@catalyst-cloud/cli 0.16.23 → 0.16.25

package/dist/env-import.js

@@ -0,0 +1,274 @@
+// env-import.ts — `catalyst env import` and `catalyst env draft --write --import-values`: store this
+// computer's values for the names a reviewed `.catalyst/catalyst.toml` declares. The only `env` code
+// that signs in; `env.ts` stays offline and delegates here.
+//
+// ⛔ A VALUE NEVER REACHES STDOUT, STDERR, THE JSON OR AN ERROR MESSAGE. Values are resolved in
+// memory (`env/machine-values.ts`), sent in request bodies, and dropped. Every printed line is built
+// from names, counts and the cloud's own name-only answers.
+//
+// The file is the allowlist: only declared names are sent, and its `secret` flag picks the route.
+// Secrets go in one `POST /me/secrets/import` and plain values one `POST /me/env-vars` each, the same
+// routes and bodies `catalyst secret import` and `catalyst var import` use. Secrets already stored are
+// kept (the import route's `name_exists`); plain variables are replaced, as `var import` does.
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { flagBool, flagString, positionals } from "./args.js";
+import { loadConfig } from "./config.js";
+import { loadContract } from "./contract.js";
+import { UsageError } from "./errors.js";
+import { repositoryNames } from "./env/draft.js";
+import { resolveMachineValues } from "./env/machine-values.js";
+import { readDeclaredVariables, validateSettingsToml } from "./env/settings-toml.js";
+import { readLocalRepositoryName } from "./onboard-settings-context.js";
+import { confirmYesNo, stdinIsTty } from "./prompt.js";
+import { ACCEPT, IMPORT_REASONS, refusalLine, SECRETS_IMPORT_PATH } from "./secret.js";
+import { apiClient } from "./transport.js";
+import { ENV_VARS_PATH } from "./var.js";
+const DESTINATION = ".catalyst/catalyst.toml";
+const REPO_RE = /^[^/\s]+\/[^/\s]+$/;
+const SOURCE_ORDER = [".envrc", "direnv environment", "~/.claude.json", "shell environment"];
+/** Shapes a credential has even when its name does not say so. Checked for plain-declared values only. */
+const CREDENTIAL_RES = [
+    /^gh[pousr]_[A-Za-z0-9]{16,}/,
+    /^github_pat_/,
+    /^glpat-/,
+    /^sk-[A-Za-z0-9_-]{8,}/,
+    /^sk_(?:live|test)_/,
+    /^xox[a-z]-/,
+    /^(?:AKIA|ASIA)[A-Z0-9]{12,}/,
+    /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/,
+    /-----BEGIN/,
+    /^[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/i,
+];
+function emptyReport(state, repo, refusal) {
+    return {
+        state,
+        repo,
+        from: [],
+        stored: { secrets: [], variables: [] },
+        updated: [],
+        kept: [],
+        noValue: [],
+        notStored: [],
+        ...(refusal === undefined ? {} : { refusal }),
+    };
+}
+/** A secret value the dotenv import line carries unchanged under every parser that reads it. */
+export function lineSafe(value) {
+    return !/[\r\n]/.test(value) && value === value.trim() && !/^["']/.test(value) && !/\s#/.test(value);
+}
+export function looksLikeCredential(value) {
+    return CREDENTIAL_RES.some((re) => re.test(value));
+}
+async function resolveRepo(root, flag, deps) {
+    if (flag !== undefined) {
+        if (!REPO_RE.test(flag))
+            throw new UsageError(`--repo must be owner/name (got "${flag}")`);
+        return flag;
+    }
+    return (deps.repoName ?? readLocalRepositoryName)(root);
+}
+function sourceText(from) {
+    const words = from.map((source) => (source === "direnv environment" && from.includes(".envrc") ? "its direnv environment" : source));
+    return words.length <= 1 ? words.join("") : `${words.slice(0, -1).join(", ")} and ${words[words.length - 1]}`;
+}
+/** One line per name that has a value: the name, secret or plain, and where the value came from. No value. */
+export function valueLines(withValue, values) {
+    return withValue.map(({ name, secret }) => `  ${name} (${secret ? "secret" : "plain"}) from ${values.get(name)?.from ?? "?"}`);
+}
+/** Resolve, ask, send, report. Human lines go to stdout unless `json`; the caller prints the JSON. */
+async function importValues(input) {
+    const { root, repo, cfg, ctx, deps, declared } = input;
+    const say = (line) => { if (!input.json)
+        ctx.stdout(line); };
+    const machine = { home: ctx.home, env: ctx.env, ...deps.machine };
+    // The same repository names the draft saw, so a header variable resolves only where it was drafted.
