linear-sdk-cli 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -4,6 +4,20 @@ Release Please generates this file from Conventional Commits. Feature and fix pu
 not edit it directly; their squash-commit titles are the release-note source of truth. This project
 adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.2](https://github.com/zhendalf/linear-sdk-cli/compare/v0.5.1...v0.5.2) (2026-09-13)
+
+### Bug Fixes
+
+- **deps:** refresh SDK and toolchain dependencies ([#66](https://github.com/zhendalf/linear-sdk-cli/issues/66)) ([dcc6060](https://github.com/zhendalf/linear-sdk-cli/commit/dcc60603f79a52d64d7265abd658ea4712e99041))
+
+## [0.5.1](https://github.com/zhendalf/linear-sdk-cli/compare/v0.5.0...v0.5.1) (2026-09-06)
+
+### Bug Fixes
+
+- associate login with projects and make workspace defaults explicit ([#62](https://github.com/zhendalf/linear-sdk-cli/issues/62)) ([faf4028](https://github.com/zhendalf/linear-sdk-cli/commit/faf4028246a947dc13f674d75df2b1ba3c0ac0f3))
+- **comment:** accept create as an add alias ([#57](https://github.com/zhendalf/linear-sdk-cli/issues/57)) ([c8146b9](https://github.com/zhendalf/linear-sdk-cli/commit/c8146b98f60b68b5cc8bd2063fdd49cc9cc91216))
+- reduce label resolution requests and latency ([#64](https://github.com/zhendalf/linear-sdk-cli/issues/64)) ([d1300a5](https://github.com/zhendalf/linear-sdk-cli/commit/d1300a5379e99a466a6111e24fbcfa7b85f21c1f))
+
 ## [0.5.0](https://github.com/zhendalf/linear-sdk-cli/compare/v0.4.0...v0.5.0) (2026-09-03)
 
 ### Features

package/COVERAGE.md

@@ -1,12 +1,12 @@
 # SDK Coverage Audit
 
-Generated by `bun run audit:coverage`. Total LinearClient members: **472**.
+Generated by `bun run audit:coverage`. Total LinearClient members: **476**.
 
 | Status   | Count | Meaning                                         |
 | -------- | ----- | ----------------------------------------------- |
 | curated  | 107   | Has a first-class CLI command                   |
-| raw-only | 142   | Reachable via `linear api` (no bespoke command) |
-| excluded | 223   | Out of scope (admin/integration/SDK plumbing)   |
+| raw-only | 144   | Reachable via `linear api` (no bespoke command) |
+| excluded | 225   | Out of scope (admin/integration/SDK plumbing)   |
 
 Every member is classified — CI fails otherwise. `raw-only` members are still
 100% reachable through the raw GraphQL escape hatch; they simply lack a tailored command.
@@ -125,7 +125,7 @@ Every member is classified — CI fails otherwise. `raw-only` members are still
 - `workflowState` — state
 - `workflowStates` — state
 
-## Excluded (223)
+## Excluded (225)
 
 - `agentActivities` — specialized/raw api only
 - `agentActivity` — specialized/raw api only
@@ -310,6 +310,7 @@ Every member is classified — CI fails otherwise. `raw-only` members are still
 - `ssoUrlFromEmail` — auth/session flows (out of scope)
 - `suspendUser` — admin/enterprise (raw api only)
 - `template` — specialized/raw api only
+- `templateSearch` — specialized/raw api only
 - `templates` — specialized/raw api only
 - `templatesForIntegration` — integration/import (raw api only)
 - `timeSchedule` — specialized/raw api only
@@ -350,8 +351,9 @@ Every member is classified — CI fails otherwise. `raw-only` members are still
 - `userRevokeAllSessions` — admin/enterprise (raw api only)
 - `userRevokeSession` — admin/enterprise (raw api only)
 - `userUnlinkFromIdentityProvider` — admin/enterprise (raw api only)
+- `userViewPreferences` — specialized/raw api only
 
-## Raw-only (142)
+## Raw-only (144)
 
