@sleds/cli 0.1.6 → 0.1.11

package/README.md

@@ -1,5 +1,7 @@
 # @sleds/cli
 
+> Private while SLEDS is in stealth: the package is published with restricted access, so `npm i -g @sleds/cli` / `npx @sleds/cli` need an `npm login` that belongs to the `sleds` org. Public release flips `publishConfig.access` back to `public`.
+
 The cost and limits of AI agent work, decided at the wall.
 
 SLEDS sits in front of Claude Code. It meters what you spend, sizes a job before it runs, and when you hit a limit — a rate limit, a weekly cap, exhausted credits — it gives you a choice right there in the terminal: continue on the org key, hold until the window resets, switch to a cheaper model, or run it overnight at half price.
@@ -10,7 +12,7 @@ SLEDS sits in front of Claude Code. It meters what you spend, sizes a job before
 npx @sleds/cli init --signup
 ```
 
-No org? That's the whole setup: your email plus your own Anthropic API key. SLEDS checks the key, stores it encrypted, and it's the only key your seat ever spends. If your team already runs SLEDS, use the seat token your admin gave you instead:
+No org? `--signup` asks: just you, or your team. Just you is your email plus your own Anthropic API key. SLEDS checks the key, stores it encrypted, and it's the only key your seat ever spends. Your team is a work email and a team name — you become its owner; a platform key is optional (a Team plan without one still gets seat tracking, hold and hand-off at a wall). If your team already runs SLEDS, use the seat token your admin gave you instead:
 
 ```bash
 npx @sleds/cli init --token sled_…

package/dist/sleds.mjs

@@ -41,6 +41,38 @@ var claudeDir = (home, env = process.env) => {
 };
 var hasHomeOverride = (env = process.env) => Boolean(env.SLEDS_HOME?.trim() || env.CLAUDE_CONFIG_DIR?.trim());
 var settingsPath = (home) => join(claudeDir(home), "settings.json");
+var sledsCommand = (sub, home, env = process.env) => {
+  const parts = [];
+  const sh = env.SLEDS_HOME?.trim();
+  const cc = env.CLAUDE_CONFIG_DIR?.trim();
+  if (sh)
+    parts.push(`SLEDS_HOME=${shellWord(resolve(home, sh))}`);
+  if (cc)
+    parts.push(`CLAUDE_CONFIG_DIR=${shellWord(resolve(home, cc))}`);
+  parts.push(`sleds ${sub}`);
+  return parts.join(" ");
+};
+var sledsCommandsIn = (settings) => {
+  const out = [];
+  const visit = (v) => {
+    if (Array.isArray(v)) {
+      for (const x of v)
+        visit(x);
+      return;
+    }
+    if (!isObject(v))
+      return;
+    if (typeof v.command === "string" && /\bsleds\b/.test(v.command))
+      out.push(v.command);
+    for (const x of Object.values(v))
+      visit(x);
+  };
+  visit(settings[STATUS_LINE_KEY]);
+  visit(settings.hooks);
+  return out;
+};
+var bakedHome = (command) => command.match(/(?:^|\s)SLEDS_HOME=('([^']*)'|(\S+))/)?.[2] ?? command.match(/(?:^|\s)SLEDS_HOME=(\S+)/)?.[1];
+var shellWord = (v) => /^[\w./~-]+$/.test(v) ? v : `'${v.replace(/'/g, "'\\''")}'`;
 var backupPath = (home) => join(claudeDir(home), "settings.json.sleds-backup");
 var tokenPath = (home, env = process.env) => {
   const o = env.SLEDS_HOME?.trim();
@@ -273,8 +305,36 @@ var parseConfig = (raw) => {
     cfg.schedule = schedule;
   if (raw.priorStatusLine !== undefined)
     cfg.priorStatusLine = raw.priorStatusLine;
+  if (raw.wiring === "seat-first" || raw.wiring === "proxy-always")
+    cfg.wiring = raw.wiring;
+  const org = parseOrgInfo(raw.org);
+  if (org)
+    cfg.org = org;
   return cfg;
 };
+var parseOrgInfo = (raw) => {
+  if (!isObject2(raw) || !isObject2(raw.capabilities))
+    return;
+  const name = optString(raw.name);
+  const slug = optString(raw.slug);
+  const plan = raw.plan;
+  const c = raw.capabilities;
+  const src = c.upstreamSource;
+  if (name === undefined || slug === undefined || plan !== "team" && plan !== "enterprise" && plan !== "api" && plan !== "individual" || src !== "own" && src !== "shared" && src !== "none")
+    return;
+  return {
+    name,
+    slug,
+    plan,
+    capabilities: {
+      upstreamKey: c.upstreamKey === true,
+      adminKey: c.adminKey === true,
+      seats: c.seats !== false,
+      upstreamSource: src
+    },
+    mode: raw.mode === "proxy-always" ? "proxy-always" : "seat-first"
+  };
+};
 var readConfig = (home) => {
   const p = configPath(home);
   if (!existsSync2(p))
@@ -798,6 +858,8 @@ var postJson = async (o, path, body) => {
 var postSeatWindow = (o, w) => postJson(o, "/proxy/seat", seatWindowBody(w));
 var postSeatWall = (o, input) => postJson(o, "/proxy/seat-wall", input);
 var SEAT_WALL_LINE = "Seat limit hit. sleds on --until-reset to continue on the org key.";
+var SEAT_WALL_LINE_NO_KEY = "Seat limit hit. Hold until the reset, or /sled 5 to hand off — this org has no platform key to switch to.";
+var seatWallLine = (hasUpstreamKey) => hasUpstreamKey ? SEAT_WALL_LINE : SEAT_WALL_LINE_NO_KEY;
 var readStdin = (timeoutMs, stdin = process.stdin) => new Promise((resolve3) => {
   if (stdin.isTTY) {
     resolve3("");
@@ -934,7 +996,7 @@ var isDanglingLink = (p) => {
 // src/commands/doctor.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { existsSync as existsSync6, lstatSync as lstatSync2, readFileSync as readFileSync5, readdirSync, readlinkSync } from "node:fs";
-import { join as join7 } from "node:path";
+import { join as join7, resolve as resolve5 } from "node:path";
 
