deepline 0.3.294 → 0.3.295

package/dist/cli/chunk-YWWAF7KZ.mjs

@@ -0,0 +1,923 @@
+import {
+  argsWantJson,
+  openInBrowser,
+  printCommandEnvelope
+} from "./chunk-6O5YZOVN.mjs";
+import {
+  ACTIVE_ORG_ID_ENV,
+  ACTIVE_ORG_NAME_ENV,
+  API_KEY_ENV,
+  FEATURES_ENV,
+  HOST_URL_ENV,
+  SDK_API_CONTRACT,
+  SDK_VERSION,
+  autoDetectBaseUrl,
+  detectAgentRuntime,
+  featureEnvValues,
+  getResolvedProjectAuthSource,
+  hostConfigDirPath,
+  hostEnvFilePath,
+  resolveApiKeyForBaseUrl,
+  resolveCliCommandContext,
+  resolveGlobalApiKeyForBaseUrl,
+  resolveProjectApiKeyForBaseUrl,
+  resolveProjectPinTarget,
+  saveHostEnvValues,
+  saveProjectDeeplineEnvValues,
+  storedHostApiKey
+} from "./chunk-EACVZI6N.mjs";
+
+// src/cli/commands/auth.ts
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { hostname } from "os";
+import { dirname, join } from "path";
+var EXIT_OK = 0;
+var EXIT_AUTH = 3;
+var EXIT_SERVER = 5;
+var EXIT_WORKSPACE_MISMATCH = 6;
+var AUTH_HTTP_TIMEOUT_MS = 1e4;
+var AUTH_REGISTER_HTTP_TIMEOUT_MS = 3e4;
+function statusBannerLine(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const banner = value;
+  if (typeof banner.message !== "string") {
+    return null;
+  }
+  return `Service notice: ${banner.message}`;
+}
+function envFilePath(baseUrl) {
+  return hostEnvFilePath(baseUrl);
+}
+function normalizeAuthScope(value) {
+  if (!value || value === "global") return "global";
+  if (value === "folder") return "folder";
+  throw new Error("--auth-scope must be one of: folder, global");
+}
+function parseAuthScope(args) {
+  const index = args.indexOf("--auth-scope");
+  return normalizeAuthScope(index >= 0 ? args[index + 1] : void 0);
+}
+function pendingClaimPath(baseUrl, scope) {
+  if (scope === "folder") {
+    const target = resolveProjectPinTarget();
+    if (!target.ok) {
+      throw new Error(
+        `Cowork project folder is ambiguous. Candidate folders: ${target.candidates.join(
+          ", "
+        )}. Set CLAUDE_PROJECT_DIR or cd into the intended project folder.`
+      );
+    }
+    return join(target.dir, ".deepline", "setup", "pending-auth.json");
+  }
+  return `${hostConfigDirPath(baseUrl)}/pending-auth.json`;
+}
+function legacyPendingClaimTokenPath(baseUrl) {
+  return `${hostConfigDirPath(baseUrl)}/pending-claim-token`;
+}
+function savePendingClaim(baseUrl, claim) {
+  const filePath = pendingClaimPath(baseUrl, claim.scope);
+  const dir = dirname(filePath);
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  writeFileSync(filePath, `${JSON.stringify(claim, null, 2)}
+`, {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function resolvePendingAuthClaimForResume(baseUrl, requestedScope) {
+  if (requestedScope) {
+    const claim = readPendingAuthClaim(baseUrl, requestedScope);
+    return { claim, scope: claim?.scope ?? requestedScope };
+  }
+  const folder = readPendingAuthClaim(baseUrl, "folder");
+  if (folder) return { claim: folder, scope: folder.scope };
+  const global = readPendingAuthClaim(baseUrl, "global");
+  return { claim: global, scope: global?.scope ?? "global" };
+}
+function readPendingAuthClaim(baseUrl, scope) {
+  let filePath;
+  try {
+    filePath = pendingClaimPath(baseUrl, scope);
+  } catch {
+    return null;
+  }
+  if (!existsSync(filePath)) {
+    if (scope !== "global") return null;
+    try {
+      const claimToken = readFileSync(
+        legacyPendingClaimTokenPath(baseUrl),
+        "utf-8"
+      ).trim();
+      return claimToken ? {
+        claimToken,
+        claimUrl: `${baseUrl}/api/v2/auth/cli/claim/${encodeURIComponent(claimToken)}`,
+        scope
+      } : null;
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+    const claimToken = typeof parsed.claimToken === "string" ? parsed.claimToken.trim() : "";
+    if (!claimToken) return null;
+    return {
+      claimToken,
+      claimUrl: typeof parsed.claimUrl === "string" && parsed.claimUrl.trim() ? parsed.claimUrl.trim() : `${baseUrl}/api/v2/auth/cli/claim/${encodeURIComponent(claimToken)}`,
+      orgName: typeof parsed.orgName === "string" ? parsed.orgName.trim() : void 0,
+      // The record's own scope, when it has one. `register` writes this field
+      // precisely so a resume can learn where the credential belongs; reading
+      // back the caller's argument instead made it decorative, and a record
+      // found by searching would have reported the scope of the search rather
+      // than the scope it was created with.
