@jentrix/cli 0.5.14 → 0.5.16

package/dist/main.js

@@ -10334,10 +10334,11 @@ import {
   mkdirSync as mkdirSync4,
   openSync as openSync3,
   readFileSync as readFileSync7,
-  statSync as statSync3
+  statSync as statSync3,
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, delimiter as delimiter2, dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
+import { basename as basename2, delimiter as delimiter2, dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // node_modules/.pnpm/commander@14.0.3/node_modules/commander/esm.mjs
@@ -20882,7 +20883,10 @@ var ACCESS_TOKEN_PREFIX = "tmo_";
 var REFRESH_TOKEN_PREFIX = "tmr_";
 function parseTokenResponse(body) {
   if (typeof body !== "object" || body === null) {
-    throw new OAuthTokenError("invalid_response", "token response is not an object");
+    throw new OAuthTokenError(
+      "invalid_response",
+      "token response is not an object"
+    );
   }
   const json = body;
   if (typeof json.error === "string") {
@@ -20962,7 +20966,7 @@ function refreshAccessToken(input) {
 
 // src/client.ts
 var CLI_NAME = "stacks-cli";
-var CLI_VERSION = "0.5.14";
+var CLI_VERSION = "0.5.16";
 var DEAD_TOKEN_MESSAGE = "authentication failed (HTTP 401): the token is dead or expired \u2014 mint a new PAT at /account/tokens on your Jentrix server and update STACKS_TOKEN (or --token / the config file).";
 var RELOGIN_MESSAGE = "OAuth session expired and could not be refreshed \u2014 run `jentrix login` to sign in again.";
 function originOf2(url2) {
@@ -21313,6 +21317,15 @@ var PROJECT_NAME_PROMPT = "Name for the new project \u2014 your own words, exact
 function buildAlignDisclosures(catalog) {
   const disclosures = [];
   const repo = catalog.detection.repoOwnerName;
+  const previous = catalog.previous;
+  if (previous && previous.usedFor.length > 0) {
+    const parts = previous.usedFor.map(
+      (kind) => kind === "project" ? `project ${previous.projectName}` : kind === "work_item" ? `task ${previous.taskKey ?? "session-level"}` : `owner ${previous.ownerLabel}`
+    );
+    disclosures.push(
+      `continuing this checkout's previous alignment \u2014 ${parts.join(" \xB7 ")} (choose Re-answer, or run with --fresh, to change)`
+    );
+  }
   if (catalog.chosenProjectId === "__pending__") {
     const name = catalog.newProjectName ?? "the new project";
     disclosures.push(
@@ -21417,7 +21430,10 @@ function buildAlignQuestions(catalog) {
     ...new Map(
       [
         ...catalog.candidates.map((candidate) => candidate.workspace),
-        ...catalog.pinnedWorkspace ? [catalog.pinnedWorkspace] : []
+        ...catalog.pinnedWorkspace ? [catalog.pinnedWorkspace] : [],
+        // D4: a repo that matches nothing offers the caller's own workspaces
+        // instead of a lone "Other…" — the same skip/ask rules apply to them.
+        ...catalog.candidates.length === 0 ? catalog.workspaces ?? [] : []
       ].map((ws) => [ws.id, ws])
     ).values()
   ];
@@ -21645,6 +21661,14 @@ function buildAlignQuestions(catalog) {
     };
   } else if (project.status !== "answered" || catalog.members === null) {
     owner = { id: "owner", prompt: "Owner", status: "pending", choices: [] };
+  } else if (catalog.members.length === 1) {
+    owner = {
+      id: "owner",
+      prompt: "Owner",
+      status: "skipped",
+      answer: catalog.members[0].id,
+      choices: []
+    };
   } else {
     owner = {
       id: "owner",
@@ -21663,7 +21687,8 @@ function buildAlignQuestions(catalog) {
     };
   }
   const targetKnown = project.status === "answered" && (projectName.status === "answered" || projectName.status === "skipped");
-  const ready = targetKnown && workItem.status === "answered" && (taskTitle.status === "answered" || taskTitle.status === "skipped") && owner.status === "answered";
+  const ready = targetKnown && workItem.status === "answered" && (taskTitle.status === "answered" || taskTitle.status === "skipped") && // D5: a sole-member owner is resolved by detection, like the workspace.
