simulo 0.2.6__tar.gz → 0.6.0__tar.gz

simulo-0.6.0/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2026, Simulo Team
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

simulo-0.6.0/PKG-INFO

@@ -0,0 +1,81 @@
+Metadata-Version: 2.4
+Name: simulo
+Version: 0.6.0
+Summary: Simulo — robotics simulation SDK and CLI (Linux + CUDA GPU required)
+Author-email: Simulo Team <team@simulo.ai>
+License: BSD-3-Clause
+Project-URL: Homepage, https://simulo.ai
+Project-URL: Documentation, https://docs.simulo.ai
+Project-URL: Source, https://github.com/simulo-ai/simulo-platform
+Keywords: robotics,simulation,reinforcement-learning,imitation-learning,isaacsim
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Environment :: GPU :: NVIDIA CUDA
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: click>=8.1
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic-settings>=2.3
+Requires-Dist: numpy>=1.20
+Requires-Dist: gymnasium>=0.29
+Requires-Dist: torch>=2.0
+Requires-Dist: isaaclab[all,isaacsim]==2.3.2.post1
+Requires-Dist: skrl<2,>=1.4.3
+Provides-Extra: dev
+Requires-Dist: black>=24.0; extra == "dev"
+Requires-Dist: isort>=5.13; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: pytest>=8.2; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pytest-cov>=5.0; extra == "dev"
+Requires-Dist: pip-audit>=2.7; extra == "dev"
+Requires-Dist: mypy>=1.10; extra == "dev"
+Provides-Extra: release
+Requires-Dist: commitizen>=3.27; extra == "release"
+Requires-Dist: build>=1.2; extra == "release"
+Requires-Dist: twine>=5.1; extra == "release"
+Dynamic: license-file
+
+# simulo
+
+The unified `simulo` PyPI package — robotics simulation SDK and CLI for
+NVIDIA Isaac Sim / IsaacLab.
+
+**Linux x86_64 with an NVIDIA CUDA GPU required.** Other platforms are
+not supported.
+
+## Install
+
+See [INSTALL.md](INSTALL.md) for the canonical two-step install
+(`pip install simulo --extra-index-url https://pypi.nvidia.com` plus the
+NVIDIA-pinned `torch` wheel).
+
+## Status
+
+This is a **Wave A skeleton** of the unified-package migration described
+in `context/design/unified-simulo-pypi-package.md` and
+`context/implementation-plans/unified-simulo-pypi-package-wave-plan.md`.
+The SDK and CLI source trees are added in Waves B and C; the conda env
+is unified in Wave E; the first release (`0.5.0`) ships from Wave G.
+
+## Layout
+
+```
+simulo-devkit/packages/simulo/
+├── pyproject.toml          # umbrella package (name = "simulo")
+├── README.md               # you are here
+├── INSTALL.md              # end-user install instructions
+├── LICENSE                 # BSD 3-Clause
+├── environment.yml         # conda env: env_simulo-devkit (py3.11)
+├── sdk/
+│   ├── src/simulo/         # SDK module (populated in Wave B)
+│   └── tests/
+└── cli/
+    ├── src/simulo_cli/     # CLI module (populated in Wave C)
+    └── tests/
+```

