@craftspace/cli 0.5.0 → 0.6.0

package/dist/index.js

@@ -18788,6 +18788,18 @@ var AuditActor;
   AuditActor2["System"] = "system";
   AuditActor2["Anonymous"] = "anonymous";
 })(AuditActor || (AuditActor = {}));
+var AuditResource;
+(function(AuditResource2) {
+  AuditResource2["Members"] = "members";
+  AuditResource2["Connections"] = "connections";
+  AuditResource2["Pages"] = "pages";
+  AuditResource2["Spaces"] = "spaces";
+  AuditResource2["Tables"] = "tables";
+  AuditResource2["Agents"] = "agents";
+  AuditResource2["Automation"] = "automation";
+  AuditResource2["Organization"] = "organization";
+  AuditResource2["Tools"] = "tools";
+})(AuditResource || (AuditResource = {}));
 var AuditTier;
 (function(AuditTier2) {
   AuditTier2["Critical"] = "critical";
@@ -18900,7 +18912,8 @@ var AUDIT_RETENTION_DAYS = {
 };
 var AUDIT_GROUPS = [
   {
-    label: "Identity and access",
+    resource: AuditResource.Members,
+    label: "Members and tokens",
     actions: [
       AuditAction.AccessDenied,
       AuditAction.MemberSignedIn,
@@ -18914,7 +18927,8 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "Connections",
+    resource: AuditResource.Connections,
+    label: "Connected apps",
     actions: [
       AuditAction.ConnectionCreated,
       AuditAction.ConnectionReconnected,
@@ -18926,23 +18940,34 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "Knowledge",
+    resource: AuditResource.Pages,
+    label: "Pages",
     actions: [
       AuditAction.PageCreated,
       AuditAction.PageUpdated,
       AuditAction.PageDeleted,
       AuditAction.PageMoved,
       AuditAction.PageShared,
-      AuditAction.PageUnshared,
+      AuditAction.PageUnshared
+    ]
+  },
+  {
+    resource: AuditResource.Spaces,
+    label: "Spaces",
+    actions: [
       AuditAction.SpaceCreated,
       AuditAction.SpaceRenamed,
       AuditAction.SpaceDeleted,
-      AuditAction.SpaceAccessChanged,
-      AuditAction.TableCreated,
-      AuditAction.TableDeleted
+      AuditAction.SpaceAccessChanged
     ]
   },
   {
+    resource: AuditResource.Tables,
+    label: "Tables",
+    actions: [AuditAction.TableCreated, AuditAction.TableDeleted]
+  },
+  {
+    resource: AuditResource.Agents,
     label: "Agents and channels",
     actions: [
       AuditAction.AgentCreated,
@@ -18953,7 +18978,8 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "Automation",
+    resource: AuditResource.Automation,
+    label: "Workflows and kits",
     actions: [
       AuditAction.KitInstalled,
       AuditAction.KitRemoved,
@@ -18964,10 +18990,7 @@ var AUDIT_GROUPS = [
     ]
   },
   {
-    label: "MCP calls",
-    actions: [AuditAction.McpToolCall, AuditAction.McpRequest]
-  },
-  {
+    resource: AuditResource.Organization,
     label: "Organization",
     actions: [
       AuditAction.OrganizationRenamed,
@@ -18975,10 +18998,17 @@ var AUDIT_GROUPS = [
       AuditAction.OrganizationModelChanged,
       AuditAction.OrganizationDeleted
     ]
+  },
+  {
+    resource: AuditResource.Tools,
+    label: "Tool and MCP calls",
+    actions: [AuditAction.McpToolCall, AuditAction.McpRequest]
   }
 ];
+var AUDIT_RESOURCES = Object.fromEntries(AUDIT_GROUPS.flatMap((group) => group.actions.map((action) => [action, group.resource])));
 var AUDIT_LISTED_ACTIONS = AUDIT_GROUPS.flatMap((group) => group.actions);
-var AUDIT_DEFAULT_ACTIONS = AUDIT_LISTED_ACTIONS.filter((action) => AUDIT_TIERS[action] !== AuditTier.Volume);
+var AUDIT_QUIET_ACTIONS = [AuditAction.McpRequest, AuditAction.PageRead, AuditAction.PageWrite];
+var AUDIT_DEFAULT_ACTIONS = AUDIT_LISTED_ACTIONS.filter((action) => !AUDIT_QUIET_ACTIONS.includes(action));
 var AUDIT_LABELS = {
   [AuditAction.AccessDenied]: "Denied request",
   [AuditAction.MemberSignedIn]: "Signed in",
@@ -19028,6 +19058,11 @@ var AUDIT_LABELS = {
   [AuditAction.PageRead]: "Read page",
   [AuditAction.PageWrite]: "Wrote page"
 };
+var AuditAppSchema = external_exports.object({
+  kind: external_exports.string(),
+  id: external_exports.string().optional(),
+  name: external_exports.string().optional()
+});
 var AuditTargetSchema = external_exports.object({
   type: external_exports.string(),
   id: external_exports.string().optional(),
@@ -19045,6 +19080,8 @@ var AuditEntrySchema = external_exports.object({
     image: external_exports.string().optional()
   }),
   target: AuditTargetSchema.optional(),
+  app: AuditAppSchema.optional(),
+  outcome: external_exports.enum(["ok", "error"]).optional(),
   data: external_exports.record(external_exports.string(), external_exports.unknown()),
   ip: external_exports.string().optional(),
   userAgent: external_exports.string().optional(),
@@ -19059,15 +19096,38 @@ var AuditSummarySchema = external_exports.object({
 var AuditQuerySchema = external_exports.object({
   days: external_exports.coerce.number().int().refine((value) => AUDIT_RANGES.includes(value)).default(AUDIT_DEFAULT_DAYS),
   page: external_exports.coerce.number().int().min(1).default(1),
-  action: external_exports.union([external_exports.enum(AuditAction), external_exports.array(external_exports.enum(AuditAction))]).optional().transform((value) => value === void 0 ? void 0 : Array.isArray(value) ? value : [value]),
+  action: manyOf(external_exports.enum(AuditAction)),
   actor: external_exports.enum(AuditActor).optional(),
-  accountId: external_exports.string().optional()
+  account: manyOf(external_exports.string()),
+  app: manyOf(external_exports.string())
+});
+var AuditFacetsSchema = external_exports.object({
+  actions: external_exports.record(external_exports.string(), external_exports.number()),
+  accounts: external_exports.array(external_exports.object({
+    accountId: external_exports.string(),
+    name: external_exports.string(),
+    email: external_exports.string().optional(),
+    image: external_exports.string().optional(),
+    count: external_exports.number()
+  })),
+  apps: external_exports.array(external_exports.object({ kind: external_exports.string(), name: external_exports.string().optional(), count: external_exports.number() }))
 });
 var AuditResponseSchema = external_exports.object({
   summary: AuditSummarySchema,
   entries: external_exports.array(AuditEntrySchema),
+  facets: AuditFacetsSchema,
   total: external_exports.number()
 });
+var VERB_OVERRIDES = {
+  [AuditAction.McpToolCall]: "called",
+  [AuditAction.McpRequest]: "called",
+  [AuditAction.PageRead]: "read",
+  [AuditAction.PageWrite]: "written",
+  [AuditAction.AdminEnteredOrg]: "opened as support"
+};
+function manyOf(schema) {
+  return external_exports.union([schema, external_exports.array(schema)]).optional().transform((value) => value === void 0 ? void 0 : Array.isArray(value) ? value : [value]);
+}
 
