@ctrl-spc/cli 1.1.1 → 1.1.3

package/dist/auth.js

@@ -1,6 +1,6 @@
 import http from 'node:http';
 import { randomUUID } from 'node:crypto';
-import { createSupabaseClient } from './supabase.js';
+import { createSupabaseClient, SUPABASE_ANON_KEY, SUPABASE_FUNCTIONS_URL } from './supabase.js';
 import { getOrCreateMachineId, saveMachineState } from './session.js';
 const CALLBACK_HOST = '127.0.0.1';
 const CALLBACK_PORT = 54321;
@@ -47,6 +47,21 @@ export function buildCallbackHtml(state) {
 export function isValidTokenCallback(body, expectedState) {
     return typeof body.state === 'string' && body.state === expectedState;
 }
+export async function requestCliLoginEmail(email, redirectTo, fetchImpl = fetch) {
+    const response = await fetchImpl(`${SUPABASE_FUNCTIONS_URL}/request-cli-login`, {
+        method: 'POST',
+        headers: {
+            apikey: SUPABASE_ANON_KEY,
+            Authorization: `Bearer ${SUPABASE_ANON_KEY}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ email, redirectTo }),
+    });
+    if (response.ok)
+        return;
+    const message = await readFunctionError(response);
+    throw new Error(message ?? SEND_EMAIL_FAILED_MESSAGE);
+}
 export async function authenticate(email) {
     const client = createSupabaseClient();
     const state = randomUUID();
@@ -108,12 +123,11 @@ export async function authenticate(email) {
             settle(() => reject(new Error(SEND_EMAIL_FAILED_MESSAGE)));
         });
         server.listen(CALLBACK_PORT, CALLBACK_HOST, async () => {
-            const { error } = await client.auth.signInWithOtp({
-                email,
-                options: { emailRedirectTo: redirectUrl },
-            });
-            if (error) {
-                settle(() => reject(new Error(SEND_EMAIL_FAILED_MESSAGE)));
+            try {
+                await requestCliLoginEmail(email, redirectUrl);
+            }
+            catch (error) {
+                settle(() => reject(error instanceof Error ? error : new Error(SEND_EMAIL_FAILED_MESSAGE)));
             }
         });
         function settle(done) {
@@ -125,6 +139,15 @@ export async function authenticate(email) {
         }
     });
 }
+async function readFunctionError(response) {
+    try {
+        const body = await response.json();
+        return typeof body.error === 'string' ? body.error : null;
+    }
+    catch {
+        return null;
+    }
+}
 function readJson(req) {
     return new Promise((resolve) => {
         let body = '';

package/dist/daemon.js

@@ -1,16 +1,37 @@
-import { disconnect, heartbeat } from './devices.js';
+import { createSessionClient, heartbeat, setDeviceStatus } from './devices.js';
 import { loadMachineState } from './session.js';
 export const HEARTBEAT_INTERVAL_MS = 30_000;
-const SESSION_WAIT_INTERVAL_MS = 5_000;
+const SESSION_RETRY_INTERVAL_MS = 5_000;
+export async function heartbeatOnce(session, deps) {
+    try {
+        await deps.heartbeat(session);
+        return session;
+    }
+    catch (err) {
+        deps.log(err instanceof Error ? err.message : 'Heartbeat failed');
+        // A re-run of `setup` may have rotated the token on disk; rebuild and let the next beat retry.
+        try {
+            return await deps.createSession();
+        }
+        catch {
+            return session;
+        }
+    }
+}
 export async function runDaemon() {
-    const state = await waitForMachineState();
+    const deps = {
+        createSession: createSessionClient,
+        heartbeat,
+        log: (msg) => process.stderr.write(`${msg}\n`),
+    };
+    let session = await acquireSession(deps);
     let shuttingDown = false;
     const shutdown = async () => {
         if (shuttingDown)
             return;
         shuttingDown = true;
         try {
-            await disconnect(state);
+            await setDeviceStatus(session, 'disconnected');
         }
         catch {
             // Best effort: a hard kill is covered by heartbeat staleness.
@@ -19,26 +40,24 @@ export async function runDaemon() {
     };
     process.once('SIGINT', () => void shutdown());
     process.once('SIGTERM', () => void shutdown());
-    await writeHeartbeat(state);
+    session = await heartbeatOnce(session, deps);
     while (true) {
         await sleep(HEARTBEAT_INTERVAL_MS);
-        await writeHeartbeat(state);
+        session = await heartbeatOnce(session, deps);
     }
 }
-export async function waitForMachineState() {
-    let state = loadMachineState();
-    while (!state) {
-        await sleep(SESSION_WAIT_INTERVAL_MS);
-        state = loadMachineState();
-    }
-    return state;
-}
-async function writeHeartbeat(state) {
-    try {
-        await heartbeat(state);
-    }
-    catch (err) {
-        process.stderr.write(`${err instanceof Error ? err.message : 'Heartbeat failed'}\n`);
+async function acquireSession(deps) {
+    while (true) {
+        while (!loadMachineState()) {
+            await sleep(SESSION_RETRY_INTERVAL_MS);
+        }
+        try {
+            return await deps.createSession();
+        }
+        catch (err) {
+            deps.log(err instanceof Error ? err.message : 'Session unavailable');
+            await sleep(SESSION_RETRY_INTERVAL_MS);
+        }
     }
 }
 function sleep(ms) {