simulo-0.6.0/README.md

@@ -0,0 +1,38 @@
+# simulo
+
+The unified `simulo` PyPI package — robotics simulation SDK and CLI for
+NVIDIA Isaac Sim / IsaacLab.
+
+**Linux x86_64 with an NVIDIA CUDA GPU required.** Other platforms are
+not supported.
+
+## Install
+
+See [INSTALL.md](INSTALL.md) for the canonical two-step install
+(`pip install simulo --extra-index-url https://pypi.nvidia.com` plus the
+NVIDIA-pinned `torch` wheel).
+
+## Status
+
+This is a **Wave A skeleton** of the unified-package migration described
+in `context/design/unified-simulo-pypi-package.md` and
+`context/implementation-plans/unified-simulo-pypi-package-wave-plan.md`.
+The SDK and CLI source trees are added in Waves B and C; the conda env
+is unified in Wave E; the first release (`0.5.0`) ships from Wave G.
+
+## Layout
+
+```
+simulo-devkit/packages/simulo/
+├── pyproject.toml          # umbrella package (name = "simulo")
+├── README.md               # you are here
+├── INSTALL.md              # end-user install instructions
+├── LICENSE                 # BSD 3-Clause
+├── environment.yml         # conda env: env_simulo-devkit (py3.11)
+├── sdk/
+│   ├── src/simulo/         # SDK module (populated in Wave B)
+│   └── tests/
+└── cli/
+    ├── src/simulo_cli/     # CLI module (populated in Wave C)
+    └── tests/
+```

simulo-0.6.0/cli/src/simulo_cli/__init__.py

@@ -0,0 +1 @@
+# simulo-cli — Simulo command-line interface

simulo-0.6.0/cli/src/simulo_cli/__main__.py

@@ -0,0 +1,6 @@
+"""Entry point for `python -m simulo_cli`."""
+
+from simulo_cli.cli import cli
+
+if __name__ == "__main__":
+    cli()

simulo-0.6.0/cli/src/simulo_cli/api/__init__.py

@@ -0,0 +1 @@
+# simulo_cli.api — HTTP client for simulo-control-plane

simulo-0.6.0/cli/src/simulo_cli/api/client.py

@@ -0,0 +1,98 @@
+"""SimuloClient — HTTP client for the simulo-control-plane REST API.
+
+Wave 4: full implementation with bearer-token injection and silent auto-refresh.
+
+The client:
+  - reads credentials from ~/.simulo/credentials
+  - checks token expiry before every authenticated call
+  - silently refreshes via POST /auth/token/refresh when expired
+  - injects Authorization: Bearer <access_token> on every authenticated call
+  - provides post_unauth() for endpoints that require no auth (e.g. /auth/cli/callback)
+
+See .claude/skills/cli-auth/SKILL.md §API Client for the specification.
+"""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+
+import httpx
+
+from simulo_cli.auth.credentials import load_credentials, save_credentials
+from simulo_cli.config import get_settings
+
+
+class SimuloClient:
+    """Thin HTTP client wrapping simulo-control-plane.
+
+    All public methods accept the same ``**kwargs`` as the underlying
+    ``httpx`` call (e.g. ``json=``, ``params=``, ``timeout=``).
+    """
+
+    def __init__(self) -> None:
+        self.settings = get_settings()
+        self.base_url = self.settings.api_base_url
+
+    # ------------------------------------------------------------------
+    # Token management
+    # ------------------------------------------------------------------
+
+    def _get_token(self) -> str:
+        """Return a valid access token, refreshing silently if expired."""
+        creds = load_credentials()
+        expires_at = datetime.fromisoformat(creds["expires_at"])
+        if datetime.now(timezone.utc) >= expires_at:
+            creds = self._refresh(creds)
+        return creds["access_token"]
+
+    def _refresh(self, creds: dict) -> dict:
+        """POST /auth/token/refresh and update credentials file.
+
+        Preserves refresh_token and active_organization_id from existing creds.
+        Raises SystemExit on failure so the caller sees a clean message.
+        """
+        resp = httpx.post(
+            f"{self.base_url}/auth/token/refresh",
+            json={"refresh_token": creds["refresh_token"]},
+            timeout=10,
+        )
+        if resp.status_code != 200:
+            err: dict = {}
+            try:
+                err = (resp.json() or {}).get("error") or {}
+            except (ValueError, AttributeError):
+                pass
+            if err.get("code") == "cognito_unavailable":
+                raise SystemExit("Auth provider temporarily unavailable. Try again in a moment.")
+            raise SystemExit("Session expired. Run: simulo login")
+
+        payload = resp.json()
+        new_creds = {
+            **creds,
+            "access_token": payload["access_token"],
+            "expires_at": payload["expires_at"],
+        }
+        save_credentials(new_creds)
+        return new_creds
+
+    def _headers(self) -> dict[str, str]:
+        return {"Authorization": f"Bearer {self._get_token()}"}
+
+    # ------------------------------------------------------------------
+    # Public HTTP helpers
+    # ------------------------------------------------------------------
+
+    def get(self, path: str, **kwargs: object) -> httpx.Response:
+        """GET *path* with bearer auth."""
+        return httpx.get(f"{self.base_url}{path}", headers=self._headers(), **kwargs)  # type: ignore[arg-type]
+
+    def post(self, path: str, **kwargs: object) -> httpx.Response:
+        """POST *path* with bearer auth."""
+        return httpx.post(f"{self.base_url}{path}", headers=self._headers(), **kwargs)  # type: ignore[arg-type]
+
+    def post_unauth(self, path: str, **kwargs: object) -> httpx.Response:
+        """POST to *path* without an Authorization header.
+
+        Suitable for endpoints that require no auth (e.g. /auth/cli/callback).
+        """
+        return httpx.post(f"{self.base_url}{path}", timeout=15, **kwargs)  # type: ignore[arg-type]

