@craftspace/cli 0.4.3 → 0.6.0

package/dist/index.js

@@ -4632,8 +4632,8 @@ var BIGINT_FORMAT_RANGES = {
 };
 function pick(schema, mask) {
   const currDef = schema._zod.def;
-  const checks = currDef.checks;
-  const hasChecks = checks && checks.length > 0;
+  const checks2 = currDef.checks;
+  const hasChecks = checks2 && checks2.length > 0;
   if (hasChecks) {
     throw new Error(".pick() cannot be used on object schemas containing refinements");
   }
@@ -4657,8 +4657,8 @@ function pick(schema, mask) {
 }
 function omit(schema, mask) {
   const currDef = schema._zod.def;
-  const checks = currDef.checks;
-  const hasChecks = checks && checks.length > 0;
+  const checks2 = currDef.checks;
+  const hasChecks = checks2 && checks2.length > 0;
   if (hasChecks) {
     throw new Error(".omit() cannot be used on object schemas containing refinements");
   }
@@ -4684,8 +4684,8 @@ function extend(schema, shape) {
   if (!isPlainObject(shape)) {
     throw new Error("Invalid input to extend: expected a plain object");
   }
-  const checks = schema._zod.def.checks;
-  const hasChecks = checks && checks.length > 0;
+  const checks2 = schema._zod.def.checks;
+  const hasChecks = checks2 && checks2.length > 0;
   if (hasChecks) {
     const existingShape = schema._zod.def.shape;
     for (const key in shape) {
@@ -4735,8 +4735,8 @@ function merge(a, b) {
 }
 function partial(Class2, schema, mask) {
   const currDef = schema._zod.def;
-  const checks = currDef.checks;
-  const hasChecks = checks && checks.length > 0;
+  const checks2 = currDef.checks;
+  const hasChecks = checks2 && checks2.length > 0;
   if (hasChecks) {
     throw new Error(".partial() cannot be used on object schemas containing refinements");
   }
@@ -5238,10 +5238,10 @@ var nanoid = /^[a-zA-Z0-9_-]{21}$/;
 var duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
 var extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
 var guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-var uuid = (version3) => {
-  if (!version3)
+var uuid = (version2) => {
+  if (!version2)
     return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+  return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
 };
 var uuid4 = /* @__PURE__ */ uuid(4);
 var uuid6 = /* @__PURE__ */ uuid(6);
@@ -5923,25 +5923,25 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   inst._zod.def = def;
   inst._zod.bag = inst._zod.bag || {};
   inst._zod.version = version;
-  const checks = [...inst._zod.def.checks ?? []];
+  const checks2 = [...inst._zod.def.checks ?? []];
   if (inst._zod.traits.has("$ZodCheck")) {
-    checks.unshift(inst);
+    checks2.unshift(inst);
   }
-  for (const ch of checks) {
+  for (const ch of checks2) {
     for (const fn of ch._zod.onattach) {
       fn(inst);
     }
   }
-  if (checks.length === 0) {
+  if (checks2.length === 0) {
     (_a3 = inst._zod).deferred ?? (_a3.deferred = []);
     inst._zod.deferred?.push(() => {
       inst._zod.run = inst._zod.parse;
     });
   } else {
-    const runChecks = (payload, checks2, ctx) => {
+    const runChecks = (payload, checks3, ctx) => {
       let isAborted = aborted(payload);
       let asyncResult;
-      for (const ch of checks2) {
+      for (const ch of checks3) {
         if (ch._zod.def.when) {
           if (explicitlyAborted(payload))
             continue;
@@ -5985,7 +5985,7 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
         canary.aborted = true;
         return canary;
       }
-      const checkResult = runChecks(payload, checks, ctx);
+      const checkResult = runChecks(payload, checks2, ctx);
       if (checkResult instanceof Promise) {
         if (ctx.async === false)
           throw new $ZodAsyncError();
@@ -6010,9 +6010,9 @@ var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
       if (result instanceof Promise) {
         if (ctx.async === false)
           throw new $ZodAsyncError();
-        return result.then((result2) => runChecks(result2, checks, ctx));
+        return result.then((result2) => runChecks(result2, checks2, ctx));
       }
-      return runChecks(result, checks, ctx);
+      return runChecks(result, checks2, ctx);
     };
   }
   defineLazy(inst, "~standard", () => ({
@@ -18117,10 +18117,10 @@ function fromJSONSchema(schema, params) {
   } catch {
     throw new Error("fromJSONSchema input is not valid JSON (possibly cyclic); use $defs/$ref for recursive schemas");
   }
-  const version3 = detectVersion(normalized, params?.defaultTarget);
+  const version2 = detectVersion(normalized, params?.defaultTarget);
   const defs = normalized.$defs || normalized.definitions || {};
   const ctx = {
-    version: version3,
+    version: version2,
     defs,
     refs: /* @__PURE__ */ new Map(),
     processing: /* @__PURE__ */ new Set(),
@@ -18710,6 +18710,16 @@ var GUS_MODELS = [
     reasoning: true,
     harness: GusHarness.OpenCode
   },
+  {
+    id: "deepseek/deepseek-v4.1-flash",
+    label: "DeepSeek V4.1 Flash",
+    blurb: "The V4 Flash refresh. Same pennies, steadier across a long tool run.",
+    inputUsdPerMillion: 0.08,
+    outputUsdPerMillion: 0.18,
+    contextWindow: 1048576,
+    reasoning: true,
+    harness: GusHarness.OpenCode
+  },
   {
     id: "deepseek/deepseek-v4-pro-0813",
     label: "DeepSeek V4 Pro",
@@ -18778,6 +18788,18 @@ var AuditActor;
   AuditActor2["System"] = "system";
   AuditActor2["Anonymous"] = "anonymous";
 })(AuditActor || (AuditActor = {}));
+var AuditResource;
+(function(AuditResource2) {
+  AuditResource2["Members"] = "members";
+  AuditResource2["Connections"] = "connections";
+  AuditResource2["Pages"] = "pages";
+  AuditResource2["Spaces"] = "spaces";
+  AuditResource2["Tables"] = "tables";
+  AuditResource2["Agents"] = "agents";
+  AuditResource2["Automation"] = "automation";
+  AuditResource2["Organization"] = "organization";
+  AuditResource2["Tools"] = "tools";
+})(AuditResource || (AuditResource = {}));
 var AuditTier;
 (function(AuditTier2) {
   AuditTier2["Critical"] = "critical";
@@ -18890,7 +18912,8 @@ var AUDIT_RETENTION_DAYS = {
 };
 var AUDIT_GROUPS = [
   {
-    label: "Identity and access",
+    resource: AuditResource.Members,
+    label: "Members and tokens",
     actions: [
       AuditAction.AccessDenied,
       AuditAction.MemberSignedIn,
@@ -18904,7 +18927,8 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "Connections",
+    resource: AuditResource.Connections,
+    label: "Connected apps",
     actions: [
       AuditAction.ConnectionCreated,
       AuditAction.ConnectionReconnected,
@@ -18916,23 +18940,34 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "Knowledge",
+    resource: AuditResource.Pages,
+    label: "Pages",
     actions: [
       AuditAction.PageCreated,
       AuditAction.PageUpdated,