package/dist/devices.js

@@ -1,66 +1,64 @@
 import { createHash } from 'node:crypto';
 import { createSupabaseClient } from './supabase.js';
-import { saveMachineState } from './session.js';
-const REGISTER_FAILED_MESSAGE = "Connected to your account but couldn't register this machine. Check your connection and re-run setup.";
-const SESSION_EXPIRED_MESSAGE = 'That sign-in link expired. Run `ctrl-spc setup` again to get a fresh one.';
+import { loadMachineState, saveMachineState } from './session.js';
+export const NOT_CONNECTED_MESSAGE = 'This machine is not connected. Run `ctrl-spc setup` first.';
+export const SESSION_EXPIRED_MESSAGE = 'Your machine session expired. Run `ctrl-spc setup` to reconnect.';
+const REGISTER_FAILED_MESSAGE = "Connected to your account but couldn't register this machine. Check your connection and try again.";
 export function hashToken(token) {
     return createHash('sha256').update(token).digest('hex');
 }
-export async function upsertDevice(state, label) {
-    const client = createSupabaseClient();
-    const activeState = await restoreSession(client, state);
-    const { data, error: userError } = await client.auth.getUser();
-    const user = data.user;
-    if (userError || !user) {
-        throw new Error(REGISTER_FAILED_MESSAGE);
-    }
-    const { error } = await client.from('devices').upsert({
-        id: activeState.machineId,
-        owner_id: user.id,
-        label,
-        token_hash: hashToken(activeState.refreshToken),
-        status: 'connected',
-        last_seen_at: new Date().toISOString(),
-    }, { onConflict: 'id' });
-    if (error) {
-        throw new Error(REGISTER_FAILED_MESSAGE);
-    }
-}
-export async function heartbeat(state) {
-    const client = createSupabaseClient();
-    const activeState = await restoreSession(client, state);
-    const { error } = await client
-        .from('devices')
-        .update({
-        last_seen_at: new Date().toISOString(),
-        status: 'connected',
-    })
-        .eq('id', activeState.machineId);
-    if (error) {
-        throw new Error(`Heartbeat failed: ${error.message}`);
-    }
-}
-export async function disconnect(state) {
-    const client = createSupabaseClient();
-    const activeState = await restoreSession(client, state);
-    const { error } = await client.from('devices').update({ status: 'disconnected' }).eq('id', activeState.machineId);
-    if (error) {
-        throw new Error(`Disconnect failed: ${error.message}`);
-    }
+export function sessionToState(machineId, session) {
+    return { machineId, accessToken: session.access_token, refreshToken: session.refresh_token };
 }
-async function restoreSession(client, state) {
+export async function createSessionClient(deps = {}) {
+    const loadState = deps.loadState ?? loadMachineState;
+    const saveState = deps.saveState ?? saveMachineState;
+    const createClient = deps.createClient ?? createSupabaseClient;
+    const state = loadState();
+    if (!state)
+        throw new Error(NOT_CONNECTED_MESSAGE);
+    const client = createClient();
+    const machineId = state.machineId;
+    client.auth.onAuthStateChange((_event, session) => {
+        if (session)
+            saveState(sessionToState(machineId, session));
+    });
     const { data, error } = await client.auth.setSession({
         access_token: state.accessToken,
         refresh_token: state.refreshToken,
     });
-    if (error || !data.session) {
+    if (error || !data.session)
         throw new Error(SESSION_EXPIRED_MESSAGE);
-    }
-    if (data.session.access_token !== state.accessToken ||
-        data.session.refresh_token !== state.refreshToken) {
-        state.accessToken = data.session.access_token;
-        state.refreshToken = data.session.refresh_token;
-        saveMachineState(state);
-    }
-    return state;
+    return { client, machineId };
+}
+export async function heartbeat(session) {
+    const { error } = await session.client
+        .from('devices')
+        .update({ last_seen_at: new Date().toISOString(), status: 'connected' })
+        .eq('id', session.machineId);
+    if (error)
+        throw new Error(`Heartbeat failed: ${error.message}`);
+}
+export async function setDeviceStatus(session, status) {
+    const { error } = await session.client.from('devices').update({ status }).eq('id', session.machineId);
+    if (error)
+        throw new Error(`Update failed: ${error.message}`);
+}
+export async function upsertDevice(session, label, loadState = loadMachineState) {
+    const { data, error: userError } = await session.client.auth.getUser();
+    if (userError || !data.user)
+        throw new Error(REGISTER_FAILED_MESSAGE);
+    const state = loadState();
+    if (!state)
+        throw new Error(NOT_CONNECTED_MESSAGE);
+    const { error } = await session.client.from('devices').upsert({
+        id: session.machineId,
+        owner_id: data.user.id,
+        label,
+        token_hash: hashToken(state.refreshToken),
+        status: 'connected',
+        last_seen_at: new Date().toISOString(),
+    }, { onConflict: 'id' });
+    if (error)
+        throw new Error(REGISTER_FAILED_MESSAGE);
 }