+    const repository = repositoryNames(root);
+    const resolved = resolveMachineValues(root, machine, declared, repository.state === "valid" ? repository.names : new Set());
+    const fromSet = new Set();
+    for (const { from } of resolved.values.values()) {
+        if (from === "direnv environment")
+            fromSet.add(".envrc");
+        fromSet.add(from);
+    }
+    const from = SOURCE_ORDER.filter((source) => fromSet.has(source));
+    const report = { ...emptyReport("stored", repo), from, noValue: resolved.noValue };
+    const secretFlag = new Map(declared.map(({ name, secret }) => [name, secret]));
+    const withValue = declared.filter(({ name }) => resolved.values.has(name));
+    const secretCount = withValue.filter(({ secret }) => secret).length;
+    say(`This computer has values for ${withValue.length} of the ${declared.length} declared names${withValue.length > 0 ? ` (${sourceText(from)})` : ""}.`);
+    if (withValue.length === 0) {
+        renderNoValue(say, report, repo, secretFlag);
+        return { code: 0, report };
+    }
+    for (const line of valueLines(withValue, resolved.values))
+        say(line);
+    if (input.confirm === "ask") {
+        if (input.json || !(deps.isTty ?? stdinIsTty)()) {
+            say("env import stores values in Catalyst; pass --yes to confirm without a terminal. Nothing was stored.");
+            return { code: 1, report: { ...report, state: "confirmation_required" } };
+        }
+        const question = `Store them for ${repo} now? ${secretCount} as secrets, ${withValue.length - secretCount} as plain variables. Values go to Catalyst and are never printed. Secrets already stored are kept; plain variables already stored are replaced. [y/N] `;
+        if (!(await (deps.confirm ?? confirmYesNo)(question))) {
+            say("Nothing was stored. Next: catalyst env import stores this computer's values for these names. It signs in and asks first.");
+            return { code: 0, report: { ...emptyReport("refused", repo, "declined"), from, noValue: resolved.noValue } };
+        }
+    }
+    const repositories = await (deps.repositories ?? (async () => (await loadContract(ctx, cfg)).doc.merge.repositories))();
+    const [owner, name] = repo.toLowerCase().split("/");
+    const entry = repositories.find((r) => r.owner.toLowerCase() === owner && r.name.toLowerCase() === name);
+    if (entry === undefined) {
+        const refusal = `${repo} is not a repository of this workspace; nothing was stored. Register it first with catalyst onboard --team <KEY> --repo ${repo}`;
+        say(refusal);
+        return { code: 1, report: { ...report, state: "refused", refusal } };
+    }
+    const secretLines = [];
+    const plain = [];
+    for (const { name: declaredName, secret } of withValue) {
+        const found = resolved.values.get(declaredName);
+        if (found === undefined)
+            continue;
+        const value = found.value;
+        if (secret) {
+            if (lineSafe(value))
+                secretLines.push(`${declaredName}=${value}`);
+            else
+                report.notStored.push({ name: declaredName, reason: `its value has a line break, spaces at either end, a leading quote or " #", which an import line cannot carry; store it with: catalyst secret set ${declaredName} --repo ${repo}` });
+        }
+        else if (looksLikeCredential(value)) {
+            report.notStored.push({ name: declaredName, reason: "its value looks like a credential, but the file declares it plain; set secret = true for it and run catalyst env import again" });
+        }
+        else
+            plain.push({ name: declaredName, value });
+    }
+    const client = deps.client ?? apiClient(cfg, ctx);
+    if (secretLines.length > 0) {
+        const res = await client.postJson(SECRETS_IMPORT_PATH, { repo, text: `${secretLines.join("\n")}\n`, rotateExisting: [], source: `env import: ${from.join(", ")}` }, { accept: ACCEPT });
+        if (res.status !== 200) {
+            const refusal = refusalLine(res.status, res.body, repo);
+            say(refusal);
+            return { code: 1, report: { ...report, state: "refused", refusal } };
+        }
+        report.stored.secrets.push(...(res.body.created ?? []), ...(res.body.rotated ?? []));
+        for (const error of res.body.errors ?? []) {
+            if (error.reason === "name_exists")
+                report.kept.push(error.name);
+            else
+                report.notStored.push({ name: error.name, reason: IMPORT_REASONS[error.reason] ?? error.reason });
+        }
+    }
+    for (const [index, item] of plain.entries()) {
+        let reply;
+        try {
+            reply = await client.postJson(ENV_VARS_PATH, { scope: "repo", repoId: entry.repoId, name: item.name, value: item.value }, { accept: ACCEPT });
+        }
+        catch {
+            report.unknown = plain.slice(index).map(({ name: unknownName }) => unknownName);
+            break;
+        }
+        if (reply.status !== 200 && reply.status !== 201) {
