = statSync3(absolutePath);
     } catch (error) {
       throw new DeeplineError(
         `Input ${ref.inputPath} references a local file that is not readable: ${ref.value} (${error instanceof Error ? error.message : String(error)}). No run was created.`,
@@ -9651,7 +9865,7 @@ function stageFile(logicalPath, absolutePath) {
 }
 function normalizePlayPath(filePath) {
   try {
-    return realpathSync.native(resolve7(filePath));
+    return realpathSync2.native(resolve7(filePath));
   } catch {
     return resolve7(filePath);
   }
@@ -12913,7 +13127,7 @@ async function handlePlayRun(args) {
     if (existsSync6(dir)) {
       const base = basename(resolved);
       try {
-        const siblings = readdirSync(dir).filter(
+        const siblings = readdirSync2(dir).filter(
           (f) => f.includes(base.replace(/\.(play\.)?ts$/, "")) || f.endsWith(".play.ts")
         );
         if (siblings.length > 0) {
@@ -17718,9 +17932,9 @@ Examples:
 import {
   existsSync as existsSync7,
   mkdirSync as mkdirSync5,
-  readdirSync as readdirSync2,
+  readdirSync as readdirSync3,
   readFileSync as readFileSync7,
-  statSync as statSync3,
+  statSync as statSync4,
   writeFileSync as writeFileSync9
 } from "fs";
 import { homedir as homedir7, platform } from "os";
@@ -17805,7 +18019,7 @@ function listSessionFiles(agent) {
 }
 function readDirectoryNames(dir) {
   try {
-    return readdirSync2(dir);
+    return readdirSync3(dir);
   } catch {
     return [];
   }
@@ -17816,7 +18030,7 @@ function listJsonlFilesRecursive(root, maxDepth) {
     if (depth > maxDepth) return;
     let entries;
     try {
-      entries = readdirSync2(dir, { withFileTypes: true });
+      entries = readdirSync3(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -17834,7 +18048,7 @@ function listJsonlFilesRecursive(root, maxDepth) {
 }
 function statIfReadable(filePath) {
   try {
-    return statSync3(filePath);
+    return statSync4(filePath);
   } catch {
     return null;
   }
@@ -18527,6 +18741,15 @@ Examples:
 async function fetchOrganizations(http, apiKey) {
   return http.post("/api/v2/auth/cli/organizations", { api_key: apiKey });
 }
+function normalizeAuthScope(value) {
+  if (!value) return "auto";
+  if (value === "auto" || value === "folder" || value === "global") {
+    return value;
+  }
+  throw new Error(
+    `Invalid --auth-scope "${value}". Expected one of: auto, folder, global.`
+  );
+}
 function orgListLines(orgs) {
   return orgs.map((org, index) => {
     const current = org.is_current ? " (current)" : "";
@@ -18534,6 +18757,90 @@ function orgListLines(orgs) {
     return `${index + 1}. ${org.name}${role}${current}`;
   });
 }
+function redactApiKey(value) {
+  if (!value) return null;
+  if (value.length <= 10) return `${value.slice(0, 3)}...`;
+  return `${value.slice(0, 8)}...${value.slice(-4)}`;
+}
+function processEnvValue(name) {
+  return process.env[name]?.trim() ?? "";
+}
+function resolveOrgSwitchAuthTarget(scope, config) {
+  const activeProject = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey
+  );
+  const folderTarget = resolveProjectPinTarget();
+  const globalOverrideWarning = activeProject && scope === "global" ? [
+    `Folder auth in ${activeProject.filePath} overrides global auth for commands run here.`
+  ] : [];
+  if (scope === "folder") {
+    if (!folderTarget.ok) {
+      throw new Error(
+        `Cowork project folder is ambiguous. Candidate folders: ${folderTarget.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder before running this command.`
+      );
+    }
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "explicit_folder",
+      source: folderTarget.source,
+      warnings: []
+    };
+  }
+  if (scope === "global") {
+    return {
+      kind: "global",
+      requested_scope: scope,
+      effective_scope: "global",
+      reason: "explicit_global",
+      warnings: globalOverrideWarning
+    };
+  }
+  if (activeProject) {
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "existing_folder_auth",
+      source: activeProject.source,
+      warnings: []
+    };
+  }
+  if (folderTarget.ok && folderTarget.source === "cowork") {