package/dist/index.js

@@ -1,4 +1,27 @@
-const [, , command] = process.argv;
+const [, , command, ...args] = process.argv;
+async function loadDaemonControl() {
+    const mod = process.platform === 'darwin'
+        ? await import('./launchd.js')
+        : await import('./windows-service.js');
+    return {
+        installDaemon: mod.installDaemon,
+        restartDaemon: mod.restartDaemon,
+        stopDaemon: mod.stopDaemon,
+        isDaemonInstalled: mod.isDaemonInstalled,
+    };
+}
+async function lifecycleDeps() {
+    const { hostname } = await import('node:os');
+    const { createSessionClient, upsertDevice, setDeviceStatus } = await import('./devices.js');
+    return {
+        createSession: createSessionClient,
+        upsertDevice,
+        setDeviceStatus,
+        daemon: await loadDaemonControl(),
+        label: hostname(),
+        log: (msg) => console.log(msg),
+    };
+}
 async function main() {
     if (command === 'setup') {
         const { runSetup } = await import('./setup.js');
@@ -10,7 +33,38 @@ async function main() {
         await runDaemon();
         return;
     }
-    console.error('Usage: ctrl-spc <setup|daemon>');
+    if (command === 'init') {
+        const { runInit } = await import('./init.js');
+        await runInit(args);
+        return;
+    }
+    if (command === 'serve') {
+        const { startMcpServer } = await import('@ctrl-spc/mcp-server');
+        await startMcpServer();
+        return;
+    }
+    if (command === 'status') {
+        const { runStatus } = await import('./lifecycle.js');
+        const deps = await lifecycleDeps();
+        await runStatus({ createSession: deps.createSession, daemon: deps.daemon, log: deps.log });
+        return;
+    }
+    if (command === 'connect') {
+        const { runConnect } = await import('./lifecycle.js');
+        await runConnect(await lifecycleDeps());
+        return;
+    }
+    if (command === 'reconnect') {
+        const { runReconnect } = await import('./lifecycle.js');
+        await runReconnect(await lifecycleDeps());
+        return;
+    }
+    if (command === 'disconnect') {
+        const { runDisconnect } = await import('./lifecycle.js');
+        await runDisconnect(await lifecycleDeps());
+        return;
+    }
+    console.error('Usage: ctrl-spc <setup|status|connect|reconnect|disconnect|init|serve>');
     process.exitCode = 1;
 }
 main().catch((err) => {