+            report.notStored.push({ name: item.name, reason: reply.body.message ?? reply.body.error ?? `HTTP ${reply.status}` });
+            continue;
+        }
+        report.stored.variables.push(item.name);
+        if (!reply.body.created)
+            report.updated.push(item.name);
+    }
+    const storedCount = report.stored.secrets.length + report.stored.variables.length;
+    say(storedCount === 0
+        ? `Stored nothing for ${repo}.`
+        : `Stored ${storedCount} values for ${repo}: ${report.stored.secrets.length} secrets, ${report.stored.variables.length} plain variables.`);
+    if (report.updated.length > 0)
+        say(`  updated (were already stored): ${report.updated.join(", ")}`);
+    if (report.kept.length > 0)
+        say(`Kept ${report.kept.length} secrets already stored for ${repo}: ${report.kept.join(", ")} (replace one with: catalyst secret set NAME --repo ${repo})`);
+    for (const item of report.notStored)
+        say(`Not stored: ${item.name} (${item.reason})`);
+    if (report.unknown !== undefined)
+        say(`Stopped: the write did not answer, so these are not confirmed: ${report.unknown.join(", ")}. Run catalyst env import again.`);
+    renderNoValue(say, report, repo, secretFlag);
+    return { code: report.notStored.length > 0 || report.unknown !== undefined ? 1 : 0, report };
+}
+function renderNoValue(say, report, repo, secretFlag) {
+    if (report.noValue.length === 0) {
+        say("Every declared name had a value on this computer.");
+        return;
+    }
+    const count = report.noValue.length;
+    say(`No value on this computer for ${count} declared ${count === 1 ? "name" : "names"} (looked in .envrc, its direnv environment and ~/.claude.json):`);
+    for (const { name, computed } of report.noValue) {
+        const store = secretFlag.get(name) ? `catalyst secret set ${name} --repo ${repo}` : `catalyst var set ${name} --repo ${repo}`;
+        say(computed
+            ? `  ${name}: .envrc computes it. Run catalyst env import in a shell where direnv has loaded this repository, or store it with: ${store}`
+            : `  ${name}: store it with: ${store}`);
+    }
+}
+/** `catalyst env import`: store this computer's values for the names the reviewed file declares. */
+export async function cmdEnvImport(args, ctx, deps = {}) {
+    const rest = positionals(args).slice(1);
+    if (rest.length > 0)
+        throw new UsageError("env import takes no positional arguments; use --root DIR");
+    const json = Boolean(args.json);
+    const refuse = (refusal, state = "refused", repo = null) => {
+        if (json)
+            ctx.stdout(JSON.stringify(emptyReport(state, repo, refusal)));
+        else
+            ctx.stderr(refusal);
+        return 1;
+    };
+    const root = resolve(flagString(args, "root") ?? ".");
+    const cfg = loadConfig(ctx.home);
+    if (cfg === null)
+        return refuse("env import stores values in Catalyst; sign in with catalyst login first. Nothing was stored.");
+    const repo = await resolveRepo(root, flagString(args, "repo"), deps);
+    if (repo === null)
+        throw new UsageError("env import needs --repo owner/name: this checkout has no GitHub origin to read it from");
+    let text;
+    try {
+        text = readFileSync(join(root, DESTINATION), "utf8");
+    }
+    catch {
+        return refuse(`no ${DESTINATION} found in this repository; draft one with catalyst env draft --write`, "refused", repo);
+    }
+    const declared = readDeclaredVariables(text);
+    if (declared === null) {
+        const checked = validateSettingsToml(text);
+        const errors = checked.state === "invalid" ? checked.errors : [`no [environment] table in ${DESTINATION}`];
+        return refuse(errors.map((error) => `${DESTINATION}: ${error}`).join("\n"), "refused", repo);
+    }
+    if (!json)
+        ctx.stdout(`Reading ${DESTINATION}: ${declared.length} declared names (${declared.filter(({ secret }) => secret).length} secret).`);
+    const result = await importValues({ root, repo, cfg, ctx, deps, declared, confirm: flagBool(args, "yes") ? "yes" : "ask", json });
+    if (json)
+        ctx.stdout(JSON.stringify(result.report));
+    return result.code;
+}
+/** After `env draft --write`: store the values now (`yes`), or ask first in a terminal (`ask`). */
+export async function offerMachineImport(input) {
+    const { root, args, ctx, mode } = input;
+    const deps = input.deps ?? {};
+    const json = Boolean(args.json);
+    const failCode = mode === "yes" ? 1 : 0;
+    const declared = readDeclaredVariables(input.toml) ?? [];
+    if (declared.length === 0)
+        return { code: 0 };
+    const say = (line) => { if (json)
+        ctx.stderr(line);
+    else
+        ctx.stdout(line); };
+    const cfg = loadConfig(ctx.home);
+    if (cfg === null) {
+        const refusal = "To store this computer's values for these names, sign in with catalyst login, then run: catalyst env import";
+        say(refusal);
+        return { code: failCode, report: emptyReport("refused", null, refusal) };
