@craftspace/cli 0.9.0 → 0.10.0

package/dist/index.js

@@ -19892,7 +19892,7 @@ var SaveWorkstationBodySchema = external_exports.object({
 var WorkstationResponseSchema = external_exports.object({ workstation: WorkstationSchema });
 
 // ../../shared/dist/machines/machine.js
-var CLI_VERSION = "0.9.0";
+var CLI_VERSION = "0.10.0";
 var CLI_PACKAGE = "@craftspace/cli";
 var CLI_INSTALL = `npm i -g ${CLI_PACKAGE}`;
 var MACHINE_BEAT_INTERVAL_MS = 15e3;
@@ -20384,7 +20384,7 @@ var MemberActivityListResponse = external_exports.object({
 // dist/machine.js
 import { execFile as execFile3, spawn as spawn2 } from "node:child_process";
 import { existsSync as existsSync2 } from "node:fs";
-import { mkdir as mkdir3, readFile as readFile3, readdir as readdir2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile3, readdir as readdir2, rename as rename2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
 import os6 from "node:os";
 import path5 from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -22259,6 +22259,24 @@ import { mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promise
 import os from "node:os";
 import path2 from "node:path";
 var migrate = {
+  async stripGlobalMcp() {
+    const target = path2.join(os.homedir(), ".mcp.json");
+    const raw = await readFile(target, "utf8").catch(() => null);
+    if (raw === null)
+      return;
+    const parsed = JSON.parse(raw);
+    const servers = parsed.mcpServers;
+    if (typeof servers !== "object" || servers === null || !("craftspace" in servers))
+      return;
+    delete servers.craftspace;
+    const emptied = Object.keys(servers).length === 0 && Object.keys(parsed).length === 1;
+    const ours = await readFile(`${target}.craftspace-backup`, "utf8").catch(() => null) === null;
+    if (emptied && ours)
+      await rm(target, { force: true });
+    else
+      await writeFile(target, `${JSON.stringify(parsed, null, 2)}
+`, { mode: 384 });
+  },
   async toLatest({ home, workDir }) {
     const done = new Set(await alreadyRan(home));
     const ran = [];
@@ -22304,22 +22322,7 @@ var STEPS = [
   {
     id: "0002-mcp-out-of-home",
     async run() {
-      const target = path2.join(os.homedir(), ".mcp.json");
-      const raw = await readFile(target, "utf8").catch(() => null);
-      if (raw === null)
-        return true;
-      const parsed = JSON.parse(raw);
-      const servers = parsed.mcpServers;
-      if (typeof servers !== "object" || servers === null || !("craftspace" in servers))
-        return true;
-      delete servers.craftspace;
-      const emptied = Object.keys(servers).length === 0 && Object.keys(parsed).length === 1;
-      const ours = await readFile(`${target}.craftspace-backup`, "utf8").catch(() => null) === null;
-      if (emptied && ours)
-        await rm(target, { force: true });
-      else
-        await writeFile(target, `${JSON.stringify(parsed, null, 2)}
-`, { mode: 384 });
+      await migrate.stripGlobalMcp();
       return true;
     }
   }
@@ -22341,16 +22344,17 @@ import { readFile as readFile2 } from "node:fs/promises";
 import os2 from "node:os";
 import path3 from "node:path";
 var probe = {
-  async tools({ dirs }) {
-    return Promise.all([brainWired(dirs), sshListening()]);
+  async tools({ dirs, organization }) {
+    return Promise.all([brainWired({ dirs, organization }), sshListening()]);
   }
 };
-async function brainWired(dirs) {
+async function brainWired({ dirs, organization }) {
   if (dirs.length === 0) {
     return { id: "brain", ok: false, detail: "no repos cloned here yet, so there is nothing to wire it into" };
   }
   const projects = await claudeProjects();
-  const unwired = dirs.filter((dir) => !("craftspace" in mcpServersIn(projects[dir])));
+  const wanted = `craftspace-${organization}`;
+  const unwired = dirs.filter((dir) => !(wanted in mcpServersIn(projects[dir])));
   return unwired.length === 0 ? { id: "brain", ok: true, detail: `wired into ${dirs.length} repo${dirs.length === 1 ? "" : "s"}` } : { id: "brain", ok: false, detail: `not wired into ${unwired.map(short).join(", ")}`.slice(0, DETAIL_MAX) };
 }
 async function claudeProjects() {
@@ -23251,9 +23255,24 @@ var INSTALL_TIMEOUT_MS = 18e4;
