@jentrix/cli 0.5.15 → 0.5.16

package/claude-plugin/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "jentrix",
   "description": "Connect this Claude Code session to a Jentrix project: /jentrix-connect binds the current session (trusted lifecycle hooks supply the session id), /jentrix-align runs the MVP alignment wizard, /jentrix-status and /jentrix-end wrap the same session operations. Business logic lives in the Jentrix CLI — removing this plugin leaves `jentrix session attach` as the universal fallback.",
-  "version": "0.5.1"
+  "version": "0.5.2"
 }

package/claude-plugin/commands/jentrix-align.md

@@ -21,6 +21,15 @@ and do NOT answer any question yourself.
 3. If `currentAlignment` is non-null: show it to the operator and ask —
    using the native choice UI (AskUserQuestion) — whether to keep it or
    re-align. Keep → relay the current snapshot and stop.
+   **Fast path.** If the payload's only `ask` question is `confirmation`
+   (project / work item / owner were pre-filled from this checkout's previous
+   alignment and the confirmation prompt says so — "continuing this
+   checkout's previous alignment …"), present that prompt VERBATIM through
+   the choice UI. Confirm ⇒ submit with the answered values exactly as the
+   payload shows them (`--project <id> --task <id>|--session-level --owner
+   <id>`). Re-answer ⇒ re-run `jentrix align --questions --json --fresh` and
+   continue with the full flow below, passing `--fresh` on the final submit
+   too.
 4. For each question whose `status` is `"ask"`, present its `choices`
    verbatim through the native choice UI (AskUserQuestion), preserving the
    labels. If the question carries a `notice`, relay it to the operator

package/codex-plugin/plugins/jentrix/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "jentrix",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Connect Codex tasks to Jentrix projects with trusted lifecycle hooks, alignment, checkpoints, and honest session capture.",
   "author": {
     "name": "Jentrix",

package/codex-plugin/plugins/jentrix/skills/jentrix-align/SKILL.md

@@ -10,6 +10,13 @@ description: Align the current Codex task to a Jentrix workspace, project, work
 2. Relay every failed or warning precondition before asking anything.
 3. If `currentAlignment` exists, ask whether to keep it or re-align. Keep means
    show the current snapshot and stop.
+   Fast path: if the payload's only `ask` question is `confirmation` (project /
+   work item / owner were pre-filled from this checkout's previous alignment and
+   the confirmation prompt says so), present that prompt verbatim. Confirm ⇒
+   submit with the answered values exactly as the payload shows them
+   (`--project <id> --task <id>|--session-level --owner <id>`). Re-answer ⇒
+   re-run `jentrix align --provider codex --questions --json --fresh` and
+   continue with the full flow below, passing `--fresh` on the final submit too.
 4. Present each `status:"ask"` question and its choices verbatim using Codex's
    structured input UI when available, otherwise ask in chat. Never answer for the
    operator. Preserve notices and the `Other…` free-text escape.

package/dist/main.js

@@ -10334,10 +10334,11 @@ import {
   mkdirSync as mkdirSync4,
   openSync as openSync3,
   readFileSync as readFileSync7,
-  statSync as statSync3
+  statSync as statSync3,
+  writeFileSync as writeFileSync5
 } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, delimiter as delimiter2, dirname as dirname4, join as join6, resolve as resolve4 } from "node:path";
+import { basename as basename2, delimiter as delimiter2, dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // node_modules/.pnpm/commander@14.0.3/node_modules/commander/esm.mjs
@@ -20965,7 +20966,7 @@ function refreshAccessToken(input) {
 
 // src/client.ts
 var CLI_NAME = "stacks-cli";
-var CLI_VERSION = "0.5.15";
+var CLI_VERSION = "0.5.16";
 var DEAD_TOKEN_MESSAGE = "authentication failed (HTTP 401): the token is dead or expired \u2014 mint a new PAT at /account/tokens on your Jentrix server and update STACKS_TOKEN (or --token / the config file).";
 var RELOGIN_MESSAGE = "OAuth session expired and could not be refreshed \u2014 run `jentrix login` to sign in again.";
 function originOf2(url2) {
@@ -21316,6 +21317,15 @@ var PROJECT_NAME_PROMPT = "Name for the new project \u2014 your own words, exact
 function buildAlignDisclosures(catalog) {
   const disclosures = [];
   const repo = catalog.detection.repoOwnerName;
+  const previous = catalog.previous;
+  if (previous && previous.usedFor.length > 0) {
+    const parts = previous.usedFor.map(
+      (kind) => kind === "project" ? `project ${previous.projectName}` : kind === "work_item" ? `task ${previous.taskKey ?? "session-level"}` : `owner ${previous.ownerLabel}`
+    );
+    disclosures.push(
+      `continuing this checkout's previous alignment \u2014 ${parts.join(" \xB7 ")} (choose Re-answer, or run with --fresh, to change)`
+    );
+  }
   if (catalog.chosenProjectId === "__pending__") {
     const name = catalog.newProjectName ?? "the new project";
     disclosures.push(
@@ -21420,7 +21430,10 @@ function buildAlignQuestions(catalog) {
     ...new Map(
       [
         ...catalog.candidates.map((candidate) => candidate.workspace),
-        ...catalog.pinnedWorkspace ? [catalog.pinnedWorkspace] : []
+        ...catalog.pinnedWorkspace ? [catalog.pinnedWorkspace] : [],
+        // D4: a repo that matches nothing offers the caller's own workspaces
+        // instead of a lone "Other…" — the same skip/ask rules apply to them.