 // ../../shared/dist/organization/install-admin.js
 var InstallCredentialNameSchema = external_exports.enum([
@@ -19838,7 +19898,7 @@ var SaveWorkstationBodySchema = external_exports.object({
 var WorkstationResponseSchema = external_exports.object({ workstation: WorkstationSchema });
 
 // ../../shared/dist/machines/machine.js
-var CLI_VERSION = "0.5.0";
+var CLI_VERSION = "0.6.0";
 var CLI_PACKAGE = "@craftspace/cli";
 var CLI_INSTALL = `npm i -g ${CLI_PACKAGE}`;
 var MACHINE_BEAT_INTERVAL_MS = 15e3;
@@ -19866,6 +19926,13 @@ var MachineToolSchema = external_exports.object({
   ok: external_exports.boolean(),
   detail: external_exports.string().max(200)
 });
+var MachineRepoSchema = external_exports.object({
+  name: external_exports.string().max(200),
+  ref: external_exports.string().max(200),
+  path: external_exports.string().max(400),
+  ok: external_exports.boolean(),
+  detail: external_exports.string().max(300)
+});
 var MachineSchema = external_exports.object({
   id: external_exports.string(),
   tokenId: external_exports.string(),
@@ -19889,6 +19956,8 @@ var MachineSchema = external_exports.object({
   tools: external_exports.array(MachineToolSchema),
   environment: external_exports.array(WorkstationStepResultSchema),
   templateId: external_exports.string().nullable(),
+  workDir: external_exports.string().nullable(),
+  repos: external_exports.array(MachineRepoSchema),
   authorizedKeys: external_exports.array(MachineAuthorizedKeySchema),
   lastBeatAt: external_exports.coerce.date().nullable(),
   lastAskedAt: external_exports.coerce.date().nullable(),
@@ -19953,11 +20022,14 @@ var MachineBeatBodySchema = external_exports.object({
   tools: external_exports.array(MachineToolSchema).max(10).default([]),
   environment: external_exports.array(WorkstationStepResultSchema).max(WORKSTATION_MAX_STEPS).default([]),
   templateId: external_exports.string().max(64).nullable().default(null),
+  workDir: external_exports.string().max(400).optional(),
+  repos: external_exports.array(MachineRepoSchema).max(WORKSTATION_MAX_REPOS).default([]),
   sshUser: external_exports.string().min(1).max(64).optional()
 });
 var MachineEnvironmentSchema = external_exports.object({
   templateId: external_exports.string().nullable(),
-  steps: external_exports.array(WorkstationStepSchema)
+  steps: external_exports.array(WorkstationStepSchema),
+  repos: external_exports.array(WorkstationRepoSchema).default([])
 });
 var MachineBeatResponseSchema = external_exports.object({
   cli: external_exports.object({ version: external_exports.string(), url: external_exports.string(), sha256: external_exports.string() }).nullable(),
@@ -20316,7 +20388,7 @@ var MemberActivityListResponse = external_exports.object({
 
