@frontera-sdk/cli 1.50.9 → 1.50.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontera-sdk/cli",
-  "version": "1.50.9",
+  "version": "1.50.11",
   "description": "The frontera CLI — scaffold, pull, save and deploy Frontera apps and automations.",
   "keywords": [
     "frontera",
@@ -39,14 +39,14 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.251",
-    "@frontera-sdk/functions": "1.50.9",
-    "@frontera-sdk/core": "1.50.9",
+    "@frontera-sdk/functions": "1.50.11",
+    "@frontera-sdk/core": "1.50.11",
     "ai": "^6.0.116",
     "gray-matter": "^4.0.3",
     "yaml": "^2.9.0"
   },
   "devDependencies": {
-    "@frontera-sdk/forge-contracts": "1.50.9",
+    "@frontera-sdk/forge-contracts": "1.50.11",
     "@types/bun": "^1.3.14",
     "typescript": "^5.9.3"
   }

package/src/forge/projects.ts

@@ -9,7 +9,7 @@ import { findProjectRoot } from '../context'
 import { readProject } from '../project'
 import { applyClaudeImport, applyManagedBlock, type BlockMarkers } from '../kit'
 import { ensureGitignored, findContext, writeContext } from '../project-context'
-import { listProfiles, normalizeOrigin } from '../profiles'
+import { listProfiles, normalizeOrigin, type ProfileMetadata } from '../profiles'
 import { badRequest } from './http'
 import type { NewProject } from './store'
 
@@ -141,32 +141,127 @@ function writeSituationFiles(root: string, body: string): void {
 }
 
 /** Where Forge keeps a workspace's folder. Visible on purpose: developers open it in editors. */
-export function workspaceRoot(workspaceSlug: string): string {
-  const safe = workspaceSlug.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^[-.]+|[-.]+$/g, '') || 'workspace'
-  return join(homedir(), 'Frontera', safe)
+/**
+ * A folder-name segment. Lower-cased: APFS and NTFS fold case, and two rows
+ * for `audit-Globex` and `audit-globex` would be one directory. Capped: an
+ * organization name is unbounded text, and a segment past the filesystem's
+ * limit fails `mkdir` for the whole workspace.
+ */
+const SEGMENT_MAX = 40
+function safeSegment(value: string, fallback: string): string {
+  const safe = value.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^[-.]+|[-.]+$/g, '')
+  return (safe || fallback).slice(0, SEGMENT_MAX).replace(/[-.]+$/g, '') || fallback
 }
 
-/** The profile bound to this deployment's API origin, if the CLI has one. */
-function profileForOrigin(apiUrl: string | null): string | null {
-  if (!apiUrl) return null
-  let origin: string
+/** Where managed workspace folders live. Injectable: `os.homedir()` ignores `$HOME` under Bun, so a test cannot redirect it. */
+export function workspacesDir(): string {
+  return join(homedir(), 'Frontera')
+}
+
+export function workspaceRoot(workspaceSlug: string, discriminator?: string, base: string = workspacesDir()): string {
+  const safe = safeSegment(workspaceSlug, 'workspace')
+  return join(base, discriminator ? `${safe}-${safeSegment(discriminator, 'x')}` : safe)
+}
+
+/**
+ * The folder for THIS workspace.
+ *
+ * Workspace slugs are unique per organization, not across them: two
+ * organizations can each have `audit`. The folder used to be keyed on the
+ * slug alone, so the second organization's `audit` landed in the first's
+ * folder — its project row, its sessions, its profile binding — and a person
+ * switching organizations saw the other one's Forge history.
+ *
+ * The plain slug stays the folder for whichever workspace claimed it first
+ * (nobody's folder moves). A later workspace with the same slug gets the
+ * slug suffixed with its organization's name, or with the workspace id's
+ * first eight characters when even that is taken or unknown.
+ */
+export function resolveWorkspaceRoot(
+  input: { workspaceId: string; workspaceSlug: string; orgName?: string },
+  takenByAnotherWorkspace: (root: string) => boolean,
+  base: string = workspacesDir(),
+): string {
+  const id8 = input.workspaceId.slice(0, 8)
+  const candidates = [
+    undefined,
+    ...(input.orgName ? [input.orgName] : []),
+    id8,
+  ]
+  for (const discriminator of candidates) {
+    const root = workspaceRoot(input.workspaceSlug, discriminator, base)
+    if (!takenByAnotherWorkspace(root)) return root
+  }
+  // Every readable name is someone else's. Number until one is free — the
+  // guarantee is total, whatever ids or names collide.
+  for (let n = 2; ; n += 1) {
+    const root = workspaceRoot(input.workspaceSlug, `${id8}-${n}`, base)
+    if (!takenByAnotherWorkspace(root)) return root
+  }
+}
+
+/**
+ * The workspace a managed folder ON DISK says it belongs to, from the id the
+ * situation block writes into its `AGENTS.md`. The store is not the only
+ * record: a row can be deleted (`DELETE /projects/:id` removes rows, never
+ * files) or the store reset, and the folder — another organization's
+ * checkout, its profile binding — is still there. Null when the folder has
+ * no managed block.
+ */
+export function workspaceIdInFolder(root: string): string | null {
   try {
-    origin = normalizeOrigin(apiUrl)
+    const text = readFileSync(join(root, 'AGENTS.md'), 'utf8')
+    const start = text.indexOf(FORGE_MARKERS.begin)
+    const end = text.indexOf(FORGE_MARKERS.end)
+    if (start === -1 || end === -1) return null
+    const match = /Workspace id `([^`]+)`/.exec(text.slice(start, end))
+    return match?.[1] ?? null
   } catch {
     return null
   }
+}
+
+/** The profile bound to this deployment's API origin, if the CLI has one. */
+/**
+ * The profile to bind a workspace folder to.
+ *
+ * Not the first profile for the origin. Two organizations on one deployment
+ * are two profiles with the same `apiUrl`, and first-match bound BOTH
+ * organizations' folders to whichever profile sorted first — the second
+ * organization's sessions then acted on the first organization's key. So:
+ * this workspace's own key; else an organization key for THIS organization;
+ * else a profile for the origin that names no organization (an older
+ * profile, or the organization is unknown here); never a profile that names
+ * a different organization.
+ */
+export function profileForWorkspace(
+  apiUrl: string | null,
+  identity: { workspaceId: string; orgId?: string },
+  profiles: Array<{ name: string; profile: ProfileMetadata }>,
+): string | null {
+  if (!apiUrl) return null
+  let origin: string
   try {
-    const match = listProfiles().find((p) => {
-      try {
-        return normalizeOrigin(p.profile.apiUrl) === origin
-      } catch {
-        return false
-      }
-    })
-    return match?.name ?? null
+    origin = normalizeOrigin(apiUrl)
   } catch {
     return null
   }
+  const atOrigin = profiles.filter((p) => {
+    try {
+      return normalizeOrigin(p.profile.apiUrl) === origin
+    } catch {
+      return false
+    }
+  })
+  const own = atOrigin.find((p) => p.profile.workspaceId === identity.workspaceId)
+  if (own) return own.name
+  const sameOrg = identity.orgId
+    ? atOrigin.find((p) => p.profile.orgId === identity.orgId && p.profile.credentialKind === 'organization')
+      ?? atOrigin.find((p) => p.profile.orgId === identity.orgId)
+    : undefined
+  if (sameOrg) return sameOrg.name
+  const unscoped = atOrigin.find((p) => !p.profile.orgId && !p.profile.workspaceId)
+  return unscoped?.name ?? null
 }
 