simulo-0.6.0/cli/src/simulo_cli/auth/__init__.py

@@ -0,0 +1 @@
+# simulo_cli.auth — credentials storage helpers

simulo-0.6.0/cli/src/simulo_cli/auth/credentials.py

@@ -0,0 +1,57 @@
+"""Credentials file helpers — ~/.simulo/credentials (mode 0600).
+
+Credentials file schema (version 1):
+{
+    "version": 1,
+    "access_token": "<jwt>",
+    "refresh_token": "<opaque>",
+    "expires_at": "2026-04-24T15:00:00Z",   # ISO 8601 UTC
+    "active_organization_id": "<org-uuid>",
+    "user_email": "user@example.com"
+}
+
+Wave 4 will call these helpers from the login/logout/refresh flow.
+Field names here are canonical — do NOT rename without also updating
+cli-auth/SKILL.md Contract Mapping table and every Wave 4 consumer.
+"""
+
+from __future__ import annotations
+
+import json
+import stat
+from pathlib import Path
+
+CREDENTIALS_PATH = Path.home() / ".simulo" / "credentials"
+
+
+def save_credentials(data: dict) -> None:
+    """Write *data* to the credentials file with mode 0600.
+
+    Creates the parent directory (~/.simulo) with mode 0700 if absent.
+    """
+    CREDENTIALS_PATH.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    CREDENTIALS_PATH.write_text(json.dumps(data, indent=2))
+    CREDENTIALS_PATH.chmod(0o600)
+
+
+def load_credentials() -> dict:
+    """Read and return the credentials dict.
+
+    Raises ``SystemExit`` if:
+    - the file does not exist (not logged in)
+    - the file has group- or world-readable permissions (security invariant)
+    """
+    if not CREDENTIALS_PATH.exists():
+        raise SystemExit("Not logged in. Run: simulo login")
+    mode = CREDENTIALS_PATH.stat().st_mode
+    if mode & (stat.S_IRWXG | stat.S_IRWXO):
+        raise SystemExit(
+            f"Credentials file {CREDENTIALS_PATH} has unsafe permissions. " f"Run: chmod 600 {CREDENTIALS_PATH}"
+        )
+    return json.loads(CREDENTIALS_PATH.read_text())
+
+
+def clear_credentials() -> None:
+    """Remove the credentials file if it exists."""
+    if CREDENTIALS_PATH.exists():
+        CREDENTIALS_PATH.unlink()