+  (owner.status === "answered" || owner.status === "skipped");
   const disclosures = targetKnown ? buildAlignDisclosures(catalog) : [];
   const confirmation = {
     id: "confirmation",
@@ -23679,6 +23704,78 @@ async function openTasksForProject(caller, boardIds) {
   tasks.sort((a, b) => b.number - a.number);
   return tasks.slice(0, MAX_WORK_ITEMS).map(({ id, key, title }) => ({ id, key, title }));
 }
+async function workspaceProjects(caller, workspaceId) {
+  const listed = await callStructured(caller, "list_projects", { workspaceId });
+  return (listed.projects ?? []).filter((project) => project.archivedAt === null).map(({ id, name, slug }) => ({ id, name, slug }));
+}
+async function workspaceMembers(caller, workspaceId) {
+  const result = await callStructured(caller, "list_members", { workspaceId });
+  return (result.members ?? []).map((member) => ({
+    id: member.userId ?? member.id ?? "",
+    name: member.name,
+    email: member.email
+  }));
+}
+async function loadProjectContext(caller, catalog, projectId) {
+  try {
+    const project = await projectBoards(caller, projectId);
+    catalog.repoLinked = repoLinkedOf(catalog, projectId, project.repoOwners);
+    catalog.projectHasBoard = project.boardIds.length > 0;
+    catalog.openTasks = await openTasksForProject(caller, project.boardIds);
+    catalog.members = await workspaceMembers(caller, project.workspaceId);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function previousAlignmentOf(caller, newest, prefetched = null) {
+  try {
+    const session = prefetched ?? await callStructured(caller, "get_agent_session", {
+      sessionId: newest.sessionId
+    });
+    const a = session.alignment;
+    if (!a?.project?.id || !a.owner?.id) return null;
+    return {
+      sessionId: newest.sessionId,
+      workspaceId: a.workspace?.id ?? newest.workspaceId,
+      project: { id: a.project.id, name: a.project.name ?? a.project.id },
+      task: a.task?.id ? { id: a.task.id, key: a.task.key ?? a.task.id } : null,
+      owner: {
+        id: a.owner.id,
+        label: a.owner.name ?? a.owner.email ?? a.owner.id
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function prefillFromPrevious(previous, catalog, projectPrefilled) {
+  const sameProject = projectPrefilled || catalog.chosenProjectId === previous.project.id;
+  if (!sameProject) return null;
+  const usedFor = [];
+  if (projectPrefilled) usedFor.push("project");
+  if (catalog.chosenWorkItem === null && catalog.openTasks !== null) {
+    if (previous.task === null) {
+      catalog.chosenWorkItem = "__none__";
+      usedFor.push("work_item");
+    } else if (catalog.openTasks.some((t) => t.id === previous.task.id)) {
+      catalog.chosenWorkItem = previous.task.id;
+      usedFor.push("work_item");
+    }
+  }
+  if (catalog.chosenOwnerId === null && catalog.members?.some((m) => m.id === previous.owner.id)) {
+    catalog.chosenOwnerId = previous.owner.id;
+    usedFor.push("owner");
+  }
+  if (usedFor.length === 0) return null;
+  return {
+    sessionId: previous.sessionId,
+    projectName: previous.project.name,
+    taskKey: previous.task?.key ?? null,
+    ownerLabel: previous.owner.label,
+    usedFor
+  };
+}
 async function resolveCandidates(caller, repoOwnerName) {
   try {
     const result = await callStructured(caller, "resolve_projects_for_repo", {
@@ -23840,32 +23937,46 @@ function producerFromFlags(flags) {
   if (!label) return null;
   return { label, emoji: flags.agentEmoji?.trim() || null };
 }
-async function buildCatalog(caller, deps2, flags, detection) {
+async function buildCatalog(caller, flags, detection) {
   const context = await callStructured(caller, "get_token_context", {});
   let pinnedWorkspace = null;
   if (context.workspacePinned === true && typeof context.workspaceId === "string") {
-    const workspaces = await callStructured(caller, "list_workspaces", {});
-    const match = (workspaces.workspaces ?? []).find((ws) => ws.id === context.workspaceId);
+    const workspaces2 = await callStructured(caller, "list_workspaces", {});
+    const match = (workspaces2.workspaces ?? []).find((ws) => ws.id === context.workspaceId);
     pinnedWorkspace = {
       id: context.workspaceId,
       name: match?.name ?? "pinned"
     };
   }
-  const { candidates, pinned: discoveryPinned } = await resolveCandidates(
+  const flagWorkspaceId = flags.workspace?.trim() ? await resolveWorkspaceFlag(
     caller,
-    detection.repoOwnerName
-  );
+    flags.workspace.trim(),
+    pinnedWorkspace
+  ) : null;
+  const { candidates: matched, pinned: discoveryPinned } = await resolveCandidates(caller, detection.repoOwnerName);
+  const candidates = flagWorkspaceId ? matched.filter((candidate) => candidate.workspace.id === flagWorkspaceId) : matched;
+  let workspaces = null;
+  if (matched.length === 0 && !pinnedWorkspace && !flagWorkspaceId) {
+    const listed = await callStructured(caller, "list_workspaces", {});
+    workspaces = (listed.workspaces ?? []).map(({ id, name, slug }) => ({ id, name, slug }));
+  }
+  const sole = (rows) => rows.length === 1 && !isArchiveNamed(rows[0].name) ? rows[0] : null;