 // src/commands/bar.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -1164,6 +1226,20 @@ async function runDoctor(o) {
       detail: `seat-event ${seat2 ? "on" : "missing"} · spec-event ${spec ? "on" : "missing"}`,
       fix: seat2 && spec ? undefined : "sleds hooks"
     });
+    const want = env.SLEDS_HOME?.trim() ? resolve5(home, env.SLEDS_HOME.trim()) : undefined;
+    const cmds = sledsCommandsIn(settings);
+    const wrong = cmds.filter((c) => {
+      const got = bakedHome(c);
+      return want ? got !== want : got !== undefined;
+    });
+    if (cmds.length > 0) {
+      checks.push({
+        level: wrong.length === 0 ? "ok" : "fail",
+        name: "commands",
+        detail: wrong.length === 0 ? `${cmds.length} command${cmds.length === 1 ? "" : "s"} in settings.json ${want ? `carry SLEDS_HOME=${want}` : "run the default seat"}` : `${wrong.length} of ${cmds.length} commands in settings.json ${want ? `do not carry SLEDS_HOME=${want}` : "carry another seat's SLEDS_HOME"} — their reads land on the wrong seat`,
+        fix: wrong.length === 0 ? undefined : `${overrides.length ? `${overrides.join(" ")} ` : ""}sleds hooks   (re-writes the status line + hooks with this seat baked in)`
+      });
+    }
     const skill = existsSync6(skillPath(home));
     checks.push({
       level: skill ? "ok" : "warn",
@@ -1249,8 +1325,6 @@ var doctor = async (o) => {
 };
 