 <details><summary>Show</summary>
 
@@ -408,6 +410,7 @@ Every member is classified — CI fails otherwise. `raw-only` members are still
 - `emailIntakeAddressRefreshSesDomainStatus`
 - `emailIntakeAddressRotate`
 - `emailUnsubscribe`
+- `inboxNotifications`
 - `initiativeAddLabel`
 - `initiativeFilterSuggestion`
 - `initiativeLabel`
@@ -472,6 +475,7 @@ Every member is classified — CI fails otherwise. `raw-only` members are still
 - `updateAttachment`
 - `updateEmailIntakeAddress`
 - `updateFavorite`
+- `updateInboxNotification`
 - `updateInitiativeLabel`
 - `updateInitiativeRelation`
 - `updateInitiativeToProject`

package/README.md

@@ -236,6 +236,10 @@ linear --workspace other-org issue list    # use a specific workspace for one co
 linear auth logout --workspace acme        # revoke OAuth, then remove one credential
 ```
 
+Successful browser and API-key login also save `workspace = "<authenticated slug>"` in the discovered project config, preserving other settings and comments. If no config exists, login creates `.linear.toml` at the Git root (or cwd outside Git). Use `auth login --no-project` for credential-only login. Human output reports the association path; JSON includes `projectConfigPath` (null with `--no-project`). Credentials remain in the global credential store. Environment overrides still take precedence over this association.
+
+Global defaults are optional: login, credential adoption, and logout never choose a new one. Use `linear auth default <slug>` to explicitly select a global fallback. Removing that workspace clears its default without promoting another workspace. Existing defaults, including defaults imported from the reference CLI, are preserved on upgrade because older files cannot distinguish a user choice from an automatically assigned default. To opt out of a legacy default, remove the top-level `default_workspace` from the user config and, if present, `default` from the reference CLI's `credentials.toml`; retain the workspace entries.
+
 If revocation is intentionally unavailable, `auth logout --local-only` removes only local state.
 If browser login temporarily superseded an existing personal API-key profile for that workspace,
 OAuth logout preserves and reactivates the API key instead of deleting it.
@@ -244,8 +248,9 @@ OAuth logout preserves and reactivates the API key instead of deleting it.
 environment and stored-credential lookup. Otherwise `LINEAR_API_KEY` or `LINEAR_ACCESS_TOKEN` is
 absolute. With no invocation-scoped credential, the workspace is chosen by `--workspace` →
 `LINEAR_WORKSPACE` env → project config `workspace` → `default_workspace` in the user config. With
-one configured workspace it's used automatically; with several and no selection, the CLI asks you
-to pick (via `--workspace`, project config, or `auth default`). An invocation credential does not
+one configured workspace it's used automatically; with several and no selection, interactive
+commands prompt for an invocation-only choice. Noninteractive and JSON commands fail clearly
+and explain how to select a workspace. Auth repair and discovery commands remain available. An invocation credential does not
 silently inherit the default or project profile's team; pair it with `--workspace` (or
 `LINEAR_WORKSPACE`) naming a configured profile when that profile metadata should apply.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linear-sdk-cli",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Ergonomic command-line interface for Linear, built on @linear/sdk",
   "type": "module",
   "license": "MIT",
@@ -57,6 +57,7 @@
     "format": "oxfmt .",
     "format:check": "oxfmt --check .",
     "test": "bun test test/unit test/contract",
+    "test:performance": "bun test --timeout 15000 test/performance",
     "test:unit": "bun test test/unit",
     "test:contract": "bun test test/contract",
     "test:live": "LINEAR_CLI_LIVE=1 bun test --timeout 60000 test/integration",
@@ -69,19 +70,19 @@
     "janitor": "bun run test/janitor.ts"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.7.1",
-    "@linear/sdk": "^92.0.0",
+    "@inquirer/prompts": "^8.7.2",
+    "@linear/sdk": "^95.0.0",
     "commander": "^15.0.0",
     "graphql": "^17.0.2",
     "picocolors": "^1.1.1",
     "smol-toml": "^1.8.0"
   },
-  "packageManager": "bun@1.4.0",
+  "packageManager": "bun@1.4.2",
   "devDependencies": {
-    "@types/bun": "^1.4.0",
-    "@types/node": "^26.4.1",
-    "oxfmt": "^0.66.0",
-    "oxlint": "^1.81.0",
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.5.1",
+    "oxfmt": "^0.67.0",
+    "oxlint": "^1.82.0",
     "typescript": "^7.0.2"
   }
 }

package/skills/linear-sdk-cli/SKILL.md

@@ -94,6 +94,8 @@ The CLI supports distinct human, hosted-app, and personal-key lifecycles:
    linear issue list --workspace acme --json
    ```
 
+Login associates the authenticated workspace with the discovered project config, or creates `.linear.toml` at the Git root (cwd outside Git). Use `--no-project` for credential-only login; JSON reports `projectConfigPath` or null. Credentials stay global. Workspace selection is `--workspace` → `LINEAR_WORKSPACE` → project config → optional global default. A sole stored workspace is automatic; multiple unselected workspaces prompt only interactively and fail in JSON/noninteractive mode. Login/adoption/logout never assign a new default. Existing legacy defaults remain valid because their original intent is unknown; `auth default` is an explicit convenience.
+
 An explicit credential flag overrides environment credentials. If both credential kinds occur at
 the same precedence level, the CLI fails rather than silently choosing an actor. Inspect resolution
 with `linear auth status`. `linear auth token` exports stored API keys only and never OAuth tokens.
@@ -215,6 +217,14 @@ perfectly with a heredoc:
 - `comment add` / `comment update` / `comment reply` → `--body-file <path>`
 - `document create` / `document update` → `--content-file <path>`
 
+Comments canonically use `add`, while resources such as attachments use `create`.
+`create` is also accepted as a compatibility alias for comment `add`. For a file-backed
+issue comment, copy this form:
+
+```bash
+linear issue comment add LUMI-9340 --body-file comment.md --json
+```
+
 ```bash
 linear issue create --title "Onboarding bug" --team TES --no-input --json \
   --description-file - <<'EOF'