 // dist/machine.js
 var run2 = promisify2(execFile3);
 var machine = {
-  home() {
+  root() {
     return process.env.CRAFTSPACE_CLI_HOME ?? path5.join(os6.homedir(), ".craftspace");
   },
+  async seats() {
+    await settleLayout();
+    const entries = await readdir2(machine.root(), { withFileTypes: true }).catch(() => []);
+    const seats = [];
+    for (const entry of entries.filter((found) => found.isDirectory())) {
+      const home = path5.join(machine.root(), entry.name);
+      const config2 = await readConfig(home);
+      if (config2 !== null)
+        seats.push({ home, config: config2 });
+    }
+    const legacy = await readConfig(machine.root());
+    if (legacy !== null)
+      seats.push({ home: machine.root(), config: legacy });
+    return seats;
+  },
   async login({ token, url: url2, install }) {
     const answer = await call({
       url: url2,
@@ -23271,26 +23290,29 @@ var machine = {
       },
       schema: MachineLoginResponseSchema
     });
-    await mkdir3(machine.home(), { recursive: true, mode: 448 });
-    await writeConfig({ url: url2, machineId: answer.machine.id, organization: toSpaceSlug(answer.organizationName) });
-    await writeFile2(tokenPath(), token, { mode: 384 });
+    const organization = toSpaceSlug(answer.organizationName) || "team";
+    const account = answer.machine.ownerAccountId;
+    await refuseSecondAccount({ account, organization });
+    const home = path5.join(machine.root(), organization);
+    await mkdir3(home, { recursive: true, mode: 448 });
+    await writeConfig(home, { url: url2, machineId: answer.machine.id, organization, account });
+    await writeFile2(tokenPath(home), token, { mode: 384 });
     await writeAgentConfigs({ writes: answer.write });
-    await wireRepos({ url: url2, token, dirs: clonedDirs(await readEnvironment()) });
+    await wireRepos({ url: url2, token, organization, dirs: clonedDirs(await readEnvironment(home)) });
     await installService();
     if (install)
-      await machine.beatOnce(ui.say);
-    return answer.machine;
+      await machine.beatOnce({ home, say: ui.say });
+    return { url: url2, token, machine: answer.machine, organization };
   },
-  async workDir() {
-    const organization = (await readConfig())?.organization;
-    return organization === void 0 ? null : setup.workDir(organization);
+  async workDir(organization) {
+    return setup.workDir(organization);
   },
   async controlPlane(override) {
-    const where = override ?? process.env.CRAFTSPACE_URL ?? (await readConfig())?.url ?? DEFAULT_URL;
+    const where = override ?? process.env.CRAFTSPACE_URL ?? (await anySeat())?.config.url ?? DEFAULT_URL;
     return where.replace(/\/$/, "");
   },
   async signIn({ url: url2, why, install = false }) {
-    const where = url2 ?? (await readConfig())?.url ?? DEFAULT_URL;
+    const where = url2 ?? (await anySeat())?.config.url ?? DEFAULT_URL;
     if (!process.stdin.isTTY)
       throw new Error(`${why} Run: cs login --token <token>`);
     const page = `${where}/workstations`;
@@ -23312,16 +23334,34 @@ ${ui.attention(why)}
       throw new Error("That line carries no key.");
     const signed = await machine.login({ token, url: where, install });
     ui.say(`
-${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name)}.`)}`);
-    return { url: where, token, machine: signed };
+${ui.ok(`Signed in as ${signed.machine.ownerName}. This machine is ${ui.name(signed.machine.name)}.`)}`);
+    return signed;
   },
   async status() {
-    const found = await withAuth(await signedInOrAsk(), (auth) => call({ ...auth, method: "GET", path: "/api/machines/me", schema: MachineSchema }));
-    return { machine: found.value, url: found.auth.url };
+    const seats = await machine.seats();
+    if (seats.length === 0) {
+      const signed = await machine.signIn({ why: "This machine is not signed in to Craftspace yet." });
+      return [{ machine: signed.machine, url: signed.url, organization: signed.organization }];
+    }
+    const found = [];
+    for (const seat of seats) {
+      const live = await withAuth(await authOf(seat), (auth) => call({ ...auth, method: "GET", path: "/api/machines/me", schema: MachineSchema }));