 // src/commands/hooks.ts
-var DEFAULT_SEAT_EVENT_COMMAND = "sleds seat-event";
-var DEFAULT_SPEC_EVENT_COMMAND = "sleds spec-event";
 var hooks = (o) => {
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
@@ -1261,9 +1335,13 @@ var hooks = (o) => {
   const settings = readSettings(o.home);
   const had = hasSeatHook(settings);
   const hadSpec = hasSpecHook(settings);
-  const withSeat = applySeatHook(settings, o.seatEventCommand ?? DEFAULT_SEAT_EVENT_COMMAND);
-  writeSettings(o.home, applySpecHook(withSeat, o.specEventCommand ?? DEFAULT_SPEC_EVENT_COMMAND));
+  const withSeat = applySeatHook(settings, o.seatEventCommand ?? sledsCommand("seat-event", o.home, o.env));
+  const withSpec = applySpecHook(withSeat, o.specEventCommand ?? sledsCommand("spec-event", o.home, o.env));
+  const hadLine = o.refreshStatusLine !== false && isSledsStatusLine(withSpec[STATUS_LINE_KEY]);
+  writeSettings(o.home, hadLine ? applyStatusLine(withSpec, sledsCommand("statusline", o.home, o.env)).settings : withSpec);
   log(`${had ? "refreshed" : "set"} hooks.Notification (${SEAT_EVENT_MATCHER}) in ${settingsPath(o.home)}`);
+  if (hadLine)
+    log(`refreshed statusLine in ${settingsPath(o.home)}`);
   log(`${hadSpec ? "refreshed" : "set"} hooks.PostToolUse (${SPEC_EVENT_MATCHER} → estimate spec files) in ${settingsPath(o.home)}`);
   return 0;
 };
@@ -1302,8 +1380,11 @@ When the proxy is active it answers a walled request with its options. The user
 /sled 3    run overnight at half price
 /sled 4    switch to a cheaper model for the rest of the session (offered when one saves ≥15%)
 /sled 5    hand off to an idle coworker, or park for the team (offered on a team of two or more)
+/sled 6    defer to reset: the job runs itself when the seat resets — same model, done in minutes, full price (offered when the wall has a reset and the org has a key)
 \`\`\`
 
+A hand-off carries a brief (the packet): what, note, cost so far, how to pick it up. The \`handoffs\` MCP tool and the dashboard's Jobs page show it; read it before taking one.
+
 ## Window reset
 
 When the user mentions their window has reset, or the deadline shown by \`sleds status\` has passed:
@@ -1316,7 +1397,7 @@ then restart \`claude\`. Settings go back to exactly what they were.
 
 ## Check
 
-\`sleds status\` — on/off, since, reverts at, proxy health, wall mode.
+\`sleds status\` — on/off, since, reverts at, proxy health, wall mode, and the org's shape (\`Org:\` / \`Wiring:\`). An org with no platform key runs seat-first and its walls offer hold (\`/sled 2\`) and hand-off (\`/sled 5\`) only — continue, overnight and switch need a key an admin adds on the dashboard.
 
 The status line's \`seat wk 52% · 5h 12%\` is the user's own Pro/Max window as Claude Code reports it (weekly, then 5-hour); \`window\` is the org key's headroom through the proxy. At \`wk 100%\` the answer is \`sleds on --until-reset\`.
 
@@ -1393,8 +1474,6 @@ From Cowork or any MCP client (\`sleds mcp\`): the \`handoffs\` tool lists what
 `;
 
 // src/commands/hooks.ts
-var DEFAULT_SEAT_EVENT_COMMAND2 = "sleds seat-event";
-var DEFAULT_SPEC_EVENT_COMMAND2 = "sleds spec-event";
 var hooks2 = (o) => {
   const log = o.log ?? console.log;
   const error = o.error ?? console.error;
@@ -1405,29 +1484,38 @@ var hooks2 = (o) => {
   const settings = readSettings(o.home);
   const had = hasSeatHook(settings);
   const hadSpec = hasSpecHook(settings);
-  const withSeat = applySeatHook(settings, o.seatEventCommand ?? DEFAULT_SEAT_EVENT_COMMAND2);
-  writeSettings(o.home, applySpecHook(withSeat, o.specEventCommand ?? DEFAULT_SPEC_EVENT_COMMAND2));
+  const withSeat = applySeatHook(settings, o.seatEventCommand ?? sledsCommand("seat-event", o.home, o.env));
+  const withSpec = applySpecHook(withSeat, o.specEventCommand ?? sledsCommand("spec-event", o.home, o.env));
+  const hadLine = o.refreshStatusLine !== false && isSledsStatusLine(withSpec[STATUS_LINE_KEY]);
+  writeSettings(o.home, hadLine ? applyStatusLine(withSpec, sledsCommand("statusline", o.home, o.env)).settings : withSpec);
   log(`${had ? "refreshed" : "set"} hooks.Notification (${SEAT_EVENT_MATCHER}) in ${settingsPath(o.home)}`);
+  if (hadLine)
+    log(`refreshed statusLine in ${settingsPath(o.home)}`);
   log(`${hadSpec ? "refreshed" : "set"} hooks.PostToolUse (${SPEC_EVENT_MATCHER} → estimate spec files) in ${settingsPath(o.home)}`);
   return 0;
 };
 
