deepline 0.3.206 → 0.3.208

package/dist/cli/index.js

@@ -3051,7 +3051,7 @@ var SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: "0.3.206",
+  version: "0.3.208",
   updateSummary: "Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.",
   packageCapabilities: {
     updatePreferences: 1
@@ -11645,6 +11645,7 @@ function printCommandEnvelope(envelope, options = {}) {
 var EXIT_OK = 0;
 var EXIT_AUTH = 3;
 var EXIT_SERVER = 5;
+var EXIT_WORKSPACE_MISMATCH = 6;
 var AUTH_HTTP_TIMEOUT_MS = 1e4;
 var AUTH_REGISTER_HTTP_TIMEOUT_MS = 3e4;
 function statusBannerLine(value) {
@@ -11735,7 +11736,8 @@ function readPendingAuthClaim(baseUrl, scope) {
     if (!claimToken) return null;
     return {
       claimToken,
-      claimUrl: typeof parsed.claimUrl === "string" ? parsed.claimUrl.trim() : "",
+      claimUrl: typeof parsed.claimUrl === "string" && parsed.claimUrl.trim() ? parsed.claimUrl.trim() : `${baseUrl}/api/v2/auth/cli/claim/${encodeURIComponent(claimToken)}`,
+      orgName: typeof parsed.orgName === "string" ? parsed.orgName.trim() : void 0,
       // The record's own scope, when it has one. `register` writes this field
       // precisely so a resume can learn where the credential belongs; reading
       // back the caller's argument instead made it decorative, and a record
@@ -11756,6 +11758,14 @@ function clearPendingClaim(baseUrl, scope) {
   } catch {
   }
 }
+function clearSatisfiedPendingClaim(baseUrl, scope, connectedWorkspaceName) {
+  const pending = readPendingAuthClaim(baseUrl, scope);
+  if (!pending) return;
+  if (pending.orgName && pending.orgName.toLowerCase() !== connectedWorkspaceName?.trim().toLowerCase()) {
+    return;
+  }
+  clearPendingClaim(baseUrl, scope);
+}
 function parseRegisterWaitMode(args) {
   let mode = "auto";
   for (let i = 0; i < args.length; i++) {
@@ -11993,7 +12003,12 @@ async function handleRegister(args) {
   const claimUrl = String(data.claim_url || "");
   const claimToken = String(data.claim_token || "");
   if (claimToken) {
-    savePendingClaim(baseUrl, { claimToken, claimUrl, scope: authScope });
+    savePendingClaim(baseUrl, {
+      claimToken,
+      claimUrl,
+      scope: authScope,
+      ...orgName ? { orgName } : {}
+    });
     saveEnvValues(
       {
         [HOST_URL_ENV]: baseUrl
@@ -12039,6 +12054,13 @@ async function handleRegister(args) {
       return EXIT_SERVER;
     }
     const state = String(statusData.status || "").toLowerCase();
+    if (statusData.code === "REQUESTED_WORKSPACE_NOT_IN_ACCOUNT") {
+      clearPendingClaim(baseUrl, authScope);
+      console.error(
+        "The requested workspace does not exist in this account. Connect to an existing workspace first; then use `deepline org create` if you need a new one."
+      );
+      return EXIT_WORKSPACE_MISMATCH;
+    }
     if (state === "claimed") {
       const apiKey = String(statusData.api_key || "");
       if (apiKey) {
@@ -12100,12 +12122,13 @@ async function handleWait(args) {
     return EXIT_AUTH;
   }
   const deadline = Date.now() + timeoutSeconds * 1e3;
-  while (Date.now() <= deadline) {
+  while (Date.now() < deadline) {
     const { status, data } = await httpJson(
       "POST",
       `${baseUrl}/api/v2/auth/cli/status`,
       null,
-      { claim_token: claimToken, reveal: true }
+      { claim_token: claimToken, reveal: true },
+      Math.min(AUTH_HTTP_TIMEOUT_MS, Math.max(1, deadline - Date.now()))
     );
     if (status === 401 || status === 403) {
       clearPendingClaim(baseUrl, authScope);
@@ -12113,7 +12136,7 @@ async function handleWait(args) {
       return EXIT_AUTH;
     }
     if (status >= 500 || status === 0 || status === 400) {
-      await sleep4(2e3);
+      await sleep4(Math.min(2e3, Math.max(0, deadline - Date.now())));
       continue;
     }
     if (status >= 400) {
@@ -12121,6 +12144,13 @@ async function handleWait(args) {
       return EXIT_SERVER;
     }
     const state = String(data.status || "").toLowerCase();
+    if (data.code === "REQUESTED_WORKSPACE_NOT_IN_ACCOUNT") {
+      clearPendingClaim(baseUrl, authScope);
+      console.error(
+        "The requested workspace does not exist in this account. Connect to an existing workspace first; then use `deepline org create` if you need a new one."