+      found.push({ machine: live.value, url: live.auth.url, organization: seat.config.organization ?? "?" });
+    }
+    return found;
+  },
+  async beatAll(say) {
+    const seats = await machine.seats();
+    if (seats.length === 0)
+      throw new Error("This machine is not signed in. Run: cs login --token <token>");
+    let busy = false;
+    for (const seat of seats)
+      busy = await machine.beatOnce({ home: seat.home, say }) || busy;
+    return busy;
   },
-  async beatOnce(say) {
-    const { url: url2, token, organization } = await requireSignedIn();
-    const built = await readEnvironment();
+  async beatOnce({ home, say }) {
+    const { url: url2, token, organization } = await requireSignedIn(home);
+    const built = await readEnvironment(home);
     const answer = await call({
       url: url2,
       token,
@@ -23331,8 +23371,8 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
         cli: CLI_VERSION,
         ...load2(),
         sessions: await readSessions(),
-        runs: drainReports(),
-        tools: await checks(),
+        runs: drainReports(home),
+        tools: await checks(home),
         environment: built?.results ?? [],
         templateId: built?.templateId ?? null,
         ...organization === void 0 ? {} : { workDir: setup.workDir(organization) },
@@ -23345,10 +23385,10 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
       updateWanted = answer.cli.version;
     const workDir = setup.workDir(answer.organization);
     if (answer.organization !== organization)
-      await writeConfig({ organization: answer.organization });
-    await migrate.toLatest({ home: machine.home(), workDir }).catch(() => []);
-    await writeAuthorizedKeys(answer.authorizedKeys);
-    const building2 = buildEnvironment({ next: answer.environment, workDir, say });
+      await writeConfig(home, { organization: answer.organization });
+    await migrate.toLatest({ home: machine.root(), workDir }).catch(() => []);
+    await writeAuthorizedKeys({ organization: answer.organization, keys: answer.authorizedKeys });
+    const building2 = buildEnvironment({ next: answer.environment, home, workDir, say });
     if (say === void 0)
       void building2.catch(() => void 0);
     else
@@ -23357,7 +23397,7 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
       if (running.has(work.id))
         continue;
       running.add(work.id);
-      void runner.unattended({ work, cwd: startIn(built), onProgress: report }).then(report).catch((error51) => report({ id: work.id, state: "failed", output: messageOf(error51) })).finally(() => running.delete(work.id));
+      void runner.unattended({ work, cwd: startIn(built), onProgress: (next) => report(home, next) }).then((next) => report(home, next)).catch((error51) => report(home, { id: work.id, state: "failed", output: messageOf(error51) })).finally(() => running.delete(work.id));
     }
     return running.size > 0 || answer.work.length > 0;
   },
@@ -23378,7 +23418,7 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
         }
       }
       try {
-        busy = await machine.beatOnce();
+        busy = await machine.beatAll();
         failures = 0;
       } catch (error51) {
         failures += 1;
@@ -23389,7 +23429,7 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
     }
   },
   async run() {
-    const first = await signedInOrAsk();
+    const first = await authOfAnySeatOrAsk();
     const { auth, value: answer } = await withAuth(first, (live) => call({ ...live, method: "GET", path: "/api/machines", schema: MachinesResponseSchema }));
     if (answer.machines.length === 0)
       return nowhereToGo(auth);
@@ -23407,23 +23447,55 @@ ${ui.ok(`Signed in as ${signed.ownerName}. This machine is ${ui.name(signed.name
     return { text: BEATING, ok: true };
   },
   async logout() {
-    const config2 = await readConfig();
-    const token = await readToken();
-    if (config2 && token) {
-      await call({ url: config2.url, token, method: "POST", path: "/api/machines/logout", schema: external_exports.object({}) }).catch(() => void 0);
-    }
-    await removeAgentConfigs();