 /**
@@ -177,11 +272,13 @@ function profileForOrigin(apiUrl: string | null): string | null {
  * to a profile is left as it is.
  */
 export function ensureWorkspaceProject(
-  input: { workspaceId: string; workspaceSlug: string; workspaceName?: string },
+  input: { workspaceId: string; workspaceSlug: string; workspaceName?: string; orgId?: string },
   apiUrl: string | null,
-  warn: (message: string) => void = () => {},
+  warn: (message: string) => void,
+  /** The folder, resolved by the caller against what it knows — see `resolveWorkspaceRoot`. Required: a default would be the slug-only path this exists to leave behind. */
+  root: string,
+  deps: { profiles?: () => Array<{ name: string; profile: ProfileMetadata }> } = {},
 ): NewProject {
-  const root = workspaceRoot(input.workspaceSlug)
   mkdirSync(root, { recursive: true })
   if (!isGitWorkTree(root)) {
     spawnSync('git', ['init', '-q'], { cwd: root, encoding: 'utf8' })
@@ -193,9 +290,15 @@ export function ensureWorkspaceProject(
     bound = null
   }
   if (!bound) {
-    const profile = profileForOrigin(apiUrl)
+    let profiles: Array<{ name: string; profile: ProfileMetadata }> = []
+    try {
+      profiles = (deps.profiles ?? listProfiles)()
+    } catch (error) {
+      warn(`could not read CLI profiles: ${error instanceof Error ? error.message : String(error)}`)
+    }
+    const profile = profileForWorkspace(apiUrl, { workspaceId: input.workspaceId, ...(input.orgId ? { orgId: input.orgId } : {}) }, profiles)
     if (!profile) {
-      warn(`no CLI profile for ${apiUrl ?? '(no api url)'}; ${root} left unbound`)
+      warn(`no CLI profile for this workspace or organization at ${apiUrl ?? '(no api url)'}; ${root} left unbound`)
     } else {
       try {
         writeContext(root, profile)

package/src/forge/server.ts

@@ -29,7 +29,7 @@ import { FORGE_HEADERS, FORGE_WELL_KNOWN_PATH } from './protocol'
 import { commandsFor } from './claude-commands'
 import { skillsFor } from './claude-skills'
 import { normalizeTurnText } from './turn-text'
-import { ensureWorkspaceProject, inspectRoot, listFiles, readChanges } from './projects'
+import { ensureWorkspaceProject, inspectRoot, listFiles, readChanges, resolveWorkspaceRoot, workspaceIdInFolder } from './projects'
 import { RunManager } from './runs'
 import { sessionView } from './sessions'
 import { ForgeStore, type StoredThread, type ThreadPatch } from './store'
@@ -56,6 +56,11 @@ export interface ForgeServerOptions {
   storePath: string
   log: Logger
   adapters?: AdapterFactory
+  /**
+   * Where managed workspace folders are created. Defaults to `~/Frontera`; a
+   * test points it at a scratch directory so it never touches the real one.
+   */
+  workspacesDir?: string
   /**
    * How host binaries are probed. Defaults to spawning them. A test supplies
    * its own so which harnesses happen to be installed on the machine running
@@ -251,20 +256,47 @@ export function startForgeServer(opts: ForgeServerOptions): ForgeServer {
 