+      );
+      return EXIT_WORKSPACE_MISMATCH;
+    }
     if (state === "claimed") {
       const apiKey = String(data.api_key || "");
       if (apiKey) {
@@ -12143,7 +12173,7 @@ async function handleWait(args) {
       console.error("That approval link expired. Run: deepline auth register");
       return EXIT_AUTH;
     }
-    await sleep4(2e3);
+    await sleep4(Math.min(2e3, Math.max(0, deadline - Date.now())));
   }
   console.error(
     "Still pending. Approve the browser link, then run: deepline auth wait"
@@ -12288,7 +12318,11 @@ async function handleStatus(args) {
     return EXIT_SERVER;
   }
   const resolvedAuthScope = authScope ?? (getResolvedProjectAuthSource(baseUrl, apiKey) ? "folder" : "global");
-  clearPendingClaim(baseUrl, resolvedAuthScope);
+  clearSatisfiedPendingClaim(
+    baseUrl,
+    resolvedAuthScope,
+    typeof data.org_name === "string" ? data.org_name : null
+  );
   const payload = {
     ...hostStatusPayload ?? { host: baseUrl },
     status: data.status || "(unknown)",
@@ -12302,6 +12336,7 @@ async function handleStatus(args) {
     user: {
       id: data.user_id ?? null
     },
+    businessDomain: typeof data.business_domain === "string" ? data.business_domain : null,
     examples: Array.isArray(data.examples) ? data.examples : []
   };
   let savedApiKeyPath = null;
@@ -12413,7 +12448,7 @@ Examples:
 `
   ).option(
     "--org-name <name>",
-    "Use this workspace, or create a separate one with this name"
+    "Connect to an existing workspace, or name your first workspace"
   ).option(
     "--org-id <id>",
     "Bind to this workspace directly, skipping the browser picker"
@@ -21536,6 +21571,11 @@ function carriesArtifact(revision, artifact) {
     revision && revision.sourceHash === artifact.sourceHash && revision.artifactHash === artifact.artifactHash && revision.graphHash === artifact.graphHash && revision.artifactKind === artifact.artifactKind
   );
 }
+function isSdkUpdated(live, artifact) {
+  return Boolean(
+    live && live.sourceHash === artifact.sourceHash && live.graphHash === artifact.graphHash && live.artifactHash !== artifact.artifactHash
+  );
+}
 function annotationForFailure(input2) {
   return {
     path: input2.file,
@@ -21970,6 +22010,11 @@ async function runDeployment(params, hooks) {
       });
     }
     const playByName = new Map(ordered.map((play) => [play.name, play]));
+    const sdkUpdated = (name) => {
+      const artifact = playByName.get(name)?.result.artifact;
+      const live = stateByName.get(name)?.liveRevision ?? null;
+      return artifact && isSdkUpdated(live, artifact) ? { sdkUpdated: true } : {};
+    };
     const outcomes = [];
     const toRegister = [];
     const toPromote = [];
@@ -22016,6 +22061,7 @@ async function runDeployment(params, hooks) {
             file: play.file,
             status: "registered",
             version: playState?.workingRevision?.version ?? void 0,
+            ...sdkUpdated(play.name),
             ...warning ? { warning } : {}
           });
         }
@@ -22057,6 +22103,7 @@ async function runDeployment(params, hooks) {
             file: item.play.file,
             status: "registered",
             version: typeof artifact.version === "number" ? artifact.version : void 0,
+            ...sdkUpdated(item.play.name),
             ...warning ? { warning } : {}
           });
         }
@@ -22071,7 +22118,7 @@ async function runDeployment(params, hooks) {
         title: `${ordered.length} play${ordered.length === 1 ? "" : "s"} validated and registered (not deployed)`,
         ...annotations.length > 0 ? { annotations } : {},