 // dist/machine.js
 import { execFile as execFile3, spawn as spawn2 } from "node:child_process";
-import { mkdir, readFile as readFile2, readdir, rm, writeFile } from "node:fs/promises";
+import { mkdir as mkdir2, readFile as readFile2, readdir, rm, writeFile } from "node:fs/promises";
 import os5 from "node:os";
 import path4 from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -21289,11 +21361,11 @@ function readlineWidth() {
 
 // ../../../node_modules/@inquirer/core/dist/lib/pagination/use-pagination.js
 function usePointerPosition({ active, renderedItems, pageSize, loop }) {
-  const state = useRef({
+  const state2 = useRef({
     lastPointer: active,
     lastActive: void 0
   });
-  const { lastPointer, lastActive } = state.current;
+  const { lastPointer, lastActive } = state2.current;
   const middle = Math.floor(pageSize / 2);
   const renderedLength = renderedItems.reduce((acc, item) => acc + item.length, 0);
   const defaultPointerPosition = renderedItems.slice(0, active).reduce((acc, item) => acc + item.length, 0);
@@ -21333,8 +21405,8 @@ function usePointerPosition({ active, renderedItems, pageSize, loop }) {
       );
     }
   }
-  state.current.lastPointer = pointer;
-  state.current.lastActive = active;
+  state2.current.lastPointer = pointer;
+  state2.current.lastActive = active;
   return pointer;
 }
 function usePagination({ items, active, renderItem, pageSize, loop = true }) {
@@ -22237,7 +22309,7 @@ var runner = {
       child.on("close", (code) => resolve(code ?? 0));
     });
   },
-  async unattended({ work, onProgress }) {
+  async unattended({ work, cwd = os2.homedir(), onProgress }) {
     const argv = headlessArgv(work);
     const raw = argv[0] === "script";
     let output = "";
@@ -22267,7 +22339,7 @@ var runner = {
     const code = await new Promise((resolve) => {
       const child = spawn(argv[0], argv.slice(1), {
         stdio: ["ignore", "pipe", "pipe"],
-        cwd: os2.homedir(),
+        cwd,
         env: {
           ...process.env,
           TERM: process.env.TERM ?? "xterm-256color",
@@ -22365,6 +22437,7 @@ function parseJson(line) {
 
 // dist/setup.js
 import { execFile } from "node:child_process";
+import { mkdir } from "node:fs/promises";
 import os4 from "node:os";
 import path3 from "node:path";
 