+  const candidateWorkspaces = [
+    ...new Map(candidates.map((c) => [c.workspace.id, c.workspace])).values()
+  ];
+  const resolvedWorkspaceId = flagWorkspaceId ?? pinnedWorkspace?.id ?? sole(workspaces ?? [])?.id ?? sole(candidateWorkspaces)?.id ?? null;
   let otherProjects = [];
   let discoveryNotice = null;
-  if (discoveryPinned && pinnedWorkspace) {
+  if (resolvedWorkspaceId) {
     try {
-      const listed = await callStructured(caller, "list_projects", {
-        workspaceId: pinnedWorkspace.id
-      });
-      otherProjects = (listed.projects ?? []).filter((project) => project.archivedAt === null).map(({ id, name, slug }) => ({ id, name, slug }));
-      discoveryNotice = "repo discovery is unavailable for a workspace-pinned token \u2014 listing every project in the pinned workspace instead (repo match unverified)";
+      otherProjects = await workspaceProjects(caller, resolvedWorkspaceId);
+      if (discoveryPinned) {
+        discoveryNotice = "repo discovery is unavailable for a workspace-pinned token \u2014 listing every project in the pinned workspace instead (repo match unverified)";
+      }
     } catch {
-      discoveryNotice = "repo discovery is unavailable for a workspace-pinned token and the workspace project list could not be loaded \u2014 pass --project <id-or-slug>, or --new-project <name> to create one";
+      if (discoveryPinned) {
+        discoveryNotice = "repo discovery is unavailable for a workspace-pinned token and the workspace project list could not be loaded \u2014 pass --project <id-or-slug>, or --new-project <name> to create one";
+      }
     }
   }
   const wantsCreate = Boolean(flags.newProject && flags.newProject.trim()) || flags.project === "__create__";
@@ -23879,71 +23990,31 @@ async function buildCatalog(caller, deps2, flags, detection) {
       (project) => project.id === flags.project || project.slug === flags.project
     );
     chosenProjectId = match?.id ?? flags.project;
-  } else if (candidates.length === 1) {
+  } else if (candidates.length === 1 && matched.length === 1) {
     chosenProjectId = candidates[0].id;
   }
-  let openTasks = null;
-  let members = null;
-  let repoLinked = null;
-  let projectHasBoard = null;
-  if (wantsCreate) {
-    openTasks = [];
-    const workspaceId = pinnedWorkspace?.id ?? null;
-    if (workspaceId) {
-      try {
-        const memberResult = await callStructured(caller, "list_members", {
-          workspaceId
-        });
-        members = memberResult.members?.map((member) => ({
-          id: member.userId ?? member.id ?? "",
-          name: member.name,
-          email: member.email
-        })) ?? [];
-      } catch {
-        members = [];
-      }
-    } else {
-      members = [];
-    }
-  } else if (chosenProjectId) {
-    try {
-      const project = await projectBoards(caller, chosenProjectId);
-      repoLinked = repoLinkedOf(
-        { candidates, detection },
-        chosenProjectId,
-        project.repoOwners
-      );
-      projectHasBoard = project.boardIds.length > 0;
-      openTasks = await openTasksForProject(caller, project.boardIds);
-      const memberResult = await callStructured(caller, "list_members", {
-        workspaceId: project.workspaceId
-      });
-      members = memberResult.members?.map((member) => ({
-        id: member.userId ?? member.id ?? "",
-        name: member.name,
-        email: member.email
-      })) ?? null;
-    } catch {
-    }
-  }
-  const chosenWorkspaceId = candidates.find((candidate) => candidate.id === chosenProjectId)?.workspace.id ?? pinnedWorkspace?.id ?? null;
-  return {
+  const chosenWorkspaceId = candidates.find((candidate) => candidate.id === chosenProjectId)?.workspace.id ?? flagWorkspaceId ?? pinnedWorkspace?.id ?? null;
+  const catalog = {
     detection,
     pinnedWorkspace,
     candidates,
     otherProjects,
     discoveryNotice,
+    workspaces,
     chosenWorkspaceId,
     chosenProjectId,
-    openTasks,
-    members,
-    operatorUserId: null,
+    openTasks: null,
+    members: null,
+    // D5 (STA-168): the server now says who the caller is — the owner
+    // question's default, and what `--yes` falls back to. Null from an older
+    // server, which keeps the explicit-owner refusal.
+    operatorUserId: typeof context.userId === "string" ? context.userId : null,
     chosenWorkItem: flags.task ? flags.task : flags.newTask ? "__new__" : flags.sessionLevel ? "__none__" : null,
     chosenOwnerId: flags.owner ?? null,
     newTaskTitle: flags.newTask?.trim() || null,
     newProjectName: flags.newProject?.trim() || null,
-    repoLinked,
-    projectHasBoard,
+    repoLinked: null,
+    projectHasBoard: null,
     // STA-11: filled by runAlign (it needs the checkout root) — the ordering
     // preference for the workspace question.
     lastAlignedWorkspaceId: null,
@@ -23959,8 +24030,24 @@ async function buildCatalog(caller, deps2, flags, detection) {
     binding: null,
     mcpConfig: null,
     // Filled by runAlign — it needs the checkout's marker session.
-    priorArtifacts: null
+    priorArtifacts: null,
+    // D7: filled by runAlign (it needs the checkout's newest marker).