+        ...catalog.candidates.length === 0 ? catalog.workspaces ?? [] : []
       ].map((ws) => [ws.id, ws])
     ).values()
   ];
@@ -21648,6 +21661,14 @@ function buildAlignQuestions(catalog) {
     };
   } else if (project.status !== "answered" || catalog.members === null) {
     owner = { id: "owner", prompt: "Owner", status: "pending", choices: [] };
+  } else if (catalog.members.length === 1) {
+    owner = {
+      id: "owner",
+      prompt: "Owner",
+      status: "skipped",
+      answer: catalog.members[0].id,
+      choices: []
+    };
   } else {
     owner = {
       id: "owner",
@@ -21666,7 +21687,8 @@ function buildAlignQuestions(catalog) {
     };
   }
   const targetKnown = project.status === "answered" && (projectName.status === "answered" || projectName.status === "skipped");
-  const ready = targetKnown && workItem.status === "answered" && (taskTitle.status === "answered" || taskTitle.status === "skipped") && owner.status === "answered";
+  const ready = targetKnown && workItem.status === "answered" && (taskTitle.status === "answered" || taskTitle.status === "skipped") && // D5: a sole-member owner is resolved by detection, like the workspace.
+  (owner.status === "answered" || owner.status === "skipped");
   const disclosures = targetKnown ? buildAlignDisclosures(catalog) : [];
   const confirmation = {
     id: "confirmation",
@@ -23682,6 +23704,78 @@ async function openTasksForProject(caller, boardIds) {
   tasks.sort((a, b) => b.number - a.number);
   return tasks.slice(0, MAX_WORK_ITEMS).map(({ id, key, title }) => ({ id, key, title }));
 }
+async function workspaceProjects(caller, workspaceId) {
+  const listed = await callStructured(caller, "list_projects", { workspaceId });
+  return (listed.projects ?? []).filter((project) => project.archivedAt === null).map(({ id, name, slug }) => ({ id, name, slug }));
+}
+async function workspaceMembers(caller, workspaceId) {
+  const result = await callStructured(caller, "list_members", { workspaceId });
+  return (result.members ?? []).map((member) => ({
+    id: member.userId ?? member.id ?? "",
+    name: member.name,
+    email: member.email
+  }));
+}
+async function loadProjectContext(caller, catalog, projectId) {
+  try {
+    const project = await projectBoards(caller, projectId);
+    catalog.repoLinked = repoLinkedOf(catalog, projectId, project.repoOwners);
+    catalog.projectHasBoard = project.boardIds.length > 0;
+    catalog.openTasks = await openTasksForProject(caller, project.boardIds);
+    catalog.members = await workspaceMembers(caller, project.workspaceId);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function previousAlignmentOf(caller, newest, prefetched = null) {
+  try {
+    const session = prefetched ?? await callStructured(caller, "get_agent_session", {
+      sessionId: newest.sessionId
+    });
+    const a = session.alignment;
+    if (!a?.project?.id || !a.owner?.id) return null;
+    return {
+      sessionId: newest.sessionId,
+      workspaceId: a.workspace?.id ?? newest.workspaceId,
+      project: { id: a.project.id, name: a.project.name ?? a.project.id },
+      task: a.task?.id ? { id: a.task.id, key: a.task.key ?? a.task.id } : null,
+      owner: {
+        id: a.owner.id,
+        label: a.owner.name ?? a.owner.email ?? a.owner.id
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+function prefillFromPrevious(previous, catalog, projectPrefilled) {
+  const sameProject = projectPrefilled || catalog.chosenProjectId === previous.project.id;
+  if (!sameProject) return null;
+  const usedFor = [];