@@ -22938,6 +23011,24 @@ var setup = {
     if (missing.length > 0)
       process.env.PATH = [...current, ...missing].join(path3.delimiter);
   },
+  workDir() {
+    return path3.join(os4.homedir(), WORK_DIR_NAME);
+  },
+  async cloneRepos({ repos, say }) {
+    if (repos.length === 0)
+      return [];
+    await mkdir(setup.workDir(), { recursive: true });
+    const cloned = [];
+    for (const [index, repo] of repos.entries()) {
+      say?.(ui.progress({ name: repo.name, done: index, total: repos.length }));
+      const at = path3.join(setup.workDir(), repo.name.split("/").pop() ?? repo.name);
+      const outcome = await checkout(repo, at);
+      cloned.push({ name: repo.name, ref: repo.ref, path: at, ...outcome });
+      say?.(`${ui.clear()}${outcome.ok ? ui.ok(`${repo.name} \xB7 ${outcome.detail}`) : ui.bad(repo.name, outcome.detail)}`);
+    }
+    say?.(ui.tally({ done: cloned.filter((repo) => repo.ok).length, total: cloned.length, noun: "cloned" }));
+    return cloned;
+  },
   async runSteps({ steps, say }) {
     const results = [];
     for (const [index, step] of steps.entries()) {
@@ -22953,6 +23044,43 @@ var setup = {
     return results;
   }
 };
+async function checkout(repo, at) {
+  const opened = await git(["-C", at, "rev-parse", "--abbrev-ref", "HEAD"]);
+  if (!opened.ok) {
+    const url2 = `https://github.com/${repo.name}.git`;
+    const made = await git(["clone", "--depth", String(CLONE_DEPTH), "--branch", repo.ref, url2, at]);
+    if (!made.ok)
+      return { ok: false, detail: made.detail };
+    return { ok: true, detail: await state({ repo, at, branch: repo.ref, dirty: false }) };
+  }
+  const branch = opened.detail;
+  const dirty = (await git(["-C", at, "status", "--porcelain"])).detail !== "";
+  const pulled = branch === repo.ref && !dirty ? await git(["-C", at, "pull", "--ff-only"]) : null;
+  return { ok: true, detail: await state({ repo, at, branch, dirty, pulled }) };
+}
+async function state({ repo, at, branch, dirty, pulled }) {
+  const head = await git(["-C", at, "rev-parse", "--short", "HEAD"]);
+  return [
+    `${branch} @ ${head.detail}`,
+    branch === repo.ref ? "" : `your team asks for ${repo.ref}`,
+    dirty ? "uncommitted work here, so it was left alone" : "",
+    pulled?.ok === false ? `could not pull: ${pulled.detail}` : ""
+  ].filter((part) => part !== "").join(" \xB7 ");
+}
+function git(argv) {
+  return new Promise((resolve) => {
+    execFile("git", argv, {
+      timeout: CLONE_TIMEOUT_MS,
+      maxBuffer: SCRIPT_BUFFER_BYTES,
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "", GIT_LFS_SKIP_SMUDGE: "1" }
+    }, (error51, stdout, stderr) => {
+      if (error51 === null)
+        return resolve({ ok: true, detail: stdout.trim() });
+      resolve({ ok: false, detail: lastLines(`${stderr}
+${stdout}`) || error51.message.split("\n")[0] || "git failed" });
+    });
+  });
+}
 function runScript(script) {
   return new Promise((resolve) => {
     execFile("/bin/sh", ["-e", "-c", script], { timeout: STEP_TIMEOUT_MS, maxBuffer: SCRIPT_BUFFER_BYTES }, (error51, stdout, stderr) => {
@@ -22977,6 +23105,9 @@ function toolDirs() {
     "/usr/local/bin"
   ];
 }
+var WORK_DIR_NAME = "craftspace";
+var CLONE_DEPTH = 20;
+var CLONE_TIMEOUT_MS = 9e5;
 var STEP_TIMEOUT_MS = 6e5;
 var SCRIPT_BUFFER_BYTES = 4 * 1024 * 1024;
 var KEPT_LINES = 3;
@@ -23051,7 +23182,7 @@ var machine = {
       },
       schema: MachineLoginResponseSchema
     });
-    await mkdir(machine.home(), { recursive: true, mode: 448 });
+    await mkdir2(machine.home(), { recursive: true, mode: 448 });
     await writeFile(configPath(), JSON.stringify({ url: url2, machineId: answer.machine.id }, null, 2), { mode: 384 });
     await writeFile(tokenPath(), token, { mode: 384 });
     await writeAgentConfigs({ url: url2, token, writes: answer.write });
@@ -23110,6 +23241,8 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
         tools: await checks(),
         environment: built?.results ?? [],
         templateId: built?.templateId ?? null,
+        workDir: setup.workDir(),
+        repos: built?.repos ?? [],
         sshUser: os5.userInfo().username
       },
       schema: MachineBeatResponseSchema