+    previous: null
   };
+  if (wantsCreate) {
+    catalog.openTasks = [];
+    catalog.members = [];
+    if (resolvedWorkspaceId) {
+      try {
+        catalog.members = await workspaceMembers(caller, resolvedWorkspaceId);
+      } catch {
+        catalog.members = [];
+      }
+    }
+  } else if (chosenProjectId) {
+    await loadProjectContext(caller, catalog, chosenProjectId);
+  }
+  return catalog;
 }
 async function priorArtifactsOf(caller, markerSession) {
   const current = markerSession?.alignment?.task;
@@ -24305,7 +24392,7 @@ async function runAlign(flags, deps2) {
       provider: detected.provider
     };
     return await withCaller(deps2, async (caller, target) => {
-      const catalog = await buildCatalog(caller, deps2, flags, detection);
+      const catalog = await buildCatalog(caller, flags, detection);
       const marker = readAlignmentMarker(
         deps2.configPath,
         inspection.root,
@@ -24317,7 +24404,8 @@ async function runAlign(flags, deps2) {
         flags.capture,
         marker !== null && markerHost !== null && isHostCapturing(deps2, marker.sessionId, markerHost)
       );
-      catalog.lastAlignedWorkspaceId = newestAlignmentMarker(deps2.configPath, inspection.root)?.workspaceId ?? null;
+      const newest = newestAlignmentMarker(deps2.configPath, inspection.root);
+      catalog.lastAlignedWorkspaceId = newest?.workspaceId ?? null;
       catalog.binding = {
         providerSessionId: detected.providerSessionId,
         transcriptPath: detected.transcriptPath,
@@ -24343,6 +24431,31 @@ async function runAlign(flags, deps2) {
         }
       }
       const markerActive = markerSession !== null && (markerSession.status === "ACTIVE" || markerSession.status === "STARTING");
+      let workspaceFromPrevious = false;
+      if (!flags.fresh && !markerActive && newest) {
+        const previous = await previousAlignmentOf(
+          caller,
+          newest,
+          // This provider session's own (ended) marker is the newest: reuse
+          // the read above rather than paying for it twice.
+          marker?.sessionId === newest.sessionId ? markerSession : null
+        );
+        if (previous) {
+          const projectPrefilled = catalog.chosenProjectId === null && await loadProjectContext(caller, catalog, previous.project.id);
+          if (projectPrefilled) {
+            catalog.chosenProjectId = previous.project.id;
+            if (catalog.chosenWorkspaceId === null) {
+              catalog.chosenWorkspaceId = previous.workspaceId;
+              workspaceFromPrevious = true;
+            }
+          }
+          catalog.previous = prefillFromPrevious(
+            previous,
+            catalog,
+            projectPrefilled
+          );
+        }
+      }
       catalog.priorArtifacts = await priorArtifactsOf(caller, markerSession);
       const preconditions = await doctorLocalChecks(deps2);
       preconditions.push(sessionBindingCheck(detected));
@@ -24427,14 +24540,7 @@ async function runAlign(flags, deps2) {
       let pendingCreateProject = null;
       if (flags.newTask) workItem = `__new__:${flags.newTask}`;
       if (flags.newProject && flags.newProject.trim()) {
-        let workspaceId = catalog.chosenWorkspaceId ?? catalog.pinnedWorkspace?.id ?? null;
-        if (flags.workspace?.trim()) {
-          workspaceId = await resolveWorkspaceFlag(
-            caller,
-            flags.workspace.trim(),
-            catalog.pinnedWorkspace ?? null
-          );
-        }
+        const workspaceId = buildAlignQuestions(catalog)[0]?.answer ?? null;
         if (!workspaceId) {
           throw new UsageError(
             "--new-project needs a resolved workspace (a workspace-pinned token, a repo-matched candidate, or --workspace <id-or-slug>) \u2014 none resolved here"
@@ -24495,11 +24601,21 @@ async function runAlign(flags, deps2) {
             catalog.newProjectName = null;
             pendingCreateProject = null;
             createWorkspaceId = null;
+            catalog.previous = null;
+            if (workspaceFromPrevious) {
+              catalog.chosenWorkspaceId = null;
+              workspaceFromPrevious = false;
+            }
             continue;
           }
           const answer = await askQuestion(deps2, next);
           if (next.id === "workspace") {
             catalog.chosenWorkspaceId = answer;
+            try {
+              catalog.otherProjects = await workspaceProjects(caller, answer);
+            } catch {
+              catalog.otherProjects = [];
+            }
           } else if (next.id === "task_title") {
             newTaskTitle = answer;
           } else if (next.id === "project_name") {
@@ -24515,7 +24631,7 @@ async function runAlign(flags, deps2) {
             };
           } else if (next.id === "project") {
             if (answer === "__create__") {
-              const workspaceId = catalog.chosenWorkspaceId ?? catalog.pinnedWorkspace?.id;
+              const workspaceId = questions[0]?.answer ?? null;
               if (!workspaceId) {
                 throw new UsageError(
                   "cannot create a project without a resolved workspace \u2014 pick a workspace first"
@@ -24527,16 +24643,7 @@ async function runAlign(flags, deps2) {
               catalog.projectHasBoard = null;
