mtrx-cli 0.1.22 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mtrx-cli",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "MATRX CLI for routing Codex, Claude, and Cursor through Matrx",
   "homepage": "https://mtrx.so",
   "repository": {
@@ -33,8 +33,11 @@
     "src/matrx/cli/cursor_proxy.py",
     "src/matrx/cli/cursor_reroute.py",
     "src/matrx/cli/cursor_service.py",
+    "src/matrx/cli/bootstrap.py",
+    "src/matrx/cli/gemini_env_bootstrap.cjs",
     "src/matrx/cli/launcher.py",
     "src/matrx/cli/main.py",
+    "src/matrx/cli/project_cmds.py",
     "src/matrx/cli/state.py"
   ],
   "engines": {

package/src/matrx/__init__.py

@@ -1 +1 @@
-__version__ = "0.1.22"
+__version__ = "0.1.24"

package/src/matrx/cli/bootstrap.py

@@ -0,0 +1,119 @@
+"""
+Bootstrap command — warms the system registry for an existing project.
+Called by `mtrx init`.
+"""
+from __future__ import annotations
+
+import json
+import subprocess
+from pathlib import Path
+
+_DEFAULT_SYSTEMS_TEMPLATE = [
+    {
+        "id": "memory",
+        "name": "Memory System",
+        "description": "Memory flywheel: extract, store, retrieve, inject",
+        "file_patterns": ["core/memory.py", "services/memory.py", "core/extractor.py", "core/profile_builder.py"]
+    },
+    {
+        "id": "proxy",
+        "name": "Proxy Service",
+        "description": "Intercepts all LLM calls, applies compression + injection",
+        "file_patterns": ["services/proxy.py", "core/compressor.py", "core/summarizer.py"]
+    },
+    {
+        "id": "auth",
+        "name": "Auth & Multi-Org",
+        "description": "Clerk JWT validation, org/project scoping, API keys",
+        "file_patterns": ["middleware/auth.py", "api/auth.py", "api/orgs.py", "models/org_member.py"]
+    },
+    {
+        "id": "analytics",
+        "name": "Analytics",
+        "description": "Usage snapshots, memory hit rate, token tracking",
+        "file_patterns": ["services/analytics.py", "api/analytics.py"]
+    },
+]
+
+
+def run_init(project_root: str = ".") -> None:
+    """Entry point for `mtrx init`."""
+    root = Path(project_root).resolve()
+    print(f"Matrx init: analyzing {root}")
+
+    # Step 1: Load or create .matrx/systems.json
+    matrx_dir = root / ".matrx"
+    matrx_dir.mkdir(exist_ok=True)
+    systems_path = matrx_dir / "systems.json"
+
+    if not systems_path.exists():
+        _seed_systems_json(root, systems_path)
+        print(f"  Created {systems_path}")
+    else:
+        print(f"  Found existing {systems_path}")
+
+    # Step 2: Analyze git log for hot systems
+    hot_files = _get_hot_files(root, days=30)
+    print(f"  Found {len(hot_files)} recently modified files")
+
+    # Step 3: Map to systems
+    systems = json.loads(systems_path.read_text()).get("systems", [])
+    hot_systems = _rank_systems_by_activity(hot_files, systems)
+
+    if hot_systems:
+        print("\n  Active systems detected:")
+        for sys_id, count, depth in hot_systems:
+            meta = next((s for s in systems if s["id"] == sys_id), None)
+            if meta:
+                print(f"    {meta['name']:<25} {count:>3} touches → {depth} card")
+    else:
+        print("\n  No recently active systems detected (no git history or no matches).")
+
+    print(f"\n  Matrx will generate cards for detected systems on first use.")
+    print(f"  Run your agent — cards will be ready within the first few calls.\n")
+    print("  Done.")
+
+
+def _get_hot_files(root: Path, days: int = 30) -> dict[str, int]:
+    """Parse git log, return file → touch count mapping."""
+    try:
+        result = subprocess.run(
+            ["git", "log", f"--since={days} days ago", "--name-only", "--pretty=format:"],
+            cwd=root, capture_output=True, text=True, timeout=10,
+        )
+        counts: dict[str, int] = {}
+        for line in result.stdout.splitlines():
+            line = line.strip()
+            if line and not line.startswith("commit"):
+                counts[line] = counts.get(line, 0) + 1
+        return counts
+    except Exception:
+        return {}
+
+
+def _rank_systems_by_activity(
+    hot_files: dict[str, int], systems: list[dict]
+) -> list[tuple[str, int, str]]:
+    """Return [(system_id, touch_count, depth)] sorted by activity."""
+    ranked = []
+    for s in systems:
+        patterns = s.get("file_patterns", [])
+        total = sum(
+            count for f, count in hot_files.items()
+            if any(pat in f or f.endswith(pat) for pat in patterns)
+        )
+        if total > 0:
+            ranked.append((s["id"], total, "standard"))
+
+    ranked.sort(key=lambda x: x[1], reverse=True)
+    # Re-assign depths by rank
+    result = []
+    for i, (sid, count, _) in enumerate(ranked):
+        depth = "full" if i < 3 else ("standard" if i < 8 else "distilled")
+        result.append((sid, count, depth))
+    return result
+
+
+def _seed_systems_json(root: Path, out_path: Path) -> None:
+    """Write default systems.json. Users can hand-edit afterward."""
+    out_path.write_text(json.dumps({"systems": _DEFAULT_SYSTEMS_TEMPLATE}, indent=2))