package/skills/linear-sdk-cli/references/auth.md

@@ -69,7 +69,7 @@ storage: string
 
 ### `linear auth login`
 
-Authenticate in the browser with OAuth, or store a personal API key
+Authenticate and select the workspace for this project
 
 ```
 linear auth login [options]
@@ -77,6 +77,7 @@ linear auth login [options]
 
 | Option                 | Description                                                           |
 | ---------------------- | --------------------------------------------------------------------- |
+| `--no-project`         | save credentials without changing the project workspace               |
 | `--key <key>`          | use a personal API key ('-' reads it from stdin)                      |
 | `--plaintext`          | Store the key in the config file (0600) instead of the system keyring |
 | `--no-browser`         | print the authorization URL instead of opening it                     |
@@ -97,6 +98,7 @@ storage: string
 scopes?: string[]
 expiresAt?: string
 path: string
+projectConfigPath: string | null
 ```
 
 ### `linear auth logout`

package/skills/linear-sdk-cli/references/comment.md

@@ -22,6 +22,8 @@ linear comment [options]
 
 Add a comment to an issue (images uploaded with --attach render inline)
 
+Aliases: `create`
+
 ```
 linear comment add [options] <issue> [body]
 ```

package/skills/linear-sdk-cli/references/issue.md

@@ -255,6 +255,8 @@ issue: string
 
 Add a comment to an issue (images uploaded with --attach render inline)
 
+Aliases: `create`
+
 ```
 linear issue comment add [options] <issue> [body]
 ```

package/src/cli.ts

@@ -111,6 +111,7 @@ export function createProgram(): Command {
       command.help();
       return;
     }
+    await ctx.selectWorkspace();
     const detail = await getIssueDetail(ctx.client, id);
     await renderIssueDetail(ctx, detail, true);
   });

package/src/commands/comment.ts

@@ -32,12 +32,12 @@ const ROW_COLUMNS: Column<svc.CommentRow>[] = [
 /** Options for a mounted copy of the shared verbs. */
 interface MountOptions {
   /** Register the short aliases (`ls`, `edit`, `rm`). Off under `issue comment`. */
-  aliases?: boolean;
+  shortAliases?: boolean;
 }
 
 function buildList(o: MountOptions): Command {
   const cmd = new Command("list").argument("<issue>").description("List comments on an issue");
-  if (o.aliases !== false) cmd.alias("ls");
+  if (o.shortAliases !== false) cmd.alias("ls");
   return cmd.action(
     action(async (ctx: Context, _opts, issueArg: string) => {
       const rows = await svc.listComments(ctx.client, issueArg, ctx.limit);
@@ -48,6 +48,7 @@ function buildList(o: MountOptions): Command {
 