package/dist/init.js

@@ -0,0 +1,79 @@
+import { stdin as input, stdout as output } from 'node:process';
+import * as readline from 'node:readline/promises';
+import { claimProject as claimWithServer } from '@ctrl-spc/mcp-server/claimResolver';
+import { createSupabaseClient } from './supabase.js';
+import { loadMachineState, saveMachineState } from './session.js';
+import { detectMonorepoProjects, detectRepo, parseProjectSelection } from './repo.js';
+import { writeMcpConfig as writeConfig } from './mcpConfig.js';
+export async function runInitForProjects(options) {
+    const messages = [];
+    for (const project of options.projects) {
+        const result = await options.claimProject({
+            name: project.name,
+            remoteUrl: options.repo.normalizedRemoteUrl,
+            localPath: project.path,
+            fingerprint: options.repo.fingerprint,
+            orgId: options.orgId,
+            isMonorepoSubproject: project.path !== options.repo.root,
+        });
+        if (!result.ok) {
+            messages.push(result.message);
+            continue;
+        }
+        messages.push(`Project registered: ${result.projectName}`);
+    }
+    options.writeMcpConfig(options.repo.root);
+    return messages;
+}
+export async function runInit(argv, cwd = process.cwd()) {
+    const orgFlagIndex = argv.indexOf('--org');
+    const personal = argv.includes('--personal');
+    const orgId = orgFlagIndex >= 0 ? argv[orgFlagIndex + 1] : null;
+    if (!personal && !orgId)
+        throw new Error('Run init from the copied Add-project prompt so Control Space knows which org to use.');
+    const repo = detectRepo(cwd);
+    const detected = detectMonorepoProjects(repo.root);
+    const projects = detected.length <= 1 ? detected : await askWhichProjects(detected);
+    if (projects.length === 0) {
+        console.log('No projects registered.');
+        return;
+    }
+    const state = loadMachineState();
+    if (!state)
+        throw new Error('Run `ctrl-spc setup` first so Control Space can act as you.');
+    const client = createSupabaseClient();
+    const { data, error } = await client.auth.setSession({
+        access_token: state.accessToken,
+        refresh_token: state.refreshToken,
+    });
+    if (error || !data.session)
+        throw new Error('Your machine session has expired. Run `ctrl-spc setup` again.');
+    if (data.session.access_token !== state.accessToken ||
+        data.session.refresh_token !== state.refreshToken) {
+        state.accessToken = data.session.access_token;
+        state.refreshToken = data.session.refresh_token;
+        saveMachineState(state);
+    }
+    const messages = await runInitForProjects({
+        repo,
+        projects,
+        orgId,
+        claimProject: (claimInput) => claimWithServer(client, claimInput),
+        writeMcpConfig: writeConfig,
+    });
+    for (const message of messages)
+        console.log(message);
+    console.log('MCP config written: .mcp.json');
+}
+async function askWhichProjects(projects) {
+    console.log('Detected multiple sub-projects:');
+    projects.forEach((project, index) => console.log(`${index + 1}. ${project.name} - ${project.path}`));
+    const rl = readline.createInterface({ input, output });
+    try {
+        const answer = await rl.question('Which should Control Space register? Enter numbers separated by commas: ');
+        return parseProjectSelection(answer, projects);
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/launchd.js

