@catalyst-cloud/cli 0.14.4 → 0.14.5

package/dist/onboard-runtime.js

@@ -11,6 +11,8 @@ import { boundedOnboardSignin } from "./onboard-signin.js";
 import { existingLinearAdapters } from "./onboard-existing.js";
 import { linearWorkspaceAdapter } from "./onboard-workspace.js";
 import { existingRepositoryAdapter } from "./onboard-repositories.js";
+import { githubInstallationAdapter } from "./onboard-github.js";
+import { guardOnboardCapabilities, } from "./onboard-capabilities.js";
 import { fetchMe } from "./transport.js";
 const waiting = (reason) => ({
     state: "waiting",
@@ -67,10 +69,6 @@ export function createOnboardRuntime(args, ctx, hooks) {
             evidence: { found, remaining: found },
         };
     };
-    const unsupported = {
-        check: async () => waiting("cloud_capability_unavailable"),
-        act: async () => waiting("cloud_capability_unavailable"),
-    };
     const personalAdapter = (provider) => personalConsentAdapter({
         provider,
         openBrowser: hooks.openBrowser ?? openBrowser,
@@ -82,102 +80,174 @@ export function createOnboardRuntime(args, ctx, hooks) {
     const linear = existingLinearAdapters(args, hooks.ui?.chooseTeam
         ? (teams) => hooks.ui.chooseTeam(teams.map((team) => ({ ...team })))
         : undefined);
-    return {
-        identity: (journal) => identity(ctx, journal),
-        bindSignals: true,
-        ui: hooks.ui,
-        adapters: {
-            machine: {
-                check: async () => process.platform === "darwin" || process.platform === "linux"
-                    ? { state: "done", evidence: { provider: process.platform } }
-                    : waiting("machine_platform_unsupported"),
+    const adapters = {
+        machine: {
+            check: async () => process.platform === "darwin" || process.platform === "linux"
+                ? { state: "done", evidence: { provider: process.platform } }
+                : waiting("machine_platform_unsupported"),
+        },
+        cli: {
+            check: async () => ({
+                state: "done",
+                evidence: { version: readManifest().version },
+            }),
+        },
+        skills: {
+            check: async (stepCtx) => {
+                const cfg = loadConfig(stepCtx.home);
+                const dir = stepCtx.env.CATALYST_SKILLS_DIR ??
+                    cfg?.skillsDir ??
+                    defaultSkillsDirFor(stepCtx.home);
+                const names = hooks.skillNames ?? [];
+                const count = names.filter((name) => existsSync(join(dir, name, "SKILL.md"))).length;
+                return names.length > 0 && count === names.length
+                    ? { state: "done", evidence: { count, path: dir } }
+                    : waiting("skills_install_unverified");
             },
-            cli: {
-                check: async () => ({
-                    state: "done",
-                    evidence: { version: readManifest().version },
-                }),
+        },
+        legacy: {
+            check: legacyCheck,
+            act: async (stepCtx) => {
+                const before = await legacyCheck(stepCtx);
+                if (before.state !== "pending")
+                    return before;
+                // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
+                const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
+                const code = await cmdLegacy({
+                    ...args,
+                    command: "legacy",
+                    subcommand: null,
+                    rest: [],
+                    flags: { remove: true, yes: true },
+                    json: false,
+                }, quiet, hooks.legacy);
+                return code === 0
+                    ? legacyCheck(stepCtx)
+                    : { state: "failed", reason: "legacy_cleanup_failed" };
             },
-            skills: {
-                check: async (stepCtx) => {
-                    const cfg = loadConfig(stepCtx.home);
-                    const dir = stepCtx.env.CATALYST_SKILLS_DIR ??
-                        cfg?.skillsDir ??
