@astrale-os/cli 0.6.3-alpha.0 → 0.8.0-alpha.0

package/dist/astrale.js

@@ -2576,7 +2576,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@astrale-os/cli",
-    version: "0.6.3-alpha.0",
+    version: "0.8.0-alpha.0",
     description: "Astrale CLI — connect to existing Astrale kernels",
     keywords: [
       "astrale",
@@ -2606,8 +2606,7 @@ var init_package = __esm(() => {
     type: "module",
     exports: {
       "./keys": "./src/lib/keys.ts",
-      "./paths": "./src/lib/paths.ts",
-      "./connect-core": "./src/connect-core.ts"
+      "./paths": "./src/lib/paths.ts"
     },
     publishConfig: {
       access: "public",
@@ -59080,24 +59079,14 @@ async function obtainToken(idp, opts, scope2) {
     scope: scope2,
     audience: opts.audience
   });
-  if (opts.onVerification) {
-    opts.onVerification({
-      verificationUri: device.verification_uri ?? device.verification_uri_complete ?? "",
-      verificationUriComplete: device.verification_uri_complete,
-      userCode: device.user_code,
-      expiresIn: device.expires_in,
-      message: device.message
-    });
-  } else {
-    if (device.verification_uri_complete)
-      log.info(`Open: ${device.verification_uri_complete}`);
-    else if (device.verification_uri)
-      log.info(`Open: ${device.verification_uri}`);
-    if (device.user_code)
-      log.info(`Code: ${device.user_code}`);
-    if (device.message)
-      log.dim(`  ${device.message}`);
-  }
+  if (device.verification_uri_complete)
+    log.info(`Open: ${device.verification_uri_complete}`);
+  else if (device.verification_uri)
+    log.info(`Open: ${device.verification_uri}`);
+  if (device.user_code)
+    log.info(`Code: ${device.user_code}`);
+  if (device.message)
+    log.dim(`  ${device.message}`);
   return pollDeviceToken({
     idp,
     deviceCode: device.device_code,
@@ -65902,6 +65891,12 @@ var init_session = __esm(() => {
 function adminInstanceMethod(method) {
   return `${ADMIN_INSTANCE}:${method}`;
 }
+async function callOwnedInstances(client) {
+  return await client.call(adminInstanceMethod("listMine"), {});
+}
+function findOwnedInstance(instances, identifier) {
+  return instances.find((instance) => instance.id === identifier || instance.slug === identifier);
+}
 function formatInstanceLocation(info2) {
   return [info2.state && info2.state !== "ready" ? info2.state : undefined, info2.region, info2.hostId].filter(Boolean).join(" · ");
 }
@@ -66019,6 +66014,8 @@ function adminTargetToInstance(target) {
   };
 }
 function isManagedInstanceNotFound(error52) {
+  if (error52 instanceof AstraleError && error52.code === "INSTANCE_NOT_FOUND")
+    return true;
   if (!(error52 instanceof Error))
     return false;
   if (error52.name === "NotFoundError")
@@ -66384,13 +66381,13 @@ var init_ca_fetch = () => {};
 // src/kernel/client.ts
 async function resolveKernelTarget(opts, config2) {
   if (opts.url && !opts.instance) {
-    const resolved2 = await resolveInstanceTarget({ source: "url", url: opts.url }, { config: config2, admin: adminLookupOpts(opts) });
+    const resolved2 = await resolveInstanceTarget({ source: "url", url: opts.url }, { config: config2 });
     return resolvedToKernelTarget(resolved2);
   }
   const resolved = await resolveInstanceTarget(opts.instance ? { source: "name", name: opts.instance } : { source: "active" }, {
     config: config2,
-    admin: adminLookupOpts(opts),
-    managed: (slug) => lookupManagedInstance(slug, opts)
+    admin: {},
+    managed: (slug) => lookupImplicitOwnedInstance(slug, opts)
   });
   return resolvedToKernelTarget(resolved, opts.url);
 }
@@ -66399,16 +66396,22 @@ async function withKernelClient(opts, fn2) {
   const target = await resolveKernelTarget(opts, config2);
   return withResolvedKernelClient(opts, config2, target, fn2);
 }
-async function lookupManagedInstance(slug, opts) {
-  return await withAdminKernelClient(adminLookupOpts(opts), async (ctx) => await ctx.client.call(adminInstanceMethod("info"), { id: slug }));
+async function listOwnedInstances(opts) {
+  return await withAdminKernelClient(opts, async (ctx) => callOwnedInstances(ctx.client));
 }
-function adminLookupOpts(opts) {
-  return {
-    as: opts.as,
-    creds: opts.creds,
-    timeout: opts.timeout,
-    debug: opts.debug
-  };
+async function lookupOwnedInstance(slug, opts) {
+  const instance = findOwnedInstance(await listOwnedInstances(opts), slug);
+  if (instance)
+    return instance;
+  throw new AstraleError("INSTANCE_NOT_FOUND", `No owned instance matches "${slug}".`);
+}
+async function lookupImplicitOwnedInstance(slug, targetOpts, deps = {
+  lookupOwned: lookupOwnedInstance
+}) {
+  return await deps.lookupOwned(slug, {
+    timeout: targetOpts.timeout,
+    debug: targetOpts.debug
+  });
 }
 function resolvedToKernelTarget(target, urlOverride) {
   return {
@@ -66564,30 +66567,97 @@ var init_provision_instance = __esm(() => {
 });
 
 // src/setup/steps/instance.ts
-async function fetchManaged(ctx) {
-  try {
-    return await withSpinner("Checking for existing instances", !ctx.machine, () => withAdminKernelClient(ctx.opts, async (client) => await client.client.call(adminInstanceMethod("list"), {})));
-  } catch {
-    return [];
-  }
-}
 function hero(slug, kernelUrl) {
   console.log("");
   console.log(renderInstanceHero(slug, guiOrigin(kernelUrl)));
   console.log("");
 }
-async function adopt(info2) {
-  const { repointedFrom } = await upsertManagedBookmark(info2.slug, info2.slug, info2.url);
-  await setActive(info2.slug);
+async function adoptOwnedInstance(info2, deps = {
+  upsert: upsertManagedBookmark,
+  activate: setActive