+    }
+    const repo = await resolveRepo(root, flagString(args, "repo"), deps);
+    if (repo === null) {
+        const refusal = "To store this computer's values, run: catalyst env import --repo owner/name (this checkout has no GitHub origin to read the repository from)";
+        say(refusal);
+        return { code: failCode, report: emptyReport("refused", null, refusal) };
+    }
+    if (!json)
+        ctx.stdout("");
+    return importValues({ root, repo, cfg, ctx, deps, declared, confirm: mode, json });
+}

package/dist/env.js

@@ -4,9 +4,13 @@
 // point of the feature: a person reviews what a repository declares without connecting anything first.
 // `env shell` (env/shell.ts) talks to Docker, and asks the cloud only when a credential-free download
 // of the image is refused; Catalyst's own image needs no login.
+//
+// The two exceptions store values and so sign in: `env import` and `env draft --write`'s offer to
+// store this computer's values. Both are delegated to `env-import.ts`; this module itself stays offline.
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { flagBool, flagString, positionals } from "./args.js";
+import { cmdEnvImport, offerMachineImport } from "./env-import.js";
 import { validateSettingsToml } from "./env/settings-toml.js";
 import { convertLegacyEnvironmentJson } from "./env/legacy.js";
 import { draftEnvironment } from "./env/draft.js";
@@ -14,18 +18,27 @@ import { inventoryRepo } from "./env/inventory.js";
 import { inventoryToJson, renderInventory } from "./env/render.js";
 import { runEnvShell } from "./env/shell.js";
 import { UsageError } from "./errors.js";
+import { stdinIsTty } from "./prompt.js";
+import { validateFullSettings } from "../vendor/settings/index.js";
+const NEXT_IMPORT_LINE = "Next: catalyst env import stores this computer's values for these names. It signs in and asks first.";
 export async function cmdEnv(args, ctx, deps = {}) {
     const [sub, ...rest] = positionals(args);
     if (sub === undefined)
-        throw new UsageError("env needs a subcommand: inventory | check | migrate | draft | shell");
+        throw new UsageError("env needs a subcommand: inventory | check | migrate | draft | import | shell");
+    if (sub === "import")
+        return cmdEnvImport(args, ctx, deps.import ?? {});
     if (sub === "shell")
         return await runEnvShell(args, ctx, deps.shell ?? {});
     if (sub === "draft") {
         if (rest.length > 0)
             throw new UsageError("env draft takes no positional arguments; use --root DIR");
+        const importValues = flagBool(args, "import-values");
+        if (importValues && !flagBool(args, "write")) {
+            throw new UsageError("--import-values needs --write; for an existing .catalyst/catalyst.toml run: catalyst env import");
+        }
         const root = resolve(flagString(args, "root") ?? ".");
         const target = join(root, ".catalyst/catalyst.toml");
-        const draft = draftEnvironment(root, deps);
+        const draft = draftEnvironment(root, deps, { machine: { home: ctx.home, env: ctx.env } });
         if (draft.state === "invalid") {
             if (args.json)
                 ctx.stdout(JSON.stringify(draft));
@@ -43,10 +56,13 @@ export async function cmdEnv(args, ctx, deps = {}) {
             sources: draft.sources,
             destination: ".catalyst/catalyst.toml",
             toml: draft.toml,
+            mcpServers: draft.mcpServers.map(({ name, configName, scope, url, headers }) => ({ name, configName, scope, url, headers })),
+            machine: machineJson(draft.machine),
         };
         const write = flagBool(args, "write");
         if (write && existsSync(target)) {
             ctx.stderr(`${summary.destination} already exists; no file was written. Review the draft with --diff and merge it by hand.`);
+            ctx.stderr("To store this computer's values for the names it declares, run: catalyst env import");
             return 1;
         }
         if (write) {
@@ -55,6 +71,10 @@ export async function cmdEnv(args, ctx, deps = {}) {
                 ctx.stderr(`draft failed local validation: ${checked.state === "invalid" ? checked.errors.join("; ") : "no environment table"}`);
                 return 1;
             }
+            if (!validateFullSettings(`[project]\nlinear_team = "DRAFT"\n\n${draft.toml}`).ok) {
+                ctx.stderr("draft failed Catalyst's settings check; no file was written");
+                return 1;
+            }
             if (deps.writeFile)
                 deps.writeFile(target, draft.toml);
             else {
@@ -62,20 +82,27 @@ export async function cmdEnv(args, ctx, deps = {}) {
                 writeFileSync(target, draft.toml, { encoding: "utf8", flag: "wx" });
             }
         }
-        if (args.json)
-            ctx.stdout(JSON.stringify({ ...summary, written: write }));
-        else if (flagBool(args, "diff")) {
+        if (args.json) {
+            // The import's answer joins the one JSON object, so it runs first; its lines go to stderr.