         summary: outcomes.map(
-          (outcome) => `- \`${outcome.name}\`: ${outcome.status}${outcome.version !== void 0 ? ` (v${outcome.version})` : ""}${outcome.warning ? `
+          (outcome) => `- \`${outcome.name}\`: ${outcome.status}${outcome.version !== void 0 ? ` (v${outcome.version})` : ""}${outcome.sdkUpdated ? " \u2014 SDK updated" : ""}${outcome.warning ? `
   - :warning: ${outcome.warning}` : ""}`
         ).join("\n")
       });
@@ -22100,6 +22147,7 @@ async function runDeployment(params, hooks) {
             status: outcome.status === "promoted" ? "promoted" : "failed",
             version: outcome.version,
             ...outcome.status === "promoted" && typeof previousVersion === "number" && previousVersion !== outcome.version ? { previousVersion } : {},
+            ...outcome.status === "promoted" ? sdkUpdated(outcome.name) : {},
             ...outcome.status === "promoted" && warning ? { warning } : {},
             ...outcome.error ? { error: outcome.error } : {}
           });
@@ -22146,7 +22194,7 @@ async function runDeployment(params, hooks) {
       title: `Deployed ${outcomes.filter((o) => o.status === "promoted").length} play(s) (${outcomes.filter((o) => o.status === "unchanged").length} unchanged)`,
       ...annotations.length > 0 ? { annotations } : {},
       summary: outcomes.map(
-        (outcome) => `- \`${outcome.name}\`: ${outcome.status}${outcome.warning ? `
+        (outcome) => `- \`${outcome.name}\`: ${outcome.status}${outcome.sdkUpdated ? " \u2014 SDK updated" : ""}${outcome.warning ? `
   - :warning: ${outcome.warning}` : ""}`
       ).join("\n")
     });
@@ -22234,8 +22282,9 @@ function topoSortByPlayDependencies(plays) {
 var MAX_DEPLOY_ATTEMPTS = 3;
 function renderOutcome(outcome) {
   const version = outcome.version === void 0 ? "" : outcome.previousVersion === void 0 ? ` v${outcome.version}` : ` v${outcome.previousVersion} -> v${outcome.version}`;
+  const sdkUpdated = outcome.sdkUpdated ? " (SDK updated)" : "";
   const note = outcome.error ?? outcome.warning;
-  return `${outcome.name} (${outcome.file}): ${outcome.status}${version}${note ? ` - ${note}` : ""}`;
+  return `${outcome.name} (${outcome.file}): ${outcome.status}${version}${sdkUpdated}${note ? ` - ${note}` : ""}`;
 }
 function printResult(input2) {
   const failed = input2.status === "failed" || input2.status === "cancelled";
@@ -22667,8 +22716,9 @@ function renderDeploymentPlayLines(results) {
   return plays.flatMap((play) => {
     const version = play.version === void 0 ? "" : play.previousVersion === void 0 ? ` v${play.version}` : ` v${play.previousVersion} -> v${play.version}`;
     const file = play.file ? ` (${play.file})` : "";
+    const sdkUpdated = play.sdkUpdated ? " (SDK updated)" : "";
     return [
-      `${play.name ?? "?"}${file} - ${play.status ?? "?"}${version}`,
+      `${play.name ?? "?"}${file} - ${play.status ?? "?"}${version}${sdkUpdated}`,
       ...play.error ? [`  error: ${play.error}`] : [],
       ...play.warning ? [`  warning: ${play.warning}`] : []
     ];
@@ -45437,11 +45487,24 @@ function openSetupAuthorization(authorizationUrl, options = {}) {
 }
 function buildPendingAuthorizationOutput(input2) {
   const authorizationUrl = input2.authorizationUrl.trim();
-  if (input2.browserOpenStatus === "opened") {
+  if (input2.browserOpenStatus === "existing_claim" && authorizationUrl) {
     return {
-      authorizationUrl: null,
-      next: `Complete browser approval, then run: ${input2.resumeCommand}`,
-      lines: ["Complete authorization in the browser window Deepline opened."]