   // The managed folder for the workspace the developer is in — no picker.
   route('POST', '/v1/forge/projects/workspace', async (req) => {
-    const body = await readJson<{ workspaceId?: unknown; workspaceSlug?: unknown; workspaceName?: unknown }>(req)
+    const body = await readJson<{ workspaceId?: unknown; workspaceSlug?: unknown; workspaceName?: unknown; orgId?: unknown; orgName?: unknown }>(req)
     if (typeof body.workspaceId !== 'string' || !body.workspaceId) throw badRequest('workspaceId is required')
     if (typeof body.workspaceSlug !== 'string' || !body.workspaceSlug) throw badRequest('workspaceSlug is required')
+    const workspaceId = body.workspaceId
+    const orgId = typeof body.orgId === 'string' && body.orgId ? body.orgId : undefined
+    const orgName = typeof body.orgName === 'string' && body.orgName ? body.orgName : undefined
+    // This workspace's own row decides its folder; only a workspace with no
+    // row yet picks one — and never a folder another workspace owns, by the
+    // store's row OR by what the folder on disk says it is (the row can be
+    // gone; the folder, with its checkout and profile binding, is not).
+    // Two organizations can each have a workspace called `audit`.
+    const own = store.projectByWorkspace(workspaceId)
+    const root = own?.root ?? resolveWorkspaceRoot(
+      { workspaceId, workspaceSlug: body.workspaceSlug, ...(orgName ? { orgName } : {}) },
+      (candidate) => {
+        const holder = store.projectByRoot(candidate)
+        if (holder !== null && holder.workspaceId !== null && holder.workspaceId !== workspaceId) return true
+        const onDisk = workspaceIdInFolder(candidate)
+        return onDisk !== null && onDisk !== workspaceId
+      },
+      opts.workspacesDir,
+    )
     const detected = ensureWorkspaceProject(
       {
-        workspaceId: body.workspaceId,
+        workspaceId,
         workspaceSlug: body.workspaceSlug,
         ...(typeof body.workspaceName === 'string' ? { workspaceName: body.workspaceName } : {}),
+        ...(orgId ? { orgId } : {}),
       },
       opts.apiUrl || null,
       (message) => log.warn(message),
+      root,
     )
-    const existing = store.projectByWorkspace(body.workspaceId) ?? store.projectByRoot(detected.root)
-    if (existing) return ok(store.refreshProject(existing.id, detected))
+    // A row at this root with no workspace (opened by hand before managed
+    // folders existed) is adopted AND claimed, so it is this workspace's from
+    // now on; one for another workspace was excluded above.
+    const existing = own ?? store.projectByRoot(root)
+    if (existing) {
+      if (existing.workspaceId === null) store.claimProjectWorkspace(existing.id, workspaceId)
+      return ok(store.refreshProject(existing.id, detected))
+    }
     const project = store.insertProject(detected)
     log.info(`workspace project ${project.id} at ${project.root}`)
     return ok(project)

package/src/forge/store.ts

@@ -290,10 +290,21 @@ export class ForgeStore {
   }
 
   /** Re-detect the parts that can change underneath us: git, app, profile. */
-  refreshProject(id: string, input: Pick<NewProject, 'profile' | 'appSlug' | 'git'>): ForgeProject {
+  refreshProject(id: string, input: Pick<NewProject, 'profile' | 'appSlug' | 'git'> & { name?: string }): ForgeProject {
     this.db
-      .query('UPDATE projects SET profile = ?, app_slug = ?, git = ?, last_opened_at = ? WHERE id = ?')
-      .run(input.profile, input.appSlug, input.git ? 1 : 0, now(), id)
+      .query('UPDATE projects SET profile = ?, app_slug = ?, git = ?, name = COALESCE(?, name), last_opened_at = ? WHERE id = ?')
+      .run(input.profile, input.appSlug, input.git ? 1 : 0, input.name ?? null, now(), id)
+    return this.getProject(id)!
+  }
+
+  /**
+   * A row opened by hand (no workspace) that a workspace now adopts takes the
+   * workspace's id, so it is found by `projectByWorkspace` from then on and
+   * counts as taken for any other workspace — a NULL there let a second
+   * organization adopt the same row.
+   */
+  claimProjectWorkspace(id: string, workspaceId: string): ForgeProject {
+    this.db.query('UPDATE projects SET workspace_id = ? WHERE id = ? AND workspace_id IS NULL').run(workspaceId, id)
     return this.getProject(id)!
   }