-                        defaultSkillsDirFor(stepCtx.home);
-                    const names = hooks.skillNames ?? [];
-                    const count = names.filter((name) => existsSync(join(dir, name, "SKILL.md"))).length;
-                    return names.length > 0 && count === names.length
-                        ? { state: "done", evidence: { count, path: dir } }
-                        : waiting("skills_install_unverified");
-                },
+        },
+        signin: {
+            check: async (stepCtx, journal) => {
+                const who = await identity(stepCtx, journal);
+                return who
+                    ? {
+                        state: "done",
+                        evidence: {
+                            account: who.account,
+                            membershipId: who.membershipId,
+                            role: who.role,
+                        },
+                    }
+                    : { state: "pending" };
             },
-            legacy: {
-                check: legacyCheck,
-                act: async (stepCtx) => {
-                    const before = await legacyCheck(stepCtx);
-                    if (before.state !== "pending")
-                        return before;
-                    // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
-                    const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
-                    const code = await cmdLegacy({
-                        ...args,
-                        command: "legacy",
-                        subcommand: null,
-                        rest: [],
-                        flags: { remove: true, yes: true },
-                        json: false,
-                    }, quiet, hooks.legacy);
-                    return code === 0
-                        ? legacyCheck(stepCtx)
-                        : { state: "failed", reason: "legacy_cleanup_failed" };
-                },
+            act: async (stepCtx, _journal, signal) => {
+                return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
             },
-            signin: {
-                check: async (stepCtx, journal) => {
-                    const who = await identity(stepCtx, journal);
-                    return who
-                        ? {
-                            state: "done",
-                            evidence: {
-                                account: who.account,
-                                membershipId: who.membershipId,
-                                role: who.role,
-                            },
-                        }
-                        : { state: "pending" };
-                },
-                act: async (stepCtx, _journal, signal) => {
-                    return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
+        },
+        ...linear,
+        "linear.workspace": linearWorkspaceAdapter({
+            fallback: linear["linear.workspace"],
+            openBrowser: hooks.openBrowser ?? openBrowser,
+            wait: hooks.ui
+                ? (message, work) => hooks.ui.wait(message, work)
+                : undefined,
+            sleep: hooks.sleep,
+        }),
+        "github.install": githubInstallationAdapter({
+            openBrowser: hooks.openBrowser ?? openBrowser,
+            wait: hooks.ui
+                ? (message, work) => hooks.ui.wait(message, work)
+                : undefined,
+            sleep: hooks.sleep,
+        }),
+        "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
+            ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
+            : undefined),
+        "linear.personal": personalAdapter("linear"),
+        "github.personal": personalAdapter("github"),
+        daemon: {
+            check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true)
+                ? waiting("local_sync_capability_unavailable")
+                : {
+                    state: "skipped",
+                    reason: "local_sync_not_selected",
+                    evidence: { provider: "cloud" },
                 },
-            },
-            ...linear,
-            "linear.workspace": linearWorkspaceAdapter({
-                fallback: linear["linear.workspace"],
-                openBrowser: hooks.openBrowser ?? openBrowser,
-                wait: hooks.ui
-                    ? (message, work) => hooks.ui.wait(message, work)
-                    : undefined,
-                sleep: hooks.sleep,
-            }),
-            "github.install": unsupported,
-            "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
-                ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
-                : undefined),
-            "linear.personal": personalAdapter("linear"),
-            "github.personal": personalAdapter("github"),
-            daemon: {
-                check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true)
-                    ? waiting("local_sync_capability_unavailable")
-                    : {
-                        state: "skipped",
-                        reason: "local_sync_not_selected",
-                        evidence: { provider: "cloud" },
-                    },
-            },
-            housekeeping: {
-                check: async () => waiting("housekeeping_service_unverified"),
-            },
-            ready: { check: hooks.ready },
         },
+        housekeeping: {
+            check: async () => waiting("housekeeping_service_unverified"),
+        },
+        ready: { check: hooks.ready },
+    };
+    const get = (path) => ({ method: "GET", path });
+    const capabilities = {
+        "linear.workspace": {
+            check: [get("/api/v1/me/connections/linear/workspace")],
+            act: [
+                get("/api/v1/me/connections/linear/workspace"),
+                get("/api/v1/me/connections/linear/workspace/start"),
+            ],
+            fallback: "connections",
+        },
+        "linear.personal": {
+            check: [get("/api/v1/me/connections/linear/personal")],
+            act: [
+                get("/api/v1/me/connections/linear/personal"),
+                get("/connect/linear/personal/start"),
+            ],
+            fallback: "personalConnections",
+        },
+        "github.install": {
+            check: [get("/api/v1/me/connections/github/workspace")],
+            act: [
+                get("/api/v1/me/connections/github/workspace"),
+                get("/api/v1/me/connections/github/workspace/start"),
+            ],
+            fallback: "connections",
+        },
+        "github.personal": {
+            check: [get("/api/v1/me/connections/github/personal")],
+            act: [
+                get("/api/v1/me/connections/github/personal"),
+                get("/connect/github/personal/start"),
+            ],
+            fallback: "personalConnections",
+        },
+        "linear.team": {
+            check: [
+                get("/api/v1/agent/teams"),
+                get("/api/v1/agent/tenant/readiness"),
+            ],
+            fallback: "connections",
+        },
+        "linear.automations": {
+            check: [get("/api/v1/agent/tenant/readiness")],
+            fallback: "connections",
+        },
+        "github.repos": {
+            check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
+            fallback: "connections",
+        },
+        ready: {
+            check: [get("/api/v1/agent/contract")],
+            fallback: "connections",
+        },
+    };
+    for (const [id, options] of Object.entries(capabilities)) {
+        const step = id;
+        const adapter = adapters[step];
+        if (adapter)
+            adapters[step] = guardOnboardCapabilities(adapter, {
+                ...options,
+                message: (text) => hooks.ui ? hooks.ui.message(text) : ctx.stderr(text),
+            });
+    }
+    // Public auth discovery and the existing /me sign-in bootstrap establish identity before the
+    // tenant-bound step guards can run. Unsupported/local-only steps make no endpoint requests.