+    return {
+      kind: "folder",
+      requested_scope: scope,
+      effective_scope: "folder",
+      reason: "detected_cowork_project",
+      source: "cowork",
+      warnings: []
+    };
+  }
+  if (!folderTarget.ok) {
+    return {
+      kind: "global",
+      requested_scope: scope,
+      effective_scope: "global",
+      reason: "ambiguous_cowork_fell_back_global",
+      warnings: [
+        `Cowork project folder is ambiguous, so global auth was updated. Candidate folders: ${folderTarget.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder to update folder auth.`
+      ]
+    };
+  }
+  return {
+    kind: "global",
+    requested_scope: scope,
+    effective_scope: "global",
+    reason: "default_global",
+    warnings: []
+  };
+}
 async function handleOrgList(options) {
   const config = resolveConfig();
   const http = new HttpClient(config);
@@ -18553,7 +18860,89 @@ async function handleOrgList(options) {
     { json: options.json }
   );
 }
+async function handleOrgStatus(options) {
+  const config = resolveConfig();
+  const http = new HttpClient(config);
+  const payload = await fetchOrganizations(http, config.apiKey);
+  const current = payload.organizations.find((org) => org.is_current) ?? payload.organizations.find((org) => org.org_id === payload.current_org_id) ?? null;
+  const projectCandidate = getActiveProjectAuthSource();
+  const activeProject = getResolvedProjectAuthSource(
+    config.baseUrl,
+    config.apiKey
+  );
+  const folderTarget = resolveProjectPinTarget();
+  const hostPath = hostEnvFilePath(config.baseUrl);
+  const envApiKey = processEnvValue(API_KEY_ENV);
+  const envHostUrl = processEnvValue(HOST_URL_ENV);
+  const authSource = envApiKey ? {
+    scope: "env",
+    source: "process",
+    path: null,
+    api_key: redactApiKey(envApiKey),
+    host: envHostUrl || null,
+    overrides_global: true,
+    overrides_folder: Boolean(projectCandidate)
+  } : activeProject ? {
+    scope: "folder",
+    source: activeProject.source,
+    path: activeProject.filePath,
+    api_key: redactApiKey(activeProject.env.DEEPLINE_API_KEY),
+    overrides_global: true
+  } : {
+    scope: "global",
+    source: "host",
+    path: hostPath,
+    api_key: redactApiKey(config.apiKey),
+    overrides_global: false
+  };
+  const folderTargetPayload = folderTarget.ok ? {
+    ok: true,
+    source: folderTarget.source,
+    dir: folderTarget.dir,
+    env_path: `${folderTarget.dir}/.env.deepline`
+  } : {
+    ok: false,
+    reason: folderTarget.reason,
+    candidates: folderTarget.candidates
+  };
+  const lines = [
+    `Organization: ${current?.name ?? "(unknown)"}`,
+    `Host: ${config.baseUrl}`,
+    `Auth scope: ${authSource.scope}`
+  ];
+  if (authSource.path) {
+    lines.push(`Auth file: ${authSource.path}`);
+  } else {
+    lines.push(`Auth source: ${API_KEY_ENV} process environment`);
+  }
+  if (envApiKey) {
+    lines.push(`${API_KEY_ENV} overrides saved auth for this process.`);
+  } else if (activeProject) {
+    lines.push("Global auth is overridden in this folder.");
+  }
+  printCommandEnvelope(
+    {
+      ok: true,
+      host: config.baseUrl,
+      organization: current,
+      current_org_id: payload.current_org_id,
+      auth_source: authSource,
+      host_env_path: hostPath,
+      folder_target: folderTargetPayload,
+      next: {
+        set_auto: "deepline org set <org>",
+        set_folder: "deepline org set <org> --auth-scope folder",
+        set_global: "deepline org set <org> --auth-scope global"
+      },
+      render: {
+        sections: [{ title: "org status", lines }]
+      }
+    },
+    { json: options.json }
+  );
+}
 async function handleOrgSwitch(selection, options) {
+  const authScope = normalizeAuthScope(options.authScope);
   const config = resolveConfig();
   const http = new HttpClient(config);
   const payload = await fetchOrganizations(http, config.apiKey);
@@ -18561,7 +18950,10 @@ async function handleOrgSwitch(selection, options) {
     printCommandEnvelope(
       {
         ...payload,
-        next: { switch: "deepline org switch <number>" },
+        next: { set: "deepline org set <number>" },