 function buildAdd(_o: MountOptions): Command {
   return new Command("add")
+    .alias("create")
     .argument("<issue>")
     .argument("[body]")
     .description("Add a comment to an issue (images uploaded with --attach render inline)")
@@ -129,7 +130,7 @@ function buildUpdate(o: MountOptions): Command {
       "prepend a real Linear mention (name, email, me, or id; repeatable)",
       collectArray,
     );
-  if (o.aliases !== false) cmd.alias("edit");
+  if (o.shortAliases !== false) cmd.alias("edit");
   return cmd.action(
     action(async (ctx: Context, opts, commentId: string, bodyArg?: string) => {
       // Fetch the comment first: the editor opens ON the current body (so
@@ -161,7 +162,7 @@ function buildUpdate(o: MountOptions): Command {
 
 function buildDelete(o: MountOptions): Command {
   const cmd = new Command("delete").argument("<commentId>").description("Delete a comment");
-  if (o.aliases !== false) cmd.alias("rm");
+  if (o.shortAliases !== false) cmd.alias("rm");
   return cmd.action(
     action(async (ctx: Context, _opts, commentId: string) => {
       if (!(await confirmDestructive(ctx, `Delete comment ${commentId}?`))) return;
@@ -250,11 +251,12 @@ export function registerComment(program: Command): void {
  * command, which keeps its own `[id] [body]` "add a comment" behavior for every
  * other operand. The short aliases (`ls`, `edit`, `rm`) are deliberately NOT
  * registered here: each subcommand name shadows a one-word comment body under
- * the parent, so the collision surface stays at the four names the reference
- * actually ships.
+ * the parent. `create` is the sole additional collision because agents commonly
+ * infer it from other resource mutations; accepting that spelling is safer than
+ * rejecting an intended comment mutation.
  */
 export function registerIssueCommentGroup(issueComment: Command): void {
   for (const build of Object.values(SHARED_COMMENT_VERBS)) {
-    issueComment.addCommand(build({ aliases: false }));
+    issueComment.addCommand(build({ shortAliases: false }));
   }
 }

package/src/commands/meta.ts

@@ -31,7 +31,7 @@ import {
 } from "../config.js";
 import { keyring } from "../lib/keyring.js";
 import { readStdinSync } from "../lib/body.js";
-import { authError, normalizeError, usageError } from "../lib/errors.js";
+import { CliError, authError, normalizeError, usageError } from "../lib/errors.js";
 import { confirmDestructive, promptSelect } from "../lib/prompt.js";
 import { listTeams } from "../services/team.js";
 import { resolveTeam } from "../lib/resolve.js";
@@ -177,6 +177,21 @@ export async function validateAuthCredential(
   };
 }
 