+}) {
+  const { repointedFrom } = await deps.upsert(info2.slug, info2.slug, info2.url, info2.organizationId);
+  await deps.activate(info2.slug);
   if (repointedFrom) {
     log.warn(`Bookmark "${info2.slug}" repointed: ${repointedFrom} → ${normalizeInstanceKernelUrl(info2.url)}`);
   }
   log.success(`Active instance: ${info2.slug}`);
   hero(info2.slug, info2.url);
 }
+function defaultDependencies(ctx) {
+  return {
+    fetchOwned: (setupCtx) => withSpinner("Checking for existing instances", !setupCtx.machine, () => listOwnedInstances(setupCtx.opts)),
+    adopt: adoptOwnedInstance,
+    selectReady: (instances) => selectFrom("No active instance. Pick one:", instances.map((info2) => ({
+      label: `${info2.slug}  ${source_default.dim(guiOrigin(info2.url))}`,
+      value: info2
+    }))),
+    confirmCreate: () => confirmDefaultYes("No instances yet. Provision your first one now?"),
+    promptSlug: () => ctx.slug ? Promise.resolve(ctx.slug) : promptText("Pick a slug for your instance", { validate: slugError }),
+    provision: (slug) => provisionInstance(slug, ctx.opts)
+  };
+}
+async function ensureOwnedInstance(ctx, deps = defaultDependencies(ctx)) {
+  let owned;
+  try {
+    owned = await deps.fetchOwned(ctx);
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    throw new AstraleError("INSTANCE_DISCOVERY_FAILED", `Could not check your Astrale instances: ${detail}`, "No instance was created. Check `astrale admin status`, then rerun `astrale setup`.");
+  }
+  const ready = owned.filter((info2) => info2.state === "ready");
+  if (ready.length === 1) {
+    await deps.adopt(ready[0]);
+    return "fixed";
+  }
+  if (ready.length > 1) {
+    const choice = await deps.selectReady(ready);
+    if (choice === null) {
+      log.dim("  Skipped — no active instance set.");
+      return "skipped";
+    }
+    await deps.adopt(choice);
+    return "fixed";
+  }
+  if (owned.length > 0) {
+    reportNotReady(owned);
+    return "skipped";
+  }
+  if (!await deps.confirmCreate()) {
+    log.dim("  Skipped — create one later: astrale instance create <slug>");
+    return "skipped";
+  }
+  const slug = await deps.promptSlug();
+  if (!slug) {
+    log.dim("  Skipped — no slug given.");
+    return "skipped";
+  }
+  const { created, selectionError } = await deps.provision(slug);
+  if (selectionError) {
+    const detail = selectionError instanceof Error ? selectionError.message : String(selectionError);
+    throw new AstraleError("INSTANCE_SELECTION_FAILED", `Instance "${slug}" was provisioned, but the CLI could not select it: ${detail}`, `Fix local CLI storage, then run \`astrale instance use ${slug}\`.`);
+  }
+  hero(slug, created.url);
+  return "fixed";
+}
+function reportNotReady(instances) {
+  log.warn(`${instances.length === 1 ? "Your instance is" : "Your instances are"} not ready; setup will not create another.`);
+  for (const info2 of instances) {
+    const phase = info2.phase && info2.phase !== info2.state ? ` (${info2.phase})` : "";
+    log.dim(`  ${info2.slug}: ${info2.state}${phase} · astrale instance status ${info2.slug}`);
+    if (info2.error)
+      log.dim(`    ${info2.error}`);
+  }
+  if (instances.some((info2) => info2.state === "failed")) {
+    log.dim("  Inspect the failure, then deliberately delete/recreate it with `astrale instance` commands.");
+  } else {
+    log.dim("  Wait for provisioning to finish, then rerun `astrale setup`.");
+  }
+}
 var instanceStep;
 var init_instance2 = __esm(() => {
   init_source();
+  init_errors3();
   init_client2();
   init_instance();
   init_local_status();
@@ -66617,38 +66687,7 @@ var init_instance2 = __esm(() => {
         log.success(`Active instance: ${instance.active} (${guiOrigin(instance.url)})`);
         return "unchanged";
       }
-      const managed = await fetchManaged(ctx);
-      if (managed.length > 0) {
-        const choice = await selectFrom("No active instance. Pick one or create a new instance:", [
-          ...managed.map((info2) => ({
-            label: `${info2.slug}  ${source_default.dim(guiOrigin(info2.url))}`,
-            value: info2
-          })),
-          { label: source_default.cyan("➕  Create a new instance"), value: "create" }
-        ]);
-        if (choice === null) {
-          log.dim("  Skipped — no active instance set.");
-          return "skipped";
-        }
-        if (choice !== "create") {
-          await adopt(choice);
-          return "fixed";
-        }
-      } else {
-        const yes = await confirmDefaultYes("No instances yet. Provision your first one now?");
-        if (!yes) {
-          log.dim("  Skipped — create one later: astrale instance create <slug>");
-          return "skipped";
-        }
-      }
-      const slug = ctx.slug ?? await promptText("Pick a slug for your instance", { validate: slugError });
-      if (!slug) {
-        log.dim("  Skipped — no slug given.");
-        return "skipped";
-      }
-      const { created } = await provisionInstance(slug, ctx.opts);
-      hero(slug, created.url);
-      return "fixed";
+      return ensureOwnedInstance(ctx);
     }
   };
 });
@@ -67027,7 +67066,7 @@ async function resolveUseTarget2(name, opts) {
     return await resolveInstance(chosen.key);
   }
   assertManagedReady(chosen.info);
-  const { repointedFrom } = await upsertManagedBookmark(chosen.key, chosen.info.slug, chosen.url);
+  const { repointedFrom } = await upsertManagedBookmark(chosen.key, chosen.info.slug, chosen.url, chosen.info.organizationId);
   if (repointedFrom) {
     log.warn(`Bookmark "${chosen.key}" repointed: ${repointedFrom} → ${chosen.url}`);