+        deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+        replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+        warnings: options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
         render: {
           sections: [
             {
@@ -18569,7 +18961,7 @@ async function handleOrgSwitch(selection, options) {
               lines: orgListLines(payload.organizations)
             }
           ],
-          actions: [{ label: "Run", command: "deepline org switch <number>" }]
+          actions: [{ label: "Run", command: "deepline org set <number>" }]
         }
       },
       { json: options.json }
@@ -18592,16 +18984,56 @@ async function handleOrgSwitch(selection, options) {
   if (!target) {
     throw new Error("Could not resolve the selected organization.");
   }
+  const authTarget = resolveOrgSwitchAuthTarget(authScope, config);
   if (target.is_current) {
+    let project_env_paths2 = [];
+    if (authTarget.kind === "folder") {
+      project_env_paths2 = saveProjectDeeplineEnvValues({
+        DEEPLINE_HOST_URL: config.baseUrl,
+        DEEPLINE_API_KEY: config.apiKey
+      });
+    } else {
+      saveHostEnvValues(config.baseUrl, {
+        DEEPLINE_HOST_URL: config.baseUrl,
+        DEEPLINE_API_KEY: config.apiKey
+      });
+    }
+    const renderLines2 = [`Already on ${target.name}.`];
+    for (const projectPath of project_env_paths2) {
+      renderLines2.push(`Saved folder auth in ${projectPath}`);
+    }
+    if (authTarget.kind === "global") {
+      renderLines2.push(`Saved global auth in ${hostEnvFilePath(config.baseUrl)}`);
+    }
+    renderLines2.push(
+      `Scope: ${authTarget.requested_scope} -> ${authTarget.effective_scope} (${authTarget.reason})`
+    );
+    if (options.deprecatedSwitch) {
+      renderLines2.push("Warning: org switch is deprecated; use org set.");
+    }
+    for (const warning of authTarget.warnings) {
+      renderLines2.push(`Warning: ${warning}`);
+    }
+    const warnings2 = [
+      ...options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+      ...authTarget.warnings
+    ];
     printCommandEnvelope(
       {
         ok: true,
         unchanged: true,
         organization: target,
+        requested_auth_scope: authTarget.requested_scope,
+        effective_auth_scope: authTarget.effective_scope,
+        auth_scope_reason: authTarget.reason,
+        auth_scope: authTarget.effective_scope,
+        host_env_path: authTarget.kind === "global" ? hostEnvFilePath(config.baseUrl) : null,
+        project_env_paths: project_env_paths2,
+        deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+        replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+        warnings: warnings2,
         render: {
-          sections: [
-            { title: "org switch", lines: [`Already on ${target.name}.`] }
-          ]
+          sections: [{ title: "org set", lines: renderLines2 }]
         }
       },
       { json: options.json }
@@ -18612,26 +19044,61 @@ async function handleOrgSwitch(selection, options) {
     api_key: config.apiKey,
     org_id: target.org_id
   });
-  saveHostEnvValues(config.baseUrl, {
-    DEEPLINE_API_KEY: switched.api_key,
-    DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
-    DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
-  });
+  let project_env_paths = [];
+  if (authTarget.kind === "folder") {
+    project_env_paths = saveProjectDeeplineEnvValues({
+      DEEPLINE_HOST_URL: config.baseUrl,
+      DEEPLINE_API_KEY: switched.api_key
+    });
+  } else {
+    saveHostEnvValues(config.baseUrl, {
+      DEEPLINE_HOST_URL: config.baseUrl,
+      DEEPLINE_API_KEY: switched.api_key,
+      DEEPLINE_ACTIVE_ORG_ID: switched.org_id,
+      DEEPLINE_ACTIVE_ORG_NAME: switched.org_name
+    });
+  }
   const { api_key: _apiKey, ...publicSwitched } = switched;
+  const renderLines = [`Switched to ${switched.org_name}.`];
+  if (authTarget.kind === "folder") {
+    for (const projectPath of project_env_paths) {
+      renderLines.push(`Saved folder auth in ${projectPath}`);
+    }
+  } else {