 // src/commands/init.ts
 var DEFAULT_PROXY_URL = "http://localhost:8787";
-var DEFAULT_STATUS_LINE_COMMAND = "sleds statusline";
-var promptStdin = (question) => new Promise((resolve5) => {
+var promptStdin = (question) => new Promise((resolve6) => {
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   rl.question(question, (answer) => {
     rl.close();
-    resolve5(answer.trim());
+    resolve6(answer.trim());
   });
 });
 async function signupIndividual(proxyUrl, email, credential, fetchFn = fetch) {
+  return signupRequest(proxyUrl, { email, apiKey: credential }, fetchFn);
+}
+async function signupTeam(proxyUrl, email, team, credential, fetchFn = fetch) {
+  return signupRequest(proxyUrl, { email, team, ...credential ? { apiKey: credential } : {} }, fetchFn);
+}
+async function signupRequest(proxyUrl, payload, fetchFn) {
   try {
     const res = await fetchFn(`${proxyUrl}/signup`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ email, apiKey: credential }),
+      body: JSON.stringify(payload),
       signal: AbortSignal.timeout(20000)
     });
     const body = await res.json().catch(() => ({}));
@@ -1448,6 +1536,9 @@ var SIGNUP_REASONS = {
   key_rejected: "Anthropic did not accept that API key. Check it at console.anthropic.com → API keys.",
   rate_limited: "too many signups from this network in the last hour. Try again later.",
   not_configured: "the proxy is not set up for self-serve signup yet.",
+  team: "the team needs a name (2–80 characters).",
+  personal_email: "a team needs a work email — that domain is a personal mailbox. Sign up as an individual instead, or use your company address.",
+  org_exists: "someone at your company already set up SLEDS. Ask them for a seat (Members → invite, Admin → Mint a seat) and run `sleds init --token …`.",
   unavailable: "the proxy could not reach its control plane. Try again in a moment.",
   unreachable: "could not reach the proxy."
 };
@@ -1473,6 +1564,20 @@ function normalizeProxyUrl(raw) {
     return null;
   }
 }
+async function fetchOrgInfo(url, token, fetchFn = fetch) {
+  try {
+    const res = await fetchFn(`${url}/proxy/meter`, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok)
+      return null;
+    const body = await res.json();
+    return body.org?.capabilities ? body.org : null;
+  } catch {
+    return null;
+  }
+}
 async function probeProxy(url, fetchFn = fetch, opts = {}) {
   const tries = opts.tries ?? 2;
   const timeoutMs = opts.timeoutMs ?? 1e4;
@@ -1504,18 +1609,40 @@ var resolveToken = async (o) => {
   const url = normalizeProxyUrl(o.url ?? env.SLEDS_PROXY_URL ?? DEFAULT_PROXY_URL);
   if (!url)
     return null;
-  const email = (await o.prompt("Your email: ")).trim();
+  const log = o.log ?? console.log;
+  const err = o.error ?? console.error;
+  let team = o.team?.trim() || null;
+  if (team === null && !o.email) {
+    const which = (await o.prompt("Set up SLEDS for (1) just you, or (2) your team? [1/2]: ")).trim();
+    if (which === "2") {
+      team = (await o.prompt("Team name (e.g. your company): ")).trim();
+      if (!team)
+        return null;
+    }
+  }
+  const email = (o.email ?? await o.prompt(team ? "Your work email: " : "Your email: ")).trim();
   if (!email.includes("@"))
     return null;
+  if (team) {
+    const credential2 = (await o.prompt("Your organization's Anthropic API key, if you have one (sk-ant-…; press enter to skip — a Team plan without one still works, walls offer hold and hand-off): ")).trim();
+    const r2 = await signupTeam(url, email, team, credential2 || null, o.fetchFn);
+    if (!r2.ok) {
+      err(signupFailureText(r2));
+      return null;
+    }
+    log(`Created ${team} with you as owner (${email}).${credential2 ? " Your platform key is stored encrypted as the org's upstream key." : " No platform key yet — add one on the dashboard (Admin → Keys) to unlock continue / overnight / switch at a wall."}`);
+    log("Invite your team on the dashboard (Members → invite by email, Admin → Mint a seat); each person runs `sleds init --token …`.");
+    return { token: r2.token, source: "signup" };
+  }
   const credential = (await o.prompt("Your Anthropic API key (sk-ant-…, stored encrypted, spends only your account): ")).trim();
   if (!credential)
     return null;
   const r = await signupIndividual(url, email, credential, o.fetchFn);
   if (!r.ok) {
-    (o.error ?? console.error)(signupFailureText(r));
+    err(signupFailureText(r));
     return null;
   }
-  (o.log ?? console.log)(r.created ? `Created your individual seat (${email}). Your key is stored encrypted and is the only key this seat spends.` : `Re-issued your individual seat (${email}); the previous token is revoked.`);
+  log(r.created ? `Created your individual seat (${email}). Your key is stored encrypted and is the only key this seat spends.` : `Re-issued your individual seat (${email}); the previous token is revoked.`);