+            const offered = write ? await afterWrite(root, draft, args, ctx, deps, importValues) : { code: 0 };
+            ctx.stdout(JSON.stringify({ ...summary, written: write, ...(offered.report === undefined ? {} : { import: offered.report }) }));
+            return offered.code;
+        }
+        if (flagBool(args, "diff")) {
             ctx.stdout(`--- /dev/null\n+++ b/${summary.destination} (draft)\n@@\n${draft.toml.split("\n").filter(Boolean).map((line) => `+${line}`).join("\n")}`);
         }
         else {
             ctx.stdout(`Drafted ${summary.destination} from ${draft.sources.length ? draft.sources.join(", ") : "no environment sources"}.`);
             ctx.stdout(`Names: ${draft.names.length} (${draft.secretNames.length} secret; all optional)`);
+            for (const line of machineLines(draft.machine, draft.mcpServers))
+                ctx.stdout(line);
             ctx.stdout(`Setup: ${draft.setup.length}; verify: ${draft.verify.length}`);
             ctx.stdout(draft.toml);
         }
-        if (write && !args.json)
-            ctx.stdout(`Wrote ${summary.destination}; review and commit it through your repository's pull request.`);
-        return 0;
+        if (!write)
+            return 0;
+        ctx.stdout(`Wrote ${summary.destination}; review and commit it through your repository's pull request.`);
+        return (await afterWrite(root, draft, args, ctx, deps, importValues)).code;
     }
     if (sub === "migrate") {
         if (rest.length > 1)
@@ -177,5 +204,70 @@ export async function cmdEnv(args, ctx, deps = {}) {
                 ctx.stderr(`${file}: ${error}`);
         return result.state === "invalid" ? 1 : 0;
     }
-    throw new UsageError(`unknown env subcommand "${sub}": inventory | check | migrate | draft | shell`);
+    throw new UsageError(`unknown env subcommand "${sub}": inventory | check | migrate | draft | import | shell`);
+}
+/** After a successful write: store now (`--import-values`), ask in a terminal, or name the next command. */
+async function afterWrite(root, draft, args, ctx, deps, importValues) {
+    if (draft.names.length === 0)
+        return { code: 0 };
+    const toml = draft.toml;
+    const importDeps = deps.import ?? {};
+    if (importValues)
+        return offerMachineImport({ root, toml, args, ctx, deps: importDeps, mode: "yes" });
+    if (!args.json && (importDeps.isTty ?? stdinIsTty)())
+        return offerMachineImport({ root, toml, args, ctx, deps: importDeps, mode: "ask" });
+    if (args.json)
+        ctx.stderr(NEXT_IMPORT_LINE);
+    else
+        ctx.stdout(NEXT_IMPORT_LINE);
+    return { code: 0 };
+}
+function machineJson(machine) {
+    if (machine === null)
+        return null;
+    return {
+        envrc: machine.envrc === null ? null : {
+            exported: machine.envrc.exported.map(({ name }) => name),
+            notRead: machine.envrc.notRead,
+            skippedNames: machine.envrc.skippedNames,
+        },
+        claudeJson: machine.claude === null ? null : {
+            servers: machine.claude.servers.map(({ name }) => name),
+            notDrafted: machine.claude.notDrafted,
+            ...(machine.claude.note === undefined ? {} : { note: machine.claude.note }),
+        },
+        notes: machine.notes,
+    };
+}
+/** What came from this computer and what was left out, names and reasons only. */
+function machineLines(machine, servers) {
+    if (machine === null || (machine.envrc === null && machine.claude === null && machine.notes.length === 0))