       AuditAction.PageDeleted,
       AuditAction.PageMoved,
       AuditAction.PageShared,
-      AuditAction.PageUnshared,
+      AuditAction.PageUnshared
+    ]
+  },
+  {
+    resource: AuditResource.Spaces,
+    label: "Spaces",
+    actions: [
       AuditAction.SpaceCreated,
       AuditAction.SpaceRenamed,
       AuditAction.SpaceDeleted,
-      AuditAction.SpaceAccessChanged,
-      AuditAction.TableCreated,
-      AuditAction.TableDeleted
+      AuditAction.SpaceAccessChanged
     ]
   },
   {
+    resource: AuditResource.Tables,
+    label: "Tables",
+    actions: [AuditAction.TableCreated, AuditAction.TableDeleted]
+  },
+  {
+    resource: AuditResource.Agents,
     label: "Agents and channels",
     actions: [
       AuditAction.AgentCreated,
@@ -18943,7 +18978,8 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "Automation",
+    resource: AuditResource.Automation,
+    label: "Workflows and kits",
     actions: [
       AuditAction.KitInstalled,
       AuditAction.KitRemoved,
@@ -18954,10 +18990,7 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "MCP calls",
-    actions: [AuditAction.McpToolCall, AuditAction.McpRequest]
-  },
-  {
+    resource: AuditResource.Organization,
     label: "Organization",
     actions: [
       AuditAction.OrganizationRenamed,
@@ -18965,10 +18998,17 @@ var AUDIT_GROUPS = [
       AuditAction.OrganizationModelChanged,
       AuditAction.OrganizationDeleted
     ]
+  },
+  {
+    resource: AuditResource.Tools,
+    label: "Tool and MCP calls",
+    actions: [AuditAction.McpToolCall, AuditAction.McpRequest]
   }
 ];
+var AUDIT_RESOURCES = Object.fromEntries(AUDIT_GROUPS.flatMap((group) => group.actions.map((action) => [action, group.resource])));
 var AUDIT_LISTED_ACTIONS = AUDIT_GROUPS.flatMap((group) => group.actions);
-var AUDIT_DEFAULT_ACTIONS = AUDIT_LISTED_ACTIONS.filter((action) => AUDIT_TIERS[action] !== AuditTier.Volume);
+var AUDIT_QUIET_ACTIONS = [AuditAction.McpRequest, AuditAction.PageRead, AuditAction.PageWrite];
+var AUDIT_DEFAULT_ACTIONS = AUDIT_LISTED_ACTIONS.filter((action) => !AUDIT_QUIET_ACTIONS.includes(action));
 var AUDIT_LABELS = {
   [AuditAction.AccessDenied]: "Denied request",
   [AuditAction.MemberSignedIn]: "Signed in",
@@ -19018,6 +19058,11 @@ var AUDIT_LABELS = {
   [AuditAction.PageRead]: "Read page",
   [AuditAction.PageWrite]: "Wrote page"
 };
+var AuditAppSchema = external_exports.object({
+  kind: external_exports.string(),
+  id: external_exports.string().optional(),
+  name: external_exports.string().optional()
+});
 var AuditTargetSchema = external_exports.object({
   type: external_exports.string(),
   id: external_exports.string().optional(),
@@ -19035,6 +19080,8 @@ var AuditEntrySchema = external_exports.object({
     image: external_exports.string().optional()
   }),
   target: AuditTargetSchema.optional(),
+  app: AuditAppSchema.optional(),
+  outcome: external_exports.enum(["ok", "error"]).optional(),
   data: external_exports.record(external_exports.string(), external_exports.unknown()),
   ip: external_exports.string().optional(),
   userAgent: external_exports.string().optional(),
@@ -19049,15 +19096,38 @@ var AuditSummarySchema = external_exports.object({
 var AuditQuerySchema = external_exports.object({
   days: external_exports.coerce.number().int().refine((value) => AUDIT_RANGES.includes(value)).default(AUDIT_DEFAULT_DAYS),
   page: external_exports.coerce.number().int().min(1).default(1),
-  action: external_exports.union([external_exports.enum(AuditAction), external_exports.array(external_exports.enum(AuditAction))]).optional().transform((value) => value === void 0 ? void 0 : Array.isArray(value) ? value : [value]),
+  action: manyOf(external_exports.enum(AuditAction)),
   actor: external_exports.enum(AuditActor).optional(),
-  accountId: external_exports.string().optional()
+  account: manyOf(external_exports.string()),
+  app: manyOf(external_exports.string())
+});
+var AuditFacetsSchema = external_exports.object({
+  actions: external_exports.record(external_exports.string(), external_exports.number()),
+  accounts: external_exports.array(external_exports.object({
+    accountId: external_exports.string(),
+    name: external_exports.string(),
+    email: external_exports.string().optional(),
+    image: external_exports.string().optional(),
+    count: external_exports.number()
+  })),
+  apps: external_exports.array(external_exports.object({ kind: external_exports.string(), name: external_exports.string().optional(), count: external_exports.number() }))
 });
 var AuditResponseSchema = external_exports.object({
   summary: AuditSummarySchema,
   entries: external_exports.array(AuditEntrySchema),
+  facets: AuditFacetsSchema,
   total: external_exports.number()
 });
+var VERB_OVERRIDES = {
+  [AuditAction.McpToolCall]: "called",
+  [AuditAction.McpRequest]: "called",
+  [AuditAction.PageRead]: "read",
+  [AuditAction.PageWrite]: "written",
+  [AuditAction.AdminEnteredOrg]: "opened as support"
+};
+function manyOf(schema) {
+  return external_exports.union([schema, external_exports.array(schema)]).optional().transform((value) => value === void 0 ? void 0 : Array.isArray(value) ? value : [value]);
+}
 
 // ../../shared/dist/organization/install-admin.js
 var InstallCredentialNameSchema = external_exports.enum([
@@ -19310,7 +19380,8 @@ var OAuthCallbackQuerySchema = external_exports.object({
 });
 var ListConnectionsResponseSchema = external_exports.object({
   connections: external_exports.array(ConnectionSchema),
-  canManage: external_exports.boolean()
+  canManage: external_exports.boolean(),
+  egressIp: external_exports.string()
 });
 var CONNECTION_CATEGORIES = [
   "Sales & support",
@@ -19751,6 +19822,10 @@ var GUS_MAX_TURN_MS = 45 * 60 * 1e3;
 // ../../shared/dist/gus/workstation.js
 var WORKSTATION_CORES = 2;
 var WORKSTATION_RECIPE_MAX_CHARS = 8e3;
+var WORKSTATION_MAX_STEPS = 20;
+var WORKSTATION_STEP_NAME_MAX_CHARS = 60;
+var WORKSTATION_STEP_DETAIL_MAX_CHARS = 600;
+var WORKSTATION_MAX_REPOS = 20;
 var WORKSTATION_ALLOWLIST_MAX_HOSTS = 50;
 var WORKSTATION_HOST_MAX_CHARS = 200;
 var SANDBOX_BROWSERS_PATH = "/vercel/sandbox/.cache/ms-playwright";
@@ -19762,14 +19837,53 @@ var WORKSTATION_SPECS = {
 };
 var PLAYWRIGHT_VERSION = "1.49.1";
 var WORKSTATION_BASE_RECIPE = [
-  "# Craftspace base v2: a headless browser, ready to use.",
+  "# Craftspace base v3: a headless browser, ready to use.",
+  `export PLAYWRIGHT_BROWSERS_PATH=${SANDBOX_BROWSERS_PATH}`,
   "sudo dnf install -y nss nspr atk at-spi2-atk at-spi2-core cups-libs libdrm libxkbcommon \\",
   "  libXcomposite libXdamage libXrandr libXfixes libXrender mesa-libgbm pango alsa-lib >/dev/null",
-  `PLAYWRIGHT_BROWSERS_PATH=${SANDBOX_BROWSERS_PATH} npx --yes playwright@${PLAYWRIGHT_VERSION} install chromium`