@@ -23124,7 +23257,7 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
       if (running.has(work.id))
         continue;
       running.add(work.id);
-      void runner.unattended({ work, onProgress: report }).then(report).catch((error51) => report({ id: work.id, state: "failed", output: messageOf(error51) })).finally(() => running.delete(work.id));
+      void runner.unattended({ work, cwd: startIn(built), onProgress: report }).then(report).catch((error51) => report({ id: work.id, state: "failed", output: messageOf(error51) })).finally(() => running.delete(work.id));
     }
     return running.size > 0 || answer.work.length > 0;
   },
@@ -23133,7 +23266,7 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
     let busy = false;
     let checkedAt = 0;
     for (; ; ) {
-      if (!busy && Date.now() - checkedAt > UPDATE_EVERY_MS) {
+      if (!busy && (failures > 2 || Date.now() - checkedAt > UPDATE_EVERY_MS)) {
         checkedAt = Date.now();
         const moved = await update.toLatest();
         if (moved !== null) {
@@ -23260,17 +23393,40 @@ async function buildEnvironment(next, say) {
   if (building || !installs() || next.templateId === null)
     return;
   const built = await readEnvironment();
-  if (!buildIsDue(built, next.templateId))
+  const buildsSteps = buildIsDue(built, next.templateId);
+  const clonesRepos = cloneIsDue(built, next.repos);
+  if (!buildsSteps && !clonesRepos)
     return;
   building = true;
   try {
-    say?.(ui.heading(`Building the ${next.steps.length} setup scripts your team runs on every box`));
-    const results = await setup.runSteps({ steps: next.steps, say });
-    await writeEnvironment({ templateId: next.templateId, results, at: Date.now() });
+    let results = built?.results ?? [];
+    let repos = built?.repos ?? [];
+    if (buildsSteps) {
+      say?.(ui.heading(`Building the ${next.steps.length} setup scripts your team runs on every box`));
+      results = await setup.runSteps({ steps: next.steps, say });
+    }
+    if (clonesRepos) {
+      say?.(ui.heading(`Cloning the ${next.repos.length} repos your team works in, into ${setup.workDir()}`));
+      repos = await setup.cloneRepos({ repos: next.repos, say });
+      await acceptClaudeGates(["craftspace"], repos.filter((repo) => repo.ok).map((repo) => repo.path));
+    }
+    await writeEnvironment({ templateId: next.templateId, results, repos, at: Date.now() });
   } finally {
     building = false;
   }
 }
+function cloneIsDue(built, wanted) {
+  const cloned = built?.repos ?? [];
+  if (wanted.length === 0 && cloned.length === 0)
+    return false;
+  if (wanted.length !== cloned.length)
+    return true;
+  const missing = wanted.some((repo) => !cloned.some((seen) => seen.name === repo.name && seen.ref === repo.ref && seen.ok));
+  return missing || Date.now() - (built?.at ?? 0) > REBUILD_AFTER_MS;
+}
+function startIn(built) {
+  return built?.repos.find((repo) => repo.ok)?.path ?? os5.homedir();
+}
 function buildIsDue(built, templateId) {
   if (built === null || built.templateId !== templateId)
     return true;
@@ -23286,7 +23442,7 @@ async function readEnvironment() {
   return parsed.success ? parsed.data : null;
 }
 async function writeEnvironment(built) {
-  await mkdir(machine.home(), { recursive: true, mode: 448 });
+  await mkdir2(machine.home(), { recursive: true, mode: 448 });
   await writeFile(environmentPath(), JSON.stringify(built, null, 2), { mode: 384 });
 }
 function installs() {
@@ -23363,7 +23519,7 @@ async function ensureKey() {
   const existing = await readFile2(pub, "utf8").catch(() => null);
   if (existing !== null)
     return existing.trim();
-  await mkdir(machine.home(), { recursive: true, mode: 448 });
+  await mkdir2(machine.home(), { recursive: true, mode: 448 });
   await run2("ssh-keygen", ["-t", "ed25519", "-N", "", "-q", "-f", priv, "-C", `craftspace-${os5.hostname()}`]);
   return (await readFile2(pub, "utf8")).trim();
 }
@@ -23403,7 +23559,7 @@ ${KEYS_END}
   const next = `${trimEnd(before)}${trimEnd(before) === "" ? "" : "\n"}${block}${after.replace(/^\n/, "")}`;
   if (next === current)
     return;
-  await mkdir(path4.dirname(target), { recursive: true, mode: 448 });
+  await mkdir2(path4.dirname(target), { recursive: true, mode: 448 });