   return { token: r.token, source: "signup" };
 };
 var init = async (o) => {
@@ -1545,17 +1672,26 @@ var init = async (o) => {
     return 2;
   }
   const wrote = [];
+  const org = await fetchOrgInfo(url, resolved.token, o.fetchFn);
+  const wiring = o.proxyAlways ? "proxy-always" : o.seatFirst ? "seat-first" : org?.mode ?? "proxy-always";
+  if (wiring === "proxy-always" && org && !org.capabilities.upstreamKey) {
+    error(`${org.name} has no platform key for the proxy to forward with; --proxy-always would break every request. Using seat-first.`);
+  }
+  const finalWiring = wiring === "proxy-always" && org && !org.capabilities.upstreamKey ? "seat-first" : wiring;
   if (backupSettings(o.home))
     wrote.push(`backed up settings to ${backupPath(o.home)}`);
-  const withProxy = applyProxy(readSettings(o.home), { url, token: resolved.token });
-  const statusLine = applyStatusLine(withProxy, o.statusLineCommand ?? DEFAULT_STATUS_LINE_COMMAND);
+  const current = readSettings(o.home);
+  const wired = finalWiring === "proxy-always" ? applyProxy(current, { url, token: resolved.token }) : removeProxy(current);
+  const statusLine = applyStatusLine(wired, o.statusLineCommand ?? sledsCommand("statusline", o.home, o.env));
   writeSettings(o.home, statusLine.settings);
-  wrote.push(`set env.ANTHROPIC_BASE_URL and env.ANTHROPIC_AUTH_TOKEN in ${settingsPath(o.home)}`);
+  wrote.push(finalWiring === "proxy-always" ? `set env.ANTHROPIC_BASE_URL and env.ANTHROPIC_AUTH_TOKEN in ${settingsPath(o.home)} (everything through the proxy)` : `left Claude Code on your seat (no ANTHROPIC_BASE_URL in ${settingsPath(o.home)}); \`sleds on\` switches to the proxy at a wall`);
   wrote.push(statusLine.prior === undefined ? `set statusLine in ${settingsPath(o.home)}` : `set statusLine in ${settingsPath(o.home)} (previous one kept for uninstall)`);
   hooks2({
     home: o.home,
-    seatEventCommand: o.seatEventCommand ?? DEFAULT_SEAT_EVENT_COMMAND2,
-    specEventCommand: o.specEventCommand ?? DEFAULT_SPEC_EVENT_COMMAND2,
+    env: o.env,
+    refreshStatusLine: false,
+    seatEventCommand: o.seatEventCommand,
+    specEventCommand: o.specEventCommand,
     log: (line) => wrote.push(line),
     error
   });
@@ -1568,20 +1704,37 @@ var init = async (o) => {
     ...prior,
     token: resolved.token,
     proxyUrl: url,
+    wiring: finalWiring,
+    ...org ? { org } : {},
     ...statusLine.prior !== undefined ? { priorStatusLine: statusLine.prior } : {}
   });
   wrote.push(`saved token and proxy URL to ${configPath(o.home)} (0600)`);
   mkdirSync6(skillDir(o.home), { recursive: true });
   writeFileSync6(skillPath(o.home), SKILL_MD);
   wrote.push(`installed skill at ${skillPath(o.home)}`);
-  log("Claude Code now runs through SLEDS on the org key.");
-  log("");
-  for (const w of wrote)
-    log(`  ${w}`);
-  log("");
-  log(`Every request goes to ${url} and is metered to this seat. Run \`sleds status\` to check.`);
-  log("The status line shows your meter: spend today, seat limits, window, allowance, queued jobs.");
-  log("Prefer to burn your own Pro/Max/Team seat first? `sleds off` puts Claude Code back on it; `sleds on --until-reset +5h` switches to the org key at a wall.");
+  const orgLine = org ? `${org.name} · ${org.plan}${org.capabilities.upstreamKey ? ` · ${org.capabilities.upstreamSource === "own" ? "org key" : "shared key"}` : " · no platform key"}` : "org unknown (proxy did not answer /proxy/meter)";
+  if (finalWiring === "proxy-always") {
+    log(`Claude Code now runs through SLEDS on the org key.  (${orgLine})`);
+    log("");
+    for (const w of wrote)
+      log(`  ${w}`);
+    log("");
+    log(`Every request goes to ${url} and is metered to this seat. Run \`sleds status\` to check.`);
+    log("The status line shows your meter: spend today, seat limits, window, allowance, queued jobs.");
+    log("Prefer your seat first? `sleds init --seat-first` leaves Claude Code on it and switches only at a wall.");
+  } else {
+    log(`SLEDS is watching your seat. Nothing changes until a wall.  (${orgLine})`);
+    log("");
+    for (const w of wrote)
+      log(`  ${w}`);
+    log("");
+    log("Claude Code keeps running on your seat; the status line reports its quota to SLEDS on every turn.");
+    if (org && !org.capabilities.upstreamKey) {
+      log("This org has no platform key, so at a wall the choices are hold until reset or hand off to a teammate. An admin can add a key on the dashboard to unlock continue / overnight / switch.");
+    } else {
+      log("At a wall: `sleds on --until-reset +5h` (or /sled 1) switches to the org key through the proxy until the reset; `sleds off` puts you back.");
+    }
+  }
   return 0;
 };
 