+  `npx --yes playwright@${PLAYWRIGHT_VERSION} install chromium`
 ].join("\n");
 var HostSchema = external_exports.string().trim().min(1).max(WORKSTATION_HOST_MAX_CHARS).regex(/^[A-Za-z0-9*._:-]+$/, "A host is a domain, optionally with a leading *. and a :port.");
+var WorkstationStepSchema = external_exports.object({
+  id: external_exports.string().min(1).max(64),
+  name: external_exports.string().trim().min(1).max(WORKSTATION_STEP_NAME_MAX_CHARS),
+  script: external_exports.string().max(WORKSTATION_RECIPE_MAX_CHARS)
+});
+var WorkstationRepoSchema = external_exports.object({
+  name: external_exports.string().trim().min(3).max(200).regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, "A repo is owner/name."),
+  ref: external_exports.string().trim().min(1).max(200)
+});
+var WORKSTATION_SEED_STEPS = [
+  { id: "step_claude_code", name: "Claude Code", script: "npm install -g @anthropic-ai/claude-code" },
+  { id: "step_codex", name: "Codex", script: "npm install -g @openai/codex" },
+  {
+    id: "step_github_cli",
+    name: "GitHub CLI",
+    script: [
+      "if command -v gh >/dev/null; then exit 0; fi",
+      "if command -v brew >/dev/null; then brew install gh",
+      "elif command -v dnf >/dev/null; then sudo -n dnf install -y gh",
+      "elif command -v apt-get >/dev/null; then sudo -n apt-get install -y gh",
+      'else echo "no package manager here, install the GitHub CLI by hand" >&2; exit 1',
+      "fi"
+    ].join("\n")
+  },
+  {
+    id: "step_chrome",
+    name: "Chrome for Playwright",
+    script: `npx --yes playwright@${PLAYWRIGHT_VERSION} install chromium`
+  }
+];
+var WorkstationStepResultSchema = external_exports.object({
+  id: external_exports.string().min(1).max(64),
+  name: external_exports.string().max(WORKSTATION_STEP_NAME_MAX_CHARS),
+  ok: external_exports.boolean(),
+  detail: external_exports.string().max(WORKSTATION_STEP_DETAIL_MAX_CHARS),
+  ms: external_exports.number().int().nonnegative()
+});
 var WorkstationSchema = external_exports.object({
-  recipe: external_exports.string(),
+  steps: external_exports.array(WorkstationStepSchema),
+  repos: external_exports.array(WorkstationRepoSchema),
   allowlist: external_exports.array(external_exports.string()),
   templateId: external_exports.string().nullable(),
   publicKey: external_exports.string(),
@@ -19777,13 +19891,14 @@ var WorkstationSchema = external_exports.object({
   updatedByName: external_exports.string().nullable()
 });
 var SaveWorkstationBodySchema = external_exports.object({
-  recipe: external_exports.string().max(WORKSTATION_RECIPE_MAX_CHARS),
+  steps: external_exports.array(WorkstationStepSchema).max(WORKSTATION_MAX_STEPS),
+  repos: external_exports.array(WorkstationRepoSchema).max(WORKSTATION_MAX_REPOS),
   allowlist: external_exports.array(HostSchema).max(WORKSTATION_ALLOWLIST_MAX_HOSTS)
 });
 var WorkstationResponseSchema = external_exports.object({ workstation: WorkstationSchema });
 
 // ../../shared/dist/machines/machine.js
-var CLI_VERSION = "0.4.3";
+var CLI_VERSION = "0.6.0";
 var CLI_PACKAGE = "@craftspace/cli";
 var CLI_INSTALL = `npm i -g ${CLI_PACKAGE}`;
 var MACHINE_BEAT_INTERVAL_MS = 15e3;
@@ -19804,13 +19919,20 @@ var MachineAuthorizedKeySchema = external_exports.object({
   addedByName: external_exports.string(),
   addedAt: external_exports.coerce.date()
 });
-var MACHINE_TOOLS = ["brain", "claude", "codex", "git", "chrome", "ssh"];
+var MACHINE_TOOLS = ["brain", "ssh"];
 var MachineToolIdSchema = external_exports.enum(MACHINE_TOOLS);
 var MachineToolSchema = external_exports.object({
   id: MachineToolIdSchema,
   ok: external_exports.boolean(),
   detail: external_exports.string().max(200)
 });
+var MachineRepoSchema = external_exports.object({
+  name: external_exports.string().max(200),
+  ref: external_exports.string().max(200),
+  path: external_exports.string().max(400),
+  ok: external_exports.boolean(),
+  detail: external_exports.string().max(300)
+});
 var MachineSchema = external_exports.object({
   id: external_exports.string(),
   tokenId: external_exports.string(),
@@ -19832,6 +19954,10 @@ var MachineSchema = external_exports.object({
   state: MachineStateSchema,
   sessions: external_exports.array(MachineSessionSchema),
   tools: external_exports.array(MachineToolSchema),
+  environment: external_exports.array(WorkstationStepResultSchema),
+  templateId: external_exports.string().nullable(),
+  workDir: external_exports.string().nullable(),
+  repos: external_exports.array(MachineRepoSchema),
   authorizedKeys: external_exports.array(MachineAuthorizedKeySchema),
   lastBeatAt: external_exports.coerce.date().nullable(),
   lastAskedAt: external_exports.coerce.date().nullable(),
@@ -19894,12 +20020,22 @@ var MachineBeatBodySchema = external_exports.object({
   sessions: external_exports.array(MachineSessionSchema).max(50),
   runs: external_exports.array(MachineRunReportSchema).max(20).default([]),
   tools: external_exports.array(MachineToolSchema).max(10).default([]),
+  environment: external_exports.array(WorkstationStepResultSchema).max(WORKSTATION_MAX_STEPS).default([]),
+  templateId: external_exports.string().max(64).nullable().default(null),
+  workDir: external_exports.string().max(400).optional(),
+  repos: external_exports.array(MachineRepoSchema).max(WORKSTATION_MAX_REPOS).default([]),
   sshUser: external_exports.string().min(1).max(64).optional()
 });
+var MachineEnvironmentSchema = external_exports.object({
+  templateId: external_exports.string().nullable(),
+  steps: external_exports.array(WorkstationStepSchema),
+  repos: external_exports.array(WorkstationRepoSchema).default([])
+});
 var MachineBeatResponseSchema = external_exports.object({
   cli: external_exports.object({ version: external_exports.string(), url: external_exports.string(), sha256: external_exports.string() }).nullable(),
   work: external_exports.array(MachineWorkSchema),
-  authorizedKeys: external_exports.array(external_exports.string())
+  authorizedKeys: external_exports.array(external_exports.string()),
+  environment: MachineEnvironmentSchema
 });
 var AddMachineKeyBodySchema = external_exports.object({
   key: external_exports.string().min(60).max(4e3),
@@ -20251,11 +20387,11 @@ var MemberActivityListResponse = external_exports.object({
 });
 
 // dist/machine.js
-import { execFile as execFile4, spawn as spawn2 } from "node:child_process";
-import { mkdir, readFile as readFile2, readdir, rm, writeFile } from "node:fs/promises";
+import { execFile as execFile3, spawn as spawn2 } from "node:child_process";
+import { mkdir as mkdir2, readFile as readFile2, readdir, rm, writeFile } from "node:fs/promises";
 import os5 from "node:os";
 import path4 from "node:path";