               catalog.openTasks = [];
               try {
-                const memberResult = await callStructured(
-                  caller,
-                  "list_members",
-                  { workspaceId }
-                );
-                catalog.members = memberResult.members?.map((member) => ({
-                  id: member.userId ?? member.id ?? "",
-                  name: member.name,
-                  email: member.email
-                })) ?? [];
+                catalog.members = await workspaceMembers(caller, workspaceId);
               } catch {
                 catalog.members = [];
               }
@@ -24544,31 +24651,7 @@ async function runAlign(flags, deps2) {
             } else {
               projectId = answer;
             }
-            try {
-              const project = await projectBoards(caller, projectId);
-              catalog.repoLinked = repoLinkedOf(
-                catalog,
-                projectId,
-                project.repoOwners
-              );
-              catalog.projectHasBoard = project.boardIds.length > 0;
-              catalog.openTasks = await openTasksForProject(
-                caller,
-                project.boardIds
-              );
-              const memberResult = await callStructured(
-                caller,
-                "list_members",
-                {
-                  workspaceId: project.workspaceId
-                }
-              );
-              catalog.members = memberResult.members?.map((member) => ({
-                id: member.userId ?? member.id ?? "",
-                name: member.name,
-                email: member.email
-              })) ?? [];
-            } catch {
+            if (!await loadProjectContext(caller, catalog, projectId)) {
               catalog.openTasks = [];
               catalog.members = [];
               catalog.repoLinked = null;
@@ -24581,10 +24664,11 @@ async function runAlign(flags, deps2) {
           }
         }
       }
+      ownerUserId ??= (catalog.members?.length === 1 ? catalog.members[0].id : null) ?? catalog.operatorUserId;
       if (pendingCreateProject) {
         if (!ownerUserId) {
           throw new UsageError(
-            "creating a project needs an owner \u2014 answer the owner question (or pass --owner <userId>)"
+            `creating a project needs an owner \u2014 answer the owner question, or pass --owner <userId> (this server did not identify you; discover members with \`jentrix tool list_members --args '{"workspaceId":"${pendingCreateProject.workspaceId}"}'\`)`
           );
         }
         const created = await callStructured(caller, "create_project", {
@@ -24766,7 +24850,7 @@ function registerAlignCommand(program3, deps2, onExit2) {
     "create a project in the resolved workspace (seeds a board + repo/board links), then align to it"
   ).option(
     "--workspace <id-or-slug>",
-    "workspace for --new-project when neither a pinned token nor a repo match resolves one (fresh checkout, non-interactive)"
+    "the workspace question's flag twin: narrows the wizard's project list, and names where --new-project creates when neither a pinned token nor a repo match resolves one"
   ).option("--task <taskId>", "existing work item to align to").option(
     "--new-task <title>",
     "create a task (existing ops core) and align to it"
@@ -24799,6 +24883,9 @@ function registerAlignCommand(program3, deps2, onExit2) {
   ).option("--json", "stable JSON output").option(
     "--yes",
     "skip the re-align confirmation on an already-aligned session"
+  ).option(
+    "--fresh",
+    "ignore this checkout's previous alignment and ask every question"
   ).action(async (flags) => onExit2(await runAlign(flags, deps2)));
 }
 
@@ -25104,7 +25191,9 @@ async function offerCardMint(kind, payload, flags, deps2, sessionId = null) {
       board,
       artifactId: payload.artifactId,
       anchorTaskId: payload.taskId,
-      noun: mintNoun(ARTIFACT_TYPE_BY_PUSH_KIND[kind] ?? "FINDINGS"),
+      noun: mintNoun(
+        ARTIFACT_TYPE_BY_PUSH_KIND[kind] ?? "FINDINGS"
+      ),
       // STA-128: the operator's own claim title, when one was given.
       artifactTitle: flags.title?.trim() || null,
       blocks: Boolean(flags.blocks),
@@ -25130,7 +25219,12 @@ async function findMintBoard(deps2, taskId) {
     const boards = (await callStructured(caller, "list_boards", { workspaceId })).boards.filter((b) => b.kind === "BUGS" && !b.archivedAt);
     const candidates = [
       ...boards,
-      ...task.boardId ? [{ id: String(task.boardId), name: String(task.boardName ?? "board") }] : []
+      ...task.boardId ? [
+        {
+          id: String(task.boardId),
+          name: String(task.boardName ?? "board")
+        }
+      ] : []
     ];
     for (const board of candidates) {
       const columns = (await callStructured(caller, "list_columns", { boardId: board.id })).columns;
@@ -25260,7 +25354,10 @@ async function runMintIssue(flags, deps2) {
 function registerMintIssueCommand(artifact, deps2, onExit2) {
   artifact.command("mint-issue").description(
     "Mint a card from a findings/gap/issue artifact: opens a card on the workspace's BUGS board (else the task's own board), links the artifact to it, and relates it back to the source task."