simulo-0.6.0/cli/src/simulo_cli/cli.py

@@ -0,0 +1,33 @@
+"""Root click group for the `simulo` CLI entry point.
+
+Command surface (Wave 1 — all stubbed, Wave 4 wires implementations):
+
+  simulo login                 Authenticate via browser loopback / manual fallback
+  simulo logout                Revoke refresh token and clear local credentials
+  simulo whoami                Print current user + active org
+  simulo org use <id>          Switch active organization context
+
+Run ``simulo --help`` for the current command tree.
+"""
+
+from __future__ import annotations
+
+import click
+
+from simulo_cli.commands.auth import login, logout, whoami
+from simulo_cli.commands.org import org
+
+
+@click.group()
+@click.version_option(package_name="simulo")
+def cli() -> None:
+    """Simulo CLI — manage projects, jobs, artifacts, and your account."""
+
+
+# Auth commands
+cli.add_command(login)
+cli.add_command(logout)
+cli.add_command(whoami)
+
+# Org commands
+cli.add_command(org)

simulo-0.6.0/cli/src/simulo_cli/commands/__init__.py

@@ -0,0 +1 @@
+# simulo_cli.commands — click command modules

simulo-0.6.0/cli/src/simulo_cli/commands/auth.py

@@ -0,0 +1,272 @@
+"""Auth commands — login, logout, whoami.
+
+Wave 4: full implementations.
+
+  - login  : PKCE loopback + manual fallback + POST /auth/cli/callback
+  - logout : load creds, POST /auth/logout (bearer), clear creds
+  - whoami : load creds, print user_email + active_organization_id
+
+See .claude/skills/cli-auth/SKILL.md for the canonical specification.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import http.server
+import secrets
+import socket
+import urllib.parse
+import webbrowser
+
+import click
+import httpx
+
+from simulo_cli.api.client import SimuloClient
+from simulo_cli.auth.credentials import clear_credentials, load_credentials, save_credentials
+from simulo_cli.config import get_settings
+
+CANDIDATE_PORTS = (8421, 8422, 8423)
+LOOPBACK_PATH = "/cli-callback"
+LOGIN_TIMEOUT_SECONDS = 300
+
+
+# ---------------------------------------------------------------------------
+# PKCE helpers
+# ---------------------------------------------------------------------------
+
+
+def _generate_pkce() -> tuple[str, str]:
+    """Return (code_verifier, code_challenge).
+
+    Verifier: 64 random bytes → base64url-encoded (≥86 chars, URL-safe).
+    Challenge: SHA-256(verifier) → base64url-encoded.
+    """
+    verifier = base64.urlsafe_b64encode(secrets.token_bytes(64)).rstrip(b"=").decode()
+    challenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
+    return verifier, challenge
+
+
+# ---------------------------------------------------------------------------
+# Loopback port binding
+# ---------------------------------------------------------------------------
+
+
+def _bind_loopback() -> socket.socket | None:
+    """Try to bind 127.0.0.1 on each CANDIDATE_PORT in order.
+
+    Returns the bound socket on the first success, or None if all fail.
+    Binds to 127.0.0.1 ONLY — never 0.0.0.0.
+    """
+    for port in CANDIDATE_PORTS:
+        try:
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            sock.bind(("127.0.0.1", port))
+            sock.listen(1)
+            return sock
+        except OSError:
+            sock.close()
+            continue
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Loopback code capture
+# ---------------------------------------------------------------------------
+
+
+def _capture_code(server_socket: socket.socket, expected_state: str) -> str:
+    """Block until the browser redirects back, validate state, return code.
+
+    Renders a success page so the browser tab can be closed by the user.
+    The server socket is closed before the HTTPServer is created — the OS
+    will rebind on the same port because SO_REUSEADDR is set.
+    """
+    result: dict[str, str] = {}
+
+    class _Handler(http.server.BaseHTTPRequestHandler):
+        def log_message(self, *args: object, **kwargs: object) -> None:  # type: ignore[override]
+            pass  # suppress default stderr logging