+  if (projectPrefilled) usedFor.push("project");
+  if (catalog.chosenWorkItem === null && catalog.openTasks !== null) {
+    if (previous.task === null) {
+      catalog.chosenWorkItem = "__none__";
+      usedFor.push("work_item");
+    } else if (catalog.openTasks.some((t) => t.id === previous.task.id)) {
+      catalog.chosenWorkItem = previous.task.id;
+      usedFor.push("work_item");
+    }
+  }
+  if (catalog.chosenOwnerId === null && catalog.members?.some((m) => m.id === previous.owner.id)) {
+    catalog.chosenOwnerId = previous.owner.id;
+    usedFor.push("owner");
+  }
+  if (usedFor.length === 0) return null;
+  return {
+    sessionId: previous.sessionId,
+    projectName: previous.project.name,
+    taskKey: previous.task?.key ?? null,
+    ownerLabel: previous.owner.label,
+    usedFor
+  };
+}
 async function resolveCandidates(caller, repoOwnerName) {
   try {
     const result = await callStructured(caller, "resolve_projects_for_repo", {
@@ -23847,8 +23941,8 @@ async function buildCatalog(caller, flags, detection) {
   const context = await callStructured(caller, "get_token_context", {});
   let pinnedWorkspace = null;
   if (context.workspacePinned === true && typeof context.workspaceId === "string") {
-    const workspaces = await callStructured(caller, "list_workspaces", {});
-    const match = (workspaces.workspaces ?? []).find((ws) => ws.id === context.workspaceId);
+    const workspaces2 = await callStructured(caller, "list_workspaces", {});
+    const match = (workspaces2.workspaces ?? []).find((ws) => ws.id === context.workspaceId);
     pinnedWorkspace = {
       id: context.workspaceId,
       name: match?.name ?? "pinned"
@@ -23861,17 +23955,28 @@ async function buildCatalog(caller, flags, detection) {
   ) : null;
   const { candidates: matched, pinned: discoveryPinned } = await resolveCandidates(caller, detection.repoOwnerName);
   const candidates = flagWorkspaceId ? matched.filter((candidate) => candidate.workspace.id === flagWorkspaceId) : matched;
+  let workspaces = null;
+  if (matched.length === 0 && !pinnedWorkspace && !flagWorkspaceId) {
+    const listed = await callStructured(caller, "list_workspaces", {});
+    workspaces = (listed.workspaces ?? []).map(({ id, name, slug }) => ({ id, name, slug }));
+  }
+  const sole = (rows) => rows.length === 1 && !isArchiveNamed(rows[0].name) ? rows[0] : null;
+  const candidateWorkspaces = [
+    ...new Map(candidates.map((c) => [c.workspace.id, c.workspace])).values()
+  ];
+  const resolvedWorkspaceId = flagWorkspaceId ?? pinnedWorkspace?.id ?? sole(workspaces ?? [])?.id ?? sole(candidateWorkspaces)?.id ?? null;
   let otherProjects = [];
   let discoveryNotice = null;
-  if (discoveryPinned && pinnedWorkspace) {
+  if (resolvedWorkspaceId) {
     try {
-      const listed = await callStructured(caller, "list_projects", {
-        workspaceId: pinnedWorkspace.id
-      });
-      otherProjects = (listed.projects ?? []).filter((project) => project.archivedAt === null).map(({ id, name, slug }) => ({ id, name, slug }));
-      discoveryNotice = "repo discovery is unavailable for a workspace-pinned token \u2014 listing every project in the pinned workspace instead (repo match unverified)";
+      otherProjects = await workspaceProjects(caller, resolvedWorkspaceId);
+      if (discoveryPinned) {
+        discoveryNotice = "repo discovery is unavailable for a workspace-pinned token \u2014 listing every project in the pinned workspace instead (repo match unverified)";
+      }
     } catch {