-  ).requiredOption("--artifact <id>", "the findings/gap/issue artifact to link").requiredOption(
+  ).requiredOption(
+    "--artifact <id>",
+    "the findings/gap/issue artifact to link"
+  ).requiredOption(
     "--from-task <id>",
     "the task the artifact was pushed on (the card RELATES_TO it)"
   ).option(
@@ -25338,7 +25435,9 @@ function statusToExit(status) {
 }
 async function runArtifactAttach(filePath, flags, deps2) {
   if (!flags.workspace && !flags.task) {
-    deps2.writeErr("--workspace <id> is required (or --task <id> to resolve it)");
+    deps2.writeErr(
+      "--workspace <id> is required (or --task <id> to resolve it)"
+    );
     return EXIT_CODES.INVALID_INPUT;
   }
   if (flags.kind && !PUSH_KINDS.includes(flags.kind)) {
@@ -25458,7 +25557,12 @@ async function runArtifactAttach(filePath, flags, deps2) {
       });
       const artifact = result.artifact ?? {};
       deps2.writeOut(
-        flags.json ? JSON.stringify({ artifactId: artifact.id ?? null, ...result }) : `Attached artifact ${String(artifact.id ?? "?")} \xB7 ${String(artifact.title ?? filename)} (${type}, ${body.byteLength} bytes)`
+        flags.json ? (
+          // The id at the top level: every other artifact-producing command
+          // answers `artifactId`, and a caller should not have to know which
+          // envelope this one came in.
+          JSON.stringify({ artifactId: artifact.id ?? null, ...result })
+        ) : `Attached artifact ${String(artifact.id ?? "?")} \xB7 ${String(artifact.title ?? filename)} (${type}, ${body.byteLength} bytes)`
       );
       return 0;
     } finally {
@@ -25483,7 +25587,10 @@ function registerArtifactCommand(program3, deps2, onExit2) {
   ).option("--project <id>", "link to a project").option("--task <id>", "link to a task").option("--run <id>", "link to a run").option("--work-order <id>", "link to a Work Order").option("--decision <id>", "link to a decision").option(
     "--kind <kind>",
     `push kind (${PUSH_KINDS.join("|")}) \u2014 files under the same ArtifactType, hence the same work layer, as \`jentrix push\``
-  ).option("--session <id>", "attribute the artifact to a connected session").option("--type <type>", "ArtifactType (default inferred from --kind, else the extension, else DOC)").option("--title <title>", "artifact title (default: the file name)").option("--json", "stable JSON output").action(
+  ).option("--session <id>", "attribute the artifact to a connected session").option(
+    "--type <type>",
+    "ArtifactType (default inferred from --kind, else the extension, else DOC)"
+  ).option("--title <title>", "artifact title (default: the file name)").option("--json", "stable JSON output").action(
     async (file, flags) => onExit2(await runArtifactAttach(file, flags, deps2))
   );
   return artifact;
@@ -26785,7 +26892,8 @@ function mountCommandTree(program3, plan, runtime) {
 var WHOAMI_SCOPE_NOTE = "scope/workspace restrictions are enforced server-side and not introspectable; a FORBIDDEN (exit 3) on a write means the token lacks write/admin scope.";
 function redactToken(token) {
   const hint = token.length > 8 ? `\u2026${token.slice(-4)}` : "\u2026";
-  if (token.startsWith("tmo_")) return { type: "oauth", display: `tmo_${hint}` };
+  if (token.startsWith("tmo_"))
+    return { type: "oauth", display: `tmo_${hint}` };
   if (token.startsWith("tm_")) return { type: "pat", display: `tm_${hint}` };
   return { type: "unknown", display: hint };
 }
@@ -26851,6 +26959,7 @@ function renderHuman(report) {
     lines.push(
       `  workspace: ${tc.workspacePinned ? `pinned to ${tc.workspaceId ?? "?"}` : "not pinned (all your workspaces)"}`
     );
+    if (tc.userId) lines.push(`  user:      ${tc.userId}`);
     if (tc.displayName) {
       lines.push(
         `  identity:  ${tc.emoji ? `${tc.emoji} ` : ""}${tc.displayName}`
@@ -26874,7 +26983,8 @@ async function runWhoamiCommand(flags, deps2) {
   const scrub = (text) => {
     let out = text;
     for (const secret of secrets) {
-      if (out.includes(secret)) out = out.split(secret).join("<redacted token>");
+      if (out.includes(secret))
+        out = out.split(secret).join("<redacted token>");
     }
     return out;
   };
@@ -26969,7 +27079,9 @@ async function runWhoamiCommand(flags, deps2) {
       note: WHOAMI_SCOPE_NOTE
     };
     deps2.writeOut(
-      redact(flags.json === true ? stableStringify(report) : renderHuman(report))
+      redact(
+        flags.json === true ? stableStringify(report) : renderHuman(report)
+      )
     );
     return EXIT_CODES.OK;
   } finally {
@@ -27008,6 +27120,7 @@ function parseTokenContext(rendered) {
     grandfathered: v.grandfathered,
     workspacePinned: v.workspacePinned,
     workspaceId: v.workspaceId ?? null,
+    userId: typeof v.userId === "string" ? v.userId : null,
     displayName: v.displayName ?? null,
     emoji: v.emoji ?? null,
     rateLimit: {
@@ -28111,6 +28224,7 @@ function registerRunnerCommand(program3, deps2, onExit2) {
 }
 
 // src/commands/setup.ts
+import { join as join5 } from "node:path";
 var NPM_INSTALL_TIMEOUT_MS2 = 3e5;
 var SUPERSEDED = ["@jentrix/stacks-cli", "@jentrix/stacks-runner"];
 var CLI_SPEC = `@jentrix/cli@${CLI_VERSION}`;
@@ -28333,21 +28447,21 @@ async function bootstrapRepository(deps2) {
       deps2,
       "      Jentrix aligns sessions by repository identity, so install git (https://git-scm.com/downloads) and re-run."