-import { promisify as promisify4 } from "node:util";
+import { promisify as promisify2 } from "node:util";
 
 // ../../../node_modules/@inquirer/core/dist/lib/key.js
 var keybindings = ["emacs", "vim"];
@@ -21225,11 +21361,11 @@ function readlineWidth() {
 
 // ../../../node_modules/@inquirer/core/dist/lib/pagination/use-pagination.js
 function usePointerPosition({ active, renderedItems, pageSize, loop }) {
-  const state = useRef({
+  const state2 = useRef({
     lastPointer: active,
     lastActive: void 0
   });
-  const { lastPointer, lastActive } = state.current;
+  const { lastPointer, lastActive } = state2.current;
   const middle = Math.floor(pageSize / 2);
   const renderedLength = renderedItems.reduce((acc, item) => acc + item.length, 0);
   const defaultPointerPosition = renderedItems.slice(0, active).reduce((acc, item) => acc + item.length, 0);
@@ -21269,8 +21405,8 @@ function usePointerPosition({ active, renderedItems, pageSize, loop }) {
       );
     }
   }
-  state.current.lastPointer = pointer;
-  state.current.lastActive = active;
+  state2.current.lastPointer = pointer;
+  state2.current.lastActive = active;
   return pointer;
 }
 function usePagination({ items, active, renderItem, pageSize, loop = true }) {
@@ -22121,9 +22257,50 @@ var dist_default6 = createPrompt((config2, done) => {
   return `${lines}${cursorHide}`;
 });
 
+// dist/probe.js
+import net from "node:net";
+import { readFile } from "node:fs/promises";
+import os from "node:os";
+import path2 from "node:path";
+var probe = {
+  async tools({ mcpPath = path2.join(os.homedir(), ".mcp.json") } = {}) {
+    return Promise.all([brainWired(mcpPath), sshListening()]);
+  }
+};
+async function brainWired(mcpPath) {
+  const raw = await readFile(mcpPath, "utf8").catch(() => null);
+  if (raw === null)
+    return { id: "brain", ok: false, detail: `no ${short(mcpPath)} on this machine` };
+  const parsed = JSON.parse(raw);
+  const servers = parsed?.mcpServers;
+  const wired = servers !== void 0 && servers !== null && "craftspace" in servers;
+  return {
+    id: "brain",
+    ok: wired,
+    detail: wired ? short(mcpPath) : `${short(mcpPath)} has no craftspace entry`
+  };
+}
+function sshListening() {
+  return new Promise((resolve) => {
+    const socket = net.connect({ host: "127.0.0.1", port: 22 });
+    const answer = (ok, detail) => {
+      socket.destroy();
+      resolve({ id: "ssh", ok, detail });
+    };
+    socket.setTimeout(SSH_PROBE_TIMEOUT_MS);
+    socket.on("connect", () => answer(true, "sshd is listening on port 22"));
+    socket.on("timeout", () => answer(false, "nothing answered on port 22"));
+    socket.on("error", () => answer(false, "sshd is not running, so nobody can open a terminal here"));
+  });
+}
+function short(target) {
+  return target.startsWith(os.homedir()) ? `~${target.slice(os.homedir().length)}` : target;
+}
+var SSH_PROBE_TIMEOUT_MS = 1500;
+
 // dist/run.js
 import { spawn } from "node:child_process";
-import os from "node:os";
+import os2 from "node:os";
 var runner = {
   attended(argv) {
     return new Promise((resolve) => {
@@ -22132,7 +22309,7 @@ var runner = {
       child.on("close", (code) => resolve(code ?? 0));
     });
   },
-  async unattended({ work, onProgress }) {
+  async unattended({ work, cwd = os2.homedir(), onProgress }) {
     const argv = headlessArgv(work);
     const raw = argv[0] === "script";
     let output = "";
@@ -22162,7 +22339,7 @@ var runner = {
     const code = await new Promise((resolve) => {
       const child = spawn(argv[0], argv.slice(1), {
         stdio: ["ignore", "pipe", "pipe"],
-        cwd: os.homedir(),
+        cwd,
         env: {
           ...process.env,
           TERM: process.env.TERM ?? "xterm-256color",
@@ -22259,112 +22436,10 @@ function parseJson(line) {
 }
 
 // dist/setup.js
-import { execFile as execFile2 } from "node:child_process";
+import { execFile } from "node:child_process";
+import { mkdir } from "node:fs/promises";
 import os4 from "node:os";
 import path3 from "node:path";
-import { promisify as promisify2 } from "node:util";
-
-// dist/probe.js
-import { execFile } from "node:child_process";
-import net from "node:net";
-import { access, readFile } from "node:fs/promises";
-import os2 from "node:os";
-import path2 from "node:path";
-import { promisify } from "node:util";
-var run = promisify(execFile);
-var probe = {
-  async tools({ mcpPath = path2.join(os2.homedir(), ".mcp.json") } = {}) {
-    const [brain, claude, codex, git, chrome, ssh] = await Promise.all([
-      brainWired(mcpPath),
-      version2({ id: "claude", command: "claude" }),
-      version2({ id: "codex", command: "codex" }),
-      gitAndGithub(),
-      chromeInstalled(),
-      sshListening()
-    ]);
-    return [brain, claude, codex, git, chrome, ssh];
-  }
-};
-async function brainWired(mcpPath) {
-  const raw = await readFile(mcpPath, "utf8").catch(() => null);
-  if (raw === null)
-    return { id: "brain", ok: false, detail: `no ${short(mcpPath)} on this machine` };
-  const parsed = JSON.parse(raw);
-  const servers = parsed?.mcpServers;
-  const wired = servers !== void 0 && servers !== null && "craftspace" in servers;
-  return {
-    id: "brain",
-    ok: wired,
-    detail: wired ? short(mcpPath) : `${short(mcpPath)} has no craftspace entry`
-  };
-}
-async function version2({ id, command }) {
-  const found = await firstLine(command, ["--version"]);
-  if (found.ran)
-    return { id, ok: true, detail: found.line };
-  return { id, ok: false, detail: found.why === "absent" ? "not installed" : "installed, but it will not report a version" };
-}
-async function gitAndGithub() {
-  const git = await firstLine("git", ["--version"]);
-  if (!git.ran)
-    return { id: "git", ok: false, detail: "git is not installed" };
-  const gh = await firstLine("gh", ["--version"]);
-  if (!gh.ran)
-    return { id: "git", ok: false, detail: `${git.line} \xB7 the GitHub CLI is not installed yet` };
-  const account = await githubAccount();
-  return {
-    id: "git",
-    ok: account !== null,
-    detail: account === null ? `${git.line} \xB7 ${gh.line}, run gh auth login on this machine` : `${git.line} \xB7 ${gh.line}, signed in as ${account}`
-  };
-}
-async function githubAccount() {
-  const raw = await readFile(path2.join(os2.homedir(), ".config", "gh", "hosts.yml"), "utf8").catch(() => null);
-  return raw === null ? null : githubUser(raw);
-}
-function githubUser(hostsYml) {
-  return /^ {4}user: *(\S+) *$/m.exec(hostsYml)?.[1] ?? null;
-}
-async function chromeInstalled() {
-  for (const command of [...MAC_CHROME, ...LINUX_CHROME]) {
-    const found = await firstLine(command, ["--version"]);
-    if (found.ran)
-      return { id: "chrome", ok: true, detail: found.line };
-  }