+      scope: parsed.scope === "folder" || parsed.scope === "global" ? parsed.scope : scope
+    };
+  } catch {
+    return null;
+  }
+}
+function clearPendingClaim(baseUrl, scope) {
+  try {
+    rmSync(pendingClaimPath(baseUrl, scope), { force: true });
+    if (scope === "global") {
+      rmSync(legacyPendingClaimTokenPath(baseUrl), { force: true });
+    }
+  } catch {
+  }
+}
+function clearSatisfiedPendingClaim(baseUrl, scope, connectedWorkspaceName) {
+  const pending = readPendingAuthClaim(baseUrl, scope);
+  if (!pending) return;
+  if (pending.orgName && pending.orgName.toLowerCase() !== connectedWorkspaceName?.trim().toLowerCase()) {
+    return;
+  }
+  clearPendingClaim(baseUrl, scope);
+}
+function parseRegisterWaitMode(args) {
+  let mode = "auto";
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--no-wait") {
+      mode = "no";
+    } else if (args[i] === "--wait" && args[i + 1]) {
+      const value = args[++i].trim().toLowerCase();
+      if (value === "auto" || value === "yes" || value === "no") {
+        mode = value;
+      } else {
+        throw new Error("--wait must be one of: auto, yes, no");
+      }
+    }
+  }
+  return mode;
+}
+function shouldWaitForRegisterClaim(mode) {
+  if (mode === "yes") return true;
+  if (mode === "no") return false;
+  return detectAgentRuntime() !== "claude_cowork";
+}
+function saveEnvValues(values, baseUrl, scope) {
+  const filtered = {
+    ...values[HOST_URL_ENV] ? { [HOST_URL_ENV]: values[HOST_URL_ENV] } : {},
+    ...values[API_KEY_ENV] ? { [API_KEY_ENV]: values[API_KEY_ENV] } : {},
+    ...values[ACTIVE_ORG_ID_ENV] ? { [ACTIVE_ORG_ID_ENV]: values[ACTIVE_ORG_ID_ENV] } : {},
+    ...Object.prototype.hasOwnProperty.call(values, ACTIVE_ORG_NAME_ENV) ? { [ACTIVE_ORG_NAME_ENV]: values[ACTIVE_ORG_NAME_ENV] } : {},
+    // An explicit empty list must reach the store: it clears a stale line.