@@ -6,6 +6,11 @@ import { fileURLToPath } from 'node:url';
 import { ensureStateDir, getStatePaths } from './session.js';
 export const PLIST_LABEL = 'com.ctrl-spc.daemon';
 const INSTALL_FAILED_MESSAGE = "Couldn't install the background helper. Try again, or download the installer from the web app.";
+const STOP_FAILED_MESSAGE = "Couldn't stop the background helper.";
+const RESTART_FAILED_MESSAGE = "Couldn't restart the background helper. Try `ctrl-spc setup` again.";
+const defaultExec = (command, args) => {
+    execFileSync(command, args, { stdio: 'pipe' });
+};
 export function getPlistPath(home = homedir()) {
     return join(home, 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);
 }
@@ -66,6 +71,34 @@ export async function installDaemon() {
 export function isDaemonInstalled(home = homedir()) {
     return existsSync(getPlistPath(home));
 }
+export function bootoutArgs(uid, plistPath) {
+    return ['bootout', `gui/${uid}`, plistPath];
+}
+export function kickstartArgs(uid) {
+    return ['kickstart', '-k', `gui/${uid}/${PLIST_LABEL}`];
+}
+export async function stopDaemon(home = homedir(), exec = defaultExec) {
+    const uid = process.getuid?.();
+    if (uid === undefined)
+        throw new Error(STOP_FAILED_MESSAGE);
+    try {
+        exec('launchctl', bootoutArgs(uid, getPlistPath(home)));
+    }
+    catch {
+        // Already stopped — fine.
+    }
+}
+export async function restartDaemon(home = homedir(), exec = defaultExec) {
+    const uid = process.getuid?.();
+    if (uid === undefined)
+        throw new Error(RESTART_FAILED_MESSAGE);
+    try {
+        exec('launchctl', kickstartArgs(uid));
+    }
+    catch {
+        throw new Error(RESTART_FAILED_MESSAGE);
+    }
+}
 function escapeXml(value) {
     return value
         .replace(/&/g, '&')

package/dist/lifecycle.js

@@ -0,0 +1,37 @@
+async function ensureDaemonRunning(daemon, forceRestart) {
+    if (!daemon.isDaemonInstalled()) {
+        await daemon.installDaemon();
+        return;
+    }
+    if (forceRestart)
+        await daemon.restartDaemon();
+}
+export async function runConnect(deps) {
+    const session = await deps.createSession();
+    await deps.upsertDevice(session, deps.label);
+    await ensureDaemonRunning(deps.daemon, true);
+    deps.log('Connected. This machine now shows as connected in the web app.');
+}
+export async function runReconnect(deps) {
+    const session = await deps.createSession();
+    await deps.setDeviceStatus(session, 'connected');
+    await ensureDaemonRunning(deps.daemon, true);
+    deps.log('Reconnected - no email needed.');
+}
+export async function runDisconnect(deps) {
+    const session = await deps.createSession();
+    await deps.setDeviceStatus(session, 'disconnected');
+    await deps.daemon.stopDaemon();
+    deps.log('Disconnected. Run `ctrl-spc reconnect` to come back online - no email needed.');
+}
+export async function runStatus(deps) {
+    try {
+        await deps.createSession();
+    }
+    catch (err) {
+        deps.log(err instanceof Error ? err.message : 'This machine is not connected.');
+        return;
+    }
+    const installed = deps.daemon.isDaemonInstalled() ? 'yes' : 'no';
+    deps.log(`Connected (session valid). Background helper installed: ${installed}.`);
+}

package/dist/mcpConfig.js

@@ -0,0 +1,12 @@
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function writeMcpConfig(repoRoot) {
+    writeFileSync(join(repoRoot, '.mcp.json'), JSON.stringify({
+        mcpServers: {
+            'ctrl-spc': {
+                command: 'ctrl-spc',
+                args: ['serve'],
+            },
+        },
+    }, null, 2));
+}