+/** Bind a completed login using the same project location rules as `config set`. */
+function saveLoginProject(ctx: Context, workspace: string, project: boolean): string | null {
+  if (!project) return null;
+  const path = ctx.config.projectConfigPath ?? defaultProjectConfigPath();
+  try {
+    setConfigKey(path, "workspace", workspace);
+  } catch {
+    throw new CliError(
+      `Credentials saved for workspace '${workspace}', but its project association could not be saved to ${path}. Fix the project file and run \`linear config set workspace ${workspace}\`; login does not need to be repeated.`,
+      "runtime",
+    );
+  }
+  return path;
+}
+
 function explicitWorkspaceSlug(input: string): string {
   const slug = input.trim();
   if (!/^[a-z0-9](?:[a-z0-9-]{0,98}[a-z0-9])?$/.test(slug)) {
@@ -202,7 +217,8 @@ export function registerMeta(program: Command): void {
   // login -------------------------------------------------------------------
   auth
     .command("login")
-    .description("Authenticate in the browser with OAuth, or store a personal API key")
+    .description("Authenticate and select the workspace for this project")
+    .option("--no-project", "save credentials without changing the project workspace")
     .option("--key <key>", "use a personal API key ('-' reads it from stdin)")
     .option("--plaintext", "Store the key in the config file (0600) instead of the system keyring")
     .option("--no-browser", "print the authorization URL instead of opening it")
@@ -241,6 +257,7 @@ export function registerMeta(program: Command): void {
           const { path, storage, keyringLabel } = writeCredential(org.urlKey, key, {
             plaintext: opts.plaintext === true,
           });
+          const projectConfigPath = saveLoginProject(ctx, org.urlKey, opts.project !== false);
           const where =
             storage === "keychain"
               ? `Credential saved to the ${keyringLabel}; ${path} records the workspace.`
@@ -253,10 +270,11 @@ export function registerMeta(program: Command): void {
               user: me,
               storage,
               path,
+              projectConfigPath,
             },
             () =>
               ctx.output.success(
-                `Authenticated as ${me.name} <${me.email}> for workspace '${org.urlKey}'. ${where}`,
+                `Authenticated as ${me.name} <${me.email}> for workspace '${org.urlKey}'. ${where}${projectConfigPath ? ` Project workspace saved to ${projectConfigPath}.` : ""}`,
               ),
           );
           return;
@@ -327,6 +345,11 @@ export function registerMeta(program: Command): void {
             user: identity.user,
           };
           const saved = writeOAuthCredential(credential);
+          const projectConfigPath = saveLoginProject(
+            ctx,
+            credential.workspace.urlKey,
+            opts.project !== false,
+          );
           ctx.output.emit(
             {
               success: true,
@@ -337,10 +360,11 @@ export function registerMeta(program: Command): void {
               scopes: credential.scopes,
               expiresAt: new Date(credential.expiresAt).toISOString(),
               path: saved.path,
+              projectConfigPath,
             },
             () =>
               ctx.output.success(
-                `Authenticated as ${credential.user.name} <${credential.user.email}> for workspace '${credential.workspace.urlKey}'. OAuth credentials saved to the ${saved.keyringLabel}.`,
+                `Authenticated as ${credential.user.name} <${credential.user.email}> for workspace '${credential.workspace.urlKey}'. OAuth credentials saved to the ${saved.keyringLabel}.${projectConfigPath ? ` Project workspace saved to ${projectConfigPath}.` : ""}`,
               ),
           );
         } finally {
@@ -455,6 +479,7 @@ export function registerMeta(program: Command): void {
     .action(
       action(async (ctx) => {
         const c = ctx.config;
+        if (c.workspaceChoices) throw c.apiKeyError;
         const credential = c.accessToken ?? c.apiKey;
         const credentialType = c.oauthCredential
           ? "oauth-user"
@@ -660,6 +685,7 @@ export function registerMeta(program: Command): void {
           if (!ctx.isTTY) {
             throw usageError("Pass --team <key>; there is no terminal to choose one from.");
           }
+          await ctx.selectWorkspace();
           const teams = await listTeams(ctx.client, Infinity);
           if (teams.length === 0) throw usageError("This workspace has no teams to choose from.");
           team = await promptSelect(

package/src/commands/open.ts

@@ -46,11 +46,12 @@ async function resolveOpenTarget(
   ctx: Context,
   target: string | undefined,
 ): Promise<{ target: OpenTarget; url: string; label: string }> {
+  if (target && URL.test(target)) return { target: "url", url: target, label: target };
+  await ctx.selectWorkspace();
   if (!target) {
     const org = await getOrganizationDetail(ctx.client);
     return { target: "workspace", url: `https://linear.app/${org.urlKey}`, label: org.name };
   }
-  if (URL.test(target)) return { target: "url", url: target, label: target };
   if (target.startsWith("team:")) {
     const team = await resolveTeam(ctx.client, target.slice("team:".length), ctx.defaultTeam);
     const org = await getOrganizationDetail(ctx.client);

package/src/config.ts

@@ -113,6 +113,8 @@ export interface ResolvedConfig {
    * needed (see createClient / `auth token`).
    */
   apiKeyError?: CliError;
+  /** Stored choices when selection is ambiguous; never an implicit default. */
+  workspaceChoices?: string[];
   /** Workspace slug whose stored credential was used, if any. */
   credentialWorkspace?: string;
   /** Selected stored profile whose non-secret metadata may participate. */
@@ -467,6 +469,7 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
   let oauthCredential: OAuthUserCredential | undefined;
   let credentialWorkspace: string | undefined;
   let workspaceProfile: string | undefined;
+  let workspaceChoices: string[] | undefined;
   let apiKeyError: CliError | undefined;
 