+    ...Object.prototype.hasOwnProperty.call(values, FEATURES_ENV) ? { [FEATURES_ENV]: values[FEATURES_ENV] } : {}
+  };
+  if (scope === "folder") {
+    saveProjectDeeplineEnvValues(filtered);
+  } else {
+    saveHostEnvValues(baseUrl, filtered);
+  }
+}
+function activeOrgEnvValues(data) {
+  const orgId = typeof data.org_id === "string" ? data.org_id.trim() : "";
+  if (!orgId) return {};
+  const orgName = typeof data.org_name === "string" ? data.org_name.trim() : "";
+  return {
+    [ACTIVE_ORG_ID_ENV]: orgId,
+    [ACTIVE_ORG_NAME_ENV]: orgName,
+    ...featureEnvValues(data)
+  };
+}
+async function httpJson(method, url, apiKey, body, timeoutMs = AUTH_HTTP_TIMEOUT_MS) {
+  const headers = {
+    "Content-Type": "application/json",
+    "User-Agent": `deepline-ts-sdk/${SDK_VERSION}`,
+    "X-Deepline-Client-Family": "sdk",
+    "X-Deepline-CLI-Family": "sdk",
+    "X-Deepline-Agent-Runtime": detectAgentRuntime(),
+    "X-Deepline-CLI-Version": SDK_VERSION,
+    "X-Deepline-SDK-Version": SDK_VERSION,
+    "X-Deepline-API-Contract": SDK_API_CONTRACT
+  };
+  if (apiKey) headers["Authorization"] = `Bearer ${apiKey}`;
+  const bypassToken = process.env.VERCEL_PROTECTION_BYPASS_TOKEN?.trim();
+  if (bypassToken) headers["x-vercel-protection-bypass"] = bypassToken;
+  let lastError = null;
+  for (const candidateUrl of buildCandidateUrls(url)) {
+    const controller = new AbortController();
+    let requestTimedOut = false;
+    const timeout = setTimeout(() => {
+      requestTimedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    try {
+      const response = await fetch(candidateUrl, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+      let data;
+      try {
+        data = await response.json();
+      } catch (error) {
+        if (controller.signal.aborted) throw error;
+        data = {};
+      }
+      return { status: response.status, data };
+    } catch (error) {
+      lastError = error;
+      if (requestTimedOut && method !== "GET") break;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error(String(lastError));
+}
+async function reportSetupCompleted(input) {
+  const apiKey = input.authScope === "folder" ? resolveProjectApiKeyForBaseUrl(input.baseUrl) : resolveGlobalApiKeyForBaseUrl(input.baseUrl);
+  if (!apiKey) return;
+  try {
+    await httpJson(
+      "POST",
+      `${input.baseUrl}/api/v2/telemetry/setup-completed`,
+      apiKey,
+      {
+        scope: input.scope,
+        resumed: input.resumed,
+        installed_agent_count: input.installedAgentCount
+      }
+    );
+  } catch {
+  }
+}
+function buildCandidateUrls(url) {
+  try {
+    const parsed = new URL(url);
+    const candidates = [url];
+    const configuredInternalOrigin = process.env.DEEPLINE_INTERNAL_APP_URL || process.env.WORKTREE_INTERNAL_APP_URL || (process.env.PORT ? `http://127.0.0.1:${process.env.PORT}` : "");
+    if (parsed.hostname === "localhost") {
+      const loopback = new URL(url);
+      loopback.hostname = "127.0.0.1";
+      candidates.push(loopback.toString());
+    }
+    if (parsed.hostname.endsWith(".localhost") && configuredInternalOrigin) {
+      const internal = new URL(url);
+      const origin = new URL(configuredInternalOrigin);
+      internal.protocol = origin.protocol;
+      internal.hostname = origin.hostname;
+      internal.port = origin.port;
+      candidates.push(internal.toString());
+    }
+    return [...new Set(candidates)];
+  } catch {
+    return [url];
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function printDeeplineLogo() {
+  if (process.stdout.isTTY && (process.stdout.columns ?? 80) >= 70) {
+    console.log(
+      " \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2557      \u2588\u2588\u2557 \u2588\u2588\u2588\u2557   \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557"
+    );
+    console.log(
+      " \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557 \u2588\u2588\u2551      \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2557  \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D"
+    );
+    console.log(
+      " \u2588\u2588\u2551  \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2557   \u2588\u2588\u2588\u2588\u2588\u2557   \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D \u2588\u2588\u2551      \u2588\u2588\u2551 \u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2557"
+    );
+    console.log(
+      " \u2588\u2588\u2551  \u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u255D   \u2588\u2588\u2554\u2550\u2550\u255D   \u2588\u2588\u2554\u2550\u2550\u2550\u255D  \u2588\u2588\u2551      \u2588\u2588\u2551 \u2588\u2588\u2551\u255A\u2588\u2588\u2557\u2588\u2588\u2551 \u2588\u2588\u2554\u2550\u2550\u255D"
+    );
+    console.log(