   }
@@ -67040,16 +67079,16 @@ async function fetchManagedInstances(name, opts) {
     return [];
   }
   try {
-    return await withAdminKernelClient(opts, async (ctx) => await ctx.client.call(adminInstanceMethod("list"), {}));
+    return await listOwnedInstances(opts);
   } catch {
     return [];
   }
 }
 function assertManagedReady(info2) {
-  if (!info2.state || info2.state === "ready")
+  if (info2.state === "ready")
     return;
   const detail = info2.phase && info2.phase !== info2.state ? ` (${info2.phase})` : "";
-  throw new AstraleError("INSTANCE_NOT_READY", `Instance "${info2.slug}" is ${info2.state}${detail}; it cannot be selected yet.`, info2.error ?? undefined);
+  throw new AstraleError("INSTANCE_NOT_READY", `Instance "${info2.slug}" is ${info2.state}${detail}; it cannot be selected yet.`, info2.error ?? `Run: astrale instance status ${info2.slug}`);
 }
 async function pickCandidate(name, candidates) {
   return selectFrom(`Multiple instances match "${name}":`, candidates.map((candidate) => ({
@@ -68002,8 +68041,8 @@ async function buildSelfContext(opts) {
   } else {
     const resolved = await resolveInstanceTarget(opts.instance ? { source: "name", name: opts.instance } : { source: "active" }, {
       config: config2,
-      admin: adminLookupOpts2(opts),
-      managed: (instanceSlug) => lookupManagedInstance2(instanceSlug, opts)
+      admin: {},
+      managed: (instanceSlug) => lookupImplicitOwnedInstance(instanceSlug, opts)
     });
     slug = resolved.name;
     defaultIdentity = resolved.defaultIdentity;
@@ -68034,17 +68073,6 @@ async function buildSelfContext(opts) {
   }
   return { identity: identity4, instanceSlug: slug, credsJwt: opts.creds, instanceSigned, idpSubject };
 }
-function adminLookupOpts2(opts) {
-  return {
-    as: opts.as,
-    creds: opts.creds,
-    timeout: opts.timeout,
-    debug: opts.debug
-  };
-}
-async function lookupManagedInstance2(slug, opts) {
-  return await withAdminKernelClient(adminLookupOpts2(opts), async (ctx) => await ctx.client.call(adminInstanceMethod("info"), { id: slug }));
-}
 async function withSelfHint(fn2, meta3) {
   if (!meta3)
     return fn2();
@@ -69727,67 +69755,6 @@ async function findFreePort(start, span2 = 20, host = LOOPBACK) {
 var LOOPBACK = "127.0.0.1";
 var init_port = () => {};
 
-// src/lib/view/resolve.ts
-function parseViewSpec(spec) {
-  if (VIEW_PATH_RE.test(spec))
-    return { kind: "view", path: spec };
-  if (spec.startsWith("/") || spec.startsWith("@"))
-    return { kind: "target", path: spec };
-  throw new AstraleError("INVALID_ARGUMENT", `"${spec}" is neither a ViewPath (/:origin:view.slug) nor a node path (/… or @id)`);
-}
-async function resolveViewCandidates(ctx, nodePath) {
-  const result = await ctx.client.call(VIEW_RESOLVE_PATH, { node: nodePath });
-  if (!Array.isArray(result)) {
-    throw new AstraleError("UNEXPECTED_RESULT", `View:resolve returned a non-array for ${nodePath}`);
-  }
-  return result;
-}
-function candidateSlug(candidate) {
-  const fromPath = candidate.path?.split("/").pop() ?? "";
-  return candidate.name ?? fromPath;
-}
-function pickCandidate2(candidates, nodePath, slug) {
-  if (slug) {
-    const match = candidates.find((c) => candidateSlug(c) === slug || c.path.endsWith(`/${slug}`));
-    if (!match) {
-      throw new AstraleError("VIEW_NOT_FOUND", `No view "${slug}" on ${nodePath} — available: ${candidates.map(candidateSlug).join(", ") || "(none)"}`);
-    }
-    return match;
-  }
-  if (candidates.length === 0) {
-    throw new AstraleError("VIEW_NOT_FOUND", `No views resolve on ${nodePath}`);
-  }
-  if (candidates.length === 1)
-    return candidates[0];
-  return "ambiguous";
-}
-function applyViewUrlOverride(resolvedUrl, override) {
-  const parsed = parseUrl(override);
-  if (parsed.pathname !== "/")
-    return parsed.toString();
-  const original = parseUrl(resolvedUrl);
-  return new URL(original.pathname + original.search + original.hash, parsed.origin).toString();
-}
-function rewriteLocalViewUrl(url2) {
-  const parsed = parseUrl(url2);
-  if (parsed.hostname !== "host.docker.internal")
-    return url2;
-  parsed.hostname = "127.0.0.1";
-  return parsed.toString();
-}
-function parseUrl(raw) {
-  try {
-    return new URL(raw);
-  } catch {
-    throw new AstraleError("INVALID_URL", `Not a valid URL: ${raw}`);
-  }
-}
-var VIEW_RESOLVE_PATH = "/:kernel.astrale.ai:class.View:resolve", VIEW_PATH_RE;
-var init_resolve7 = __esm(() => {
-  init_errors3();
-  VIEW_PATH_RE = /^\/:[^\s/:@]+:view\.[a-z][a-z0-9-]*$/;
-});
-
 // src/lib/view/session.ts
 import { mkdir as mkdir9, readdir as readdir2, readFile as readFile10, rm as rm2, writeFile as writeFile8 } from "node:fs/promises";
 import { join as join10 } from "node:path";
@@ -69858,11 +69825,132 @@ var init_session2 = __esm(() => {
   VIEW_DIR = join10(paths.home, "view");
 });
 
-// src/lib/view/server.ts
+// src/lib/view/port-allocation.ts
+import { join as join11 } from "node:path";
+function withViewPortAllocationLock(fn2, lockPath = VIEW_PORT_LOCK) {
+  return withFileLock(lockPath, fn2);
+}
+var VIEW_PORT_LOCK;
+var init_port_allocation = __esm(() => {
+  init_fs_atomic();
+  init_session2();
+  VIEW_PORT_LOCK = join11(VIEW_DIR, "ports.lock");
+});
+
+// src/lib/view/resolve.ts
+function parseViewSpec(spec) {
+  if (VIEW_PATH_RE.test(spec))
+    return { kind: "view", path: spec };
+  if (spec.startsWith("/") || spec.startsWith("@"))
+    return { kind: "target", path: spec };
+  throw new AstraleError("INVALID_ARGUMENT", `"${spec}" is neither a ViewPath (/:origin:view.slug) nor a node path (/… or @id)`);