   if (flags.apiKey && flags.accessToken) {
@@ -539,8 +542,9 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
         take(slugs[0]!);
       } else if (slugs.length > 1) {
         // Multiple workspaces but no default → ambiguous (deferred).
+        workspaceChoices = slugs;
         apiKeyError = new CliError(
-          `Multiple workspaces are configured (${slugs.join(", ")}) but none is selected. Pass --workspace <slug> or run \`linear auth default <slug>\`.`,
+          `Multiple workspaces are configured (${slugs.join(", ")}) but none is selected. Pass --workspace <slug>, run \`linear config set workspace <slug>\` for this project, or explicitly choose \`linear auth default <slug>\`.`,
           "usage",
         );
       }
@@ -621,6 +625,7 @@ export function resolveConfig(inputs: ConfigInputs = {}): ResolvedConfig {
     apiKeyError,
     credentialWorkspace,
     workspaceProfile,
+    workspaceChoices,
     team: teamTiers.find(([, settings]) => settings.team !== undefined)?.[1].team,
     // The display setting walks every tier. Credential selection above uses
     // the flag, env, and project tiers, then the auth-specific user default.
@@ -1001,10 +1006,6 @@ export function writeOAuthCredential(credential: OAuthUserCredential): WriteOAut
       table.keyring = true;
       table.oauth = true;
       ws[slug] = table;
-      if (!asString(obj.default_workspace)) {
-        const reference = readReferenceCredentials(referenceCredentialsPath());
-        if (!reference.defaultWorkspace) obj.default_workspace = slug;
-      }
       writeUserObject(path, obj);
     } catch (err) {
       try {
@@ -1130,10 +1131,6 @@ export function adoptKeyringCredential(
     delete table.api_key;
     table.keyring = true;
     ws[slug] = table;
-    if (!asString(obj.default_workspace)) {
-      const reference = readReferenceCredentials(referenceCredentialsPath());
-      if (!reference.defaultWorkspace) obj.default_workspace = slug;
-    }
     writeUserObject(path, obj);
     return { path, storage: "keychain", keyringLabel: found.keyringLabel };
   });
@@ -1146,8 +1143,8 @@ export function adoptKeyringCredential(
  * no keyring, it is written as `api_key` in the 0600 file — the latter without
  * complaint, since a platform is not an error. Either way the OTHER form for
  * the same slug is dropped from the file, so a re-login moves the key rather
- * than leaving a plaintext copy behind that would keep winning. If no default
- * workspace exists anywhere (ours or the reference CLI's), this slug becomes it.
+ * than leaving a plaintext copy behind that would keep winning. Global defaults
+ * are only written by setDefaultWorkspace; existing legacy defaults are preserved.
  */
 export function writeCredential(
   slug: string,
@@ -1177,12 +1174,6 @@ export function writeCredential(
     }
     systemBackend?.delete(oauthAccount(slug));
     ws[slug] = table;
-    if (!asString(obj.default_workspace)) {
-      // Leave the reference CLI's default in charge if it has one; writing ours
-      // over it would silently switch a migrating user's workspace.
-      const reference = readReferenceCredentials(referenceCredentialsPath());
-      if (!reference.defaultWorkspace) obj.default_workspace = slug;
-    }
     writeUserObject(path, obj);
     return { path, storage, keyringLabel: backend?.label };
   });
@@ -1242,7 +1233,7 @@ function removeFromReferenceCredentials(slug: string): boolean {
   const reference = readReferenceCredentials(path);
   if (!reference.workspaces.includes(slug)) return false;
   const workspaces = reference.workspaces.filter((s) => s !== slug).sort();
-  const def = reference.defaultWorkspace === slug ? workspaces[0] : reference.defaultWorkspace;
+  const def = reference.defaultWorkspace === slug ? undefined : reference.defaultWorkspace;
   const obj: Record<string, unknown> = {};
   if (def) obj.default = def;
   obj.workspaces = workspaces;
@@ -1253,8 +1244,8 @@ function removeFromReferenceCredentials(slug: string): boolean {
 /**
  * Forget a workspace: remove its `[workspaces."<slug>"]` table, its keyring
  * entry, and its line in the reference CLI's list — whichever exist. If the
- * removed slug was the default, the default is repointed to a remaining
- * workspace (or cleared). Returns true if anything was removed.
+ * removed slug was the default, that default is cleared without choosing another
+ * workspace. Returns true if anything was removed.
  */
 export interface RemoveCredentialResult {
   removed: boolean;
@@ -1287,9 +1278,7 @@ export function removeCredentialWithMetadata(slug: string): RemoveCredentialResu
     if (Object.keys(ws).length === 0) delete obj.workspaces;
 