+        return [];
+    const lines = ["From this computer:"];
+    if (machine.envrc !== null) {
+        const notRead = machine.envrc.notRead.length === 0
+            ? ""
+            : ` Not read: ${machine.envrc.notRead.map(({ line, reason }) => `line ${line} ${reason}`).join(", ")}; names those lines load are not drafted.`;
+        lines.push(`  .envrc: ${machine.envrc.exported.length} exported names.${notRead}`);
+        if (machine.envrc.skippedNames.length > 0)
+            lines.push(`    Not drafted (settings of this computer): ${machine.envrc.skippedNames.join(", ")}`);
+    }
+    if (machine.claude !== null) {
+        if (machine.claude.note !== undefined)
+            lines.push(`  ${machine.claude.note}`);
+        else {
+            const names = servers.map(({ name, configName }) => (name === configName ? name : `${name} (from ${JSON.stringify(configName)})`));
+            lines.push(`  ~/.claude.json: ${servers.length} HTTP MCP servers${names.length ? ` (${names.join(", ")})` : ""}. Each header names a variable; no header value is copied.`);
+        }
+        for (const server of servers) {
+            for (const { variable, header } of server.derived) {
+                lines.push(`    ${server.name}: its ${header} header held a value; drafted as $${variable}, which env import reads from ~/.claude.json`);
+            }
+        }
+        for (const { name, reason } of machine.claude.notDrafted)
+            lines.push(`    Not drafted: ${name} (${reason})`);
+    }
+    for (const note of machine.notes)
+        lines.push(`  ${note}`);
+    return lines;
 }

package/dist/hosts.js

@@ -1,23 +1,11 @@
-import { createInterface } from "node:readline/promises";
 import { positionals } from "./args.js";
 import { requireConfig } from "./config.js";
 import { CliError, UsageError } from "./errors.js";
 import { apiClient } from "./transport.js";
 import { isMachineInventory, isMachineMutation, } from "./machine-inventory.js";
-import { stdinIsTty } from "./prompt.js";
+import { confirmYesNo } from "./prompt.js";
 async function confirmRemove(name) {
-    if (!stdinIsTty())
-        return false;
-    const prompt = createInterface({
-        input: process.stdin,
-        output: process.stderr,
-    });
-    try {
-        return /^(y|yes)$/i.test((await prompt.question(`Remove ${name} from this account? It will stop receiving work. [y/N] `)).trim());
-    }
-    finally {
-        prompt.close();
-    }
+    return confirmYesNo(`Remove ${name} from this account? It will stop receiving work. [y/N] `);
 }
 export function machineLines(inventory) {
     const lines = inventory.machines.map((m) => `${m.name} | ${m.ownership === "self_hosted" ? "Self-hosted" : "Catalyst's"} | ${m.teams.join(", ")} | ${m.slots} slots, ${m.inUse} in use, ${m.free} free | ${m.status} | last check-in ${m.lastCheckInAtMs === null ? "never" : new Date(m.lastCheckInAtMs).toISOString()}`);

package/dist/mcp-status.js

@@ -0,0 +1,111 @@
+import { normalizeBaseUrl, requireConfig } from "./config.js";
+import { loadContract } from "./contract.js";
+import { CliError, MeError } from "./errors.js";
+import { needsNewerCloud } from "./execution.js";
+import { bearerFor } from "./oauth.js";
+import { ApiClient } from "./transport.js";
+export const CALLS_WINDOW = 50;
+function portalBase(doc, cfg) {
+    const raw = doc.portal?.url;
+    if (doc.portal && !raw) {
+        // A current cloud that names why it publishes no portal URL: refuse with that reason, not "upgrade".