+      " \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255D \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551      \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551 \u2588\u2588\u2551 \u255A\u2588\u2588\u2588\u2588\u2551 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557"
+    );
+    console.log(
+      " \u255A\u2550\u2550\u2550\u2550\u2550\u255D  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D      \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D \u255A\u2550\u255D \u255A\u2550\u255D  \u255A\u2550\u2550\u2550\u255D \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u255D"
+    );
+    console.log("");
+    return;
+  }
+  console.log("DEEPLINE");
+}
+async function claimInstallBonus(baseUrl, apiKey) {
+  try {
+    const { status, data } = await httpJson(
+      "POST",
+      `${baseUrl}/api/v2/billing/claim-install-bonus`,
+      apiKey,
+      {}
+    );
+    if (status !== 200) return;
+    const granted = typeof data.credits_granted === "number" ? data.credits_granted : 0;
+    const alreadyGranted = data.already_granted === true;
+    if (granted > 0) {
+      console.log(`
+  \u2022 +${granted} free credits added to your account!`);
+    } else if (alreadyGranted) {
+      console.log("\n  \u2022 Free credits already applied to your account.");
+    }
+  } catch {
+  }
+}
+async function printClaimSuccessBanner(baseUrl, apiKey, statusData) {
+  console.log("");
+  printDeeplineLogo();
+  console.log("\u2713 All set! Your CLI is connected.");
+  await claimInstallBonus(baseUrl, apiKey);
+  if (statusData.org_name) {
+    console.log(`  \u2022 Signed in with organization: ${statusData.org_name}`);
+  }
+}
+async function handleRegister(args) {
+  const baseUrl = autoDetectBaseUrl().replace(/\/$/, "");
+  let orgName = "";
+  let orgId = "";
+  let agentName = "";
+  let waitMode;
+  let authScope;
+  try {
+    waitMode = parseRegisterWaitMode(args);
+    authScope = args.includes("--auth-scope") ? parseAuthScope(args) : args.includes("--org-id") ? "folder" : "global";
+    if (authScope === "folder") {
+      pendingClaimPath(baseUrl, authScope);
+    }
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    return 2;
+  }
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--org-name" && args[i + 1]) orgName = args[++i];
+    else if (args[i] === "--org-id" && args[i + 1]) orgId = args[++i];
+    else if (args[i] === "--agent-name" && args[i + 1]) agentName = args[++i];
+  }
+  if (!agentName) {
+    try {
+      agentName = hostname() || "Deepline CLI (TS)";
+    } catch {
+      agentName = "Deepline CLI (TS)";
+    }
+  }
+  const payload = {};
+  if (orgName) payload.org_name = orgName;
+  if (orgId) payload.org_id = orgId;
+  if (agentName) payload.agent_name = agentName;
+  const { status, data } = await httpJson(
+    "POST",
+    `${baseUrl}/api/v2/auth/cli/register`,
+    null,
+    payload,
+    AUTH_REGISTER_HTTP_TIMEOUT_MS
+  );
+  if (status >= 400) {
+    console.error(`Auth register failed (status ${status}).`);
+    if (data.error) console.error(String(data.error));
+    return EXIT_SERVER;
+  }
+  const claimUrl = String(data.claim_url || "");
+  const claimToken = String(data.claim_token || "");
+  if (claimToken) {
+    savePendingClaim(baseUrl, {
+      claimToken,
+      claimUrl,
+      scope: authScope,
+      ...orgName ? { orgName } : {}
+    });
+    saveEnvValues(
+      {
+        [HOST_URL_ENV]: baseUrl
+      },
+      baseUrl,
+      authScope
+    );
+  }
+  if (claimUrl) {
+    const shouldOpen = waitMode !== "no" && detectAgentRuntime() !== "claude_cowork";
+    console.log(
+      shouldOpen ? "  Opening approval page in your browser." : "  Open this approval page in your browser:"
+    );
+    console.log(`  ${claimUrl}`);
+    if (shouldOpen) openInBrowser(claimUrl);
+  }
+  if (data.cli_message) {
+    console.log(String(data.cli_message));
+  }
+  if (!shouldWaitForRegisterClaim(waitMode)) return EXIT_OK;
+  if (!claimToken) {
+    console.error("Missing claim token from register response.");
+    return EXIT_SERVER;
+  }
+  while (true) {
+    const { status: s, data: statusData } = await httpJson(
+      "POST",
+      `${baseUrl}/api/v2/auth/cli/status`,
+      null,
+      { claim_token: claimToken, reveal: true }
+    );
+    if (s === 401 || s === 403) {
+      clearPendingClaim(baseUrl, authScope);
+      console.log("Status: unauthorized");
+      return EXIT_AUTH;
+    }
+    if (s >= 500 || s === 0 || s === 400) {
+      await sleep(2e3);
+      continue;
+    }
+    if (s >= 400) {
+      console.error(`Auth status error (status ${s}).`);
+      return EXIT_SERVER;
+    }
+    const state = String(statusData.status || "").toLowerCase();
+    if (statusData.code === "REQUESTED_WORKSPACE_NOT_IN_ACCOUNT") {
+      clearPendingClaim(baseUrl, authScope);
+      console.error(
+        "The requested workspace does not exist in this account. Connect to an existing workspace first; then use `deepline org create` if you need a new one."