+    return {
+        identity: (journal) => identity(ctx, journal),
+        bindSignals: true,
+        ui: hooks.ui,
+        adapters,
     };
 }

package/dist/onboard-ui.js

@@ -141,7 +141,19 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
                 personal_login_refresh_required: "Renew your login with catalyst login, then run catalyst onboard to resume.",
                 personal_status_unavailable: "Your personal connection could not be checked. Run catalyst onboard to try again.",
                 personal_browser_unavailable: "The browser could not open. Run catalyst onboard to try again.",
-                cloud_capability_unavailable: "Your cloud does not support this setup step yet.",
+                cloud_capability_unavailable: "This setup step is not available on this server yet. Use the web app link shown above, then resume after the server update.",
+                onboarding_capability_unavailable: "The server's setup capabilities could not be checked. Run catalyst onboard to try again.",
+                onboarding_capability_identity_unverified: "The server's setup capabilities belong to another login or workspace. Sign in to the original workspace to resume.",
+                onboarding_capability_login_refresh_required: "Your login needs a refresh before setup capabilities can be checked. Run catalyst login, then catalyst onboard.",
+                workspace_consent_refused: "The server did not accept this login for Linear workspace setup. Sign in again or ask your workspace administrator.",
+                github_installation_status_unavailable: "Your GitHub App installation could not be checked. Run catalyst onboard to try again.",
+                github_installation_status_shape: "The server returned a GitHub installation result that could not be verified.",
+                github_installation_consent_handoff: "The GitHub installation approval link could not be verified. Run catalyst onboard to try again.",
+                github_installation_consent_refused: "The server did not accept this login for GitHub App setup. Sign in again or ask your workspace administrator.",
+                github_installation_identity_refused: "GitHub setup belongs to another login or workspace. Sign in to the original workspace to resume.",
+                github_installation_admin_required: "A workspace owner or administrator approves the GitHub App installation.",
+                github_installation_login_refresh_required: "Your login needs a refresh. Run catalyst onboard to resume.",
+                github_installation_browser_unavailable: "The GitHub App approval page could not be opened. Use your workspace's Connections page, then resume.",
                 step_not_available_in_this_release: "This setup step is not available yet.",
                 prerequisite_not_ready: "Waiting for an earlier setup step.",
                 local_sync_not_selected: "Using cloud reads. Local sync was not selected.",

package/dist/onboard-workspace.js

@@ -3,49 +3,90 @@ import { pollConsent } from "./onboard-consent.js";
 const STATUS = "/api/v1/me/connections/linear/workspace";
 const HANDOFF = "/connect/linear/workspace/handoff";
 const idPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
-const states = new Set(["connected", "missing-scope", "expired-or-revoked", "unreachable", "not-connected"]);
-const warmth = new Set(["warm", "absent", "expired", "renewal-due", "no-expiry", "unavailable"]);
-const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : null;
-const waiting = (reason) => ({ state: "waiting", reason });
+const states = new Set([
+    "connected",
+    "missing-scope",
+    "expired-or-revoked",
+    "unreachable",
+    "not-connected",
+]);
+const warmth = new Set([
+    "warm",
+    "absent",
+    "expired",
+    "renewal-due",
+    "no-expiry",
+    "unavailable",
+]);
+const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v)
+    ? v
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
 const nullableText = (v) => v === null || typeof v === "string";
-const nullableTime = (v) => v === null || typeof v === "number" && Number.isFinite(v) && v >= 0;
+const nullableTime = (v) => v === null || (typeof v === "number" && Number.isFinite(v) && v >= 0);