+}
+async function resolveViewCandidates(ctx, nodePath) {
+  const result = await ctx.client.call(VIEW_RESOLVE_PATH, { node: nodePath });
+  if (!Array.isArray(result)) {
+    throw new AstraleError("UNEXPECTED_RESULT", `View:resolve returned a non-array for ${nodePath}`);
+  }
+  return result;
+}
+function candidateSlug(candidate) {
+  const fromPath = candidate.path?.split("/").pop() ?? "";
+  return candidate.name ?? fromPath;
+}
+function pickCandidate2(candidates, nodePath, slug) {
+  if (slug) {
+    const match = candidates.find((c) => candidateSlug(c) === slug || c.path.endsWith(`/${slug}`));
+    if (!match) {
+      throw new AstraleError("VIEW_NOT_FOUND", `No view "${slug}" on ${nodePath} — available: ${candidates.map(candidateSlug).join(", ") || "(none)"}`);
+    }
+    return match;
+  }
+  if (candidates.length === 0) {
+    throw new AstraleError("VIEW_NOT_FOUND", `No views resolve on ${nodePath}`);
+  }
+  if (candidates.length === 1)
+    return candidates[0];
+  return "ambiguous";
+}
+function applyViewUrlOverride(resolvedUrl, override) {
+  const parsed = parseUrl(override);
+  if (parsed.pathname !== "/")
+    return parsed.toString();
+  const original = parseUrl(resolvedUrl);
+  return new URL(original.pathname + original.search + original.hash, parsed.origin).toString();
+}
+function rewriteLocalViewUrl(url2) {
+  const parsed = parseUrl(url2);
+  if (parsed.hostname !== "host.docker.internal")
+    return url2;
+  parsed.hostname = "127.0.0.1";
+  return parsed.toString();
+}
+function parseUrl(raw) {
+  try {
+    return new URL(raw);
+  } catch {
+    throw new AstraleError("INVALID_URL", `Not a valid URL: ${raw}`);
+  }
+}
+var VIEW_RESOLVE_PATH = "/:kernel.astrale.ai:class.View:resolve", VIEW_PATH_RE;
+var init_resolve7 = __esm(() => {
+  init_errors3();
+  VIEW_PATH_RE = /^\/:[^\s/:@]+:view\.[a-z][a-z0-9-]*$/;
+});
+
+// src/lib/view/assets.ts
 import { existsSync as existsSync5 } from "node:fs";
+import { copyFile as copyFile2 } from "node:fs/promises";
+import { dirname as dirname8, join as join12 } from "node:path";
+import { fileURLToPath } from "node:url";
+function viewerDistDir(moduleUrl = import.meta.url, entry = process.argv[1] ?? ".") {
+  const override = process.env.ASTRALE_VIEWER_DIR;
+  if (override)
+    return override;
+  const moduleDirectory = dirname8(fileURLToPath(moduleUrl));
+  const published = join12(moduleDirectory, "..", "viewer", "dist");
+  const source = join12(moduleDirectory, "..", "..", "..", "viewer", "dist");
+  const legacy = join12(dirname8(entry), "..", "viewer", "dist");
+  const complete = [published, source, legacy].find(hasViewerBundle);
+  if (complete)
+    return complete;
+  if (hasViewerSource(join12(source, "..")))
+    return source;
+  return published;
+}
+async function ensureViewerAssets(moduleUrl = import.meta.url, entry = process.argv[1] ?? ".") {
+  const dist = viewerDistDir(moduleUrl, entry);
+  if (hasViewerBundle(dist))
+    return dist;
+  const srcDir = join12(dist, "..");
+  const bun = globalThis.Bun;
+  if (bun && hasViewerSource(srcDir)) {
+    const result = await bun.build({
+      entrypoints: [join12(srcDir, "main.ts")],
+      outdir: dist,
+      target: "browser",
+      minify: false
+    });
+    if (!result.success)
+      throw new Error(`viewer build failed: ${result.logs.join(`
+`)}`);
+    await copyFile2(join12(srcDir, "index.html"), join12(dist, "index.html"));
+    return dist;
+  }
+  throw new Error(`viewer bundle missing at ${dist} — reinstall the CLI (or run \`bun scripts/build.ts\` in a dev checkout)`);
+}
+function hasViewerBundle(directory) {
+  return existsSync5(join12(directory, "main.js")) && existsSync5(join12(directory, "index.html"));
+}
+function hasViewerSource(directory) {
+  return existsSync5(join12(directory, "main.ts")) && existsSync5(join12(directory, "index.html"));
+}
+var init_assets = () => {};
+
+// src/lib/view/server.ts
 import { readFile as readFile11 } from "node:fs/promises";
 import { createServer } from "node:http";
-import { dirname as dirname8, join as join11 } from "node:path";
+import { join as join13 } from "node:path";
 import { Readable } from "node:stream";
 function startViewServer(config2) {
   const { session, proxy } = config2;
@@ -69920,11 +70008,11 @@ function startViewServer(config2) {
       return;
     }
     if (sub === "/" || sub === "/index.html") {
-      await serveAsset(res, join11(hostDir, "index.html"), "text/html; charset=utf-8");
+      await serveAsset(res, join13(hostDir, "index.html"), "text/html; charset=utf-8");
       return;
     }
     if (sub === "/main.js") {
-      await serveAsset(res, join11(hostDir, "main.js"), "text/javascript; charset=utf-8");
+      await serveAsset(res, join13(hostDir, "main.js"), "text/javascript; charset=utf-8");
       return;
     }
     if (sub === "/config.json" && req.method === "GET") {
@@ -70009,34 +70097,6 @@ function startViewServer(config2) {
   server.listen(session.port, "127.0.0.1");
   return server;
 }
-function viewerDistDir() {
-  const override = process.env.ASTRALE_VIEWER_DIR;
-  if (override)
-    return override;
-  return join11(dirname8(process.argv[1] ?? "."), "..", "viewer", "dist");
-}
-async function ensureViewerAssets() {
-  const dist = viewerDistDir();
-  if (existsSync5(join11(dist, "main.js")) && existsSync5(join11(dist, "index.html")))
-    return dist;
-  const srcDir = join11(dist, "..");
-  const bun = globalThis.Bun;
-  if (bun && existsSync5(join11(srcDir, "main.ts"))) {
-    const result = await bun.build({
-      entrypoints: [join11(srcDir, "main.ts")],
-      outdir: dist,