+      );
+      return EXIT_WORKSPACE_MISMATCH;
+    }
+    if (state === "claimed") {
+      const apiKey = String(statusData.api_key || "");
+      if (apiKey) {
+        saveEnvValues(
+          {
+            [HOST_URL_ENV]: baseUrl,
+            [API_KEY_ENV]: apiKey,
+            ...activeOrgEnvValues(statusData)
+          },
+          baseUrl,
+          authScope
+        );
+        clearPendingClaim(baseUrl, authScope);
+        await printClaimSuccessBanner(baseUrl, apiKey, statusData);
+        return EXIT_OK;
+      }
+    }
+    if (state === "expired") {
+      clearPendingClaim(baseUrl, authScope);
+      console.log(
+        "That approval link expired. Please run: deepline auth register"
+      );
+      return EXIT_AUTH;
+    }
+    await sleep(2e3);
+  }
+}
+async function handleWait(args) {
+  const baseUrl = autoDetectBaseUrl().replace(/\/$/, "");
+  let timeoutSeconds = 300;
+  let requestedScope;
+  if (args.includes("--auth-scope")) {
+    try {
+      requestedScope = parseAuthScope(args);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 2;
+    }
+  }
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--timeout" && args[i + 1]) {
+      const parsed = Number.parseInt(args[++i], 10);
+      if (Number.isFinite(parsed) && parsed > 0) {
+        timeoutSeconds = parsed;
+      }
+    }
+  }
+  const resumed = resolvePendingAuthClaimForResume(baseUrl, requestedScope);
+  const pendingClaim = resumed.claim;
+  const authScope = resumed.scope;
+  const claimToken = pendingClaim?.claimToken ?? "";
+  if (!pendingClaim) {
+    const scopedApiKey = authScope === "folder" ? resolveProjectApiKeyForBaseUrl(baseUrl) : resolveGlobalApiKeyForBaseUrl(baseUrl);
+    if (scopedApiKey) {
+      console.log("Already connected.");
+      return EXIT_OK;
+    }
+    console.error("No pending approval. Run: deepline auth register --wait no");
+    return EXIT_AUTH;
+  }
+  const deadline = Date.now() + timeoutSeconds * 1e3;
+  while (Date.now() < deadline) {
+    const { status, data } = await httpJson(
+      "POST",
+      `${baseUrl}/api/v2/auth/cli/status`,
+      null,
+      { claim_token: claimToken, reveal: true },
+      Math.min(AUTH_HTTP_TIMEOUT_MS, Math.max(1, deadline - Date.now()))
+    );
+    if (status === 401 || status === 403) {
+      clearPendingClaim(baseUrl, authScope);
+      console.error("Claim is invalid. Run: deepline auth register");
+      return EXIT_AUTH;
+    }
+    if (status >= 500 || status === 0 || status === 400) {
+      await sleep(Math.min(2e3, Math.max(0, deadline - Date.now())));
+      continue;
+    }
+    if (status >= 400) {
+      console.error(`Auth status error (status ${status}).`);
+      return EXIT_SERVER;
+    }
+    const state = String(data.status || "").toLowerCase();
+    if (data.code === "REQUESTED_WORKSPACE_NOT_IN_ACCOUNT") {
+      clearPendingClaim(baseUrl, authScope);
+      console.error(
+        "The requested workspace does not exist in this account. Connect to an existing workspace first; then use `deepline org create` if you need a new one."