     );
-    return;
+    return false;
   }
   const inRepo = async () => (await deps2.git(["rev-parse", "--is-inside-work-tree"], here)).code === 0;
   if (!await inRepo()) {
     const reply = await deps2.readLine(
       `Initialize a git repository in ${here} so agent sessions can align here? [y/N] `
     );
-    if (!/^y/i.test(reply.trim())) return;
+    if (!/^y/i.test(reply.trim())) return false;
     if ((await deps2.git(["init"], here)).code !== 0) {
       say(deps2, "note: `git init` failed \u2014 skipped the repository step.");
-      return;
+      return false;
     }
   }
   if ((await deps2.git(["remote", "get-url", "origin"], here)).code === 0)
-    return;
+    return true;
   const fallback = here.split(/[/\\]/).filter(Boolean).pop().toLowerCase().replace(/ /g, "-");
   say(
     deps2,
@@ -28360,15 +28474,55 @@ async function bootstrapRepository(deps2) {
   const answer = (await deps2.readLine(
     "GitHub repo for origin (owner/name or full URL, blank to skip): "
   )).trim();
-  if (!answer) return;
+  if (!answer) return true;
   const url2 = /:\/\/|^[^/]+@[^:]+:/.test(answer) ? answer : /^[^/]+\/[^/]+$/.test(answer) ? `https://github.com/${answer}.git` : null;
   if (!url2) {
     say(deps2, `skipped \u2014 "${answer}" is neither owner/name nor a URL`);
-    return;
+    return true;
   }
   if ((await deps2.git(["remote", "add", "origin", url2], here)).code === 0) {
     say(deps2, `origin \u2192 ${url2}`);
   }
+  return true;
+}
+function writeCheckoutMcpConfig(deps2, url2) {
+  const path = join5(deps2.cwd(), ".mcp.json");
+  if (!url2) {
+    say(
+      deps2,
+      "note: skipped ./.mcp.json \u2014 no endpoint is known yet (not signed in, no --url); the first `jentrix align` here writes it."
+    );
+    return;
+  }
+  const raw = deps2.readTextFile(path);
+  let existing = null;
+  if (raw !== null) {
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      say(
+        deps2,
+        `note: ${path} is not valid JSON \u2014 left untouched (fix or remove it, then re-run; align refuses it the same way).`
+      );
+      return;
+    }
+  }
+  const plan = planMcpServerEntry(existing, url2, null);
+  if (plan.action === "unchanged") {
+    say(deps2, `./.mcp.json already names ${url2}.`);
+    return;
+  }
+  deps2.writeTextFile(path, renderMcpConfig(plan.next));
+  say(
+    deps2,
+    plan.action === "repoint" ? `Repointed the "jentrix" MCP server in ./.mcp.json: ${plan.previousUrl} \u2192 ${url2} (Claude Code reads it at session start; no credential inside).` : `Wrote ./.mcp.json \u2192 ${url2} (Claude Code reads it at session start; no credential inside).`
+  );
+  if (plan.removedAuthorization) {
+    say(
+      deps2,
+      "  Removed its Authorization header: a header suppresses the client's OAuth discovery. `jentrix align --pat` puts it back for a headless checkout."
+    );
+  }
 }
 async function runSetupCommand(flags, deps2) {
   const nodeMajor = Number(process.versions.node.split(".")[0]);
@@ -28402,13 +28556,20 @@ async function runSetupCommand(flags, deps2) {
   const codex = await deps2.resolveCodex();
   if (codex) await registerCodexMcp(deps2, codex, pending);
   if (flags.git !== false && deps2.cwd() !== deps2.homeDir()) {
+    let inWorkTree;
     if (deps2.isInteractive) {
-      await bootstrapRepository(deps2);
-    } else if (!await deps2.resolveGit() || (await deps2.git(["rev-parse", "--is-inside-work-tree"], deps2.cwd())).code !== 0) {
-      say(
-        deps2,
-        "note: skipped the repository offer (not an interactive terminal) \u2014 this folder is not a git work tree, and align requires one. Run `git init` here first."
-      );
+      inWorkTree = await bootstrapRepository(deps2);
+    } else {
+      inWorkTree = await deps2.resolveGit() !== null && (await deps2.git(["rev-parse", "--is-inside-work-tree"], deps2.cwd())).code === 0;
+      if (!inWorkTree) {
+        say(
+          deps2,
+          "note: skipped the repository offer (not an interactive terminal) \u2014 this folder is not a git work tree, and align requires one. Run `git init` here first."