+    for (const seat of await machine.seats()) {
+      const token = await readToken(seat.home);
+      if (token === null)
+        continue;
+      await call({
+        url: seat.config.url,
+        token,
+        method: "POST",
+        path: "/api/machines/logout",
+        schema: external_exports.object({})
+      }).catch(() => void 0);
+      await removeAgentConfigs(seat.home);
+      if (seat.config.organization !== void 0) {
+        await writeAuthorizedKeys({ organization: seat.config.organization, keys: [] });
+      }
+    }
+    await unwireRepos();
     await uninstallService();
-    await rm2(machine.home(), { recursive: true, force: true });
+    await rm2(machine.root(), { recursive: true, force: true });
   }
 };
-async function requireSignedIn() {
-  const config2 = await readConfig();
-  const token = await readToken();
+async function requireSignedIn(home) {
+  const config2 = await readConfig(home);
+  const token = await readToken(home);
   if (!config2 || !token)
     throw new Error("This machine is not signed in. Run: cs login --token <token>");
   return { url: config2.url, token, ...spreadIfDefined({ organization: config2.organization }) };
 }
+async function refuseSecondAccount({ account, organization }) {
+  const taken = (await machine.seats()).find((seat) => seat.config.account !== void 0 && seat.config.account !== account);
+  if (taken === void 0)
+    return;
+  throw new Error(`This box is already signed in as someone else, under ${taken.config.organization ?? "another org"}. One box holds one account, any number of its orgs. Run: cs logout, then sign in for ${organization}.`);
+}
+async function anySeat() {
+  return (await machine.seats())[0];
+}
+async function authOf(seat) {
+  const token = await readToken(seat.home);
+  if (token === null)
+    throw new Error("This machine is not signed in. Run: cs login --token <token>");
+  return { url: seat.config.url, token };
+}
+async function authOfAnySeatOrAsk() {
+  const seat = await anySeat();
+  if (seat === void 0)
+    return machine.signIn({ why: "This machine is not signed in to Craftspace yet." });
+  return authOf(seat);
+}
 async function pick2(machines) {
   return dist_default6({
     message: "Which workstation?",
@@ -23482,25 +23554,27 @@ ${ui.attention("No workstations here yet.")}
   ui.say("\n");
   return 1;
 }
-async function checks() {
-  if (probed !== null && Date.now() - probed.at < PROBE_EVERY_MS)
-    return probed.tools;
-  const dirs = clonedDirs(await readEnvironment());
-  const first = await probe.tools({ dirs });
+async function checks(home) {
+  const seen = probed.get(home);
+  if (seen !== void 0 && Date.now() - seen.at < PROBE_EVERY_MS)
+    return seen.tools;
+  const organization = (await readConfig(home))?.organization ?? "team";
+  const dirs = clonedDirs(await readEnvironment(home));
+  const first = await probe.tools({ dirs, organization });
   const unwired = first.some((tool) => tool.id === "brain" && !tool.ok);
-  const found = unwired && installs() && dirs.length > 0 ? await rewire(dirs).then(() => probe.tools({ dirs }), () => first) : first;
-  probed = { at: Date.now(), tools: found };
+  const found = unwired && installs() && dirs.length > 0 ? await rewire(home, dirs).then(() => probe.tools({ dirs, organization }), () => first) : first;
+  probed.set(home, { at: Date.now(), tools: found });
   return found;
 }
-async function buildEnvironment({ next, workDir, say }) {
-  if (building || !installs() || next.templateId === null)
+async function buildEnvironment({ next, home, workDir, say }) {
+  if (building.has(home) || !installs() || next.templateId === null)
     return;
-  const built = await readEnvironment();
+  const built = await readEnvironment(home);
   const buildsSteps = buildIsDue(built, next.templateId);
   const clonesRepos = cloneIsDue({ built, wanted: next.repos, workDir });
   if (!buildsSteps && !clonesRepos)
     return;
-  building = true;
+  building.add(home);
   try {
     let results = built?.results ?? [];
     let repos = built?.repos ?? [];
@@ -23511,11 +23585,11 @@ async function buildEnvironment({ next, workDir, say }) {