+        throw new CliError(`mcp status cannot reach this workspace's MCP portal: the cloud publishes no portal.url (${doc.portal.unavailable ?? "no reason given"}). Ask your operator to configure the portal host.`, "portal-unavailable");
+    }
+    if (!raw) {
+        throw new CliError(`mcp status needs a newer Catalyst Cloud than ${normalizeBaseUrl(cfg.baseUrl)} is running: its contract names no MCP portal (portal.url). Nothing is wrong with your workspace.`, "route-not-deployed", 3);
+    }
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new CliError(`the contract's portal.url is not a URL: ${raw}`, "contract-shape");
+    }
+    const loginOrigin = new URL(normalizeBaseUrl(cfg.baseUrl)).origin;
+    if (url.origin !== loginOrigin) {
+        throw new CliError(`the contract's portal.url (${url.origin}) is not on the cloud you logged in to (${loginOrigin}); not sending your key there`, "portal-origin");
+    }
+    return { origin: url.origin, path: url.pathname.replace(/\/+$/, "") };
+}
+async function portalGet(api, path, what, cfg, query) {
+    const res = await api.getJson(path, { query, accept: [403, 404], parseAccepted: true });
+    if (res.status === 404)
+        throw needsNewerCloud(what, cfg);
+    if (res.status === 403) {
+        const body = res.body;
+        const reason = typeof body === "object" && body !== null
+            ? ("reason" in body && typeof body.reason === "string" ? body.reason
+                : "error" in body && typeof body.error === "string" ? body.error : "forbidden")
+            : "forbidden";
+        throw new CliError(`GET ${path} failed (403): the MCP portal refused this key (${reason}). It admits an active member's personal key, or an account key scoped portal:access.`, "forbidden", 2, 403);
+    }
+    return res.body;
+}
+function isStatus(body) {
+    return typeof body === "object" && body !== null && "server" in body && typeof body.server === "string"
+        && "state" in body && typeof body.state === "string";
+}
+function isCalls(body) {
+    return typeof body === "object" && body !== null && "server" in body && typeof body.server === "string"
+        && "calls" in body && Array.isArray(body.calls);
+}
+/** Numeric display fields are checked at runtime because older or malformed responses may omit them. */
+export function renderServerStatus(status, calls) {
+    const lines = [`${status.server} — ${status.state}`];
+    if (status.detail)
+        lines.push(`  ${status.detail}`);
+    lines.push(`auth: ${status.auth ?? "not reported (no registration)"}`);
+    if (status.credentials?.length)
+        lines.push(`credentials: ${status.credentials.join(", ")}`);
+    const tools = status.tools;
+    lines.push(tools
+        ? `tools: ${tools.offered} offered, ${tools.catalog} in catalog${tools.missing_upstream?.length ? ` (missing upstream: ${tools.missing_upstream.join(", ")})` : ""}`
+        : `tools: not reported (${status.state})`);
+    const grants = status.grants;
+    lines.push(grants
+        ? `grants for this key: ${grants.granted} of ${grants.cataloged}${grants.missing?.length ? ` (missing: ${grants.missing.join(", ")})` : ""}`
+        : "grants for this key: not reported (no registration)");
+    if (calls.length === 0)
+        return [...lines, `No tool calls recorded for ${status.server}.`];
+    lines.push(`last ${calls.length} call${calls.length === 1 ? "" : "s"} (newest first, up to ${CALLS_WINDOW}):`);
+    const rows = calls.map((call) => {
+        const date = new Date(typeof call.at === "number" ? call.at : NaN);
+        return [
+            Number.isFinite(date.getTime()) ? date.toISOString() : "?",
+            call.outcome,
+            call.tool_name,
+            `${typeof call.latency_ms === "number" && Number.isFinite(call.latency_ms) ? call.latency_ms : "?"}ms`,
+            call.dispatch ? `${call.dispatch.ticket} ${call.dispatch.phase}` : "-",
+            call.outcome === "ok" ? "" : [call.denied_reason, call.explanation].filter((part) => typeof part === "string" && part.length > 0).join(": "),
+        ];
+    });
+    const widths = Array.from({ length: 5 }, (_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length)));
+    for (const row of rows) {
+        lines.push(`  ${row.map((value, column) => column === 3 ? value.padStart(widths[column] ?? 0) : value.padEnd(widths[column] ?? 0)).join("  ")}`.trimEnd());
+    }
+    return lines;
+}
+export async function cmdMcpStatus(args, ctx, name) {
+    const cfg = requireConfig(ctx);
+    let loaded = await loadContract(ctx, cfg);
+    // A fresh cache may predate portal discovery. Revalidate once before refusing it.