-  return { id: "chrome", ok: false, detail: "not installed yet, so browser runs will fail" };
-}
-function sshListening() {
-  return new Promise((resolve) => {
-    const socket = net.connect({ host: "127.0.0.1", port: 22 });
-    const answer = (ok, detail) => {
-      socket.destroy();
-      resolve({ id: "ssh", ok, detail });
-    };
-    socket.setTimeout(SSH_PROBE_TIMEOUT_MS);
-    socket.on("connect", () => answer(true, "sshd is listening on port 22"));
-    socket.on("timeout", () => answer(false, "nothing answered on port 22"));
-    socket.on("error", () => answer(false, "sshd is not running, so nobody can ssh in"));
-  });
-}
-async function firstLine(command, args) {
-  if (command.includes("/")) {
-    const reachable = await access(command).then(() => true, () => false);
-    if (!reachable)
-      return { ran: false, why: "absent" };
-  }
-  const answer = await run(command, args, { timeout: PROBE_TIMEOUT_MS }).catch((thrown) => thrown);
-  if (answer instanceof Error)
-    return { ran: false, why: answer.code === "ENOENT" ? "absent" : "broken" };
-  const line = answer.stdout.split("\n")[0]?.trim() ?? "";
-  return line === "" ? { ran: false, why: "broken" } : { ran: true, line: line.slice(0, 200) };
-}
-function short(target) {
-  return target.startsWith(os2.homedir()) ? `~${target.slice(os2.homedir().length)}` : target;
-}
-var MAC_CHROME = ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"];
-var LINUX_CHROME = ["google-chrome", "google-chrome-stable", "chromium"];
-var PROBE_TIMEOUT_MS = 5e3;
-var SSH_PROBE_TIMEOUT_MS = 1500;
 
 // node_modules/chalk/source/vendor/ansi-styles/index.js
 var ANSI_BACKGROUND_OFFSET = 10;
@@ -22650,10 +22725,10 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     return 3;
   }
   if ("TERM_PROGRAM" in env) {
-    const version3 = Number.parseInt((env.TERM_PROGRAM_VERSION || "").split(".")[0], 10);
+    const version2 = Number.parseInt((env.TERM_PROGRAM_VERSION || "").split(".")[0], 10);
     switch (env.TERM_PROGRAM) {
       case "iTerm.app": {
-        return version3 >= 3 ? 3 : 2;
+        return version2 >= 3 ? 3 : 2;
       }
       case "Apple_Terminal": {
         return 2;
@@ -22929,7 +23004,6 @@ var LABEL_WIDTH = 13;
 var BAR_CELLS = 10;
 
 // dist/setup.js
-var run2 = promisify2(execFile2);
 var setup = {
   widenPath() {
     const current = (process.env.PATH ?? "").split(path3.delimiter).filter((entry) => entry !== "");
@@ -22937,44 +23011,89 @@ var setup = {
     if (missing.length > 0)
       process.env.PATH = [...current, ...missing].join(path3.delimiter);
   },
-  async run({ install, rewire: rewire2, say }) {
-    const found = await probe.tools();
-    if (!install)
-      return withReasons(found);
-    const repairs = { ...REPAIRS, ...rewire2 === void 0 ? {} : { brain: { name: "the brain", fix: rewire2 } } };
-    const broken = found.filter((tool) => !tool.ok && repairs[tool.id] !== void 0 && isDue(tool.id));
-    if (broken.length === 0)
-      return withReasons(found);
-    let ready = 0;
-    for (const [index, tool] of broken.entries()) {
-      const repair = repairs[tool.id];
-      if (repair === void 0)
-        continue;
-      say?.(ui.progress({ name: repair.name, done: index, total: broken.length }));
-      tried.set(tool.id, Date.now());
-      const failed = await repair.fix().then(() => null, (error51) => firstLine2(error51.message));
-      if (failed === null)
-        reasons.delete(tool.id);
-      else
-        reasons.set(tool.id, failed);
-      if (failed === null)
-        ready += 1;
-      say?.(`${ui.clear()}${failed === null ? ui.ok(repair.name) : ui.bad(repair.name, failed)}`);
+  workDir() {
+    return path3.join(os4.homedir(), WORK_DIR_NAME);
+  },
+  async cloneRepos({ repos, say }) {
+    if (repos.length === 0)
+      return [];
+    await mkdir(setup.workDir(), { recursive: true });
+    const cloned = [];
+    for (const [index, repo] of repos.entries()) {
+      say?.(ui.progress({ name: repo.name, done: index, total: repos.length }));
+      const at = path3.join(setup.workDir(), repo.name.split("/").pop() ?? repo.name);
+      const outcome = await checkout(repo, at);
+      cloned.push({ name: repo.name, ref: repo.ref, path: at, ...outcome });
+      say?.(`${ui.clear()}${outcome.ok ? ui.ok(`${repo.name} \xB7 ${outcome.detail}`) : ui.bad(repo.name, outcome.detail)}`);
+    }
+    say?.(ui.tally({ done: cloned.filter((repo) => repo.ok).length, total: cloned.length, noun: "cloned" }));
+    return cloned;
+  },
+  async runSteps({ steps, say }) {
+    const results = [];
+    for (const [index, step] of steps.entries()) {
+      say?.(ui.progress({ name: step.name, done: index, total: steps.length }));
+      const startedAt = Date.now();
+      const outcome = await runScript(step.script);
+      results.push({ ...outcome, id: step.id, name: step.name, ms: Date.now() - startedAt });
+      say?.(`${ui.clear()}${outcome.ok ? ui.ok(step.name) : ui.bad(step.name, outcome.detail)}`);
+    }
+    if (results.length > 0) {
+      say?.(ui.tally({ done: results.filter((result) => result.ok).length, total: results.length, noun: "ready" }));
     }
-    say?.(ui.tally({ done: ready, total: broken.length, noun: "ready" }));
-    return withReasons(await probe.tools());
+    return results;
   }
 };
-function isDue(id) {
-  const last = tried.get(id);
-  return last === void 0 || Date.now() - last > RETRY_AFTER_MS;
-}
-function withReasons(tools2) {
-  return tools2.map((tool) => {
-    const reason = tool.ok ? void 0 : reasons.get(tool.id);
-    return reason === void 0 ? tool : { ...tool, detail: `${tool.detail} \xB7 ${reason}`.slice(0, 200) };
+async function checkout(repo, at) {
+  const opened = await git(["-C", at, "rev-parse", "--abbrev-ref", "HEAD"]);
+  if (!opened.ok) {
+    const url2 = `https://github.com/${repo.name}.git`;
+    const made = await git(["clone", "--depth", String(CLONE_DEPTH), "--branch", repo.ref, url2, at]);
+    if (!made.ok)
+      return { ok: false, detail: made.detail };
+    return { ok: true, detail: await state({ repo, at, branch: repo.ref, dirty: false }) };
+  }
+  const branch = opened.detail;
+  const dirty = (await git(["-C", at, "status", "--porcelain"])).detail !== "";
+  const pulled = branch === repo.ref && !dirty ? await git(["-C", at, "pull", "--ff-only"]) : null;
+  return { ok: true, detail: await state({ repo, at, branch, dirty, pulled }) };
+}
+async function state({ repo, at, branch, dirty, pulled }) {
+  const head = await git(["-C", at, "rev-parse", "--short", "HEAD"]);
+  return [
+    `${branch} @ ${head.detail}`,
+    branch === repo.ref ? "" : `your team asks for ${repo.ref}`,
+    dirty ? "uncommitted work here, so it was left alone" : "",
+    pulled?.ok === false ? `could not pull: ${pulled.detail}` : ""