package/dist/repo.js

@@ -0,0 +1,52 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { fingerprintRepo, normalizeRemoteUrl } from '@ctrl-spc/mcp-server/fingerprint';
+function git(cwd, args) {
+    return execFileSync('git', args, { cwd, encoding: 'utf8' }).trim();
+}
+export function detectRepo(cwd) {
+    const root = git(cwd, ['rev-parse', '--show-toplevel']);
+    const rootCommit = git(root, ['rev-list', '--max-parents=0', 'HEAD']).split('\n')[0];
+    let remoteUrl = '';
+    try {
+        remoteUrl = git(root, ['config', '--get', 'remote.origin.url']);
+    }
+    catch {
+        remoteUrl = '';
+    }
+    const normalizedRemoteUrl = normalizeRemoteUrl(remoteUrl);
+    return {
+        root,
+        rootCommit,
+        remoteUrl,
+        normalizedRemoteUrl,
+        fingerprint: fingerprintRepo(rootCommit, normalizedRemoteUrl),
+    };
+}
+export function detectMonorepoProjects(root) {
+    const rootPackage = join(root, 'package.json');
+    const hasWorkspaceMarker = existsSync(join(root, 'pnpm-workspace.yaml')) ||
+        existsSync(join(root, 'turbo.json')) ||
+        existsSync(join(root, 'nx.json')) ||
+        existsSync(join(root, 'lerna.json')) ||
+        (existsSync(rootPackage) && Boolean(JSON.parse(readFileSync(rootPackage, 'utf8')).workspaces));
+    if (!hasWorkspaceMarker)
+        return [{ name: basename(root), path: root }];
+    const packagesDir = join(root, 'packages');
+    if (!existsSync(packagesDir))
+        return [{ name: basename(root), path: root }];
+    const projects = readdirSync(packagesDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory())
+        .map((entry) => join(packagesDir, entry.name))
+        .filter((path) => existsSync(join(path, 'package.json')))
+        .map((path) => ({ name: basename(path), path }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+    return projects.length > 0 ? projects : [{ name: basename(root), path: root }];
+}
+export function parseProjectSelection(input, projects) {
+    if (!input.trim())
+        return [];
+    const indexes = new Set(input.split(',').map((value) => Number(value.trim()) - 1));
+    return projects.filter((_, index) => indexes.has(index));
+}

package/dist/session.js

@@ -1,4 +1,4 @@
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import * as path from 'node:path';
 import { homedir } from 'node:os';
@@ -35,8 +35,10 @@ export function loadMachineState(statePath = getStatePaths().statePath) {
 }
 export function saveMachineState(state, statePath = getStatePaths().statePath) {
     mkdirSync(path.dirname(statePath), { recursive: true });
-    writeFileSync(statePath, JSON.stringify(state, null, 2), { mode: 0o600 });
-    chmodSync(statePath, 0o600);
+    const tmpPath = `${statePath}.tmp`;
+    writeFileSync(tmpPath, JSON.stringify(state, null, 2), { mode: 0o600 });
+    chmodSync(tmpPath, 0o600);
+    renameSync(tmpPath, statePath);
 }
 export function getOrCreateMachineId(statePath = getStatePaths().statePath) {
     return loadMachineState(statePath)?.machineId ?? randomUUID();

package/dist/setup.js

@@ -14,7 +14,7 @@ export async function runSetup() {
         return;
     }
     const { authenticate } = await import('./auth.js');
-    const { upsertDevice } = await import('./devices.js');
+    const { createSessionClient, upsertDevice } = await import('./devices.js');
     const installer = process.platform === 'darwin'
         ? await import('./launchd.js')
         : await import('./windows-service.js');
@@ -22,12 +22,15 @@ export async function runSetup() {
         await completeSetup({
             email,
             label: hostname(),
-            installDaemon: installer.installDaemon,
             onReadyForAuth: () => {
                 console.log('Check your email for a sign-in link to connect this machine.');
             },
-            authenticate,
-            upsertDevice,
+            authenticate: async (addr) => { await authenticate(addr); },
+            registerDevice: async (label) => {
+                const session = await createSessionClient();
+                await upsertDevice(session, label);
+            },
+            installDaemon: installer.installDaemon,
         });
     }
     catch (err) {
@@ -50,8 +53,8 @@ function exitWithMessage(message) {
     process.exitCode = 1;
 }
 export async function completeSetup(options) {
-    await options.installDaemon();
     options.onReadyForAuth?.();
-    const state = await options.authenticate(options.email);
-    await options.upsertDevice(state, options.label);
+    await options.authenticate(options.email);
+    await options.registerDevice(options.label);
+    await options.installDaemon();
 }

package/dist/supabase.js

@@ -1,10 +1,11 @@
 import { createClient } from '@supabase/supabase-js';
 export const SUPABASE_URL = 'https://dxlxlphkypjjyqfgpood.supabase.co';
 export const SUPABASE_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImR4bHhscGhreXBqanlxZmdwb29kIiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODAwNzcxMjEsImV4cCI6MjA5NTY1MzEyMX0.s0RkrQUqGRN45Q0lcBb_LkVEqYdYc0FKuVupzKKJrtQ';
+export const SUPABASE_FUNCTIONS_URL = `${SUPABASE_URL}/functions/v1`;
 export function createSupabaseClient() {
     return createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
         auth: {
-            autoRefreshToken: false,
+            autoRefreshToken: true,
             detectSessionInUrl: false,
             persistSession: false,
         },