-      target: "browser",
-      minify: false
-    });
-    if (!result.success)
-      throw new Error(`viewer build failed: ${result.logs.join(`
-`)}`);
-    const { copyFile: copyFile2 } = await import("node:fs/promises");
-    await copyFile2(join11(srcDir, "index.html"), join11(dist, "index.html"));
-    return dist;
-  }
-  throw new Error(`viewer bundle missing at ${dist} — reinstall the CLI (or run \`bun scripts/build.ts\` in a dev checkout)`);
-}
 function jwtExpiry(token) {
   try {
     const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
@@ -70093,7 +70153,9 @@ var TOKEN_REFRESH_MARGIN_MS, FALLBACK_TOKEN_TTL_MS = 3600000, IDLE_SWEEP_MS = 60
 var init_server = __esm(() => {
   init_kernel2();
   init_ca_fetch();
+  init_assets();
   init_session2();
+  init_assets();
   TOKEN_REFRESH_MARGIN_MS = 5 * 60000;
 });
 
@@ -70174,7 +70236,7 @@ __export(exports_view, {
 import { randomBytes } from "node:crypto";
 import { closeSync, existsSync as existsSync6, openSync, statSync } from "node:fs";
 import { mkdir as mkdir10, readdir as readdir3, readFile as readFile12, writeFile as writeFile9 } from "node:fs/promises";
-import { dirname as dirname9, join as join12 } from "node:path";
+import { dirname as dirname9, join as join14 } from "node:path";
 async function resolveSession(spec, opts) {
   const parsed = spec ? parseViewSpec(spec) : undefined;
   if (parsed?.kind === "target" && opts.target) {
@@ -70250,7 +70312,7 @@ async function resolveServeRuntime() {
   if (node2 && entry?.endsWith(".js") && existsSync6(entry))
     return { file: node2, args: [entry] };
   if (node2 && entry?.endsWith(".ts")) {
-    const dist = join12(dirname9(entry), "..", "dist", "astrale.js");
+    const dist = join14(dirname9(entry), "..", "dist", "astrale.js");
     await ensureDevDist(entry, dist);
     if (existsSync6(dist))
       return { file: node2, args: [dist] };
@@ -70268,7 +70330,7 @@ async function ensureDevDist(entry, dist) {
   const bun = globalThis.Bun;
   if (!bun)
     return;
-  const srcDir = join12(dirname9(entry), "..", "src");
+  const srcDir = join14(dirname9(entry), "..", "src");
   if (existsSync6(dist) && !await newerThan(srcDir, statSync(dist).mtimeMs))
     return;
   console.error("(dev) building dist/astrale.js for the session server…");
@@ -70284,7 +70346,7 @@ async function newerThan(dir, mtimeMs) {
   for (const item of entries) {
     if (!item.isFile())
       continue;
-    if (statSync(join12(item.parentPath, item.name)).mtimeMs > mtimeMs)
+    if (statSync(join14(item.parentPath, item.name)).mtimeMs > mtimeMs)
       return true;
   }
   return false;
@@ -70293,11 +70355,18 @@ async function startSession(view, target, opts) {
   await ensureViewerAssets();
   const config2 = await readConfig();
   const kernelTarget = await resolveKernelTarget(opts, config2);
+  const [instances, identities, runtime] = await Promise.all([
+    readInstances(),
+    readIdentities(),
+    resolveServeRuntime()
+  ]);
+  return withViewPortAllocationLock(() => startSessionLocked(view, target, opts, kernelTarget, instances.active, identities.default, runtime));
+}
+async function startSessionLocked(view, target, opts, kernelTarget, activeInstance, defaultIdentity, runtime) {
   const port = await findFreePort(VIEW_PORT_BASE, VIEW_PORT_SPAN);
   if (port === null) {
-    fatal(new Error(`No free port in ${VIEW_PORT_BASE}-${VIEW_PORT_BASE + VIEW_PORT_SPAN - 1} — close sessions with \`astrale view --close --all\``));
+    throw new Error(`No free port in ${VIEW_PORT_BASE}-${VIEW_PORT_BASE + VIEW_PORT_SPAN - 1} — close sessions with \`astrale view --close --all\``);
   }
-  const [instances, identities] = await Promise.all([readInstances(), readIdentities()]);
   const id = `v-${randomBytes(3).toString("hex")}`;
   const nonce = randomBytes(12).toString("hex");
   const record2 = {
@@ -70308,8 +70377,8 @@ async function startSession(view, target, opts) {
     pageUrl: `http://127.0.0.1:${port}/s/${nonce}/`,
     view,
     target,
-    instance: opts.instance ?? (opts.url ? opts.url : instances.active),
-    identity: opts.creds ? "(pre-signed creds)" : opts.as ?? identities.default,
+    instance: opts.instance ?? (opts.url ? opts.url : activeInstance),
+    identity: opts.creds ? "(pre-signed creds)" : opts.as ?? defaultIdentity,
     createdAt: new Date().toISOString()
   };
   const serveConfig = {
@@ -70331,7 +70400,6 @@ async function startSession(view, target, opts) {
   await mkdir10(VIEW_DIR, { recursive: true });
   await writeFile9(configPath(id), JSON.stringify(serveConfig, null, 2));
   const logFd = openSync(logPath(id), "a");
-  const runtime = await resolveServeRuntime();
   const child = spawnHandle(runtime.file, [...runtime.args, "__view-serve", "--config", configPath(id)], {
     detached: true,
     stdio: ["ignore", logFd, logFd]
@@ -70339,7 +70407,7 @@ async function startSession(view, target, opts) {
   child.unref();
   closeSync(logFd);
   if (!child.pid)
-    fatal(new Error("Failed to spawn the view session server"));
+    throw new Error("Failed to spawn the view session server");
   const live = { ...record2, pid: child.pid };
   await saveRecord(live);
   const deadline = Date.now() + READY_TIMEOUT_MS;
@@ -70355,9 +70423,9 @@ async function startSession(view, target, opts) {
   }
   const tail = await readFile12(logPath(id), "utf8").catch(() => "");
   await closeSession(live);
-  return fatal(new Error(`View session server did not come up.${tail ? `
+  throw new Error(`View session server did not come up.${tail ? `
 --- server log ---
-${tail.slice(-2000)}` : ""}`));