   await writeFile(target, next, { mode: 384 });
 }
 function trimEnd(text) {
@@ -23414,7 +23570,7 @@ async function writeAgentConfigs({ url: url2, token, writes }) {
   const owned = [];
   for (const write of planned) {
     const target = expand(write.path);
-    await mkdir(path4.dirname(target), { recursive: true });
+    await mkdir2(path4.dirname(target), { recursive: true });
     const current = await readFile2(target, "utf8").catch(() => null);
     if (current !== null)
       await writeFile(`${target}.craftspace-backup`, current, { flag: "wx" }).catch(() => void 0);
@@ -23429,22 +23585,29 @@ async function writeAgentConfigs({ url: url2, token, writes }) {
 function serversIn(writes) {
   return writes.flatMap((write) => isPlainObject3(write.contents.mcpServers) ? Object.keys(write.contents.mcpServers) : []);
 }
-async function acceptClaudeGates(servers) {
+async function acceptClaudeGates(servers, dirs = [os5.homedir()]) {
   const target = path4.join(os5.homedir(), ".claude.json");
   const raw = await readFile2(target, "utf8").catch(() => null);
   if (raw === null)
     return;
   const parsed = JSON.parse(raw);
   const projects = isPlainObject3(parsed.projects) ? parsed.projects : {};
-  const found = projects[os5.homedir()];
-  const here2 = isPlainObject3(found) ? { ...found } : {};
-  const enabled = /* @__PURE__ */ new Set([...Array.isArray(here2.enabledMcpjsonServers) ? here2.enabledMcpjsonServers : [], ...servers]);
-  if (here2.hasTrustDialogAccepted === true && enabled.size === asArray(here2.enabledMcpjsonServers).length)
+  const opened = { ...projects };
+  let moved = false;
+  for (const dir of dirs) {
+    const found = opened[dir];
+    const here2 = isPlainObject3(found) ? { ...found } : {};
+    const enabled = /* @__PURE__ */ new Set([...asArray(here2.enabledMcpjsonServers), ...servers]);
+    if (here2.hasTrustDialogAccepted === true && enabled.size === asArray(here2.enabledMcpjsonServers).length)
+      continue;
+    here2.hasTrustDialogAccepted = true;
+    here2.enabledMcpjsonServers = [...enabled];
+    opened[dir] = here2;
+    moved = true;
+  }
+  if (!moved)
     return;
-  here2.hasTrustDialogAccepted = true;
-  here2.enabledMcpjsonServers = [...enabled];
-  const next = { ...parsed, projects: { ...projects, [os5.homedir()]: here2 } };
-  await writeFile(target, `${JSON.stringify(next, null, 2)}
+  await writeFile(target, `${JSON.stringify({ ...parsed, projects: opened }, null, 2)}
 `, { mode: 384 });
 }
 function asArray(value) {
@@ -23495,16 +23658,17 @@ async function installService() {
     return;
   if (process.platform === "linux") {
     const dir = path4.join(os5.homedir(), ".config", "systemd", "user");
-    await mkdir(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     await writeFile(path4.join(dir, `${SERVICE_NAME}.service`), systemdUnit());
     await run2("loginctl", ["enable-linger", os5.userInfo().username]).catch(() => void 0);
     await run2("systemctl", ["--user", "daemon-reload"]).catch(() => void 0);
-    await run2("systemctl", ["--user", "enable", "--now", SERVICE_NAME]).catch(() => void 0);
+    await run2("systemctl", ["--user", "enable", SERVICE_NAME]).catch(() => void 0);
+    await run2("systemctl", ["--user", "restart", SERVICE_NAME]).catch(() => void 0);
     return;
   }
   if (process.platform === "darwin") {
     const target = path4.join(os5.homedir(), "Library", "LaunchAgents", `${LAUNCH_LABEL}.plist`);
-    await mkdir(path4.dirname(target), { recursive: true });
+    await mkdir2(path4.dirname(target), { recursive: true });
     await writeFile(target, launchdPlist());
     await run2("launchctl", ["unload", target]).catch(() => void 0);
     await run2("launchctl", ["load", target]).catch(() => void 0);
@@ -23600,6 +23764,7 @@ var ConfigSchema = external_exports.object({ url: external_exports.string(), mac
 var BuiltSchema = external_exports.object({
   templateId: external_exports.string(),
   results: external_exports.array(WorkstationStepResultSchema),
+  repos: external_exports.array(MachineRepoSchema).default([]),
   at: external_exports.number()
 });
 var OwnedSchema = external_exports.object({ paths: external_exports.array(external_exports.string()) });