+      );
+      return EXIT_WORKSPACE_MISMATCH;
+    }
+    if (state === "claimed") {
+      const apiKey = String(data.api_key || "");
+      if (apiKey) {
+        saveEnvValues(
+          {
+            [HOST_URL_ENV]: baseUrl,
+            [API_KEY_ENV]: apiKey,
+            ...activeOrgEnvValues(data)
+          },
+          baseUrl,
+          authScope
+        );
+        clearPendingClaim(baseUrl, authScope);
+        await printClaimSuccessBanner(baseUrl, apiKey, data);
+        return EXIT_OK;
+      }
+    }
+    if (state === "expired") {
+      clearPendingClaim(baseUrl, authScope);
+      console.error("That approval link expired. Run: deepline auth register");
+      return EXIT_AUTH;
+    }
+    await sleep(Math.min(2e3, Math.max(0, deadline - Date.now())));
+  }
+  console.error(
+    "Still pending. Approve the browser link, then run: deepline auth wait"
+  );
+  return EXIT_AUTH;
+}
+async function handleStatus(args) {
+  const baseUrl = autoDetectBaseUrl().replace(/\/$/, "");
+  const reveal = args.includes("--reveal");
+  const jsonOutput = argsWantJson(args);
+  const hasExplicitAuthScope = args.includes("--auth-scope");
+  let authScope = null;
+  if (hasExplicitAuthScope) {
+    try {
+      authScope = parseAuthScope(args);
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      return 2;
+    }
+  }
+  let hostStatusPayload = null;
+  const hostLines = [];
+  try {
+    const { status: hStatus, data: hData } = await httpJson(
+      "GET",
+      `${baseUrl}/api/v2/health`,
+      null
+    );
+    if (hStatus === 200) {
+      hostStatusPayload = {
+        host: baseUrl,
+        hostStatus: hData.status || "ok",
+        hostVersion: hData.version || "(unknown)",
+        status_banner: hData.status_banner ?? null
+      };
+      hostLines.push(`Host: ${baseUrl}`);
+      hostLines.push(`Host status: ${hData.status || "ok"}`);
+      hostLines.push(`Host version: ${hData.version || "(unknown)"}`);
+      const bannerLine = statusBannerLine(hData.status_banner);
+      if (bannerLine) hostLines.push(bannerLine);
+    }
+  } catch {
+    hostStatusPayload = {
+      host: baseUrl,
+      hostStatus: "unreachable",
+      hostVersion: null
+    };
+    hostLines.push(`Host: ${baseUrl} (unreachable)`);
+  }
+  const apiKey = authScope === "folder" ? resolveProjectApiKeyForBaseUrl(baseUrl) : authScope === "global" ? resolveGlobalApiKeyForBaseUrl(baseUrl) : resolveApiKeyForBaseUrl(baseUrl);
+  if (!apiKey) {
+    const { claim: pendingClaim } = resolvePendingAuthClaimForResume(
+      baseUrl,
+      authScope ?? void 0
+    );
+    if (pendingClaim) {
+      printCommandEnvelope(
+        {
+          ...hostStatusPayload ?? { host: baseUrl },
+          status: "pending",
+          connected: false,
+          authorization_url: pendingClaim.claimUrl || null,
+          next: "deepline auth wait",
+          render: {
+            sections: [
+              {
+                title: "auth status",
+                lines: [...hostLines, "Status: pending"]
+              }
+            ],
+            actions: [{ label: "Run", command: "deepline auth wait" }]
+          }
+        },
+        { json: jsonOutput }
+      );
+      return EXIT_OK;
+    }
+    printCommandEnvelope(
+      {
+        ...hostStatusPayload ?? { host: baseUrl },
+        status: "not connected",
+        connected: false,
+        next: "deepline auth register --wait auto && deepline auth wait",
+        render: {
+          sections: [
+            {
+              title: "auth status",
+              lines: [...hostLines, "Status: not connected"]
+            }
+          ],
+          actions: [
+            {
+              label: "Register",
+              command: "deepline auth register --wait auto"
+            },
+            { label: "Wait", command: "deepline auth wait" }
+          ]
+        }
+      },
+      { json: jsonOutput }
+    );
+    return EXIT_OK;
+  }
+  const { status, data } = await httpJson(
+    "POST",
+    `${baseUrl}/api/v2/auth/cli/status`,
+    apiKey,
+    {
+      api_key: apiKey,
+      reveal
+    }
+  );
+  if (status === 401 || status === 403) {
+    printCommandEnvelope(
+      {
+        ...hostStatusPayload ?? { host: baseUrl },
+        status: "unauthorized",
+        connected: false,
+        next: "deepline auth register --wait auto && deepline auth wait",
+        render: {