-      discoveryNotice = "repo discovery is unavailable for a workspace-pinned token and the workspace project list could not be loaded \u2014 pass --project <id-or-slug>, or --new-project <name> to create one";
+      if (discoveryPinned) {
+        discoveryNotice = "repo discovery is unavailable for a workspace-pinned token and the workspace project list could not be loaded \u2014 pass --project <id-or-slug>, or --new-project <name> to create one";
+      }
     }
   }
   const wantsCreate = Boolean(flags.newProject && flags.newProject.trim()) || flags.project === "__create__";
@@ -23888,68 +23993,28 @@ async function buildCatalog(caller, flags, detection) {
   } else if (candidates.length === 1 && matched.length === 1) {
     chosenProjectId = candidates[0].id;
   }
-  let openTasks = null;
-  let members = null;
-  let repoLinked = null;
-  let projectHasBoard = null;
-  if (wantsCreate) {
-    openTasks = [];
-    const workspaceId = pinnedWorkspace?.id ?? null;
-    if (workspaceId) {
-      try {
-        const memberResult = await callStructured(caller, "list_members", {
-          workspaceId
-        });
-        members = memberResult.members?.map((member) => ({
-          id: member.userId ?? member.id ?? "",
-          name: member.name,
-          email: member.email
-        })) ?? [];
-      } catch {
-        members = [];
-      }
-    } else {
-      members = [];
-    }
-  } else if (chosenProjectId) {
-    try {
-      const project = await projectBoards(caller, chosenProjectId);
-      repoLinked = repoLinkedOf(
-        { candidates, detection },
-        chosenProjectId,
-        project.repoOwners
-      );
-      projectHasBoard = project.boardIds.length > 0;
-      openTasks = await openTasksForProject(caller, project.boardIds);
-      const memberResult = await callStructured(caller, "list_members", {
-        workspaceId: project.workspaceId
-      });
-      members = memberResult.members?.map((member) => ({
-        id: member.userId ?? member.id ?? "",
-        name: member.name,
-        email: member.email
-      })) ?? null;
-    } catch {
-    }
-  }
   const chosenWorkspaceId = candidates.find((candidate) => candidate.id === chosenProjectId)?.workspace.id ?? flagWorkspaceId ?? pinnedWorkspace?.id ?? null;
-  return {
+  const catalog = {
     detection,
     pinnedWorkspace,
     candidates,
     otherProjects,
     discoveryNotice,
+    workspaces,
     chosenWorkspaceId,
     chosenProjectId,
-    openTasks,
-    members,
-    operatorUserId: null,
+    openTasks: null,
+    members: null,
+    // D5 (STA-168): the server now says who the caller is — the owner
+    // question's default, and what `--yes` falls back to. Null from an older
+    // server, which keeps the explicit-owner refusal.
+    operatorUserId: typeof context.userId === "string" ? context.userId : null,
     chosenWorkItem: flags.task ? flags.task : flags.newTask ? "__new__" : flags.sessionLevel ? "__none__" : null,
     chosenOwnerId: flags.owner ?? null,
     newTaskTitle: flags.newTask?.trim() || null,
     newProjectName: flags.newProject?.trim() || null,
-    repoLinked,
-    projectHasBoard,
+    repoLinked: null,
+    projectHasBoard: null,
     // STA-11: filled by runAlign (it needs the checkout root) — the ordering
     // preference for the workspace question.
     lastAlignedWorkspaceId: null,
@@ -23965,8 +24030,24 @@ async function buildCatalog(caller, flags, detection) {
     binding: null,
     mcpConfig: null,
     // Filled by runAlign — it needs the checkout's marker session.
-    priorArtifacts: null
+    priorArtifacts: null,
+    // D7: filled by runAlign (it needs the checkout's newest marker).