     if (asString(obj.default_workspace) === slug) {
-      const remaining = obj.workspaces ? Object.keys(obj.workspaces as object) : [];
-      if (remaining.length > 0) obj.default_workspace = remaining[0]!;
-      else delete obj.default_workspace;
+      delete obj.default_workspace;
       writeUserObject(path, obj);
     } else if (listed) {
       writeUserObject(path, obj);
@@ -1344,7 +1333,6 @@ export function removeOAuthCredential(slug: string): RemoveOAuthCredentialResult
       const table = ws[slug];
       const hadOAuthMarker = table?.oauth === true;
       if (hadOAuthMarker) removed = true;
-      const reference = readReferenceCredentials(referenceCredentialsPath());
       const apiKeyFallback = Boolean(asString(table?.api_key)) || keyringApiKey;
 
       if (apiKeyFallback) {
@@ -1360,11 +1348,7 @@ export function removeOAuthCredential(slug: string): RemoveOAuthCredentialResult
       if (Object.keys(ws).length === 0) delete obj.workspaces;
 
       if (!apiKeyFallback && asString(obj.default_workspace) === slug) {
-        const remaining = obj.workspaces ? Object.keys(obj.workspaces as object) : [];
-        const referenceFallback = reference.workspaces.find((candidate) => candidate !== slug);
-        if (remaining.length > 0) obj.default_workspace = remaining[0]!;
-        else if (referenceFallback) obj.default_workspace = referenceFallback;
-        else delete obj.default_workspace;
+        delete obj.default_workspace;
       }
       if (hadOAuthMarker || apiKeyFallback) writeUserObject(path, obj);
       return {

package/src/context.ts

@@ -7,6 +7,7 @@
 import type { LinearClient } from "@linear/sdk";
 import { resolveConfig, type ResolvedConfig } from "./config.js";
 import { createClient, setRetryReporter } from "./client.js";
+import { promptSelect } from "./lib/prompt.js";
 import { Output } from "./output/format.js";
 import { isDebugEnabled, shouldUseColor } from "./output/color.js";
 
@@ -46,7 +47,7 @@ export function firstTeam(team: string | string[] | undefined): string | undefin
 }
 
 export class Context {
-  readonly config: ResolvedConfig;
+  config: ResolvedConfig;
   readonly output: Output;
   readonly options: GlobalOptions;
   readonly isTTY: boolean;
@@ -96,6 +97,25 @@ export class Context {
     setRetryReporter((line) => this.output.info(line));
   }
 
+  /** Choose only for this invocation; never persist an interactive fallback. */
+  async selectWorkspace(): Promise<void> {
+    const choices = this.config.workspaceChoices;
+    if (!choices || !this.isTTY) return;
+    const workspace = await promptSelect(
+      this,
+      "Select a workspace for this invocation",
+      choices.map((slug) => ({ name: slug, value: slug })),
+    );
+    this.config = resolveConfig({
+      flags: {
+        apiKey: this.options.apiKey,
+        accessToken: this.options.accessToken,
+        team: firstTeam(this.options.team),
+        workspace,
+      },
+    });
+  }
+
   /** Lazily construct the Linear client (so `--help` never needs a key). */
   get client(): LinearClient {
     if (!this._client) this._client = createClient(this.config);

package/src/lib/action.ts

@@ -21,6 +21,14 @@ export function action(handler: ActionHandler) {
     const localOpts = (args[args.length - 2] ?? {}) as Record<string, any>;
     const positionals = args.slice(0, -2);
     const ctx = new Context(command.optsWithGlobals() as GlobalOptions);
+    // Repair and local discovery need no selection. Config/open select within
+    // their handlers only when the chosen path needs credentials.
+    let group = command;
+    while (group.parent?.parent) group = group.parent;
+    const offline =
+      ["config", "open", "commands", "completion"].includes(group.name()) ||
+      (group.name() === "auth" && !["whoami", "status", "token"].includes(command.name()));
+    if (!offline) await ctx.selectWorkspace();
     await handler(ctx, localOpts, ...positionals);
   };
 }

package/src/lib/output-shapes.ts

@@ -328,6 +328,7 @@ export const OUTPUT_SHAPES: Record<string, OutputShape | null> = {
     "scopes?": ["string"],
     "expiresAt?": "string",
     path: "string",
+    projectConfigPath: "string|null",
   }),
   "auth logout": receipt({
     success: "boolean",