+  ].filter((part) => part !== "").join(" \xB7 ");
+}
+function git(argv) {
+  return new Promise((resolve) => {
+    execFile("git", argv, {
+      timeout: CLONE_TIMEOUT_MS,
+      maxBuffer: SCRIPT_BUFFER_BYTES,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "", GIT_LFS_SKIP_SMUDGE: "1" }
+    }, (error51, stdout, stderr) => {
+      if (error51 === null)
+        return resolve({ ok: true, detail: stdout.trim() });
+      resolve({ ok: false, detail: lastLines(`${stderr}
+${stdout}`) || error51.message.split("\n")[0] || "git failed" });
+    });
+  });
+}
+function runScript(script) {
+  return new Promise((resolve) => {
+    execFile("/bin/sh", ["-e", "-c", script], { timeout: STEP_TIMEOUT_MS, maxBuffer: SCRIPT_BUFFER_BYTES }, (error51, stdout, stderr) => {
+      if (error51 === null)
+        return resolve({ ok: true, detail: lastLines(stdout) });
+      resolve({ ok: false, detail: lastLines(`${stderr}
+${stdout}`) || error51.message.split("\n")[0] || "it failed" });
+    });
   });
 }
+function lastLines(output) {
+  return output.split("\n").map((line) => line.trim()).filter((line) => line !== "").slice(-KEPT_LINES).join(" \xB7 ").slice(0, WORKSTATION_STEP_DETAIL_MAX_CHARS);
+}
 function toolDirs() {
   const prefix = process.env.npm_config_prefix;
   return [
@@ -22986,56 +23105,17 @@ function toolDirs() {
     "/usr/local/bin"
   ];
 }
-var REPAIRS = {
-  claude: { name: "Claude Code", fix: () => npmGlobal("@anthropic-ai/claude-code") },
-  codex: { name: "Codex", fix: () => npmGlobal("@openai/codex") },
-  git: {
-    name: "the GitHub CLI",
-    fix: async () => {
-      if (await firstAvailable(["gh"]) !== null)
-        return;
-      await installPackage({ brew: ["gh"], apt: ["gh"], dnf: ["gh"] });
-    }
-  },
-  chrome: {
-    name: "Google Chrome",
-    fix: () => installPackage({ brew: ["--cask", "google-chrome"], apt: ["chromium"], dnf: ["chromium"] })
-  }
-};
-async function npmGlobal(name) {
-  await run2("npm", ["install", "-g", name], { timeout: INSTALL_TIMEOUT_MS });
-}
-async function installPackage({ brew, apt, dnf }) {
-  if (process.platform === "darwin") {
-    await run2("brew", ["install", ...brew], { timeout: INSTALL_TIMEOUT_MS });
-    return;
-  }
-  const manager = await firstAvailable(["apt-get", "dnf"]);
-  if (manager === null)
-    throw new Error("no package manager this CLI knows how to drive");
-  const packages = manager === "apt-get" ? apt : dnf;
-  await run2("sudo", ["-n", manager, "install", "-y", ...packages], { timeout: INSTALL_TIMEOUT_MS });
-}
-async function firstAvailable(commands) {
-  for (const command of commands) {
-    const there = await run2("/bin/sh", ["-c", `command -v ${command}`]).then(() => true, () => false);
-    if (there)
-      return command;
-  }
-  return null;
-}
-function firstLine2(message) {
-  return message.split("\n")[0] ?? "it failed";
-}
-var tried = /* @__PURE__ */ new Map();
-var reasons = /* @__PURE__ */ new Map();
-var INSTALL_TIMEOUT_MS = 18e4;
-var RETRY_AFTER_MS = 216e5;
+var WORK_DIR_NAME = "craftspace";
+var CLONE_DEPTH = 20;
+var CLONE_TIMEOUT_MS = 9e5;
+var STEP_TIMEOUT_MS = 6e5;
+var SCRIPT_BUFFER_BYTES = 4 * 1024 * 1024;
+var KEPT_LINES = 3;
 
 // dist/update.js
-import { execFile as execFile3 } from "node:child_process";
-import { promisify as promisify3 } from "node:util";
-var run3 = promisify3(execFile3);
+import { execFile as execFile2 } from "node:child_process";
+import { promisify } from "node:util";
+var run = promisify(execFile2);
 var update = {
   async latest() {
     const answer = await fetch(`${REGISTRY}/${CLI_PACKAGE}/latest`, {
@@ -23045,17 +23125,17 @@ var update = {
     if (answer === null || !answer.ok)
       return null;
     const body = await answer.json().catch(() => null);
-    const version3 = isRecord(body) ? body.version : void 0;
-    return typeof version3 === "string" && isNewer(version3) ? version3 : null;
+    const version2 = isRecord(body) ? body.version : void 0;
+    return typeof version2 === "string" && isNewer(version2) ? version2 : null;
   },
   async toLatest() {
-    const version3 = await update.latest();
-    if (version3 === null)
+    const version2 = await update.latest();
+    if (version2 === null)
       return null;
-    const installed = await run3("npm", ["install", "--global", "--no-fund", `${CLI_PACKAGE}@${version3}`], {
-      timeout: INSTALL_TIMEOUT_MS2
+    const installed = await run("npm", ["install", "--global", "--no-fund", `${CLI_PACKAGE}@${version2}`], {
+      timeout: INSTALL_TIMEOUT_MS
     }).then(() => true, () => false);
-    return installed ? version3 : null;
+    return installed ? version2 : null;
   }
 };
 function isNewer(candidate, current = CLI_VERSION) {
@@ -23069,18 +23149,18 @@ function isNewer(candidate, current = CLI_VERSION) {
   }
   return false;
 }
-function parts(version3) {
-  return (/^\d+\.\d+\.\d+/.exec(version3.trim())?.[0] ?? "").split(".").map(Number);
+function parts(version2) {
+  return (/^\d+\.\d+\.\d+/.exec(version2.trim())?.[0] ?? "").split(".").map(Number);
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
 var REGISTRY = "https://registry.npmjs.org";
 var REQUEST_TIMEOUT_MS = 1e4;
-var INSTALL_TIMEOUT_MS2 = 18e4;
+var INSTALL_TIMEOUT_MS = 18e4;
 
 // dist/machine.js
-var run4 = promisify4(execFile4);
+var run2 = promisify2(execFile3);
 var machine = {
   home() {
     return process.env.CRAFTSPACE_CLI_HOME ?? path4.join(os5.homedir(), ".craftspace");
@@ -23102,15 +23182,13 @@ var machine = {
       },
       schema: MachineLoginResponseSchema
     });
-    await mkdir(machine.home(), { recursive: true, mode: 448 });
+    await mkdir2(machine.home(), { recursive: true, mode: 448 });
     await writeFile(configPath(), JSON.stringify({ url: url2, machineId: answer.machine.id }, null, 2), { mode: 384 });
     await writeFile(tokenPath(), token, { mode: 384 });
     await writeAgentConfigs({ url: url2, token, writes: answer.write });
     await installService();
-    probed = {
-      at: Date.now(),
-      tools: await setup.run({ install, rewire, say: ui.say })
-    };
+    if (install)
+      await machine.beatOnce(ui.say);
     return answer.machine;
   },
   async controlPlane(override) {
@@ -23147,8 +23225,9 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
     const found = await withAuth(await signedInOrAsk(), (auth) => call({ ...auth, method: "GET", path: "/api/machines/me", schema: MachineSchema }));
     return { machine: found.value, url: found.auth.url };
   },
-  async beatOnce() {
+  async beatOnce(say) {
     const { url: url2, token } = await requireSignedIn();
+    const built = await readEnvironment();
     const answer = await call({
       url: url2,
       token,