+    previous: null
   };
+  if (wantsCreate) {
+    catalog.openTasks = [];
+    catalog.members = [];
+    if (resolvedWorkspaceId) {
+      try {
+        catalog.members = await workspaceMembers(caller, resolvedWorkspaceId);
+      } catch {
+        catalog.members = [];
+      }
+    }
+  } else if (chosenProjectId) {
+    await loadProjectContext(caller, catalog, chosenProjectId);
+  }
+  return catalog;
 }
 async function priorArtifactsOf(caller, markerSession) {
   const current = markerSession?.alignment?.task;
@@ -24323,7 +24404,8 @@ async function runAlign(flags, deps2) {
         flags.capture,
         marker !== null && markerHost !== null && isHostCapturing(deps2, marker.sessionId, markerHost)
       );
-      catalog.lastAlignedWorkspaceId = newestAlignmentMarker(deps2.configPath, inspection.root)?.workspaceId ?? null;
+      const newest = newestAlignmentMarker(deps2.configPath, inspection.root);
+      catalog.lastAlignedWorkspaceId = newest?.workspaceId ?? null;
       catalog.binding = {
         providerSessionId: detected.providerSessionId,
         transcriptPath: detected.transcriptPath,
@@ -24349,6 +24431,31 @@ async function runAlign(flags, deps2) {
         }
       }
       const markerActive = markerSession !== null && (markerSession.status === "ACTIVE" || markerSession.status === "STARTING");
+      let workspaceFromPrevious = false;
+      if (!flags.fresh && !markerActive && newest) {
+        const previous = await previousAlignmentOf(
+          caller,
+          newest,
+          // This provider session's own (ended) marker is the newest: reuse
+          // the read above rather than paying for it twice.
+          marker?.sessionId === newest.sessionId ? markerSession : null
+        );
+        if (previous) {
+          const projectPrefilled = catalog.chosenProjectId === null && await loadProjectContext(caller, catalog, previous.project.id);
+          if (projectPrefilled) {
+            catalog.chosenProjectId = previous.project.id;
+            if (catalog.chosenWorkspaceId === null) {
+              catalog.chosenWorkspaceId = previous.workspaceId;
+              workspaceFromPrevious = true;
+            }
+          }
+          catalog.previous = prefillFromPrevious(
+            previous,
+            catalog,
+            projectPrefilled
+          );
+        }
+      }
       catalog.priorArtifacts = await priorArtifactsOf(caller, markerSession);
       const preconditions = await doctorLocalChecks(deps2);
       preconditions.push(sessionBindingCheck(detected));
@@ -24433,7 +24540,7 @@ async function runAlign(flags, deps2) {
       let pendingCreateProject = null;
       if (flags.newTask) workItem = `__new__:${flags.newTask}`;
       if (flags.newProject && flags.newProject.trim()) {
-        const workspaceId = catalog.chosenWorkspaceId ?? catalog.pinnedWorkspace?.id ?? null;
+        const workspaceId = buildAlignQuestions(catalog)[0]?.answer ?? null;
         if (!workspaceId) {
           throw new UsageError(
             "--new-project needs a resolved workspace (a workspace-pinned token, a repo-matched candidate, or --workspace <id-or-slug>) \u2014 none resolved here"
@@ -24494,11 +24601,21 @@ async function runAlign(flags, deps2) {
             catalog.newProjectName = null;
             pendingCreateProject = null;
             createWorkspaceId = null;
+            catalog.previous = null;
+            if (workspaceFromPrevious) {
+              catalog.chosenWorkspaceId = null;
+              workspaceFromPrevious = false;
+            }
             continue;
           }
           const answer = await askQuestion(deps2, next);
           if (next.id === "workspace") {
             catalog.chosenWorkspaceId = answer;
+            try {
+              catalog.otherProjects = await workspaceProjects(caller, answer);
+            } catch {
+              catalog.otherProjects = [];
+            }
           } else if (next.id === "task_title") {
             newTaskTitle = answer;
           } else if (next.id === "project_name") {
@@ -24514,7 +24631,7 @@ async function runAlign(flags, deps2) {
             };
           } else if (next.id === "project") {
             if (answer === "__create__") {
-              const workspaceId = catalog.chosenWorkspaceId ?? catalog.pinnedWorkspace?.id;
+              const workspaceId = questions[0]?.answer ?? null;
               if (!workspaceId) {
                 throw new UsageError(