+      authorizationUrl,
+      next: `The existing approval is still pending. Use its authorization URL if needed, then run: ${input2.resumeCommand}`,
+      lines: [
+        "Deepline did not open another browser tab. Use the existing approval page or this link:",
+        authorizationUrl
+      ]
+    };
+  }
+  if (input2.browserOpenStatus === "timed_out" && authorizationUrl) {
+    return {
+      authorizationUrl,
+      next: `Approval is still pending after five minutes. Use the authorization URL if needed, then run: ${input2.resumeCommand}`,
+      lines: [
+        "Approval is still pending. Use this link if the tab was missed:",
+        authorizationUrl
+      ]
     };
   }
   if (authorizationUrl) {
@@ -45631,15 +45694,16 @@ function rollbackCommand(scope, root) {
   const allowScriptsFlag = npmSupportsAllowScripts(readNpmVersion(process.env)) ? " --allow-scripts=esbuild" : "";
   return `npm install -g${prefix} --no-audit --no-fund --include=optional${allowScriptsFlag} deepline@${SDK_VERSION}`;
 }
-function setupResumeCommand(baseUrl, scope) {
+function setupResumeCommand(baseUrl, scope, orgName) {
   const hostPrefix = baseUrl === "https://code.deepline.com" ? "" : `DEEPLINE_HOST_URL=${JSON.stringify(baseUrl)} `;
-  return `${hostPrefix}deepline setup --scope ${scope} --json`;
+  const quotedOrgName = orgName ? process.platform === "win32" ? ` --org-name "${orgName.replace(/"/g, '""')}"` : ` --org-name '${orgName.replace(/'/g, `'\\''`)}'` : "";
+  return `${hostPrefix}deepline setup --scope ${scope}${quotedOrgName} --json`;
 }
 function setupRetry(input2) {
   return {
     phase: input2.phase,
-    command: setupResumeCommand(input2.baseUrl, input2.scope),
-    automatic: true
+    command: setupResumeCommand(input2.baseUrl, input2.scope, input2.orgName),
+    automatic: input2.retryAutomatic ?? true
   };
 }
 function reportSetupPhaseFailure(input2) {
@@ -45695,6 +45759,7 @@ function reportSetupAuthStatusFailure(input2) {
     scope: input2.scope,
     root: input2.root,
     phases: input2.phases,
+    orgName: input2.orgName,
     phase: "auth",
     code: "AUTH_STATUS_FAILED",
     exitCode: 4,
@@ -45817,22 +45882,14 @@ function pendingResult(input2) {
     status: "authorization_pending",
     phases: input2.phases
   });
-  let browserOpenStatus = "failed";
-  if (input2.authorizationUrl) {
-    browserOpenStatus = openSetupAuthorization(input2.authorizationUrl);
-    if (browserOpenStatus === "opened") {
-      process.stderr.write(
-        "Opened Deepline authorization in your browser. Complete approval there.\n"
-      );
-    } else if (browserOpenStatus === "failed") {
-      process.stderr.write(`Authorize Deepline: ${input2.authorizationUrl}
-`);
-    }
-  }
   const pendingOutput = buildPendingAuthorizationOutput({
     authorizationUrl: input2.authorizationUrl,
-    browserOpenStatus,
-    resumeCommand: setupResumeCommand(input2.baseUrl, input2.scope)
+    browserOpenStatus: input2.browserOpenStatus,
+    resumeCommand: setupResumeCommand(
+      input2.baseUrl,
+      input2.scope,
+      input2.orgName
+    )
   });
   printCommandEnvelope(
     {
@@ -45841,8 +45898,9 @@ function pendingResult(input2) {
       complete: false,
       scope: input2.scope,
       authorizationUrl: pendingOutput.authorizationUrl,
-      browserOpened: browserOpenStatus === "opened",
-      browserOpenStatus,
+      browserOpened: input2.browserOpenStatus === "timed_out",
+      browserOpenStatus: input2.browserOpenStatus,
+      authClaimSource: input2.authClaimSource,
       statePath,
       phases: input2.phases,
       currentPhase: "auth",
@@ -45850,7 +45908,8 @@ function pendingResult(input2) {
       retry: setupRetry({
         baseUrl: input2.baseUrl,
         scope: input2.scope,
-        phase: "auth"
+        phase: "auth",
+        orgName: input2.orgName
       }),
       next: pendingOutput.next,
       render: {
@@ -45867,6 +45926,20 @@ function pendingResult(input2) {
   return 0;
 }
 async function runSetupCommand(options) {
+  let orgName = options.orgName?.trim();
+  if (options.orgName !== void 0 && !orgName) {
+    printCommandEnvelope(
+      {
+        ok: false,
+        status: "failed",
+        code: "INVALID_ORG_NAME",
+        exitCode: 2,
+        message: "Workspace name cannot be empty."