+          sections: [
+            {
+              title: "auth status",
+              lines: [...hostLines, "Status: unauthorized"]
+            }
+          ],
+          actions: [
+            {
+              label: "Register",
+              command: "deepline auth register --wait auto"
+            },
+            { label: "Wait", command: "deepline auth wait" }
+          ]
+        }
+      },
+      { json: jsonOutput }
+    );
+    return EXIT_AUTH;
+  }
+  if (status >= 400) {
+    console.error(`Auth status error (status ${status}).`);
+    return EXIT_SERVER;
+  }
+  const resolvedAuthScope = authScope ?? (getResolvedProjectAuthSource(baseUrl, apiKey) ? "folder" : "global");
+  clearSatisfiedPendingClaim(
+    baseUrl,
+    resolvedAuthScope,
+    typeof data.org_name === "string" ? data.org_name : null
+  );
+  const payload = {
+    ...hostStatusPayload ?? { host: baseUrl },
+    status: data.status || "(unknown)",
+    connected: true,
+    rateLimitTier: data.rate_limit_tier || "(unknown)",
+    workspace: {
+      id: data.org_id ?? null,
+      name: data.org_name ?? null,
+      slug: data.org_slug ?? null
+    },
+    user: {
+      id: data.user_id ?? null
+    },
+    businessDomain: typeof data.business_domain === "string" ? data.business_domain : null,
+    examples: Array.isArray(data.examples) ? data.examples : []
+  };
+  let savedApiKeyPath = null;
+  if (reveal) {
+    const apiKeyResp = String(data.api_key || apiKey);
+    if (apiKeyResp) {
+      saveEnvValues(
+        {
+          [HOST_URL_ENV]: baseUrl,
+          [API_KEY_ENV]: apiKeyResp,
+          ...activeOrgEnvValues(data)
+        },
+        baseUrl,
+        resolvedAuthScope
+      );
+      if (resolvedAuthScope === "folder") {
+        const target = resolveProjectPinTarget();
+        savedApiKeyPath = target.ok ? join(target.dir, ".env.deepline") : null;
+      } else {
+        savedApiKeyPath = envFilePath(baseUrl);
+      }
+    }
+  } else if (resolvedAuthScope === "folder" || storedHostApiKey(baseUrl) === apiKey) {
+    saveEnvValues(featureEnvValues(data), baseUrl, resolvedAuthScope);
+  }
+  printCommandEnvelope(
+    {
+      ...payload,
+      ...detectAgentRuntime() !== "unknown" ? {
+        command_context: resolveCliCommandContext(
+          { baseUrl, apiKey },
+          resolvedAuthScope
+        )
+      } : {},
+      ...savedApiKeyPath ? { saved_api_key_path: savedApiKeyPath } : {},
+      render: {
+        sections: [
+          {
+            title: "auth status",
+            lines: [
+              ...hostLines,
+              `Status: ${payload.status}`,
+              `Rate limit tier: ${payload.rateLimitTier}`,
+              ...payload.workspace.name ? [`Workspace: ${payload.workspace.name}`] : [],
+              ...payload.workspace.slug ? [`Workspace slug: ${payload.workspace.slug}`] : [],
+              ...payload.workspace.id != null ? [`Org ID: ${payload.workspace.id}`] : [],
+              // Switching orgs lives under `deepline org`, but this is where
+              // people look when they discover they are in the wrong
+              // workspace. Without the pointer the reasonable next move is
+              // `deepline auth register`, which re-approves the same account
+              // and leaves the active org unchanged.
+              "Switch workspace: deepline org list, then deepline org set <org-id>",
+              ...payload.user.id != null ? [`User ID: ${payload.user.id}`] : [],
+              ...payload.examples.length > 0 ? [
+                "Examples:",
+                ...payload.examples.slice(0, 3).map((example) => `  ${String(example)}`)
+              ] : [],
+              ...savedApiKeyPath ? [`Saved API key to ${savedApiKeyPath}`] : []
+            ]
+          }
+        ]
+      }
+    },
+    { json: jsonOutput }
+  );
+  return EXIT_OK;
+}
+function registerAuthCommands(program) {
+  const auth = program.command("auth").description("Register this device and show CLI auth status.").addHelpText(
+    "after",
+    `
+Common commands:
+  deepline auth register
+  deepline auth register --wait no
+  deepline auth wait --timeout 300
+  deepline auth status
+  deepline auth status --json
+
+Notes:
+  Registration uses --wait auto by default: it waits locally and returns after
+  opening the approval page in Cowork. Use --wait no in CI or agent runs, then
+  finish with deepline auth wait.