                   "cannot create a project without a resolved workspace \u2014 pick a workspace first"
@@ -24526,16 +24643,7 @@ async function runAlign(flags, deps2) {
               catalog.projectHasBoard = null;
               catalog.openTasks = [];
               try {
-                const memberResult = await callStructured(
-                  caller,
-                  "list_members",
-                  { workspaceId }
-                );
-                catalog.members = memberResult.members?.map((member) => ({
-                  id: member.userId ?? member.id ?? "",
-                  name: member.name,
-                  email: member.email
-                })) ?? [];
+                catalog.members = await workspaceMembers(caller, workspaceId);
               } catch {
                 catalog.members = [];
               }
@@ -24543,31 +24651,7 @@ async function runAlign(flags, deps2) {
             } else {
               projectId = answer;
             }
-            try {
-              const project = await projectBoards(caller, projectId);
-              catalog.repoLinked = repoLinkedOf(
-                catalog,
-                projectId,
-                project.repoOwners
-              );
-              catalog.projectHasBoard = project.boardIds.length > 0;
-              catalog.openTasks = await openTasksForProject(
-                caller,
-                project.boardIds
-              );
-              const memberResult = await callStructured(
-                caller,
-                "list_members",
-                {
-                  workspaceId: project.workspaceId
-                }
-              );
-              catalog.members = memberResult.members?.map((member) => ({
-                id: member.userId ?? member.id ?? "",
-                name: member.name,
-                email: member.email
-              })) ?? [];
-            } catch {
+            if (!await loadProjectContext(caller, catalog, projectId)) {
               catalog.openTasks = [];
               catalog.members = [];
               catalog.repoLinked = null;
@@ -24580,10 +24664,11 @@ async function runAlign(flags, deps2) {
           }
         }
       }
+      ownerUserId ??= (catalog.members?.length === 1 ? catalog.members[0].id : null) ?? catalog.operatorUserId;
       if (pendingCreateProject) {
         if (!ownerUserId) {
           throw new UsageError(
-            "creating a project needs an owner \u2014 answer the owner question (or pass --owner <userId>)"
+            `creating a project needs an owner \u2014 answer the owner question, or pass --owner <userId> (this server did not identify you; discover members with \`jentrix tool list_members --args '{"workspaceId":"${pendingCreateProject.workspaceId}"}'\`)`
           );
         }
         const created = await callStructured(caller, "create_project", {
@@ -24798,6 +24883,9 @@ function registerAlignCommand(program3, deps2, onExit2) {
   ).option("--json", "stable JSON output").option(
     "--yes",
     "skip the re-align confirmation on an already-aligned session"
+  ).option(
+    "--fresh",
+    "ignore this checkout's previous alignment and ask every question"
   ).action(async (flags) => onExit2(await runAlign(flags, deps2)));
 }
 
@@ -26871,6 +26959,7 @@ function renderHuman(report) {
     lines.push(
       `  workspace: ${tc.workspacePinned ? `pinned to ${tc.workspaceId ?? "?"}` : "not pinned (all your workspaces)"}`
     );
+    if (tc.userId) lines.push(`  user:      ${tc.userId}`);
     if (tc.displayName) {
       lines.push(
         `  identity:  ${tc.emoji ? `${tc.emoji} ` : ""}${tc.displayName}`
@@ -27031,6 +27120,7 @@ function parseTokenContext(rendered) {
     grandfathered: v.grandfathered,
     workspacePinned: v.workspacePinned,
     workspaceId: v.workspaceId ?? null,
+    userId: typeof v.userId === "string" ? v.userId : null,
     displayName: v.displayName ?? null,
     emoji: v.emoji ?? null,
     rateLimit: {
@@ -28134,6 +28224,7 @@ function registerRunnerCommand(program3, deps2, onExit2) {
 }
 
 // src/commands/setup.ts
+import { join as join5 } from "node:path";
 var NPM_INSTALL_TIMEOUT_MS2 = 3e5;
 var SUPERSEDED = ["@jentrix/stacks-cli", "@jentrix/stacks-runner"];
 var CLI_SPEC = `@jentrix/cli@${CLI_VERSION}`;
@@ -28356,21 +28447,21 @@ async function bootstrapRepository(deps2) {
       deps2,
       "      Jentrix aligns sessions by repository identity, so install git (https://git-scm.com/downloads) and re-run."