+      },
+      { json: options.json }
+    );
+    return 2;
+  }
   let scope;
   let root;
   try {
@@ -45911,6 +45984,7 @@ async function runSetupCommand(options) {
           exitCode: 7,
           message: installedButUnreachable ? `The global Deepline executable is not reachable on PATH: ${globalCli.persistentPath}` : "No persistent global Deepline executable was found.",
           json: options.json,
+          orgName,
           extra: {
             persistentPath: globalCli.persistentPath,
             fallback: "https://code.deepline.com/INSTALL.md"
@@ -45930,6 +46004,7 @@ async function runSetupCommand(options) {
         exitCode: 7,
         message: `An unknown executable named deepline is first on PATH: ${conflict}`,
         json: options.json,
+        orgName,
         extra: { path: conflict }
       });
     }
@@ -45963,7 +46038,8 @@ async function runSetupCommand(options) {
         code: "LEGACY_CLEANUP_FAILED",
         exitCode: 5,
         message: error instanceof Error ? error.message : String(error),
-        json: options.json
+        json: options.json,
+        orgName
       });
     }
   }
@@ -45984,7 +46060,7 @@ async function runSetupCommand(options) {
         process.stderr.write(
           "Global skill setup failed. Trying project-local skills instead.\n"
         );
-        return runSetupCommand({ scope: "local", json: options.json });
+        return runSetupCommand({ scope: "local", json: options.json, orgName });
       }
       return reportSetupPhaseFailure({
         baseUrl,
@@ -45996,7 +46072,8 @@ async function runSetupCommand(options) {
         exitCode: skills.exitCode,
         message: typeof skillsPayload?.message === "string" ? skillsPayload.message : "Deepline skills could not be installed.",
         json: options.json,
-        next: `! ${setupResumeCommand(baseUrl, scope)}`,
+        orgName,
+        next: `! ${setupResumeCommand(baseUrl, scope, orgName)}`,
         extra: { detail: skillsPayload }
       });
     }
@@ -46018,6 +46095,13 @@ async function runSetupCommand(options) {
     );
   }
   const authScope = authScopeForSetup(scope);
+  const pendingAtStart = readPendingAuthClaim(baseUrl, authScope);
+  const replacingPendingClaim = Boolean(
+    pendingAtStart && orgName && pendingAtStart.orgName?.toLowerCase() !== orgName.toLowerCase()
+  );
+  if (pendingAtStart && !replacingPendingClaim) {
+    if (pendingAtStart.orgName) orgName = pendingAtStart.orgName;
+  }
   beginSetupPhase(phases, "auth");
   persistSetupProgress({ baseUrl, scope, root, phases });
   let auth = await readAuthStatus(authScope);
@@ -46028,88 +46112,146 @@ async function runSetupCommand(options) {
     scope,
     root,
     phases,
+    orgName,
     json: options.json
   });
   if (initialAuthFailure !== null) return initialAuthFailure;
-  if (auth.payload?.connected !== true) {
-    const pending = readPendingAuthClaim(baseUrl, authScope);
-    if (pending) {
-      process.stderr.write("Checking pending Deepline authorization...\n");
-      await captureStdout2(
-        () => handleWait(["--timeout", "1", "--auth-scope", authScope])
-      );
-      auth = await readAuthStatus(authScope);
-      const resumedAuthFailure = reportSetupAuthStatusFailure({
-        auth,
-        baseUrl,
-        authScope,
-        scope,
-        root,
-        phases,
-        json: options.json
-      });
-      if (resumedAuthFailure !== null) return resumedAuthFailure;
-      if (auth.payload?.connected !== true) {
-        const stillPending = readPendingAuthClaim(baseUrl, authScope);
-        if (stillPending) {
-          return pendingResult({
-            baseUrl,
-            scope,
-            root,
-            phases,
-            authorizationUrl: stillPending.claimUrl,
-            resumed,
-            json: options.json
-          });
-        }
+  const connectedToRequestedWorkspace = () => {