+${tail.slice(-2000)}` : ""}`);
 }
 async function waitForPageState(record2) {
   const deadline = Date.now() + STATE_TIMEOUT_MS;
@@ -70502,6 +70570,7 @@ var init_view4 = __esm(() => {
   init_output();
   init_port();
   init_proc();
+  init_port_allocation();
   init_resolve7();
   init_server();
   init_session2();
@@ -70886,28 +70955,28 @@ __export(exports_studio, {
   default: () => studio_default
 });
 import { existsSync as existsSync8, realpathSync } from "node:fs";
-import { dirname as dirname10, join as join13, resolve } from "node:path";
+import { dirname as dirname10, join as join15, resolve } from "node:path";
 function resolveStudioDir() {
   const candidates = [];
   if (process.env.ASTRALE_STUDIO_DIR)
     candidates.push(process.env.ASTRALE_STUDIO_DIR);
   try {
     const entryDir = dirname10(realpathSync(process.argv[1] ?? ""));
-    candidates.push(join13(entryDir, "..", "studio"), join13(entryDir, "studio"));
+    candidates.push(join15(entryDir, "..", "studio"), join15(entryDir, "studio"));
   } catch {}
   for (const c of candidates) {
-    if (existsSync8(join13(c, "server", "index.ts")))
+    if (existsSync8(join15(c, "server", "index.ts")))
       return resolve(c);
   }
   throw new Error(`Domain Studio assets not found (looked in: ${candidates.join(", ") || "<none>"}). ` + `Reinstall the astrale CLI, or set ASTRALE_STUDIO_DIR to a studio checkout.`);
 }
 function isDevSource(studioDir) {
-  return existsSync8(join13(studioDir, "vite.config.ts")) && existsSync8(join13(studioDir, "client", "src"));
+  return existsSync8(join15(studioDir, "vite.config.ts")) && existsSync8(join15(studioDir, "client", "src"));
 }
 function resolveViteBin(studioDir) {
   for (const c of [
-    join13(studioDir, "node_modules", ".bin", "vite"),
-    join13(studioDir, "..", "..", "node_modules", ".bin", "vite")
+    join15(studioDir, "node_modules", ".bin", "vite"),
+    join15(studioDir, "..", "..", "node_modules", ".bin", "vite")
   ]) {
     if (existsSync8(c))
       return c;
@@ -70982,6 +71051,11 @@ var init_studio = __esm(() => {
       },
       { flags: "--prod", description: "Serve the prebuilt client (the default)" },
       { flags: "--schema-dir <dir>", description: "Schema entry dir to scan for (default: schema)" },
+      {
+        flags: "--harness <name>",
+        description: "Lock the agent harness for this Studio process",
+        choices: ["claude", "codex"]
+      },
       ...RAW_OUTPUT_OPTIONS
     ],
     afterHelpText: `
@@ -71005,6 +71079,10 @@ Behavior:
   By default the command just PRINTS the URL — it does not pop a browser (that's
   invasive when you already have a tab open). Pass --open to launch one.
 
+  Agent harness: choose Claude Code or Codex per domain in Studio Settings. Pass
+  --harness claude|codex to lock this process to one harness. Each harness uses
+  its existing local authentication and keeps an independent resumable session.
+
   The command stays attached and supervises its child processes; Ctrl-C tears
   them all down (a second Ctrl-C force-kills). With --json it prints a
   { url, port, mode, workspace } descriptor.
@@ -71013,6 +71091,7 @@ Examples:
   $ astrale studio                 # start the studio + print its URL (no browser)
   $ astrale studio --open          # …and open it in a browser
   $ astrale studio ./my-domain
+  $ astrale studio --harness codex
   $ astrale studio --port 4400
   $ astrale studio --dev           # live-edit the studio itself (from source)
 `,
@@ -71115,12 +71194,13 @@ Examples:
               DOMAIN_STUDIO_DEV: "1",
               VITE_URL: `http://127.0.0.1:${vitePort}`,
               PORT: String(studioPort),
-              DOMAIN_STUDIO_HOST: "127.0.0.1"
+              DOMAIN_STUDIO_HOST: "127.0.0.1",
+              ...opts.harness ? { DOMAIN_STUDIO_HARNESS: opts.harness } : {}
             }
           }), "server");
         } else {
-          const dist = join13(studioDir, "client", "dist");
-          if (!existsSync8(join13(dist, "index.html"))) {
+          const dist = join15(studioDir, "client", "dist");
+          if (!existsSync8(join15(dist, "index.html"))) {
             throw new Error(`studio client not built at ${dist} — run: pnpm --filter @astrale-os/studio build`);
           }
           serverChild = supervise(spawnHandle("bun", ["server/index.ts", workspace, "--port", String(studioPort), "--no-open"], {
@@ -71130,7 +71210,8 @@ Examples:
               ...process.env,
               DOMAIN_STUDIO_DIST: dist,
               PORT: String(studioPort),
-              DOMAIN_STUDIO_HOST: "127.0.0.1"
+              DOMAIN_STUDIO_HOST: "127.0.0.1",
+              ...opts.harness ? { DOMAIN_STUDIO_HARNESS: opts.harness } : {}
             }
           }), "server");
         }
@@ -71242,7 +71323,7 @@ var init_list = __esm(() => {
         }));
         let managed = [];
         if (!opts.bookmarked) {
-          managed = await withSpinner("Fetching instances", !isMachine(opts), () => withAdminKernelClient(opts, async (ctx) => await ctx.client.call(adminInstanceMethod("list"), {})));
+          managed = await withSpinner("Fetching instances", !isMachine(opts), () => listOwnedInstances(opts));
         }
         if (isMachine(opts)) {
           output({
@@ -71499,6 +71580,7 @@ __export(exports_status2, {
 var status_default2;
 var init_status2 = __esm(() => {
   init_source();
+  init_errors3();
   init_client2();
   init_admin_target();
   init_log();
@@ -71510,20 +71592,26 @@ var init_status2 = __esm(() => {
     options: [...ADMIN_TARGET_OPTIONS],
     action: async (id, opts) => {
       try {