     );
-    return;
+    return false;
   }
   const inRepo = async () => (await deps2.git(["rev-parse", "--is-inside-work-tree"], here)).code === 0;
   if (!await inRepo()) {
     const reply = await deps2.readLine(
       `Initialize a git repository in ${here} so agent sessions can align here? [y/N] `
     );
-    if (!/^y/i.test(reply.trim())) return;
+    if (!/^y/i.test(reply.trim())) return false;
     if ((await deps2.git(["init"], here)).code !== 0) {
       say(deps2, "note: `git init` failed \u2014 skipped the repository step.");
-      return;
+      return false;
     }
   }
   if ((await deps2.git(["remote", "get-url", "origin"], here)).code === 0)
-    return;
+    return true;
   const fallback = here.split(/[/\\]/).filter(Boolean).pop().toLowerCase().replace(/ /g, "-");
   say(
     deps2,
@@ -28383,15 +28474,55 @@ async function bootstrapRepository(deps2) {
   const answer = (await deps2.readLine(
     "GitHub repo for origin (owner/name or full URL, blank to skip): "
   )).trim();
-  if (!answer) return;
+  if (!answer) return true;
   const url2 = /:\/\/|^[^/]+@[^:]+:/.test(answer) ? answer : /^[^/]+\/[^/]+$/.test(answer) ? `https://github.com/${answer}.git` : null;
   if (!url2) {
     say(deps2, `skipped \u2014 "${answer}" is neither owner/name nor a URL`);
-    return;
+    return true;
   }
   if ((await deps2.git(["remote", "add", "origin", url2], here)).code === 0) {
     say(deps2, `origin \u2192 ${url2}`);
   }
+  return true;
+}
+function writeCheckoutMcpConfig(deps2, url2) {
+  const path = join5(deps2.cwd(), ".mcp.json");
+  if (!url2) {
+    say(
+      deps2,
+      "note: skipped ./.mcp.json \u2014 no endpoint is known yet (not signed in, no --url); the first `jentrix align` here writes it."
+    );
+    return;
+  }
+  const raw = deps2.readTextFile(path);
+  let existing = null;
+  if (raw !== null) {
+    try {
+      existing = JSON.parse(raw);
+    } catch {
+      say(
+        deps2,
+        `note: ${path} is not valid JSON \u2014 left untouched (fix or remove it, then re-run; align refuses it the same way).`
+      );
+      return;
+    }
+  }
+  const plan = planMcpServerEntry(existing, url2, null);
+  if (plan.action === "unchanged") {
+    say(deps2, `./.mcp.json already names ${url2}.`);
+    return;
+  }
+  deps2.writeTextFile(path, renderMcpConfig(plan.next));
+  say(
+    deps2,
+    plan.action === "repoint" ? `Repointed the "jentrix" MCP server in ./.mcp.json: ${plan.previousUrl} \u2192 ${url2} (Claude Code reads it at session start; no credential inside).` : `Wrote ./.mcp.json \u2192 ${url2} (Claude Code reads it at session start; no credential inside).`
+  );
+  if (plan.removedAuthorization) {
+    say(
+      deps2,
+      "  Removed its Authorization header: a header suppresses the client's OAuth discovery. `jentrix align --pat` puts it back for a headless checkout."
+    );
+  }
 }
 async function runSetupCommand(flags, deps2) {
   const nodeMajor = Number(process.versions.node.split(".")[0]);
@@ -28425,13 +28556,20 @@ async function runSetupCommand(flags, deps2) {
   const codex = await deps2.resolveCodex();
   if (codex) await registerCodexMcp(deps2, codex, pending);
   if (flags.git !== false && deps2.cwd() !== deps2.homeDir()) {
+    let inWorkTree;
     if (deps2.isInteractive) {
-      await bootstrapRepository(deps2);
-    } else if (!await deps2.resolveGit() || (await deps2.git(["rev-parse", "--is-inside-work-tree"], deps2.cwd())).code !== 0) {
-      say(
-        deps2,
-        "note: skipped the repository offer (not an interactive terminal) \u2014 this folder is not a git work tree, and align requires one. Run `git init` here first."
-      );
+      inWorkTree = await bootstrapRepository(deps2);
+    } else {
+      inWorkTree = await deps2.resolveGit() !== null && (await deps2.git(["rev-parse", "--is-inside-work-tree"], deps2.cwd())).code === 0;
+      if (!inWorkTree) {
+        say(
+          deps2,
+          "note: skipped the repository offer (not an interactive terminal) \u2014 this folder is not a git work tree, and align requires one. Run `git init` here first."