 /** A bounded read never rotates credentials or writes a token after the receipt lock is released. */
 async function read(ctx, journal, path, timeoutMs, external) {
     const cfg = loadConfig(ctx.home);
     if (!cfg?.user)
         return { reason: "personal_login_required" };
-    if ((journal.account ?? journal.tenant) && (journal.account ?? journal.tenant) !== cfg.account ||
-        journal.membershipId && journal.membershipId !== cfg.user.id ||
-        journal.baseUrl && normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+    if (((journal.account ?? journal.tenant) &&
+        (journal.account ?? journal.tenant) !== cfg.account) ||
+        (journal.membershipId && journal.membershipId !== cfg.user.id) ||
+        (journal.baseUrl &&
+            normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl)))
         return { reason: "workspace_identity_refused" };
-    const expiry = cfg.auth ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime() : 0;
-    const bearer = cfg.key || (cfg.auth && Number.isFinite(expiry) && expiry > 30_000 ? cfg.auth.accessToken : undefined);
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
     if (!bearer)
         return { reason: "workspace_login_refresh_required" };
     const deadline = new AbortController();
     const timer = setTimeout(() => deadline.abort(), timeoutMs);
-    const signal = external ? AbortSignal.any([external, deadline.signal]) : deadline.signal;
+    const signal = external
+        ? AbortSignal.any([external, deadline.signal])
+        : deadline.signal;
     let remove = () => { };
     try {
-        return await new Promise(resolve => {
-            const stopped = () => resolve({ reason: external?.aborted ? "interrupted" : "workspace_status_unavailable" });
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "workspace_status_unavailable",
+            });
             if (signal.aborted) {
                 stopped();
                 return;
             }
             signal.addEventListener("abort", stopped, { once: true });
             remove = () => signal.removeEventListener("abort", stopped);
-            Promise.resolve().then(async () => {
+            Promise.resolve()
+                .then(async () => {
                 if (signal.aborted)
                     return { reason: "interrupted" };
                 const response = await ctx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}${path}`, {
-                    method: "GET", redirect: "error", headers: { authorization: `Bearer ${bearer}`, accept: "application/json" }, signal,
+                    method: "GET",
+                    redirect: "error",
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                    },
+                    signal,
                 });
                 // Refusal bodies and provider diagnostics are never parsed, returned or printed.
                 if (response.status !== 200)
                     return { status: response.status };
-                return { status: 200, body: await response.json() };
-            }).then(value => signal.aborted ? stopped() : resolve(value), () => signal.aborted ? stopped() : resolve({ reason: "workspace_status_unavailable" }));
+                return { status: 200, body: (await response.json()) };
+            })
+                .then((value) => (signal.aborted ? stopped() : resolve(value)), () => signal.aborted
+                ? stopped()
+                : resolve({ reason: "workspace_status_unavailable" }));
         });
     }
     finally {
@@ -55,8 +96,10 @@ async function read(ctx, journal, path, timeoutMs, external) {
 }
 function readFailure(value) {
     if ("reason" in value)
-        return value.reason === "workspace_identity_refused" || value.reason === "personal_login_required"
-            ? { state: "refused", reason: value.reason } : waiting(value.reason);
+        return value.reason === "workspace_identity_refused" ||
+            value.reason === "personal_login_required"
+            ? { state: "refused", reason: value.reason }
+            : waiting(value.reason);
     if (value.status === 401 || value.status === 403)
         return { state: "refused", reason: "workspace_consent_refused" };