+  Auth status shows the target host and active workspace without printing secrets.
+  Registering again re-approves the same account; it does not change the active
+  workspace. To switch, use deepline org list and deepline org set <org-id>.
+`
+  );
+  auth.command("workspaces", { hidden: true }).description("Deprecated. Use deepline org list to see workspaces.").action(() => {
+    console.error(
+      "Workspaces live under `deepline org`.\n  List:   deepline org list\n  Switch: deepline org set <org-id>\n`deepline auth register` re-approves this device; it does not change the active workspace."
+    );
+    process.exitCode = 1;
+  });
+  auth.command("register").description(
+    "Register this device and open the approval page in your browser."
+  ).addHelpText(
+    "after",
+    `
+Notes:
+  Opens a browser approval page. --wait auto waits locally and returns after
+  opening the approval page in Cowork.
+  The saved API key is scoped to the selected workspace and host.
+
+Examples:
+  deepline auth register
+  deepline auth register --org-name Acme --agent-name local-cli
+  deepline auth register --wait no
+  deepline auth register --auth-scope folder --wait no
+`
+  ).option(
+    "--org-name <name>",
+    "Connect to an existing workspace, or name your first workspace"
+  ).option(
+    "--org-id <id>",
+    "Bind to this workspace directly, skipping the browser picker"
+  ).option("--agent-name <name>", "Agent name to register").option("--wait <mode>", "Wait mode: auto, yes, or no", "auto").option("--no-wait", "Alias for --wait no").option(
+    "--auth-scope <scope>",
+    "Credential scope: global or folder",
+    "global"
+  ).action(async (options) => {
+    process.exitCode = await handleRegister([
+      ...options.orgName ? ["--org-name", options.orgName] : [],
+      ...options.orgId ? ["--org-id", String(options.orgId)] : [],
+      ...options.agentName ? ["--agent-name", options.agentName] : [],
+      ...options.noWait || options.wait === false ? ["--wait", "no"] : ["--wait", String(options.wait ?? "auto")],
+      "--auth-scope",
+      String(options.authScope ?? "global")
+    ]);
+  });
+  auth.command("wait").description("Wait for a pending browser approval and save the API key.").addHelpText(
+    "after",
+    `
+Notes:
+  Completes a previous deepline auth register --wait no flow.
+  Saves the approved API key into the host auth file.
+
+Examples:
+  deepline auth wait
+  deepline auth wait --timeout 120
+  deepline auth wait --auth-scope folder --timeout 120
+`
+  ).option("--timeout <seconds>", "Maximum seconds to wait", "300").option(
+    "--auth-scope <scope>",
+    "Credential scope: global or folder",
+    "global"
+  ).action(async (options) => {
+    process.exitCode = await handleWait([
+      ...options.timeout ? ["--timeout", options.timeout] : [],
+      "--auth-scope",
+      String(options.authScope ?? "global")
+    ]);
+  });
+  auth.command("status").description("Show the current CLI auth and workspace status.").addHelpText(
+    "after",
+    `
+Notes:
+  Shows the host, server health, connection state, active workspace, and user id.
+  Use --reveal only when you intentionally want the server to return and persist
+  the API key into this host's CLI auth file.
+
+Examples:
+  deepline auth status
+  deepline auth status --auth-scope folder
+  deepline auth status --json
+`
+  ).option(
+    "--reveal",
+    "Persist the revealed API key back to the host auth file"
+  ).option("--auth-scope <scope>", "Read only folder or global auth").option("--json", "Emit JSON output. Also automatic when stdout is piped").action(async (options) => {
+    process.exitCode = await handleStatus([
+      ...options.reveal ? ["--reveal"] : [],
+      ...options.authScope ? ["--auth-scope", String(options.authScope)] : [],
+      ...options.json ? ["--json"] : []
+    ]);
+  });
+}
+
+export {
+  EXIT_WORKSPACE_MISMATCH,
+  resolvePendingAuthClaimForResume,
+  readPendingAuthClaim,
+  clearPendingClaim,
+  clearSatisfiedPendingClaim,
+  reportSetupCompleted,
+  handleRegister,
+  handleWait,
+  handleStatus,
+  registerAuthCommands
+};