     if (clonesRepos) {
       say?.(ui.heading(`Cloning the ${next.repos.length} repos your team works in, into ${workDir}`));
       repos = await setup.cloneRepos({ repos: next.repos, workDir, say });
-      await rewire(repos.filter((repo) => repo.ok).map((repo) => repo.path));
+      await rewire(home, repos.filter((repo) => repo.ok).map((repo) => repo.path));
     }
-    await writeEnvironment({ templateId: next.templateId, results, repos, at: Date.now() });
+    await writeEnvironment(home, { templateId: next.templateId, results, repos, at: Date.now() });
   } finally {
-    building = false;
+    building.delete(home);
   }
 }
 function cloneIsDue({ built, wanted, workDir }) {
@@ -23542,35 +23616,40 @@ function buildIsDue(built, templateId) {
     return false;
   return Date.now() - built.at > REBUILD_AFTER_MS;
 }
-async function readEnvironment() {
-  const raw = await readFile3(environmentPath(), "utf8").catch(() => null);
+async function readEnvironment(home) {
+  const raw = await readFile3(environmentPath(home), "utf8").catch(() => null);
   if (raw === null)
     return null;
   const parsed = BuiltSchema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : null;
 }
-async function writeEnvironment(built) {
-  await mkdir3(machine.home(), { recursive: true, mode: 448 });
-  await writeFile2(environmentPath(), JSON.stringify(built, null, 2), { mode: 384 });
+async function writeEnvironment(home, built) {
+  await mkdir3(home, { recursive: true, mode: 448 });
+  await writeFile2(environmentPath(home), JSON.stringify(built, null, 2), { mode: 384 });
 }
 function installs() {
   return process.env.CRAFTSPACE_NO_INSTALL !== "1";
 }
-async function rewire(dirs) {
-  const { url: url2, token } = await requireSignedIn();
-  await wireRepos({ url: url2, token, dirs });
+async function rewire(home, dirs) {
+  const { url: url2, token, organization } = await requireSignedIn(home);
+  await wireRepos({ url: url2, token, organization: organization ?? "team", dirs });
 }
 function clonedDirs(built) {
   return (built?.repos ?? []).filter((repo) => repo.ok).map((repo) => repo.path);
 }
-function report(next) {
-  reports.set(next.id, next);
+function report(home, next) {
+  const mine = reports.get(home) ?? /* @__PURE__ */ new Map();
+  mine.set(next.id, next);
+  reports.set(home, mine);
 }
-function drainReports() {
-  const pending = [...reports.values()];
+function drainReports(home) {
+  const mine = reports.get(home);
+  if (mine === void 0)
+    return [];
+  const pending = [...mine.values()];
   for (const item of pending)
     if (item.state !== "running")
-      reports.delete(item.id);
+      mine.delete(item.id);
   return pending;
 }
 async function call({ url: url2, token, method, path: route, body, schema }) {
@@ -23594,13 +23673,6 @@ var Unauthorized = class extends Error {
     super("This machine no longer has a key Craftspace accepts.");
   }
 };
-async function signedInOrAsk() {
-  const config2 = await readConfig();
-  const token = await readToken();
-  if (config2 && token)
-    return { url: config2.url, token };
-  return machine.signIn({ why: "This machine is not signed in to Craftspace yet." });
-}
 async function withAuth(auth, work) {
   try {
     return { auth, value: await work(auth) };
@@ -23625,33 +23697,46 @@ function tokenIn(line) {
   return /cst_[A-Za-z0-9_-]+/.exec(line)?.[0];
 }
 async function ensureKey() {
-  const priv = path5.join(machine.home(), "id_ed25519");
+  const priv = path5.join(machine.root(), "id_ed25519");
   const pub = `${priv}.pub`;
   const existing = await readFile3(pub, "utf8").catch(() => null);
   if (existing !== null)
     return existing.trim();
-  await mkdir3(machine.home(), { recursive: true, mode: 448 });
+  await mkdir3(machine.root(), { recursive: true, mode: 448 });
   await run2("ssh-keygen", ["-t", "ed25519", "-N", "", "-q", "-f", priv, "-C", `craftspace-${os6.hostname()}`]);
   return (await readFile3(pub, "utf8")).trim();
 }
-async function writeConfig(next) {
-  const merged = { ...await readConfig(), ...next };
-  await mkdir3(machine.home(), { recursive: true, mode: 448 });
-  await writeFile2(configPath(), `${JSON.stringify(merged, null, 2)}