     return value.status === 200 ? null : waiting("workspace_status_unavailable");
@@ -67,16 +110,33 @@ function observation(body, now) {
     const workspace = object(row?.workspace);
     const credential = object(row?.credential);
     const verification = object(row?.verification);
-    if (!row || typeof row.connected !== "boolean" || !workspace || typeof workspace.bound !== "boolean" ||
-        !nullableText(workspace.workspaceId) || !nullableText(workspace.workspaceSlug) || !nullableText(workspace.workspaceName) ||
-        !credential || ![true, false, null].includes(credential.stored) ||
-        !nullableTime(credential.updatedAt) || !nullableTime(credential.expiresAt) || (typeof credential.warmth !== "string" || !warmth.has(credential.warmth)) || !verification)
+    if (!row ||
+        typeof row.connected !== "boolean" ||
+        !workspace ||
+        typeof workspace.bound !== "boolean" ||
+        !nullableText(workspace.workspaceId) ||
+        !nullableText(workspace.workspaceSlug) ||
+        !nullableText(workspace.workspaceName) ||
+        !credential ||
+        ![true, false, null].includes(credential.stored) ||
+        !nullableTime(credential.updatedAt) ||
+        !nullableTime(credential.expiresAt) ||
+        typeof credential.warmth !== "string" ||
+        !warmth.has(credential.warmth) ||
+        !verification)
         return waiting("workspace_status_shape");
-    if (verification.source === "none" && verification.state === "not-run" && verification.checkedAt === null && row.connected === false)
+    if (verification.source === "none" &&
+        verification.state === "not-run" &&
+        verification.checkedAt === null &&
+        row.connected === false)
         return waiting("workspace_status_unavailable");
-    if (verification.source !== "live-probe" || (typeof verification.state !== "string" || !states.has(verification.state)) ||
-        typeof verification.checkedAt !== "number" || !Number.isFinite(verification.checkedAt) ||
-        verification.checkedAt < now - 120_000 || verification.checkedAt > now + 30_000 ||
+    if (verification.source !== "live-probe" ||
+        typeof verification.state !== "string" ||
+        !states.has(verification.state) ||
+        typeof verification.checkedAt !== "number" ||
+        !Number.isFinite(verification.checkedAt) ||
+        verification.checkedAt < now - 120_000 ||
+        verification.checkedAt > now + 30_000 ||
         row.connected !== (verification.state === "connected"))
         return waiting("workspace_status_shape");
     if (verification.state === "unreachable")
@@ -84,15 +144,29 @@ function observation(body, now) {
     if (!row.connected)
         return { state: "pending" };
     // A working credential alone cannot prove this account has a bound Linear workspace.
-    if (!workspace.bound || typeof workspace.workspaceId !== "string" || !idPattern.test(workspace.workspaceId))
+    if (!workspace.bound ||
+        typeof workspace.workspaceId !== "string" ||
+        !idPattern.test(workspace.workspaceId))
         return waiting("linear_workspace_unverified");
-    return { state: "done", evidence: { provider: "linear", workspace: workspace.workspaceId, checkedAt: verification.checkedAt } };
+    return {
+        state: "done",
+        evidence: {
+            provider: "linear",
+            workspace: workspace.workspaceId,
+            checkedAt: verification.checkedAt,
+        },
+    };
 }
 function safeHandoff(body, ctx) {
     const row = object(body);
     const cfg = loadConfig(ctx.home);
-    if (!cfg || !row || typeof row.authorizationUrl !== "string" || row.authorizationUrl.length > 8192 || /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
-        typeof row.expiresAt !== "number" || !Number.isFinite(row.expiresAt))
+    if (!cfg ||
+        !row ||
+        typeof row.authorizationUrl !== "string" ||
+        row.authorizationUrl.length > 8192 ||
+        /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
+        typeof row.expiresAt !== "number" ||
+        !Number.isFinite(row.expiresAt))
         return null;
     const remaining = row.expiresAt - ctx.now().getTime();
     // Thirty seconds accommodates clock skew; an expired link is never launched.