+    if (loaded.source === "cache" && !loaded.doc.portal?.url)
+        loaded = await loadContract(ctx, cfg, { refresh: true });
+    const base = portalBase(loaded.doc, cfg);
+    const api = new ApiClient(base.origin, () => bearerFor(ctx, cfg), ctx.fetch);
+    const server = `${base.path}/servers/${encodeURIComponent(name)}`;
+    const [status, calls] = await Promise.all([
+        portalGet(api, `${server}/status`, `MCP server status for ${name}`, cfg),
+        portalGet(api, `${server}/calls`, `recent tool calls for ${name}`, cfg, { limit: CALLS_WINDOW }),
+    ]);
+    if (!isStatus(status))
+        throw new MeError(`GET ${server}/status returned an unexpected shape`, "shape");
+    if (!isCalls(calls))
+        throw new MeError(`GET ${server}/calls returned an unexpected shape`, "shape");
+    if (args.json)
+        ctx.stdout(JSON.stringify({ status, calls }));
+    else
+        for (const line of renderServerStatus(status, calls.calls))
+            ctx.stdout(line);
+    return 0;
+}

package/dist/mcp.js

@@ -1,6 +1,7 @@
 import { flagList, flagString, positionals } from "./args.js";
 import { requireConfig } from "./config.js";
 import { CliError, UsageError } from "./errors.js";
+import { cmdMcpStatus } from "./mcp-status.js";
 import { bearerFor } from "./oauth.js";
 import { loadTenantSdk } from "./sdk.js";
 const SECRET_NAME = /^[A-Z][A-Z0-9_]*$/;
@@ -66,8 +67,8 @@ function describeServer(server) {
 }
 export async function cmdMcp(args, ctx) {
     const [verb, ...rest] = positionals(args);
-    if (verb !== "add" && verb !== "list" && verb !== "remove")
-        throw new UsageError("mcp needs add, list or remove");
+    if (verb !== "add" && verb !== "list" && verb !== "remove" && verb !== "status")
+        throw new UsageError("mcp needs add, list, remove or status");
     if (rest.length !== (verb === "list" ? 0 : 1))
         throw new UsageError(`mcp ${verb}${verb === "list" ? "" : " <name>"}`);
     const name = rest[0] ?? "";
@@ -76,6 +77,8 @@ export async function cmdMcp(args, ctx) {
     if (verb !== "add" && ["url", "auth", "bearer", "header"].some((key) => key in args.flags)) {
         throw new UsageError("URL and auth options are only accepted by mcp add");
     }
+    if (verb === "status")
+        return await cmdMcpStatus(args, ctx, name);
     const input = verb === "add" ? registration(args, name) : null;
     const cfg = requireConfig(ctx);
     const key = await bearerFor(ctx, cfg);

package/dist/onboard-next.js

@@ -130,7 +130,11 @@ const REASONS = {
     runner_thoughts_custody_unavailable: "Setup could not verify protected access to this Mac's shared work files. Keep their ownership and permissions. Check Docker access, then run catalyst onboard --runner. If the check still fails, ask Catalyst support to inspect it.",
     runner_installation_unverified: "Setup found a possible existing machine installation but could not verify its Compose files and identity. Keep its files and credentials. Run docker compose -p catalyst-host logs supervisor to check it, then run catalyst setup --runner again.",
     runner_enrollment_unavailable: "Setup could not read this workspace's runner hosts. Run catalyst onboard again to retry.",
-    runner_enrolled_for_other_team: "This runner is enrolled for another Linear team. Keep using that team, or ask your administrator to revoke the old enrollment before setting up this machine for the selected team.",
+    runner_enrolled_for_other_team: "This runner is enrolled for another Linear team, and Catalyst could not add the selected team to it. Keep using that team, or ask your administrator to revoke the old enrollment before setting up this machine for the selected team.",
+    runner_team_not_added: "This runner does not serve the selected Linear team yet. Run catalyst setup --runner to add the team to it.",
+    runner_team_limit: "This runner already serves 16 Linear teams, the most one runner can serve. Set up another machine for the selected team.",
+    runner_team_add_failed: "Setup could not add the selected Linear team to this runner. Run catalyst setup --runner again to retry.",
+    runner_supervisor_outdated: "This runner's supervisor has not reported that it can serve several teams yet. Run docker compose -p catalyst-host logs supervisor to check it is running, then run catalyst setup --runner again.",
     runner_enrollment_revoked: "Catalyst confirms that this machine's saved enrollment was revoked. Keep its credential and organization key. Ask your workspace administrator to review the enrollment before replacing it, then run catalyst setup --runner.",
     runner_credential_unverified: "Setup could not read this machine's saved enrollment. Keep its credential and organization key. Run docker compose -p catalyst-host logs supervisor to check the error, then run catalyst setup --runner.",
     runner_enrollment_stale: "Setup could not match this machine's saved enrollment with Catalyst. Keep its credential and organization key, then run catalyst setup --runner to check again.",