@@ -1941,8 +2094,17 @@ async function handoffsTool(deps) {
   if (handoffs.length === 0)
     return { text: "No open hand-offs on your team. Park one with the handoff tool." };
   const now = (deps.now ?? Date.now)();
-  return { text: handoffLines(handoffs, now).slice(1).join(`
-`) };
+  const packets = handoffs.map((h) => str2(h.packet)).filter((p) => Boolean(p)).join(`
+
+---
+
+`);
+  return {
+    text: [handoffLines(handoffs, now).slice(1).join(`
+`), packets ? `
+${packets}` : ""].join(`
+`)
+  };
 }
 async function handoffTool(deps, args) {
   if (!meterSource(deps.home))
@@ -2261,6 +2423,10 @@ var on = (o) => {
     error("Saved token is not a sled_ token. Run `sleds init --token <sled_…>`.");
     return 2;
   }
+  if (cfg.org && !cfg.org.capabilities.upstreamKey) {
+    error(`${cfg.org.name} has no platform key, so there is no org key to switch to. Hold until the reset, or hand off with /sled 5. An admin can add a key on the dashboard.`);
+    return 2;
+  }
   const url = (o.url ?? cfg.proxyUrl ?? env.SLEDS_PROXY_URL ?? DEFAULT_PROXY_URL2).replace(/\/+$/, "");
   let untilResetMs;
   if (o.untilReset !== undefined) {
@@ -2356,10 +2522,11 @@ var seatEvent = async (o) => {
     if (week && week.resetsAt > now)
       writeSeatState(o.home, { ...state, lastWallResetsAt: week.resetsAt });
   } catch {}
-  log(SEAT_WALL_LINE);
+  const line = seatWallLine(readConfig(o.home).org?.capabilities.upstreamKey !== false);
+  log(line);
   if ((o.platform ?? process.platform) === "darwin" && o.exec) {
     try {
-      o.exec("osascript", osascriptArgs(NOTIFICATION_TITLE, SEAT_WALL_LINE));
+      o.exec("osascript", osascriptArgs(NOTIFICATION_TITLE, line));
     } catch {}
   }
   return 0;
@@ -3056,6 +3223,10 @@ var formatStatus = (s) => {
   }
   if (s.email)
     lines.push(row2("Seat:", s.email));
+  if (s.org)
+    lines.push(row2("Org:", `${s.org.name} · ${s.org.plan} · ${s.org.upstream === "none" ? "no platform key (walls: hold or hand off)" : s.org.upstream === "own" ? "org key" : "shared key"}`));
+  if (s.wiring)
+    lines.push(row2("Wiring:", s.wiring === "seat-first" ? "seat-first — Claude Code on your seat; the proxy only after `sleds on`" : "proxy-always — every request through the proxy"));
   if (s.mode === "off") {
     lines.push(s.pointed ? "Claude Code is pointed at the proxy by settings.json (set by `sleds init`)." : "Claude Code is on your seat. Hit a limit? `sleds on --until-reset +5h`.");
   }
@@ -3087,6 +3258,14 @@ var status = async (o) => {
     info.tokenMasked = maskToken(token);
   if (cfg.email)
     info.email = cfg.email;
+  if (cfg.wiring)
+    info.wiring = cfg.wiring;
+  if (cfg.org)
+    info.org = {
+      name: cfg.org.name,
+      plan: cfg.org.plan,
+      upstream: cfg.org.capabilities.upstreamSource
+    };
   if (cfg.reason)
     info.reason = cfg.reason;
   if (o.tz)
@@ -3243,9 +3422,14 @@ commands:
               --token <sled_\u2026>       seat token (else SLEDS_TOKEN, ~/.sleds-token, or prompt)