+async function writeConfig(home, next) {
+  const merged = { ...await readConfig(home), ...next };
+  await mkdir3(home, { recursive: true, mode: 448 });
+  await writeFile2(configPath(home), `${JSON.stringify(merged, null, 2)}
 `, { mode: 384 });
 }
-async function readConfig() {
-  const raw = await readFile3(configPath(), "utf8").catch(() => null);
+async function readConfig(home) {
+  const raw = await readFile3(configPath(home), "utf8").catch(() => null);
   if (raw === null)
     return null;
-  return ConfigSchema.parse(JSON.parse(raw));
+  const parsed = ConfigSchema.safeParse(JSON.parse(raw));
+  return parsed.success ? parsed.data : null;
 }
-async function readToken() {
-  const raw = await readFile3(tokenPath(), "utf8").catch(() => null);
+async function readToken(home) {
+  const raw = await readFile3(tokenPath(home), "utf8").catch(() => null);
   return raw === null ? null : raw.trim();
 }
+async function settleLayout() {
+  const root = machine.root();
+  const config2 = await readConfig(root);
+  const organization = config2?.organization;
+  if (config2 === null || organization === void 0)
+    return;
+  const home = path5.join(root, organization);
+  await mkdir3(home, { recursive: true, mode: 448 });
+  for (const name of SEAT_FILES) {
+    await rename2(path5.join(root, name), path5.join(home, name)).catch(() => void 0);
+  }
+}
 async function readSessions() {
-  const dir = path5.join(machine.home(), "sessions");
+  const dir = path5.join(machine.root(), "sessions");
   const names = await readdir2(dir).catch(() => []);
   const sessions = [];
   for (const name of names.filter((entry) => entry.endsWith(".json"))) {
@@ -23664,43 +23749,63 @@ async function readSessions() {
   }
   return sessions.slice(0, MAX_REPORTED_SESSIONS);
 }
-async function writeAuthorizedKeys(keys) {
+async function writeAuthorizedKeys({ organization, keys }) {
   const target = path5.join(os6.homedir(), ".ssh", "authorized_keys");
   const current = await readFile3(target, "utf8").catch(() => "");
-  const before = current.split(KEYS_BEGIN)[0] ?? "";
-  const after = current.includes(KEYS_END) ? current.split(KEYS_END)[1] ?? "" : "";
-  const block = keys.length === 0 ? "" : `${KEYS_BEGIN}
-${keys.join("\n")}
-${KEYS_END}
+  const block = keys.length === 0 ? "" : `${keys.join("\n")}
 `;
-  const next = `${trimEnd(before)}${trimEnd(before) === "" ? "" : "\n"}${block}${after.replace(/^\n/, "")}`;
+  const next = replaceBlock({
+    text: replaceBlock({ text: current, begin: KEYS_BEGIN, end: KEYS_END, block: "" }),
+    begin: `${KEYS_BEGIN} ${organization}`,
+    end: `${KEYS_END} ${organization}`,
+    block
+  });
   if (next === current)
     return;
   await mkdir3(path5.dirname(target), { recursive: true, mode: 448 });
   await writeFile2(target, next, { mode: 384 });
 }
+function replaceBlock({ text, begin, end, block }) {
+  const before = text.split(begin)[0] ?? "";
+  const after = text.includes(end) ? text.split(end)[1] ?? "" : text.includes(begin) ? "" : null;
+  if (after === null && block === "")
+    return text;
+  const kept = after ?? "";
+  const wrapped = block === "" ? "" : `${begin}
+${block}${end}
+`;
+  return `${trimEnd(before)}${trimEnd(before) === "" ? "" : "\n"}${wrapped}${kept.replace(/^\n/, "")}`;
+}
 function trimEnd(text) {
   return text.replace(/\s+$/, "");
 }
-async function wireRepos({ url: url2, token, dirs }) {
+async function wireRepos({ url: url2, token, organization, dirs }) {
   if (dirs.length === 0)
     return;
+  await migrate.stripGlobalMcp();
   const server = { type: "http", url: `${url2}/mcp`, headers: { Authorization: `Bearer ${token}` } };
   await editClaudeConfig((projects) => {
     for (const dir of dirs) {
       const here2 = isPlainObject3(projects[dir]) ? { ...projects[dir] } : {};
       const servers = isPlainObject3(here2.mcpServers) ? { ...here2.mcpServers } : {};
-      projects[dir] = { ...here2, hasTrustDialogAccepted: true, mcpServers: { ...servers, craftspace: server } };
+      delete servers.craftspace;
+      projects[dir] = {
+        ...here2,
+        hasTrustDialogAccepted: true,