+        );
+      }
+    }
+    if (inWorkTree) {
+      writeCheckoutMcpConfig(deps2, deps2.signedInUrl() ?? flags.url ?? null);
     }
   }
   say(deps2, "");
@@ -28494,7 +28655,7 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var MAX_SLICE_BYTES = 1e6;
 function captureConsented(host, marker) {
   if (host && typeof host.captureTrace === "boolean") return host.captureTrace;
@@ -28529,7 +28690,7 @@ function resolveSnapshotSession(payload, spoolRoot, configPath, repoRoot, readHo
   return null;
 }
 function offsetPath(spoolRoot, sessionId) {
-  return join5(spoolRoot, sessionId, "snapshot.json");
+  return join6(spoolRoot, sessionId, "snapshot.json");
 }
 function readOffset(spoolRoot, sessionId) {
   try {
@@ -28750,7 +28911,8 @@ function loadSurface(json) {
   const seen = /* @__PURE__ */ new Set();
   const validated = tools.map((tool, index) => {
     const where = (field) => isRecord9(tool) && typeof tool.name === "string" ? `tool "${tool.name}": ${field}` : `tools[${index}]: ${field}`;
-    if (!isRecord9(tool)) throw new SurfaceError(`tools[${index}] is not an object`);
+    if (!isRecord9(tool))
+      throw new SurfaceError(`tools[${index}] is not an object`);
     if (typeof tool.name !== "string" || tool.name.length === 0) {
       throw new SurfaceError(where("missing or empty `name`"));
     }
@@ -29051,7 +29213,7 @@ var sessionDeps = {
       closeSync3(fd);
     }
   },
-  spoolRoot: join6(homedir2(), ".config", "stacks", "session-spool")
+  spoolRoot: join7(homedir2(), ".config", "stacks", "session-spool")
 };
 var sessionCommand = registerSessionCommand(program2, sessionDeps, onExit);
 registerSnapshotCommand(sessionCommand, sessionDeps, onExit);
@@ -29109,17 +29271,17 @@ registerSetupCommand(
       };
       const root = await ask(["root", "-g"]);
       const prefix = await ask(["prefix", "-g"]);
-      const binDir = prefix ? process.platform === "win32" ? prefix : join6(prefix, "bin") : null;
+      const binDir = prefix ? process.platform === "win32" ? prefix : join7(prefix, "bin") : null;
       const dir = (name) => {
         if (!root) return null;
-        const candidate = join6(root, "@jentrix", name);
-        return existsSync6(join6(candidate, "package.json")) ? candidate : null;
+        const candidate = join7(root, "@jentrix", name);
+        return existsSync6(join7(candidate, "package.json")) ? candidate : null;
       };
       const cliDir = dir("cli");
       const versionOf = (packageDir) => {
         if (!packageDir) return null;
         try {
-          const raw = readFileSync7(join6(packageDir, "package.json"), "utf8");
+          const raw = readFileSync7(join7(packageDir, "package.json"), "utf8");
           const parsed = JSON.parse(raw);
           const value = typeof parsed === "object" && parsed !== null ? parsed.version : void 0;
           return typeof value === "string" ? value : null;
@@ -29154,14 +29316,14 @@ registerSetupCommand(
       const packageRoot = persistentPluginRoot(
         root,
         PACKAGE_ROOT,
-        (dir) => isPluginMarketplaceDir(join6(dir, "claude-plugin"))
+        (dir) => isPluginMarketplaceDir(join7(dir, "claude-plugin"))
       );
       return runPluginInstall(
         packageRoot === PACKAGE_ROOT ? pluginDeps : {
           ...pluginDeps,
-          resolvePluginDir: () => join6(packageRoot, "claude-plugin"),
+          resolvePluginDir: () => join7(packageRoot, "claude-plugin"),
           resolveCodexPluginDir: () => {
-            const dir = join6(packageRoot, "codex-plugin");
+            const dir = join7(packageRoot, "codex-plugin");
             return isCodexPluginMarketplaceDir(dir) ? dir : null;
           }
         },
@@ -29178,12 +29340,14 @@ registerSetupCommand(
       }
     },
     login: (flags) => runLoginCommand(flags, loginDeps),
-    codexConfigPath: () => join6(process.env.CODEX_HOME ?? join6(homedir2(), ".codex"), "config.toml"),
+    codexConfigPath: () => join7(process.env.CODEX_HOME ?? join7(homedir2(), ".codex"), "config.toml"),
     readTextFile: (path) => existsSync6(path) ? readFileSync7(path, "utf8") : null,
     appendTextFile: (path, text) => {
       mkdirSync4(dirname4(path), { recursive: true });
       appendFileSync(path, text);
     },
+    // D6 — the checkout's ./.mcp.json (OAuth mode, no credential inside).
+    writeTextFile: (path, text) => writeFileSync5(path, text, { mode: 420 }),
     copyFile: (from, to) => copyFileSync(from, to),
     now: () => /* @__PURE__ */ new Date(),
     cwd: () => process.cwd(),