+    if (auth.payload?.connected !== true) return false;
+    if (!orgName) return true;
+    const workspace = asRecord3(auth.payload.workspace);
+    return typeof workspace?.name === "string" && workspace.name.trim().toLowerCase() === orgName.toLowerCase();
+  };
+  let pending = replacingPendingClaim ? null : readPendingAuthClaim(baseUrl, authScope);
+  if (replacingPendingClaim && connectedToRequestedWorkspace()) {
+    clearPendingClaim(baseUrl, authScope);
+  }
+  let authClaimSource = "none";
+  if (pending || !connectedToRequestedWorkspace()) {
+    const reusedClaim = Boolean(pending);
+    authClaimSource = reusedClaim ? "existing" : "new";
+    if (!pending) {
+      process.stderr.write("Starting Deepline browser authorization...\n");
+      const registered = await captureStdout2(
+        () => handleRegister([
+          "--wait",
+          "no",
+          "--auth-scope",
+          authScope,
+          ...orgName ? ["--org-name", orgName] : []
+        ])
+      );
+      if (registered.exitCode !== 0) {
+        return reportSetupPhaseFailure({
+          baseUrl,
+          scope,
+          root,
+          phases,
+          phase: "auth",
+          code: "AUTH_REGISTER_FAILED",
+          exitCode: registered.exitCode,
+          message: "Deepline browser authorization could not be started.",
+          orgName,
+          json: options.json,
+          extra: { detail: parseCapturedJson(registered.stdout), authScope }
+        });
+      }
+      pending = readPendingAuthClaim(baseUrl, authScope);
+      if (!pending?.claimUrl) {
+        return reportSetupPhaseFailure({
+          baseUrl,
+          scope,
+          root,
+          phases,
+          phase: "auth",
+          code: "AUTH_CLAIM_URL_MISSING",
+          exitCode: 4,
+          message: "Deepline authorization did not return a usable claim URL.",
+          orgName,
+          json: options.json
+        });
       }
+      const browserOpenStatus = openSetupAuthorization(pending.claimUrl);
+      if (browserOpenStatus === "failed") {
+        return pendingResult({
+          baseUrl,
+          scope,
+          root,
+          phases,
+          authorizationUrl: pending.claimUrl,
+          browserOpenStatus: "failed",
+          authClaimSource,
+          orgName,
+          resumed,
+          json: options.json
+        });
+      }
+      process.stderr.write("Opened Deepline sign-in in the browser.\n");
     }
-  }
-  if (auth.payload?.connected !== true) {
-    process.stderr.write("Starting Deepline browser authorization...\n");
-    const agentRuntime = detectAgentRuntime();
-    const agentLed = agentRuntime !== "unknown";
-    const waitMode = options.json || agentLed || !process.stdin.isTTY ? "no" : "auto";
-    const registered = await captureStdout2(
-      () => handleRegister(["--wait", waitMode, "--auth-scope", authScope])
+    process.stderr.write(
+      "Waiting up to five minutes for Deepline approval...\n"
+    );
+    const waited = await captureStdout2(
+      () => handleWait(["--timeout", "300", "--auth-scope", authScope])
     );
-    if (registered.exitCode !== 0) {
-      return reportSetupPhaseFailure({
-        baseUrl,
-        scope,
-        root,
-        phases,
-        phase: "auth",
-        code: "AUTH_REGISTER_FAILED",
-        exitCode: registered.exitCode,
-        message: "Deepline browser authorization could not be started.",
-        json: options.json,
-        extra: {
-          detail: parseCapturedJson(registered.stdout),
-          authScope
-        }
-      });
-    }
     auth = await readAuthStatus(authScope);
-    const registeredAuthFailure = reportSetupAuthStatusFailure({
+    const authFailure = reportSetupAuthStatusFailure({
       auth,
       baseUrl,
       authScope,
       scope,
       root,
       phases,
+      orgName,
       json: options.json
     });
-    if (registeredAuthFailure !== null) return registeredAuthFailure;