@@ -23159,17 +23238,26 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
         ...load2(),
         sessions: await readSessions(),
         runs: drainReports(),
-        tools: await tools(),
+        tools: await checks(),
+        environment: built?.results ?? [],
+        templateId: built?.templateId ?? null,
+        workDir: setup.workDir(),
+        repos: built?.repos ?? [],
         sshUser: os5.userInfo().username
       },
       schema: MachineBeatResponseSchema
     });
     await writeAuthorizedKeys(answer.authorizedKeys);
+    const building2 = buildEnvironment(answer.environment, say);
+    if (say === void 0)
+      void building2.catch(() => void 0);
+    else
+      await building2;
     for (const work of answer.work) {
       if (running.has(work.id))
         continue;
       running.add(work.id);
-      void runner.unattended({ work, onProgress: report }).then(report).catch((error51) => report({ id: work.id, state: "failed", output: messageOf(error51) })).finally(() => running.delete(work.id));
+      void runner.unattended({ work, cwd: startIn(built), onProgress: report }).then(report).catch((error51) => report({ id: work.id, state: "failed", output: messageOf(error51) })).finally(() => running.delete(work.id));
     }
     return running.size > 0 || answer.work.length > 0;
   },
@@ -23178,7 +23266,7 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
     let busy = false;
     let checkedAt = 0;
     for (; ; ) {
-      if (!busy && Date.now() - checkedAt > UPDATE_EVERY_MS) {
+      if (!busy && (failures > 2 || Date.now() - checkedAt > UPDATE_EVERY_MS)) {
         checkedAt = Date.now();
         const moved = await update.toLatest();
         if (moved !== null) {
@@ -23240,7 +23328,7 @@ async function pick2(machines) {
     choices: machines.map((candidate) => ({
       name: `${candidate.name.padEnd(24)} ${candidate.state.padEnd(12)} ${specs(candidate)}  ${beat(candidate)}`,
       value: candidate,
-      description: candidate.sshAddress === null ? "No address yet, so nothing to open" : void 0
+      disabled: candidate.sshAddress === null ? "(no address yet, so nothing to open)" : false
     })),
     pageSize: 12
   });
@@ -23292,13 +23380,74 @@ ${ui.attention("No workstations here yet.")}
   ui.say("\n");
   return 1;
 }
-async function tools() {
+async function checks() {
   if (probed !== null && Date.now() - probed.at < PROBE_EVERY_MS)
     return probed.tools;
-  const found = await setup.run({ install: process.env.CRAFTSPACE_NO_INSTALL !== "1", rewire });
+  const first = await probe.tools();
+  const unwired = first.some((tool) => tool.id === "brain" && !tool.ok);
+  const found = unwired && installs() ? await rewire().then(() => probe.tools(), () => first) : first;
   probed = { at: Date.now(), tools: found };
   return found;
 }
+async function buildEnvironment(next, say) {
+  if (building || !installs() || next.templateId === null)
+    return;
+  const built = await readEnvironment();
+  const buildsSteps = buildIsDue(built, next.templateId);
+  const clonesRepos = cloneIsDue(built, next.repos);
+  if (!buildsSteps && !clonesRepos)
+    return;
+  building = true;
+  try {
+    let results = built?.results ?? [];
+    let repos = built?.repos ?? [];
+    if (buildsSteps) {
+      say?.(ui.heading(`Building the ${next.steps.length} setup scripts your team runs on every box`));
+      results = await setup.runSteps({ steps: next.steps, say });
+    }
+    if (clonesRepos) {
+      say?.(ui.heading(`Cloning the ${next.repos.length} repos your team works in, into ${setup.workDir()}`));
+      repos = await setup.cloneRepos({ repos: next.repos, say });
+      await acceptClaudeGates(["craftspace"], repos.filter((repo) => repo.ok).map((repo) => repo.path));
+    }
+    await writeEnvironment({ templateId: next.templateId, results, repos, at: Date.now() });
+  } finally {
+    building = false;
+  }
+}
+function cloneIsDue(built, wanted) {
+  const cloned = built?.repos ?? [];
+  if (wanted.length === 0 && cloned.length === 0)
+    return false;
+  if (wanted.length !== cloned.length)
+    return true;
+  const missing = wanted.some((repo) => !cloned.some((seen) => seen.name === repo.name && seen.ref === repo.ref && seen.ok));
+  return missing || Date.now() - (built?.at ?? 0) > REBUILD_AFTER_MS;
+}
+function startIn(built) {
+  return built?.repos.find((repo) => repo.ok)?.path ?? os5.homedir();
+}
+function buildIsDue(built, templateId) {
+  if (built === null || built.templateId !== templateId)
+    return true;
+  if (built.results.every((result) => result.ok))
+    return false;
+  return Date.now() - built.at > REBUILD_AFTER_MS;
+}
+async function readEnvironment() {
+  const raw = await readFile2(environmentPath(), "utf8").catch(() => null);
+  if (raw === null)
+    return null;
+  const parsed = BuiltSchema.safeParse(JSON.parse(raw));
+  return parsed.success ? parsed.data : null;
+}
+async function writeEnvironment(built) {
+  await mkdir2(machine.home(), { recursive: true, mode: 448 });
+  await writeFile(environmentPath(), JSON.stringify(built, null, 2), { mode: 384 });
+}
+function installs() {
+  return process.env.CRAFTSPACE_NO_INSTALL !== "1";
+}
 async function rewire() {
   const { url: url2, token } = await requireSignedIn();
   await writeAgentConfigs({ url: url2, token, writes: [] });
@@ -23359,7 +23508,7 @@ ${ui.note("Picking up where you left off.")}
 }
 async function openInBrowser(url2) {
   const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
-  await run4(opener, [url2]).catch(() => void 0);
+  await run2(opener, [url2]).catch(() => void 0);
 }
 function tokenIn(line) {
   return /cst_[A-Za-z0-9_-]+/.exec(line)?.[0];
@@ -23370,8 +23519,8 @@ async function ensureKey() {
   const existing = await readFile2(pub, "utf8").catch(() => null);
   if (existing !== null)
     return existing.trim();
-  await mkdir(machine.home(), { recursive: true, mode: 448 });
-  await run4("ssh-keygen", ["-t", "ed25519", "-N", "", "-q", "-f", priv, "-C", `craftspace-${os5.hostname()}`]);
+  await mkdir2(machine.home(), { recursive: true, mode: 448 });
+  await run2("ssh-keygen", ["-t", "ed25519", "-N", "", "-q", "-f", priv, "-C", `craftspace-${os5.hostname()}`]);
   return (await readFile2(pub, "utf8")).trim();
 }
 async function readConfig() {
@@ -23410,7 +23559,7 @@ ${KEYS_END}
   const next = `${trimEnd(before)}${trimEnd(before) === "" ? "" : "\n"}${block}${after.replace(/^\n/, "")}`;
   if (next === current)
     return;
-  await mkdir(path4.dirname(target), { recursive: true, mode: 448 });
+  await mkdir2(path4.dirname(target), { recursive: true, mode: 448 });
   await writeFile(target, next, { mode: 384 });
 }
 function trimEnd(text) {
@@ -23421,7 +23570,7 @@ async function writeAgentConfigs({ url: url2, token, writes }) {