package/dist/machine.js

@@ -3,7 +3,7 @@ import { mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { promisify } from 'node:util';
-import { CLI_VERSION, MACHINE_BEAT_BUSY_INTERVAL_MS, MACHINE_BEAT_INTERVAL_MS, MachineBeatResponseSchema, MachineLoginResponseSchema, MachineSchema, MachineSessionSchema, MachinesResponseSchema, WorkstationStepResultSchema, } from '@craftspace/shared';
+import { CLI_VERSION, MACHINE_BEAT_BUSY_INTERVAL_MS, MACHINE_BEAT_INTERVAL_MS, MachineBeatResponseSchema, MachineLoginResponseSchema, MachineSchema, MachineRepoSchema, MachineSessionSchema, MachinesResponseSchema, WorkstationStepResultSchema, } from '@craftspace/shared';
 import { confirm, input, select } from '@inquirer/prompts';
 import { z } from 'zod';
 import { probe } from './probe.js';
@@ -89,6 +89,8 @@ export const machine = {
                 tools: await checks(),
                 environment: built?.results ?? [],
                 templateId: built?.templateId ?? null,
+                workDir: setup.workDir(),
+                repos: built?.repos ?? [],
                 sshUser: os.userInfo().username,
             },
             schema: MachineBeatResponseSchema,
@@ -104,7 +106,7 @@ export const machine = {
                 continue;
             running.add(work.id);
             void runner
-                .unattended({ work, onProgress: report })
+                .unattended({ work, cwd: startIn(built), onProgress: report })
                 .then(report)
                 .catch((error) => report({ id: work.id, state: 'failed', output: messageOf(error) }))
                 .finally(() => running.delete(work.id));
@@ -116,7 +118,7 @@ export const machine = {
         let busy = false;
         let checkedAt = 0;
         for (;;) {
-            if (!busy && Date.now() - checkedAt > UPDATE_EVERY_MS) {
+            if (!busy && (failures > 2 || Date.now() - checkedAt > UPDATE_EVERY_MS)) {
                 checkedAt = Date.now();
                 const moved = await update.toLatest();
                 if (moved !== null) {
@@ -238,18 +240,41 @@ async function buildEnvironment(next, say) {
     if (building || !installs() || next.templateId === null)
         return;
     const built = await readEnvironment();
-    if (!buildIsDue(built, next.templateId))
+    const buildsSteps = buildIsDue(built, next.templateId);
+    const clonesRepos = cloneIsDue(built, next.repos);
+    if (!buildsSteps && !clonesRepos)
         return;
     building = true;
     try {
-        say?.(ui.heading(`Building the ${next.steps.length} setup scripts your team runs on every box`));
-        const results = await setup.runSteps({ steps: next.steps, say });
-        await writeEnvironment({ templateId: next.templateId, results, at: Date.now() });
+        let results = built?.results ?? [];
+        let repos = built?.repos ?? [];
+        if (buildsSteps) {
+            say?.(ui.heading(`Building the ${next.steps.length} setup scripts your team runs on every box`));
+            results = await setup.runSteps({ steps: next.steps, say });
+        }
+        if (clonesRepos) {
+            say?.(ui.heading(`Cloning the ${next.repos.length} repos your team works in, into ${setup.workDir()}`));
+            repos = await setup.cloneRepos({ repos: next.repos, say });
+            await acceptClaudeGates(['craftspace'], repos.filter((repo) => repo.ok).map((repo) => repo.path));
+        }
+        await writeEnvironment({ templateId: next.templateId, results, repos, at: Date.now() });
     }
     finally {
         building = false;
     }
 }
+function cloneIsDue(built, wanted) {
+    const cloned = built?.repos ?? [];
+    if (wanted.length === 0 && cloned.length === 0)
+        return false;
+    if (wanted.length !== cloned.length)
+        return true;
+    const missing = wanted.some((repo) => !cloned.some((seen) => seen.name === repo.name && seen.ref === repo.ref && seen.ok));
+    return missing || Date.now() - (built?.at ?? 0) > REBUILD_AFTER_MS;
+}
+function startIn(built) {
+    return built?.repos.find((repo) => repo.ok)?.path ?? os.homedir();
+}
 function buildIsDue(built, templateId) {
     if (built === null || built.templateId !== templateId)
         return true;
@@ -403,22 +428,29 @@ async function writeAgentConfigs({ url, token, writes, }) {
 function serversIn(writes) {
     return writes.flatMap((write) => isPlainObject(write.contents.mcpServers) ? Object.keys(write.contents.mcpServers) : []);
 }
-async function acceptClaudeGates(servers) {
+async function acceptClaudeGates(servers, dirs = [os.homedir()]) {
     const target = path.join(os.homedir(), '.claude.json');
     const raw = await readFile(target, 'utf8').catch(() => null);
     if (raw === null)
         return;
     const parsed = JSON.parse(raw);
     const projects = isPlainObject(parsed.projects) ? parsed.projects : {};
-    const found = projects[os.homedir()];
-    const here = isPlainObject(found) ? { ...found } : {};
-    const enabled = new Set([...(Array.isArray(here.enabledMcpjsonServers) ? here.enabledMcpjsonServers : []), ...servers]);
-    if (here.hasTrustDialogAccepted === true && enabled.size === asArray(here.enabledMcpjsonServers).length)
+    const opened = { ...projects };
+    let moved = false;
+    for (const dir of dirs) {
+        const found = opened[dir];
+        const here = isPlainObject(found) ? { ...found } : {};
+        const enabled = new Set([...asArray(here.enabledMcpjsonServers), ...servers]);
+        if (here.hasTrustDialogAccepted === true && enabled.size === asArray(here.enabledMcpjsonServers).length)
+            continue;
+        here.hasTrustDialogAccepted = true;
+        here.enabledMcpjsonServers = [...enabled];
+        opened[dir] = here;
+        moved = true;
+    }
+    if (!moved)
         return;
-    here.hasTrustDialogAccepted = true;
-    here.enabledMcpjsonServers = [...enabled];
-    const next = { ...parsed, projects: { ...projects, [os.homedir()]: here } };
-    await writeFile(target, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+    await writeFile(target, `${JSON.stringify({ ...parsed, projects: opened }, null, 2)}\n`, { mode: 0o600 });
 }
 function asArray(value) {
     return Array.isArray(value) ? value : [];
@@ -472,7 +504,8 @@ async function installService() {
         await writeFile(path.join(dir, `${SERVICE_NAME}.service`), systemdUnit());
         await run('loginctl', ['enable-linger', os.userInfo().username]).catch(() => undefined);
         await run('systemctl', ['--user', 'daemon-reload']).catch(() => undefined);
-        await run('systemctl', ['--user', 'enable', '--now', SERVICE_NAME]).catch(() => undefined);
+        await run('systemctl', ['--user', 'enable', SERVICE_NAME]).catch(() => undefined);
+        await run('systemctl', ['--user', 'restart', SERVICE_NAME]).catch(() => undefined);
         return;
     }
     if (process.platform === 'darwin') {
@@ -573,6 +606,7 @@ const ConfigSchema = z.object({ url: z.string(), machineId: z.string() });
 const BuiltSchema = z.object({
     templateId: z.string(),
     results: z.array(WorkstationStepResultSchema),
+    repos: z.array(MachineRepoSchema).default([]),
     at: z.number(),
 });
 const OwnedSchema = z.object({ paths: z.array(z.string()) });

package/dist/run.d.ts

@@ -1,8 +1,9 @@
 import { type MachineRunReport, type MachineWork } from '@craftspace/shared';
 export declare const runner: {
     attended(argv: string[]): Promise<number>;
-    unattended({ work, onProgress, }: {
+    unattended({ work, cwd, onProgress, }: {
         work: MachineWork;
+        cwd?: string;
         onProgress?: (report: MachineRunReport) => void;
     }): Promise<MachineRunReport>;
 };

package/dist/run.js

@@ -9,7 +9,7 @@ export const runner = {
             child.on('close', (code) => resolve(code ?? 0));
         });
     },
-    async unattended({ work, onProgress, }) {
+    async unattended({ work, cwd = os.homedir(), onProgress, }) {
         const argv = headlessArgv(work);
         const raw = argv[0] === 'script';
         let output = '';
@@ -37,7 +37,7 @@ export const runner = {
         const code = await new Promise((resolve) => {
             const child = spawn(argv[0], argv.slice(1), {
                 stdio: ['ignore', 'pipe', 'pipe'],
-                cwd: os.homedir(),
+                cwd,
                 env: {
                     ...process.env,
                     TERM: process.env.TERM ?? 'xterm-256color',