-        const result = await withSpinner(`Fetching instance ${id}`, !isMachine(opts), () => withAdminKernelClient(opts, async (ctx) => await ctx.client.call(adminInstanceMethod("info"), { id })));
+        const result = await withSpinner(`Fetching instance ${id}`, !isMachine(opts), () => listOwnedInstances(opts).then((instances) => {
+          const match = findOwnedInstance(instances, id);
+          if (match)
+            return match;
+          throw new AstraleError("INSTANCE_NOT_FOUND", `No owned instance matches "${id}".`, "Run `astrale instance list` to see your instances.");
+        }));
         if (isMachine(opts)) {
           output(result, opts);
           return;
         }
         console.log(`${source_default.bold(result.slug)} ${source_default.dim(result.url)}`);
-        if (result.state)
-          log.dim(`  state: ${result.state}${result.phase ? ` (${result.phase})` : ""}`);
+        log.dim(`  state: ${result.state}${result.phase ? ` (${result.phase})` : ""}`);
         if (result.error)
           log.dim(`  error: ${result.error}`);
         if (result.region)
           log.dim(`  region: ${result.region}`);
         if (result.hostId)
           log.dim(`  host: ${result.hostId}`);
+        if (result.organizationId)
+          log.dim(`  organization: ${result.organizationId}`);
         if (result.createdAt)
           log.dim(`  created: ${result.createdAt}`);
       } catch (e) {
@@ -71548,7 +71636,9 @@ async function resolveActiveForDisplay() {
     };
   }
   try {
-    const managed = await withAdminKernelClient({}, async (ctx) => await ctx.client.call(adminInstanceMethod("info"), { id: active.name }));
+    const managed = findOwnedInstance(await listOwnedInstances({}), active.name);
+    if (!managed)
+      return { name: active.name };
     return {
       name: managed.slug,
       url: normalizeInstanceKernelUrl(managed.url),
@@ -71834,7 +71924,7 @@ async function installViaAdmin(target, opts) {
   const adminOpts = { ...opts, instance: undefined };
   try {
     await withAdminKernelClient(adminOpts, async (ctx) => {
-      const instances = await ctx.client.call(adminInstanceMethod("list"), {});
+      const instances = await callOwnedInstances(ctx.client);
       const ref2 = await resolveDomainRef(ctx, target, interactive);
       const slug = await resolveTargetSlug(opts, target, interactive, instances);
       const match = instances.find((i) => i.slug === slug);
@@ -71842,6 +71932,7 @@ async function installViaAdmin(target, opts) {
         const known = instances.map((i) => i.slug).join(", ") || "(none)";
         throw new AstraleError("INSTANCE_NOT_MANAGED", `Instance "${slug}" is not admin-managed (managed: ${known}).`, `Install the url directly onto it instead: astrale domain install <url> --direct -i ${slug}`);
       }
+      assertInstallTargetReady(match);
       const label = ref2.origin ?? ref2.url ?? "domain";
       const result = await withSpinner(`Installing ${label} on ${match.slug}`, !isMachine(opts), () => ctx.client.call(adminDomainMethod("install"), {
         instanceId: match.slug,
@@ -71858,9 +71949,15 @@ async function installViaAdmin(target, opts) {
       log.dim(`  url:    ${result.url}`);
     });
   } catch (e) {
-    fatal(e);
+    fatal(e, opts);
   }
 }
+function assertInstallTargetReady(instance) {
+  if (instance.state === "ready")
+    return;
+  const detail = instance.phase && instance.phase !== instance.state ? ` (${instance.phase})` : "";
+  throw new AstraleError("INSTANCE_NOT_READY", `Instance "${instance.slug}" is ${instance.state}${detail}; domains cannot be installed yet.`, instance.error ?? `Run: astrale instance status ${instance.slug}`);
+}
 function domainRefFromTarget(target) {
   return isHttpUrl(target) ? { url: target } : { origin: target };
 }
@@ -72959,21 +73056,21 @@ var init_status4 = __esm(() => {
 
 // src/telemetry/store.ts
 import { existsSync as existsSync9, readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 function sessionsRoot() {
-  return join14(createPaths().home, "sessions");
+  return join16(createPaths().home, "sessions");
 }
 function sessionDir(id) {
-  return join14(sessionsRoot(), id);
+  return join16(sessionsRoot(), id);
 }
 function eventsPath(id) {
-  return join14(sessionDir(id), "events.jsonl");
+  return join16(sessionDir(id), "events.jsonl");
 }
 function metaPath(id) {
-  return join14(sessionDir(id), "meta.json");
+  return join16(sessionDir(id), "meta.json");
 }
 function markerPath(id) {
-  return join14(sessionDir(id), ".analyzed");
+  return join16(sessionDir(id), ".analyzed");
 }
 function readJsonSafe(path4) {
   try {
@@ -73051,12 +73148,12 @@ var init_list4 = __esm(() => {
 // src/telemetry/adapters/claude-code.ts
 import { existsSync as existsSync10, readdirSync as readdirSync3, statSync as statSync3 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join17 } from "node:path";
 function mungeCwd(cwd) {
   return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
-function claudeCodeAdapter(base2 = join15(homedir3(), ".claude")) {
-  const projectsDir = join15(base2, "projects");
+function claudeCodeAdapter(base2 = join17(homedir3(), ".claude")) {
+  const projectsDir = join17(base2, "projects");
   function detect2() {
     try {
       return existsSync10(projectsDir);
@@ -73080,7 +73177,7 @@ function claudeCodeAdapter(base2 = join15(homedir3(), ".claude")) {
       for (const dir of dirs) {
         if (dir !== munged && !dir.startsWith(prefix))
           continue;
-        const projectPath = join15(projectsDir, dir);
+        const projectPath = join17(projectsDir, dir);