@@ -102,9 +176,17 @@ function safeHandoff(body, ctx) {
         const url = new URL(row.authorizationUrl);
         const keys = [...url.searchParams.keys()];
         const handoff = url.searchParams.get("handoff");
-        if (url.protocol !== "https:" || url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin || url.username || url.password ||
-            url.pathname !== HANDOFF || url.hash || keys.length !== 1 || keys[0] !== "handoff" ||
-            !handoff || handoff.length > 4096 || /[\s\u0000-\u001f\u007f]/.test(handoff))
+        if (url.protocol !== "https:" ||
+            url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin ||
+            url.username ||
+            url.password ||
+            url.pathname !== HANDOFF ||
+            url.hash ||
+            keys.length !== 1 ||
+            keys[0] !== "handoff" ||
+            !handoff ||
+            handoff.length > 4096 ||
+            /[\s\u0000-\u001f\u007f]/.test(handoff))
             return null;
         return url.toString();
     }
@@ -112,19 +194,29 @@ function safeHandoff(body, ctx) {
         return null;
     }
 }
-/** Uses the new personal bearer twins; old clouds retain their supported read-only readiness path. */
+/** Uses personal bearer twins; missing routes wait without an ungated readiness fallback. */
 export function linearWorkspaceAdapter(options) {
     const timeoutMs = options.requestTimeoutMs ?? 30_000;
     const consentTimeoutMs = options.consentTimeoutMs ?? 600_000;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 30_000 ||
-        !Number.isSafeInteger(consentTimeoutMs) || consentTimeoutMs < 1 || consentTimeoutMs > 600_000)
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > 30_000 ||
+        !Number.isSafeInteger(consentTimeoutMs) ||
+        consentTimeoutMs < 1 ||
+        consentTimeoutMs > 600_000)
         throw new Error("workspace_timeout_invalid");
     const inspect = async (ctx, journal, signal) => {
         const result = await read(ctx, journal, STATUS, timeoutMs, signal);
-        if ("status" in result && result.status === 404)
-            return { result: await options.fallback.check(ctx, journal, signal), unsupported: true };
+        if ("status" in result && [404, 405].includes(result.status))
+            return {
+                result: waiting("cloud_capability_unavailable"),
+                unsupported: true,
+            };
         const failure = readFailure(result);
-        return { result: failure ?? observation("body" in result ? result.body : undefined, ctx.now().getTime()) };
+        return {
+            result: failure ??
+                observation("body" in result ? result.body : undefined, ctx.now().getTime()),
+        };
     };
     return {
         check: async (ctx, journal, signal) => (await inspect(ctx, journal, signal)).result,
@@ -140,7 +232,7 @@ export function linearWorkspaceAdapter(options) {
             if (before.unsupported)
                 return waiting("cloud_capability_unavailable");
             const start = await read(ctx, journal, `${STATUS}/start`, timeoutMs, signal);
-            if ("status" in start && start.status === 404)
+            if ("status" in start && [404, 405].includes(start.status))
                 return waiting("cloud_capability_unavailable");
             const failure = readFailure(start);
             if (failure)
@@ -151,7 +243,9 @@ export function linearWorkspaceAdapter(options) {
             if (signal?.aborted)
                 return waiting("interrupted");
             const current = loadConfig(ctx.home);
-            if (!current?.user || current.account !== cfg.account || current.user.id !== cfg.user.id ||
+            if (!current?.user ||
+                current.account !== cfg.account ||
+                current.user.id !== cfg.user.id ||
                 normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
                 return { state: "refused", reason: "workspace_identity_refused" };
             if (!["owner", "admin"].includes(current.user.role))
@@ -165,20 +259,30 @@ export function linearWorkspaceAdapter(options) {
                 return waiting("workspace_browser_unavailable");
             }
             let latest = waiting("workspace_status_unavailable");
-            const run = () => pollConsent({ timeoutMs: consentTimeoutMs, signal, sleep: options.sleep,
+            const run = () => pollConsent({
+                timeoutMs: consentTimeoutMs,
+                signal,
+                sleep: options.sleep,
                 readStatus: async (pollSignal) => {
                     const value = await inspect(ctx, journal, pollSignal);
                     latest = value.result;
                     if (value.unsupported)
-                        return { outcome: "failed", reason: "cloud_capability_unavailable" };
+                        return {
+                            outcome: "waiting",
+                            reason: "cloud_capability_unavailable",
+                        };
                     if (latest.state === "done")
                         return { outcome: "connected" };
                     if (latest.state === "refused" || latest.state === "failed")
                         return { outcome: latest.state, reason: latest.reason };
-                    return { outcome: latest.state === "pending" ? "absent" : "unavailable" };
+                    return {
+                        outcome: latest.state === "pending" ? "absent" : "unavailable",
+                    };
                 },
             });
-            const result = options.wait ? await options.wait("Waiting for workspace approval", run) : await run();
+            const result = options.wait
+                ? await options.wait("Waiting for workspace approval", run)
+                : await run();
             return result.state === "done" ? latest : result;
         },
     };