+    renderLines.push(`Saved global auth in ${hostEnvFilePath(config.baseUrl)}`);
+  }
+  renderLines.push(
+    `Scope: ${authTarget.requested_scope} -> ${authTarget.effective_scope} (${authTarget.reason})`
+  );
+  if (options.deprecatedSwitch) {
+    renderLines.push("Warning: org switch is deprecated; use org set.");
+  }
+  for (const warning of authTarget.warnings) {
+    renderLines.push(`Warning: ${warning}`);
+  }
+  const warnings = [
+    ...options.deprecatedSwitch ? ["org switch is deprecated; use org set."] : [],
+    ...authTarget.warnings
+  ];
   printCommandEnvelope(
     {
       ok: true,
-      host_env_path: hostEnvFilePath(config.baseUrl),
+      host_env_path: authTarget.kind === "global" ? hostEnvFilePath(config.baseUrl) : null,
+      project_env_paths,
       ...publicSwitched,
       api_key_saved: true,
+      requested_auth_scope: authTarget.requested_scope,
+      effective_auth_scope: authTarget.effective_scope,
+      auth_scope_reason: authTarget.reason,
+      auth_scope: authTarget.effective_scope,
+      deprecated_command: options.deprecatedSwitch ? "org switch" : null,
+      replacement_command: options.deprecatedSwitch ? "deepline org set" : null,
+      warnings,
       render: {
         sections: [
           {
-            title: "org switch",
-            lines: [
-              `Switched to ${switched.org_name}.`,
-              `Saved host auth in ${hostEnvFilePath(config.baseUrl)}`
-            ]
+            title: "org set",
+            lines: renderLines
           }
         ]
       }
@@ -18647,6 +19114,7 @@ async function handleOrgCreate(name, options) {
     name
   });
   saveHostEnvValues(config.baseUrl, {
+    DEEPLINE_HOST_URL: config.baseUrl,
     DEEPLINE_API_KEY: created.api_key,
     DEEPLINE_ACTIVE_ORG_ID: created.org_id,
     DEEPLINE_ACTIVE_ORG_NAME: created.org_name
@@ -18676,18 +19144,41 @@ async function handleOrgCreate(name, options) {
   );
 }
 function registerOrgCommands(program) {
-  const org = program.command("org").description("List, create, and switch organizations.").addHelpText(
+  const org = program.command("org").description("List, create, and set organizations.").addHelpText(
     "after",
     `
 Notes:
-  Organizations are workspaces. Switching organizations mutates the saved host
-  auth file so later CLI commands target the selected workspace.
+  Organizations are workspaces. Auth is stored as an API key scoped to one
+  organization, so setting an org saves a key for the selected auth scope.
+
+  Auth scopes:
+    auto    Update the folder pin that already controls this command; in
+            Cowork, write the mounted project folder; otherwise update global
+            host auth.
+    folder  Write .env.deepline in the current project/Cowork project and make
+            sure .env.deepline is gitignored. Commands below that folder use
+            this org; sibling folders can pin different orgs.
+    global  Write ~/.local/deepline/<host>/.env. Commands outside folder pins
+            use this org. Existing folder pins still override global auth.
+
+  Process env DEEPLINE_API_KEY overrides saved auth for that command only.
+
+Agent loop:
+  deepline org list --json
+  deepline org set <number-or-org-id> --auth-scope folder --json
+  deepline org status --json
+  deepline auth status --json
 
 Examples:
   deepline org list --json
+  deepline org status --json
   deepline org create Acme --json
-  deepline org switch 2
-  deepline org switch --org-id org_123 --json
+  deepline org set 2
+  deepline org set 2 --auth-scope folder
+  deepline org set --org-id org_123 --json
+  cd path/to/project-a && deepline org set Prove --auth-scope folder --json
+  cd path/to/project-b && deepline org set Mixmax --auth-scope folder --json
+  cd .. && deepline org status --json
 `
   );
   org.command("list").description("List your organizations.").addHelpText(
@@ -18714,21 +19205,88 @@ Examples:
   deepline org create "Acme Sales" --json
 `
   ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgCreate);
-  org.command("switch [selection]").description(
-    "Switch to another organization and save the new API key in the host auth file."