package/dist/windows-service.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from 'node:url';
 import { ensureStateDir, getStatePaths } from './session.js';
 export const WINDOWS_SERVICE_NAME = 'ctrl-spc-daemon';
 const INSTALL_FAILED_MESSAGE = "Couldn't install the background helper. Try again, or download the installer from the web app.";
+const STOP_FAILED_MESSAGE = "Couldn't stop the background helper.";
 export function resolveBinPath(moduleUrl = import.meta.url) {
     return fileURLToPath(new URL('../bin/ctrl-spc.js', moduleUrl));
 }
@@ -85,6 +86,40 @@ export function installAndStartService(service, serviceDir) {
         }
     });
 }
+export function stopService(service) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const timeout = setTimeout(() => finish(() => reject(new Error(STOP_FAILED_MESSAGE))), 60_000);
+        service.once('stop', () => finish(resolve));
+        service.once('error', () => finish(() => reject(new Error(STOP_FAILED_MESSAGE))));
+        try {
+            service.stop();
+        }
+        catch {
+            finish(() => reject(new Error(STOP_FAILED_MESSAGE)));
+        }
+        function finish(done) {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeout);
+            done();
+        }
+    });
+}
+export async function stopDaemon() {
+    if (process.platform !== 'win32')
+        throw new Error(STOP_FAILED_MESSAGE);
+    const userProfile = process.env.USERPROFILE ?? homedir();
+    const appData = process.env.APPDATA ?? path.win32.join(userProfile, 'AppData', 'Roaming');
+    const service = createWindowsService(buildWindowsServiceConfig({ userProfile, appData }));
+    await stopService(service);
+}
+export async function restartDaemon() {
+    await stopDaemon();
+    // installDaemon is idempotent: 'alreadyinstalled' -> start.
+    await installDaemon();
+}
 export function isDaemonInstalled() {
     const userProfile = process.env.USERPROFILE ?? homedir();
     const appData = process.env.APPDATA ?? path.win32.join(userProfile, 'AppData', 'Roaming');

package/node_modules/@ctrl-spc/mcp-server/dist/claimResolver.d.ts

@@ -0,0 +1,24 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+export type ClaimInput = {
+    name: string;
+    remoteUrl: string;
+    localPath: string;
+    fingerprint: string;
+    orgId: string | null;
+    isMonorepoSubproject?: boolean;
+};
+export type ClaimResult = {
+    ok: true;
+    projectId: string;
+    projectName: string;
+    claimed: boolean;
+} | {
+    ok: false;
+    message: string;
+};
+export declare function mapClaimError(message: string): string;
+export declare function claimProject(client: SupabaseClient, input: ClaimInput): Promise<ClaimResult>;
+export declare function releaseProjectClaim(client: SupabaseClient, projectId: string): Promise<{
+    ok: boolean;
+    message?: string;
+}>;

package/node_modules/@ctrl-spc/mcp-server/dist/claimResolver.js

@@ -0,0 +1,32 @@
+export function mapClaimError(message) {
+    const claimed = message.match(/repo_claimed:([^"]+)$/);
+    if (claimed) {
+        return `This repository is managed by ${claimed[1]}. Ask an admin for access.`;
+    }
+    if (message.includes('manage_projects_required')) {
+        return "You do not have permission to manage projects in this context.";
+    }
+    return 'Something went wrong. Please try again.';
+}
+export async function claimProject(client, input) {
+    const { data, error } = await client.rpc('create_project_with_links', {
+        p_name: input.name,
+        p_remote_url: input.remoteUrl,
+        p_local_path: input.localPath,
+        p_fingerprint: input.fingerprint,
+        p_org_id: input.orgId,
+        p_is_monorepo_subproject: Boolean(input.isMonorepoSubproject),
+    });
+    if (error)
+        return { ok: false, message: mapClaimError(error.message) };
+    const row = Array.isArray(data) ? data[0] : data;
+    if (!row)
+        return { ok: false, message: 'Something went wrong. Please try again.' };
+    return { ok: true, projectId: row.project_id, projectName: row.project_name, claimed: Boolean(row.claimed) };
+}
+export async function releaseProjectClaim(client, projectId) {
+    const { error } = await client.rpc('release_project_claim', { p_project_id: projectId });
+    if (error)
+        return { ok: false, message: mapClaimError(error.message) };
+    return { ok: true };
+}