               --url <proxy-url>      proxy base URL (else SLEDS_PROXY_URL, default ${DEFAULT_PROXY_URL})
               --no-probe             skip the /healthz check of the proxy URL
+              --seat-first           keep Claude Code on your seat; the proxy only at a wall (default for seat plans)
+              --proxy-always         every request through the proxy on the org key (default for API-plan orgs)
               --non-interactive      never prompt; exit 2 if no token is available
-              --signup               no org? create an individual seat: your email + your own
-                                     Anthropic API key (validated, stored encrypted, the only key it spends)
+              --signup               no org? create one: (1) just you \u2014 your email + your own Anthropic
+                                     API key (validated, stored encrypted, the only key it spends), or
+                                     (2) your team \u2014 work email + team name, platform key optional
+              --team "<name>"        with --signup: create the team org (you become its owner)
+              --email <you@work.com> with --signup: skip the email prompt
   on          Hit a limit on your seat? Switch Claude Code to the org key through the proxy.
               --until-reset <when>   revert at this time: +5h, +90m, or an ISO timestamp
               --reason "<text>"      note shown by \`sleds status\`
@@ -3333,7 +3517,11 @@ var main = async (argv) => {
         url: stringFlag(flags, "url"),
         nonInteractive: flags["non-interactive"] === true,
         signup: flags.signup === true,
+        team: typeof flags.team === "string" ? flags.team : undefined,
+        email: typeof flags.email === "string" ? flags.email : undefined,
         noProbe: flags["no-probe"] === true,
+        proxyAlways: flags["proxy-always"] === true,
+        seatFirst: flags["seat-first"] === true,
         prompt: promptStdin,
         statusLineCommand: statusLineCommand(sledsArgv()),
         seatEventCommand: seatEventCommand(sledsArgv()),
@@ -3384,7 +3572,7 @@ var main = async (argv) => {
     case "version":
     case "--version":
     case "-v":
-      console.log(`sleds ${"0.1.6"}`);
+      console.log(`sleds ${"0.1.11"}`);
       return 0;
     default:
       console.error(`unknown command: ${cmd}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleds/cli",
-  "version": "0.1.6",
+  "version": "0.1.11",
   "description": "SLEDS CLI — the cost and limits of AI agent work, decided at the wall. Point Claude Code at a SLEDS proxy; estimate before you run; hold, switch model, or run overnight when you hit a limit.",
   "license": "UNLICENSED",
   "type": "module",
@@ -24,7 +24,7 @@
     "batch",
     "mcp"
   ],
-  "publishConfig": { "access": "public" },
+  "publishConfig": { "access": "restricted" },
   "scripts": {
     "build": "bun scripts/build.ts",
     "prepack": "bun scripts/build.ts",