+        );
+      }
+    }
+    if (inWorkTree) {
+      writeCheckoutMcpConfig(deps2, deps2.signedInUrl() ?? flags.url ?? null);
     }
   }
   say(deps2, "");
@@ -28517,7 +28655,7 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 var MAX_SLICE_BYTES = 1e6;
 function captureConsented(host, marker) {
   if (host && typeof host.captureTrace === "boolean") return host.captureTrace;
@@ -28552,7 +28690,7 @@ function resolveSnapshotSession(payload, spoolRoot, configPath, repoRoot, readHo
   return null;
 }
 function offsetPath(spoolRoot, sessionId) {
-  return join5(spoolRoot, sessionId, "snapshot.json");
+  return join6(spoolRoot, sessionId, "snapshot.json");
 }
 function readOffset(spoolRoot, sessionId) {
   try {
@@ -29075,7 +29213,7 @@ var sessionDeps = {
       closeSync3(fd);
     }
   },
-  spoolRoot: join6(homedir2(), ".config", "stacks", "session-spool")
+  spoolRoot: join7(homedir2(), ".config", "stacks", "session-spool")
 };
 var sessionCommand = registerSessionCommand(program2, sessionDeps, onExit);
 registerSnapshotCommand(sessionCommand, sessionDeps, onExit);
@@ -29133,17 +29271,17 @@ registerSetupCommand(
       };
       const root = await ask(["root", "-g"]);
       const prefix = await ask(["prefix", "-g"]);
-      const binDir = prefix ? process.platform === "win32" ? prefix : join6(prefix, "bin") : null;
+      const binDir = prefix ? process.platform === "win32" ? prefix : join7(prefix, "bin") : null;
       const dir = (name) => {
         if (!root) return null;
-        const candidate = join6(root, "@jentrix", name);
-        return existsSync6(join6(candidate, "package.json")) ? candidate : null;
+        const candidate = join7(root, "@jentrix", name);
+        return existsSync6(join7(candidate, "package.json")) ? candidate : null;
       };
       const cliDir = dir("cli");
       const versionOf = (packageDir) => {
         if (!packageDir) return null;
         try {
-          const raw = readFileSync7(join6(packageDir, "package.json"), "utf8");
+          const raw = readFileSync7(join7(packageDir, "package.json"), "utf8");
           const parsed = JSON.parse(raw);
           const value = typeof parsed === "object" && parsed !== null ? parsed.version : void 0;
           return typeof value === "string" ? value : null;
@@ -29178,14 +29316,14 @@ registerSetupCommand(
       const packageRoot = persistentPluginRoot(
         root,
         PACKAGE_ROOT,
-        (dir) => isPluginMarketplaceDir(join6(dir, "claude-plugin"))
+        (dir) => isPluginMarketplaceDir(join7(dir, "claude-plugin"))
       );
       return runPluginInstall(
         packageRoot === PACKAGE_ROOT ? pluginDeps : {
           ...pluginDeps,
-          resolvePluginDir: () => join6(packageRoot, "claude-plugin"),
+          resolvePluginDir: () => join7(packageRoot, "claude-plugin"),
           resolveCodexPluginDir: () => {
-            const dir = join6(packageRoot, "codex-plugin");
+            const dir = join7(packageRoot, "codex-plugin");
             return isCodexPluginMarketplaceDir(dir) ? dir : null;
           }
         },
@@ -29202,12 +29340,14 @@ registerSetupCommand(
       }
     },
     login: (flags) => runLoginCommand(flags, loginDeps),
-    codexConfigPath: () => join6(process.env.CODEX_HOME ?? join6(homedir2(), ".codex"), "config.toml"),
+    codexConfigPath: () => join7(process.env.CODEX_HOME ?? join7(homedir2(), ".codex"), "config.toml"),
     readTextFile: (path) => existsSync6(path) ? readFileSync7(path, "utf8") : null,
     appendTextFile: (path, text) => {
       mkdirSync4(dirname4(path), { recursive: true });
       appendFileSync(path, text);
     },
+    // D6 — the checkout's ./.mcp.json (OAuth mode, no credential inside).
+    writeTextFile: (path, text) => writeFileSync5(path, text, { mode: 420 }),
     copyFile: (from, to) => copyFileSync(from, to),
     now: () => /* @__PURE__ */ new Date(),
     cwd: () => process.cwd(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jentrix/cli",
-  "version": "0.5.15",
+  "version": "0.5.16",
   "description": "Command-line client for the Jentrix MCP surface (jentrix tool <name>, generated noun-verb commands).",
   "keywords": [
     "jentrix",