package/node_modules/@ctrl-spc/mcp-server/dist/fingerprint.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeRemoteUrl(remote: string | null | undefined): string;
+export declare function fingerprintRepo(rootCommitSha: string, normalizedRemoteUrl: string): string;

package/node_modules/@ctrl-spc/mcp-server/dist/fingerprint.js

@@ -0,0 +1,21 @@
+import { createHash } from 'node:crypto';
+export function normalizeRemoteUrl(remote) {
+    if (!remote)
+        return '';
+    const trimmed = remote.trim().replace(/\/+$/, '').replace(/\.git$/i, '');
+    const ssh = trimmed.match(/^git@([^:]+):(.+)$/);
+    if (ssh) {
+        return `https://${ssh[1].toLowerCase()}/${ssh[2].toLowerCase().replace(/\.git$/i, '')}`;
+    }
+    try {
+        const url = new URL(trimmed);
+        const path = url.pathname.replace(/^\/+/, '').replace(/\/+$/, '').replace(/\.git$/i, '');
+        return `https://${url.host.toLowerCase()}/${path.toLowerCase()}`;
+    }
+    catch {
+        return trimmed.toLowerCase();
+    }
+}
+export function fingerprintRepo(rootCommitSha, normalizedRemoteUrl) {
+    return createHash('sha256').update(`${rootCommitSha}\n${normalizedRemoteUrl}`).digest('hex');
+}

package/node_modules/@ctrl-spc/mcp-server/dist/index.d.ts

@@ -0,0 +1 @@
+export declare function startMcpServer(): Promise<void>;

package/node_modules/@ctrl-spc/mcp-server/dist/index.js

@@ -0,0 +1,22 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const json = (body) => ({ content: [{ type: 'text', text: JSON.stringify(body) }] });
+export async function startMcpServer() {
+    const server = new Server({ name: 'ctrl-spc', version: '0.1.0' }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: [
+            {
+                name: 'get_status',
+                description: 'Returns a small health response from the Control Space MCP server.',
+                inputSchema: { type: 'object', properties: {} },
+            },
+        ],
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        if (request.params.name === 'get_status')
+            return json({ ok: true, server: 'ctrl-spc' });
+        throw new Error(`Unknown tool: ${request.params.name}`);
+    });
+    await server.connect(new StdioServerTransport());
+}

package/node_modules/@ctrl-spc/mcp-server/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@ctrl-spc/mcp-server",
+  "version": "0.1.0",
+  "description": "Control Space MCP server and governance chokepoint",
+  "type": "module",
+  "types": "dist/index.d.ts",
+  "files": ["dist/"],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./fingerprint": {
+      "types": "./dist/fingerprint.d.ts",
+      "import": "./dist/fingerprint.js"
+    },
+    "./claimResolver": {
+      "types": "./dist/claimResolver.d.ts",
+      "import": "./dist/claimResolver.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.11.0",
+    "@supabase/supabase-js": "^2.108.2"
+  },
+  "devDependencies": {
+    "@types/node": "^24.13.2",
+    "typescript": "~6.0.2",
+    "vitest": "^4.1.9"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ctrl-spc/cli",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Control Space CLI - machine setup and background daemon",
   "type": "module",
   "files": [
@@ -15,12 +15,19 @@
   },
   "scripts": {
     "build": "tsc",
+    "prepack": "node scripts/bundle-mcp-server.mjs",
+    "postpack": "node scripts/cleanup-bundle.mjs",
     "test": "vitest run"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.11.0",
+    "@ctrl-spc/mcp-server": "0.1.0",
     "@supabase/supabase-js": "^2.108.2",
     "node-windows": "^1.0.0-beta.8"
   },
+  "bundledDependencies": [
+    "@ctrl-spc/mcp-server"
+  ],
   "devDependencies": {
     "@types/node": "^24.13.2",
     "typescript": "~6.0.2",