-  ).addHelpText(
+  org.command("status").description("Show the current organization and auth source.").addHelpText(
     "after",
     `
 Notes:
-  Mutates the saved host auth file. Selection can be a list number, exact
-  organization name, or organization id. Without a selection, prints choices.
+  Read-only. Shows the current org plus auth_source.scope, auth_source.path,
+  folder_target, host_env_path, and next commands.
+
+  Scopes are env, folder, or global. env means DEEPLINE_API_KEY/
+  DEEPLINE_HOST_URL in process env wins. folder means nearest/Cowork
+  .env.deepline wins. global means host config wins.
+
+  Run before and after org set to verify what future commands will use.
+
+Examples:
+  deepline org status
+  deepline org status --json
+`
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgStatus);
+  const addOrgSetOptions = (command) => command.option("--org-id <id>", "Set using an explicit organization id").option(
+    "--auth-scope <scope>",
+    "Where to save auth: auto, folder, or global",
+    "auto"
+  ).option("--json", "Emit JSON output. Also automatic when stdout is piped");
+  addOrgSetOptions(
+    org.command("set [selection]").description("Set the organization for the selected auth scope.").addHelpText(
+      "after",
+      `
+Notes:
+  Selection can be a list number, exact organization name, or organization id.
+  Without a selection, prints choices.
+
+  Mutates local auth state and asks Deepline for an org-scoped API key. It
+  writes only the selected scope:
+    auto    Update the folder pin that already controls this command; in
+            Cowork, write the mounted project folder; otherwise update global
+            host auth.
+    folder  Write .env.deepline in the current project/Cowork project and make
+            sure .env.deepline is gitignored.
+    global  Write ~/.local/deepline/<host>/.env.
+
+  Folder auth shadows global auth. If you set --auth-scope global from a pinned
+  folder, commands in that folder still use the folder pin until it is changed
+  or removed.
+
+  Use --json for stable fields including effective_auth_scope,
+  auth_scope_reason, host_env_path, project_env_paths, warnings, org_id, and
+  org_name.
+
+Examples:
+  deepline org set
+  deepline org set 2
+  deepline org set 2 --auth-scope folder
+  deepline org set 2 --auth-scope global
+  deepline org set --org-id org_123 --json
+  deepline org status --json
+`
+    )
+  ).action(handleOrgSwitch);
+  addOrgSetOptions(
+    org.command("switch [selection]").description(
+      "Deprecated alias for org set. Set the organization for the selected auth scope."
+    ).addHelpText(
+      "after",
+      `
+Notes:
+  Deprecated alias. Use deepline org set instead. The command still mutates
+  local auth state with the same --auth-scope behavior as org set.
+
+  Run deepline org set --help for scope definitions and the agent verification
+  loop.
 
 Examples:
   deepline org switch
   deepline org switch 2
+  deepline org switch 2 --auth-scope folder
+  deepline org switch 2 --auth-scope global
   deepline org switch --org-id org_123 --json
 `
-  ).option("--org-id <id>", "Switch using an explicit organization id").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(handleOrgSwitch);
+    )
+  ).action(
+    (selection, options) => handleOrgSwitch(selection, { ...options, deprecatedSwitch: true })
+  );
 }
 
 // src/cli/commands/quickstart.ts
@@ -21595,7 +22153,7 @@ import { spawn as spawn3 } from "child_process";
 import {
   existsSync as existsSync11,
   mkdirSync as mkdirSync9,
-  realpathSync as realpathSync2,
+  realpathSync as realpathSync3,
   readFileSync as readFileSync11,
   renameSync,
   rmSync as rmSync3,
@@ -22094,7 +22652,7 @@ function findRepoBackedSdkRoot(startPath) {
 function inferNpmGlobalPrefixFromEntrypoint(entrypoint) {
   const normalized = (() => {
     try {
-      return realpathSync2(entrypoint);
+      return realpathSync3(entrypoint);
     } catch {
       return resolve12(entrypoint);
     }