         let files;
         try {
           files = readdirSync3(projectPath);
@@ -73090,7 +73187,7 @@ function claudeCodeAdapter(base2 = join15(homedir3(), ".claude")) {
         for (const file2 of files) {
           if (!file2.endsWith(".jsonl"))
             continue;
-          const transcriptPath = join15(projectPath, file2);
+          const transcriptPath = join17(projectPath, file2);
           try {
             const st = statSync3(transcriptPath);
             const mtimeMs = st.mtime.getTime();
@@ -73126,7 +73223,7 @@ var init_claude_code = __esm(() => {
 import { existsSync as existsSync11, openSync as openSync2, readdirSync as readdirSync4, readSync, statSync as statSync4 } from "node:fs";
 import { closeSync as closeSync2 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 function readFirstLine(path4) {
   let fd = null;
   try {
@@ -73166,8 +73263,8 @@ function numericDirs(path4) {
     return [];
   }
 }
-function codexAdapter(base2 = join16(homedir4(), ".codex")) {
-  const sessionsDir = join16(base2, "sessions");
+function codexAdapter(base2 = join18(homedir4(), ".codex")) {
+  const sessionsDir = join18(base2, "sessions");
   function detect2() {
     try {
       return existsSync11(sessionsDir);
@@ -73182,12 +73279,12 @@ function codexAdapter(base2 = join16(homedir4(), ".codex")) {
       const endMs = window2.end.getTime();
       const lowerMs = startMs - DAY_MS;
       for (const yyyy of numericDirs(sessionsDir)) {
-        for (const mm of numericDirs(join16(sessionsDir, yyyy))) {
-          for (const dd of numericDirs(join16(sessionsDir, yyyy, mm))) {
+        for (const mm of numericDirs(join18(sessionsDir, yyyy))) {
+          for (const dd of numericDirs(join18(sessionsDir, yyyy, mm))) {
             const dayStart = Date.UTC(Number(yyyy), Number(mm) - 1, Number(dd));
             if (dayStart > endMs + DAY_MS || dayStart + DAY_MS <= lowerMs)
               continue;
-            scanDay(join16(sessionsDir, yyyy, mm, dd), root, startMs, endMs, sessions);
+            scanDay(join18(sessionsDir, yyyy, mm, dd), root, startMs, endMs, sessions);
           }
         }
       }
@@ -73209,7 +73306,7 @@ function scanDay(dayPath, root, startMs, endMs, out) {
   for (const file2 of files) {
     if (!file2.startsWith("rollout-") || !file2.endsWith(".jsonl"))
       continue;
-    const transcriptPath = join16(dayPath, file2);
+    const transcriptPath = join18(dayPath, file2);
     try {
       const st = statSync4(transcriptPath);
       const mtimeMs = st.mtime.getTime();
@@ -73356,7 +73453,7 @@ var init_gate = () => {};
 // src/telemetry/analyze.ts
 import { spawn as spawn3 } from "node:child_process";
 import { appendFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join19 } from "node:path";
 function writeMarker(id, marker) {
   writeFileSync2(markerPath(id), JSON.stringify(marker, null, 2) + `
 `);
@@ -73452,7 +73549,7 @@ async function analyzeSession(id, opts = {}) {
   const guides = new Map(adapters.map((a) => [a.name, a.readingGuide]));
   const prompt = buildPrompt({ id, root, signals: signals2, guides, file: opts.file ?? false });
   const dir = sessionDir(id);
-  writeFileSync2(join17(dir, "analyzer-prompt.md"), prompt);
+  writeFileSync2(join19(dir, "analyzer-prompt.md"), prompt);
   const outcome = await runClaude(prompt, dir, opts);
   const marker = {
     analyzedAt: new Date().toISOString(),
@@ -73460,7 +73557,7 @@ async function analyzeSession(id, opts = {}) {
     note: outcome.note
   };
   writeMarker(id, marker);
-  return { ...marker, reportPath: join17(dir, "report.md") };
+  return { ...marker, reportPath: join19(dir, "report.md") };
 }
 function runClaude(prompt, cwd, opts) {
   return new Promise((resolve2) => {
@@ -73490,7 +73587,7 @@ function runClaude(prompt, cwd, opts) {
     child.on("close", (code) => {
       clearTimeout(timer);
       try {
-        appendFileSync(join17(cwd, "analyzer.log"), out + (err ? `
+        appendFileSync(join19(cwd, "analyzer.log"), out + (err ? `
 --- stderr ---
 ${err}` : ""));
       } catch {}
@@ -73540,9 +73637,9 @@ var init_settings = __esm(() => {
 
 // src/telemetry/trigger.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync2, readFileSync as readFileSync6, rmSync as rmSync2, unlinkSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join20 } from "node:path";
 function lockPath() {
-  return join18(sessionsRoot(), ".analyzer.lock");
+  return join20(sessionsRoot(), ".analyzer.lock");
 }
 function releaseLock() {
   try {
@@ -74301,12 +74398,12 @@ function redactArgv(argv) {
 init_store2();
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync13, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname12, join as join19 } from "node:path";
+import { dirname as dirname12, join as join21 } from "node:path";
 var MAX_ID_LEN = 64;
 function findGitRoot(start) {
   let dir = start;
   for (;; ) {
-    if (existsSync13(join19(dir, ".git")))
+    if (existsSync13(join21(dir, ".git")))
       return dir;
     const parent = dirname12(dir);
     if (parent === dir)
@@ -74407,7 +74504,7 @@ init_settings();
 init_store2();
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync14, mkdirSync as mkdirSync4, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 var LOCK_STALE_MS2 = 30 * 60 * 1000;
 var GC_AGE_MS2 = 30 * 24 * 60 * 60 * 1000;
 var GC_MAX_PER_RUN = 20;
@@ -74426,7 +74523,7 @@ function gcOldSessions(sessions) {
   } catch {}
 }
 function lockPath2() {
-  return join20(sessionsRoot(), ".analyzer.lock");
+  return join22(sessionsRoot(), ".analyzer.lock");
 }
 function claimLock() {
   const path4 = lockPath2();