+
+        def do_GET(self) -> None:  # noqa: N802 — must match BaseHTTPRequestHandler
+            parsed = urllib.parse.urlparse(self.path)
+            if parsed.path != LOOPBACK_PATH:
+                self.send_error(404)
+                return
+            params = urllib.parse.parse_qs(parsed.query)
+            code = (params.get("code") or [""])[0]
+            state = (params.get("state") or [""])[0]
+
+            if not secrets.compare_digest(state, expected_state):
+                result["error"] = "state_mismatch"
+                self.send_error(400, "state mismatch")
+                return
+            if not code:
+                result["error"] = "missing_code"
+                self.send_error(400, "missing code")
+                return
+
+            result["code"] = code
+            self.send_response(200)
+            self.send_header("Content-Type", "text/html; charset=utf-8")
+            self.end_headers()
+            self.wfile.write(
+                b"<html><body>"
+                b"<h2>simulo: sign-in complete</h2>"
+                b"<p>You may close this window.</p>"
+                b"</body></html>"
+            )
+
+    host, port = server_socket.getsockname()
+    server_socket.close()
+    httpd = http.server.HTTPServer((host, port), _Handler)
+    httpd.timeout = LOGIN_TIMEOUT_SECONDS
+    httpd.handle_request()
+    httpd.server_close()
+
+    if "error" in result:
+        raise SystemExit(f"Login failed: {result['error']}")
+    if "code" not in result:
+        raise SystemExit("Login timed out. Run `simulo login` again.")
+    return result["code"]
+
+
+# ---------------------------------------------------------------------------
+# Manual fallback (headless / remote-SSH environments)
+# ---------------------------------------------------------------------------
+
+
+def _manual_fallback_code(authorize_url: str, expected_state: str) -> str:
+    """Print the authorize URL and prompt the user to paste back the code.
+
+    The page at console.simulo.ai/cli-callback shows the code and the first
+    8 characters of the state as a fingerprint the user must confirm here
+    (defense against shoulder-surf token substitution).
+    """
+    click.echo(
+        "\nCould not open a local browser callback port.\n"
+        "Open this URL in a browser on another machine:\n\n"
+        f"  {authorize_url}\n\n"
+        "After signing in, the page will display a short code and an 8-character\n"
+        "state fingerprint. Paste both below.\n"
+    )
+
+    code = click.prompt("Paste the code").strip()
+    # Ask the user to type what they saw on the page — NOT what the CLI generated.
+    # This is the out-of-band state check: two independent channels must agree.
+    entered_fingerprint = click.prompt("Enter the 8-character fingerprint shown on the page").strip()
+
+    state_fingerprint = expected_state[:8]
+    if not secrets.compare_digest(entered_fingerprint, state_fingerprint):
+        raise SystemExit("Login failed: state mismatch")
+
+    return code
+
+
+# ---------------------------------------------------------------------------
+# Commands
+# ---------------------------------------------------------------------------
+
+
+@click.command()
+def login() -> None:
+    """Authenticate the CLI via browser (loopback or manual fallback)."""
+    settings = get_settings()
+
+    # Guard: an empty client ID causes a silent 401 after the full OAuth round-trip
+    # (Cognito accepts blank client_id but the control plane rejects the token).
+    # Fail early with a clear message rather than a confusing post-redirect 401.
+    if not settings.cli_app_client_id:
+        raise SystemExit(
+            "SIMULO_CLI_APP_CLIENT_ID is not set.\n"
+            "  For staging:    SIMULO_ENV=staging simulo login\n"
+            "  For dev:        set SIMULO_CLI_APP_CLIENT_ID=<client-id> (see .env.example)\n"
+            "See: simulo-devkit/packages/simulo/cli/README.md"
+        )
+
+    verifier, challenge = _generate_pkce()