+        mcpServers: { ...servers, [serverNameFor(organization)]: server }
+      };
     }
   });
 }
+function serverNameFor(organization) {
+  return `craftspace-${organization}`;
+}
 async function unwireRepos() {
   await editClaudeConfig((projects) => {
     for (const [dir, found] of Object.entries(projects)) {
       if (!isPlainObject3(found) || !isPlainObject3(found.mcpServers))
         continue;
-      const servers = { ...found.mcpServers };
-      delete servers.craftspace;
+      const servers = Object.fromEntries(Object.entries(found.mcpServers).filter(([name]) => name !== "craftspace" && !name.startsWith("craftspace-")));
       projects[dir] = { ...found, mcpServers: servers };
     }
   });
@@ -23720,7 +23825,7 @@ async function editClaudeConfig(edit) {
 async function writeAgentConfigs({ writes }) {
   if (writes.length === 0)
     return;
-  const owned = [...await readOwned()];
+  const owned = [];
   for (const write of writes) {
     const target = expand(write.path);
     await mkdir3(path5.dirname(target), { recursive: true });
@@ -23732,10 +23837,10 @@ async function writeAgentConfigs({ writes }) {
 `, { mode: 384 });
     owned.push(target);
   }
-  await writeFile2(ownedPath(), JSON.stringify({ paths: [...new Set(owned)] }, null, 2));
+  await writeFile2(ownedPath(machine.root()), JSON.stringify({ paths: [...new Set(owned)] }, null, 2));
 }
-async function readOwned() {
-  const raw = await readFile3(ownedPath(), "utf8").catch(() => null);
+async function readOwned(home) {
+  const raw = await readFile3(ownedPath(home), "utf8").catch(() => null);
   if (raw === null)
     return [];
   const parsed = OwnedSchema.safeParse(JSON.parse(raw));
@@ -23752,9 +23857,8 @@ function mergeInto(current, incoming) {
 function isPlainObject3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function removeAgentConfigs() {
-  await unwireRepos();
-  for (const target of await readOwned()) {
+async function removeAgentConfigs(home) {
+  for (const target of await readOwned(home)) {
     const current = await readFile3(target, "utf8").catch(() => null);
     if (current === null)
       continue;
@@ -23852,17 +23956,17 @@ function entryPath() {
 function expand(target) {
   return target.startsWith("~/") ? path5.join(os6.homedir(), target.slice(2)) : target;
 }
-function configPath() {
-  return path5.join(machine.home(), "config.json");
+function configPath(home) {
+  return path5.join(home, "config.json");
 }
-function tokenPath() {
-  return path5.join(machine.home(), "token");
+function tokenPath(home) {
+  return path5.join(home, "token");
 }
-function ownedPath() {
-  return path5.join(machine.home(), "owned.json");
+function ownedPath(home) {
+  return path5.join(home, "owned.json");
 }
-function environmentPath() {
-  return path5.join(machine.home(), "environment.json");
+function environmentPath(home) {
+  return path5.join(home, "environment.json");
 }
 function load2() {
   const cores = Math.max(1, os6.cpus().length);
@@ -23881,7 +23985,12 @@ function nextDelayMs(failures, busy = false) {
 function messageOf(error51) {
   return error51 instanceof Error ? error51.message : String(error51);
 }
-var ConfigSchema = external_exports.object({ url: external_exports.string(), machineId: external_exports.string(), organization: external_exports.string().optional() });
+var ConfigSchema = external_exports.object({
+  url: external_exports.string(),
+  machineId: external_exports.string(),
+  organization: external_exports.string().optional(),
+  account: external_exports.string().optional()
+});
 var BuiltSchema = external_exports.object({
   templateId: external_exports.string(),
   results: external_exports.array(WorkstationStepResultSchema),
@@ -23890,6 +23999,7 @@ var BuiltSchema = external_exports.object({
 });
 var OwnedSchema = external_exports.object({ paths: external_exports.array(external_exports.string()) });
 var CLAUDE_FILE = ".claude.json";
+var SEAT_FILES = ["config.json", "token", "environment.json", "owned.json"];
 var SERVICE_NAME = "craftspace";
 var LAUNCH_LABEL = "app.craftspace.machine";
 var REQUEST_TIMEOUT_MS2 = 15e3;
@@ -23920,8 +24030,8 @@ var DEFAULT_URL = process.env.CRAFTSPACE_URL ?? "https://craftspace.app";