-    if (auth.payload?.connected !== true) {
-      const pending = readPendingAuthClaim(baseUrl, authScope);
-      return pendingResult({
+    if (authFailure !== null) return authFailure;
+    if (waited.exitCode === EXIT_WORKSPACE_MISMATCH) {
+      return reportSetupPhaseFailure({
+        baseUrl,
+        scope,
+        root,
+        phases,
+        phase: "auth",
+        code: "REQUESTED_WORKSPACE_NOT_IN_ACCOUNT",
+        exitCode: EXIT_WORKSPACE_MISMATCH,
+        message: `The requested workspace${orgName ? ` ${orgName}` : ""} does not exist in this account. Connect to an existing workspace first; then use deepline org create if you need a new one.`,
+        orgName,
+        retryAutomatic: false,
+        next: "Ask the user which existing workspace or account to use. Sign in with an account that can access it, then rerun setup with --org-name set to the confirmed workspace.",
+        json: options.json
+      });
+    }
+    if (!connectedToRequestedWorkspace()) {
+      const stillPending = readPendingAuthClaim(baseUrl, authScope);
+      if (stillPending?.claimUrl) {
+        return pendingResult({
+          baseUrl,
+          scope,
+          root,
+          phases,
+          authorizationUrl: stillPending.claimUrl,
+          browserOpenStatus: reusedClaim ? "existing_claim" : "timed_out",
+          authClaimSource,
+          orgName,
+          resumed,
+          json: options.json
+        });
+      }
+      return reportSetupPhaseFailure({
         baseUrl,
         scope,
         root,
         phases,
-        authorizationUrl: pending?.claimUrl ?? "",
-        resumed,
+        phase: "auth",
+        code: orgName && auth.payload?.connected ? "AUTH_WORKSPACE_MISMATCH" : "AUTH_WAIT_FAILED",
+        exitCode: waited.exitCode || 4,
+        message: orgName && auth.payload?.connected ? `Deepline is connected to a different workspace than ${orgName}.` : "Deepline authorization did not complete.",
+        orgName,
+        ...orgName && auth.payload?.connected ? {
+          retryAutomatic: false,
+          next: "Ask the user which existing workspace or account to use. Rerun setup with --org-name set to the confirmed workspace."
+        } : {},
         json: options.json
       });
     }
@@ -46143,6 +46285,7 @@ async function runSetupCommand(options) {
       code: "DOCTOR_FAILED",
       exitCode: 7,
       message: "Deepline setup verification found one or more failed checks.",
+      orgName,
       json: options.json,
       extra: {
         doctor: doctorPayload,
@@ -46183,6 +46326,9 @@ async function runSetupCommand(options) {
       cliVersion: SDK_VERSION,
       agents: installedAgents,
       workspace: apiCheck?.workspace ?? null,
+      businessDomain: typeof auth.payload?.businessDomain === "string" ? auth.payload.businessDomain : null,
+      authClaimSource,
+      browserOpened: authClaimSource === "new",
       rollbackCommand: rollbackCommand(scope, root),
       statePath,
       doctor: doctorPayload,
@@ -46214,7 +46360,10 @@ async function runSetupCommand(options) {
   return 0;
 }
 function registerSetupCommands(program) {
-  program.command("setup").description("Install skills, authenticate, and verify Deepline.").option("--scope <scope>", "Setup scope: global or local", "global").option("--json", "Emit one final JSON result envelope").addHelpText(
+  program.command("setup").description("Install skills, authenticate, and verify Deepline.").option("--scope <scope>", "Setup scope: global or local", "global").option(
+    "--org-name <name>",
+    "Connect to an existing workspace, or name your first workspace"
+  ).option("--json", "Emit one final JSON result envelope").addHelpText(
     "after",
     `
 Notes:
@@ -46224,6 +46373,7 @@ Notes:
 
 Examples:
   deepline setup --json
+  deepline setup --org-name Acme --json
   deepline setup --scope local --json
 `
   ).action(async (options) => {