package/src/lib/resolve.ts

@@ -209,46 +209,60 @@ export async function resolveLabelIds(
   names: string[],
   teamId?: string,
 ): Promise<string[]> {
-  const ids: string[] = [];
-  for (const name of names) {
-    if (isUuid(name)) {
-      ids.push(name);
-      continue;
+  // Share in-flight searches only within this call. Later calls must observe
+  // renamed/deleted labels, and exact spelling matters for case preference.
+  const lookups = new Map<string, Promise<any[]>>();
+  const lookup = (name: string): Promise<any[]> => {
+    let pending = lookups.get(name);
+    if (!pending) {
+      pending = (async () => {
+        const conn = await withRetry(() =>
+          client.issueLabels({
+            filter: { name: { eqIgnoreCase: name } } as any,
+            first: RESOLVE_PAGE,
+          }),
+        );
+        // Share the complete scan too: concurrent consumers must not advance
+        // the same mutable SDK connection independently.
+        return scanAll<any>(conn as any, "labels", "linear label list");
+      })();
+      lookups.set(name, pending);
     }
-    const conn = await withRetry(() =>
-      client.issueLabels({ filter: { name: { eqIgnoreCase: name } } as any, first: RESOLVE_PAGE }),
-    );
-    // Scanned rather than capped: the team narrowing below can discard every
-    // label on the first page, so a fixed page cap could turn a label that
-    // exists into a not-found.
-    const nodes = await scanAll<any>(conn as any, "labels", "linear label list");
-    if (nodes.length === 0)
-      throw notFound(`No label matching '${name}'. Run 'linear label list' to see the options.`);
-
-    // Narrow to this team's labels + workspace-level labels when a team is known.
-    // If a team is known and nothing is in scope, that's not-found (do NOT fall
-    // back to an out-of-scope label from another team).
-    // Label groups are containers, not labels that can be applied to an issue.
-    let candidates: any[] = nodes.filter((label: any) => !label.isGroup);
-    if (teamId) {
-      const scoped = await Promise.all(
-        nodes.map(async (l: any) => ({ label: l, team: await l.team })),
-      );
-      candidates = scoped.filter((s) => !s.team || s.team.id === teamId).map((s) => s.label);
-      if (candidates.length === 0) throw notFound(`No label '${name}' in this team or workspace.`);
-    }
-
-    // Prefer an exact (case-sensitive) match.
-    const exact = candidates.filter((l: any) => l.name === name);
-    const finalists = exact.length ? exact : candidates;
-    if (finalists.length > 1) {
-      throw ambiguous(
-        `Multiple labels named '${name}'${teamId ? " in scope" : ""}; pass the label id instead.`,
-      );
-    }
-    ids.push(finalists[0]!.id);
-  }
-  return ids;
+    return pending;
+  };
+  return Promise.all(
+    names.map(async (name) => {
+      if (isUuid(name)) return name;
+      const nodes = await lookup(name);
+      if (nodes.length === 0)
+        throw notFound(`No label matching '${name}'. Run 'linear label list' to see the options.`);
+
+      // Narrow to this team's labels + workspace-level labels when a team is known.
+      // If a team is known and nothing is in scope, that's not-found (do NOT fall
+      // back to an out-of-scope label from another team).
+      // Label groups are containers, not labels that can be applied to an issue.
+      let candidates: any[] = nodes.filter((label: any) => !label.isGroup);
+      if (teamId) {
+        // The SDK includes teamId in the label response; accessing team fetches it again.
+        candidates = candidates.filter((label) => !label.teamId || label.teamId === teamId);
+        if (candidates.length === 0)
+          throw notFound(`No label '${name}' in this team or workspace.`);
+      }
+
+      if (candidates.length === 0)
+        throw notFound(`No label matching '${name}'. Run 'linear label list' to see the options.`);
+
+      // Prefer an exact (case-sensitive) match.
+      const exact = candidates.filter((l: any) => l.name === name);
+      const finalists = exact.length ? exact : candidates;
+      if (finalists.length > 1) {
+        throw ambiguous(
+          `Multiple labels named '${name}'${teamId ? " in scope" : ""}; pass the label id instead.`,
+        );
+      }
+      return finalists[0]!.id;
+    }),
+  );
 }
 
 /**