 var PROBE_EVERY_MS = 3e5;
 var REBUILD_AFTER_MS = 216e5;
 var updateWanted = null;
-var probed = null;
-var building = false;
+var probed = /* @__PURE__ */ new Map();
+var building = /* @__PURE__ */ new Set();
 var reports = /* @__PURE__ */ new Map();
 var running = /* @__PURE__ */ new Set();
 
@@ -23931,12 +24041,13 @@ var program2 = new Command();
 program2.enablePositionalOptions().name("cs").description("Sign this machine in to your team, so every agent on it reads the same brain.").version(CLI_VERSION).showHelpAfterError();
 program2.command("login").description("sign this machine in").option("--token <token>", "the login token from your team", process.env.CRAFTSPACE_TOKEN).option("--url <url>", "your control plane, remembered after the first login").option("--no-install", "do not install anything this machine is missing").action(async ({ token, url: url2, install }) => {
   const where = await machine.controlPlane(url2);
-  const signed = token === void 0 ? (await machine.signIn({ url: where, why: "Signing this machine in.", install })).machine : await machine.login({ token, url: where, install });
+  const signed = token === void 0 ? await machine.signIn({ url: where, why: "Signing this machine in.", install }) : await machine.login({ token, url: where, install });
   const daemon = await machine.daemon();
-  ui.say(ui.heading(`Signed in as ${signed.ownerName}`));
-  ui.say(ui.field("Machine", `${ui.name(signed.name)}  ${ui.dim(machineSpecs(signed))}`));
-  const workDir = await machine.workDir();
-  ui.say(ui.field("Work dir", workDir === null ? "set on the first beat" : workDir));
+  const seats = await machine.seats();
+  ui.say(ui.heading(`Signed in as ${signed.machine.ownerName}`));
+  ui.say(ui.field("Machine", `${ui.name(signed.machine.name)}  ${ui.dim(machineSpecs(signed.machine))}`));
+  ui.say(ui.field("Org", `${ui.name(signed.organization)}${orgTally(seats.length)}`));
+  ui.say(ui.field("Work dir", await machine.workDir(signed.organization)));
   ui.say(ui.field("MCP wired", "into every repo cloned there, for Claude Code"));
   ui.say(ui.field("Daemon", daemon.ok ? daemon.text : ui.attention(daemon.text)));
   ui.say(`
@@ -23947,14 +24058,17 @@ program2.command("run").description("pick a workstation and open a terminal on i
   process.exitCode = await machine.run();
 });
 program2.command("status").description("what this machine is and what it is doing").action(async () => {
-  const { machine: found } = await machine.status();
-  const since = found.lastBeatAt === null ? "never" : `${secondsSince(found.lastBeatAt)}s ago`;
-  ui.say(ui.heading(`${found.name}  ${found.state}`));
-  ui.say(ui.field("Owner", found.ownerName));
-  ui.say(ui.field("Machine", ui.dim(machineSpecs(found))));
-  ui.say(ui.field("CLI", `${found.cli}, beat ${since}`));
-  for (const session of found.sessions)
-    ui.say(ui.field("Session", `${session.state}  ${session.title ?? session.id}`));
+  for (const { machine: found, organization } of await machine.status()) {
+    const since = found.lastBeatAt === null ? "never" : `${secondsSince(found.lastBeatAt)}s ago`;
+    ui.say(ui.heading(`${found.name}  ${found.state}  ${ui.dim(organization)}`));
+    ui.say(ui.field("Owner", found.ownerName));
+    ui.say(ui.field("Machine", ui.dim(machineSpecs(found))));
+    ui.say(ui.field("CLI", `${found.cli}, beat ${since}`));
+    ui.say(ui.field("Work dir", found.workDir ?? "set on the first beat"));
+    for (const session of found.sessions) {
+      ui.say(ui.field("Session", `${session.state}  ${session.title ?? session.id}`));
+    }
+  }
   ui.say("\n");
 });
 program2.command("logout").description("leave the team, and undo what login wrote").action(async () => {
@@ -23962,6 +24076,9 @@ program2.command("logout").description("leave the team, and undo what login wrot
   ui.say(ui.ok("Left the team. Nothing of ours is running here."));
 });
 program2.command("daemon", { hidden: true }).action(async () => machine.beatForever());
+function orgTally(seats) {
+  return seats < 2 ? "" : ui.dim(`  \xB7 ${seats} orgs on this box`);
+}
 try {
   await program2.parseAsync(process.argv);
 } catch (error51) {