package/dist/setup.d.ts

@@ -1,6 +1,11 @@
-import { type WorkstationStep, type WorkstationStepResult } from '@craftspace/shared';
+import { type MachineRepo, type WorkstationRepo, type WorkstationStep, type WorkstationStepResult } from '@craftspace/shared';
 export declare const setup: {
     widenPath(): void;
+    workDir(): string;
+    cloneRepos({ repos, say, }: {
+        repos: WorkstationRepo[];
+        say?: (line: string) => void;
+    }): Promise<MachineRepo[]>;
     runSteps({ steps, say, }: {
         steps: WorkstationStep[];
         say?: (line: string) => void;

package/dist/setup.js

@@ -1,4 +1,5 @@
 import { execFile } from 'node:child_process';
+import { mkdir } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { WORKSTATION_STEP_DETAIL_MAX_CHARS, } from '@craftspace/shared';
@@ -10,6 +11,24 @@ export const setup = {
         if (missing.length > 0)
             process.env.PATH = [...current, ...missing].join(path.delimiter);
     },
+    workDir() {
+        return path.join(os.homedir(), WORK_DIR_NAME);
+    },
+    async cloneRepos({ repos, say, }) {
+        if (repos.length === 0)
+            return [];
+        await mkdir(setup.workDir(), { recursive: true });
+        const cloned = [];
+        for (const [index, repo] of repos.entries()) {
+            say?.(ui.progress({ name: repo.name, done: index, total: repos.length }));
+            const at = path.join(setup.workDir(), repo.name.split('/').pop() ?? repo.name);
+            const outcome = await checkout(repo, at);
+            cloned.push({ name: repo.name, ref: repo.ref, path: at, ...outcome });
+            say?.(`${ui.clear()}${outcome.ok ? ui.ok(`${repo.name} · ${outcome.detail}`) : ui.bad(repo.name, outcome.detail)}`);
+        }
+        say?.(ui.tally({ done: cloned.filter((repo) => repo.ok).length, total: cloned.length, noun: 'cloned' }));
+        return cloned;
+    },
     async runSteps({ steps, say, }) {
         const results = [];
         for (const [index, step] of steps.entries()) {
@@ -25,6 +44,44 @@ export const setup = {
         return results;
     },
 };
+async function checkout(repo, at) {
+    const opened = await git(['-C', at, 'rev-parse', '--abbrev-ref', 'HEAD']);
+    if (!opened.ok) {
+        const url = `https://github.com/${repo.name}.git`;
+        const made = await git(['clone', '--depth', String(CLONE_DEPTH), '--branch', repo.ref, url, at]);
+        if (!made.ok)
+            return { ok: false, detail: made.detail };
+        return { ok: true, detail: await state({ repo, at, branch: repo.ref, dirty: false }) };
+    }
+    const branch = opened.detail;
+    const dirty = (await git(['-C', at, 'status', '--porcelain'])).detail !== '';
+    const pulled = branch === repo.ref && !dirty ? await git(['-C', at, 'pull', '--ff-only']) : null;
+    return { ok: true, detail: await state({ repo, at, branch, dirty, pulled }) };
+}
+async function state({ repo, at, branch, dirty, pulled, }) {
+    const head = await git(['-C', at, 'rev-parse', '--short', 'HEAD']);
+    return [
+        `${branch} @ ${head.detail}`,
+        branch === repo.ref ? '' : `your team asks for ${repo.ref}`,
+        dirty ? 'uncommitted work here, so it was left alone' : '',
+        pulled?.ok === false ? `could not pull: ${pulled.detail}` : '',
+    ]
+        .filter((part) => part !== '')
+        .join(' · ');
+}
+function git(argv) {
+    return new Promise((resolve) => {
+        execFile('git', argv, {
+            timeout: CLONE_TIMEOUT_MS,
+            maxBuffer: SCRIPT_BUFFER_BYTES,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: '', GIT_LFS_SKIP_SMUDGE: '1' },
+        }, (error, stdout, stderr) => {
+            if (error === null)
+                return resolve({ ok: true, detail: stdout.trim() });
+            resolve({ ok: false, detail: lastLines(`${stderr}\n${stdout}`) || error.message.split('\n')[0] || 'git failed' });
+        });
+    });
+}
 function runScript(script) {
     return new Promise((resolve) => {
         execFile('/bin/sh', ['-e', '-c', script], { timeout: STEP_TIMEOUT_MS, maxBuffer: SCRIPT_BUFFER_BYTES }, (error, stdout, stderr) => {
@@ -54,6 +111,9 @@ function toolDirs() {
         '/usr/local/bin',
     ];
 }
+const WORK_DIR_NAME = 'craftspace';
+const CLONE_DEPTH = 20;
+const CLONE_TIMEOUT_MS = 900_000;
 const STEP_TIMEOUT_MS = 600_000;
 const SCRIPT_BUFFER_BYTES = 4 * 1024 * 1024;
 const KEPT_LINES = 3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craftspace/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "description": "Sign a Mac or Linux machine into Craftspace and keep its agent setup in step.",
   "license": "MIT",