+    state = secrets.token_urlsafe(32)
+
+    loopback = _bind_loopback()
+    if loopback is not None:
+        _, port = loopback.getsockname()
+        redirect_uri = f"http://127.0.0.1:{port}{LOOPBACK_PATH}"
+    else:
+        redirect_uri = f"{settings.console_base_url}{LOOPBACK_PATH}"
+
+    authorize_url = f"{settings.cognito_hosted_ui}/oauth2/authorize?" + urllib.parse.urlencode(
+        {
+            "client_id": settings.cli_app_client_id,
+            "response_type": "code",
+            "scope": "openid email profile",
+            "redirect_uri": redirect_uri,
+            "state": state,
+            "code_challenge": challenge,
+            "code_challenge_method": "S256",
+        }
+    )
+
+    if loopback is not None:
+        click.echo("Opening your browser to sign in…")
+        webbrowser.open(authorize_url)
+        code = _capture_code(loopback, state)
+    else:
+        code = _manual_fallback_code(authorize_url, state)
+
+    client = SimuloClient()
+    # code_verifier is intentionally NOT logged; it must not appear in any log.
+    resp = client.post_unauth(
+        "/auth/cli/callback",
+        json={
+            "code": code,
+            "code_verifier": verifier,
+            "redirect_uri": redirect_uri,
+        },
+    )
+
+    if resp.status_code != 200:
+        try:
+            err: dict = (resp.json() or {}).get("error") or {}
+        except (ValueError, AttributeError):
+            err = {}
+        raise SystemExit(f"Login failed: {err.get('message') or err.get('code') or 'unknown error'}")
+
+    token = resp.json()
+    # Explicit mapping — never save the raw response dict.
+    # Note: response uses 'organization_id'; credentials file uses 'active_organization_id'.
+    creds = {
+        "version": 1,
+        "access_token": token["access_token"],
+        "refresh_token": token["refresh_token"],
+        "expires_at": token["expires_at"],
+        "user_email": token["user_email"],
+        "active_organization_id": token["organization_id"],
+    }
+    save_credentials(creds)
+    click.echo(f"Logged in as {creds['user_email']} (org: {creds['active_organization_id']})")
+
+
+@click.command()
+def logout() -> None:
+    """Clear the local authenticated session and revoke the refresh token."""
+    try:
+        creds = load_credentials()
+        client = SimuloClient()
+        # Server response is intentionally ignored — per use case Alt Flow 1,
+        # logout always clears local credentials regardless of whether server-side
+        # Cognito revocation succeeds. Network errors are also swallowed for the
+        # same reason: the user must always be able to reach the signed-out state.
+        client.post("/auth/logout", json={"refresh_token": creds.get("refresh_token")})
+    except (SystemExit, httpx.HTTPError):
+        pass  # Not logged in, session expired, or network error — still clear local state
+    clear_credentials()
+    click.echo("Logged out.")
+
+
+@click.command()
+def whoami() -> None:
+    """Show the current authenticated identity."""
+    creds = load_credentials()
+    click.echo(f"Email:  {creds['user_email']}")
+    click.echo(f"Org:    {creds['active_organization_id']}")

simulo-0.6.0/cli/src/simulo_cli/commands/org.py

@@ -0,0 +1,29 @@
+"""Org commands — org use.
+
+Wave 4: full implementation.
+
+  - org use <id>: load creds, set active_organization_id, save creds
+
+See .claude/skills/cli-auth/SKILL.md §simulo org use for the specification.
+"""
+
+from __future__ import annotations
+
+import click
+
+from simulo_cli.auth.credentials import load_credentials, save_credentials
+
+
+@click.group()
+def org() -> None:
+    """Manage organization context."""
+
+
+@org.command("use")
+@click.argument("organization_id")
+def org_use(organization_id: str) -> None:
+    """Switch the active organization context to ORGANIZATION_ID."""
+    creds = load_credentials()
+    creds["active_organization_id"] = organization_id
+    save_credentials(creds)
+    click.echo(f"Active org set to: {organization_id}")