   const owned = [];
   for (const write of planned) {
     const target = expand(write.path);
-    await mkdir(path4.dirname(target), { recursive: true });
+    await mkdir2(path4.dirname(target), { recursive: true });
     const current = await readFile2(target, "utf8").catch(() => null);
     if (current !== null)
       await writeFile(`${target}.craftspace-backup`, current, { flag: "wx" }).catch(() => void 0);
@@ -23436,22 +23585,29 @@ async function writeAgentConfigs({ url: url2, token, writes }) {
 function serversIn(writes) {
   return writes.flatMap((write) => isPlainObject3(write.contents.mcpServers) ? Object.keys(write.contents.mcpServers) : []);
 }
-async function acceptClaudeGates(servers) {
+async function acceptClaudeGates(servers, dirs = [os5.homedir()]) {
   const target = path4.join(os5.homedir(), ".claude.json");
   const raw = await readFile2(target, "utf8").catch(() => null);
   if (raw === null)
     return;
   const parsed = JSON.parse(raw);
   const projects = isPlainObject3(parsed.projects) ? parsed.projects : {};
-  const found = projects[os5.homedir()];
-  const here2 = isPlainObject3(found) ? { ...found } : {};
-  const enabled = /* @__PURE__ */ new Set([...Array.isArray(here2.enabledMcpjsonServers) ? here2.enabledMcpjsonServers : [], ...servers]);
-  if (here2.hasTrustDialogAccepted === true && enabled.size === asArray(here2.enabledMcpjsonServers).length)
+  const opened = { ...projects };
+  let moved = false;
+  for (const dir of dirs) {
+    const found = opened[dir];
+    const here2 = isPlainObject3(found) ? { ...found } : {};
+    const enabled = /* @__PURE__ */ new Set([...asArray(here2.enabledMcpjsonServers), ...servers]);
+    if (here2.hasTrustDialogAccepted === true && enabled.size === asArray(here2.enabledMcpjsonServers).length)
+      continue;
+    here2.hasTrustDialogAccepted = true;
+    here2.enabledMcpjsonServers = [...enabled];
+    opened[dir] = here2;
+    moved = true;
+  }
+  if (!moved)
     return;
-  here2.hasTrustDialogAccepted = true;
-  here2.enabledMcpjsonServers = [...enabled];
-  const next = { ...parsed, projects: { ...projects, [os5.homedir()]: here2 } };
-  await writeFile(target, `${JSON.stringify(next, null, 2)}
+  await writeFile(target, `${JSON.stringify({ ...parsed, projects: opened }, null, 2)}
 `, { mode: 384 });
 }
 function asArray(value) {
@@ -23502,30 +23658,31 @@ async function installService() {
     return;
   if (process.platform === "linux") {
     const dir = path4.join(os5.homedir(), ".config", "systemd", "user");
-    await mkdir(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     await writeFile(path4.join(dir, `${SERVICE_NAME}.service`), systemdUnit());
-    await run4("loginctl", ["enable-linger", os5.userInfo().username]).catch(() => void 0);
-    await run4("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
-    await run4("systemctl", ["--user", "enable", "--now", SERVICE_NAME]).catch(() => void 0);
+    await run2("loginctl", ["enable-linger", os5.userInfo().username]).catch(() => void 0);
+    await run2("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
+    await run2("systemctl", ["--user", "enable", SERVICE_NAME]).catch(() => void 0);
+    await run2("systemctl", ["--user", "restart", SERVICE_NAME]).catch(() => void 0);
     return;
   }
   if (process.platform === "darwin") {
     const target = path4.join(os5.homedir(), "Library", "LaunchAgents", `${LAUNCH_LABEL}.plist`);
-    await mkdir(path4.dirname(target), { recursive: true });
+    await mkdir2(path4.dirname(target), { recursive: true });
     await writeFile(target, launchdPlist());
-    await run4("launchctl", ["unload", target]).catch(() => void 0);
-    await run4("launchctl", ["load", target]).catch(() => void 0);
+    await run2("launchctl", ["unload", target]).catch(() => void 0);
+    await run2("launchctl", ["load", target]).catch(() => void 0);
   }
 }
 async function uninstallService() {
   if (process.platform === "linux") {
-    await run4("systemctl", ["--user", "disable", "--now", SERVICE_NAME]).catch(() => void 0);
+    await run2("systemctl", ["--user", "disable", "--now", SERVICE_NAME]).catch(() => void 0);
     await rm(path4.join(os5.homedir(), ".config", "systemd", "user", `${SERVICE_NAME}.service`), { force: true });
     return;
   }
   if (process.platform === "darwin") {
     const target = path4.join(os5.homedir(), "Library", "LaunchAgents", `${LAUNCH_LABEL}.plist`);
-    await run4("launchctl", ["unload", target]).catch(() => void 0);
+    await run2("launchctl", ["unload", target]).catch(() => void 0);
     await rm(target, { force: true });
   }
 }
@@ -23562,10 +23719,10 @@ function here() {
   return `${process.execPath} ${entryPath()}`;
 }
 async function serviceRunning() {
-  return await run4("systemctl", ["--user", "is-active", SERVICE_NAME]).catch(() => null) !== null;
+  return await run2("systemctl", ["--user", "is-active", SERVICE_NAME]).catch(() => null) !== null;
 }
 async function userLingers() {
-  const shown = await run4("loginctl", ["show-user", os5.userInfo().username, "-p", "Linger"]).catch(() => null);
+  const shown = await run2("loginctl", ["show-user", os5.userInfo().username, "-p", "Linger"]).catch(() => null);
   return shown?.stdout.includes("Linger=yes") === true;
 }
 function entryPath() {
@@ -23583,6 +23740,9 @@ function tokenPath() {
 function ownedPath() {
   return path4.join(machine.home(), "owned.json");
 }
+function environmentPath() {
+  return path4.join(machine.home(), "environment.json");
+}
 function load2() {
   const cores = Math.max(1, os5.cpus().length);
   const busy = Math.min(100, (os5.loadavg()[0] ?? 0) / cores * 100);
@@ -23601,6 +23761,12 @@ function messageOf(error51) {
   return error51 instanceof Error ? error51.message : String(error51);
 }
 var ConfigSchema = external_exports.object({ url: external_exports.string(), machineId: external_exports.string() });
+var BuiltSchema = external_exports.object({
+  templateId: external_exports.string(),
+  results: external_exports.array(WorkstationStepResultSchema),
+  repos: external_exports.array(MachineRepoSchema).default([]),
+  at: external_exports.number()
+});
 var OwnedSchema = external_exports.object({ paths: external_exports.array(external_exports.string()) });
 var SERVICE_NAME = "craftspace";
 var LAUNCH_LABEL = "app.craftspace.machine";
@@ -23629,7 +23795,9 @@ var PORTABLE_TERMS = /* @__PURE__ */ new Set([
 var LINGER_LINE = `sudo loginctl enable-linger ${os5.userInfo().username}`;
 var DEFAULT_URL = process.env.CRAFTSPACE_URL ?? "https://craftspace.app";
 var PROBE_EVERY_MS = 3e5;
+var REBUILD_AFTER_MS = 216e5;
 var probed = null;
+var building = false;
 var reports = /* @__PURE__ */ new Map();
 var running = /* @__PURE__ */ new Set();