package/src/matrx/cli/gemini_env_bootstrap.cjs

@@ -0,0 +1,34 @@
+"use strict";
+
+function decodeBase64Env(name) {
+  const value = process.env[name];
+  if (!value) {
+    return undefined;
+  }
+  try {
+    return Buffer.from(value, "base64").toString("utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+const envMappings = [
+  ["MTRX_GEMINI_CUSTOM_HEADERS_B64", "GEMINI_CLI_CUSTOM_HEADERS"],
+  ["MTRX_CODE_ASSIST_ENDPOINT_B64", "CODE_ASSIST_ENDPOINT"],
+  ["MTRX_GEMINI_API_ENDPOINT_B64", "GEMINI_API_ENDPOINT"],
+];
+
+for (const [sourceName, targetName] of envMappings) {
+  const decoded = decodeBase64Env(sourceName);
+  if (decoded && !process.env[targetName]) {
+    process.env[targetName] = decoded;
+  }
+}
+
+if (
+  process.env.MTRX_GEMINI_API_KEY_AUTH_MECHANISM &&
+  !process.env.GEMINI_API_KEY_AUTH_MECHANISM
+) {
+  process.env.GEMINI_API_KEY_AUTH_MECHANISM =
+    process.env.MTRX_GEMINI_API_KEY_AUTH_MECHANISM;
+}

package/src/matrx/cli/launcher.py

@@ -64,6 +64,10 @@ MATRX_ENV_KEYS = {
     "ANTHROPIC_CUSTOM_HEADERS",
 }
 
+# Avoid routing Codex/Claude/Gemini through Cursor's MITM proxy when running
+# from Cursor's integrated terminal. These tools should talk directly to MATRX.
+_PROXY_ENV_KEYS = ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy")
+
 MTRX_CODEX_BLOCK_START = "# >>> mtrx managed codex route >>>"
 MTRX_CODEX_BLOCK_END = "# <<< mtrx managed codex route <<<"
 VALID_ROUTES = {"direct", "matrx"}
@@ -91,6 +95,46 @@ def _runtime_agent_basename(tool: str) -> tuple[str, str, list[str], str]:
     return normalized, f"{tool.capitalize()} CLI", ["cli", tool], tool
 
 
+def _append_sandbox_env(env: dict[str, str], key: str, value: str | None) -> None:
+    if not value:
+        return
+    entry = f"{key}={value}"
+    existing = [item.strip() for item in (env.get("SANDBOX_ENV") or "").split(",") if item.strip()]
+    filtered = [item for item in existing if not item.startswith(f"{key}=")]
+    filtered.append(entry)
+    env["SANDBOX_ENV"] = ",".join(filtered)
+
+
+def _remove_sandbox_env_keys(env: dict[str, str], keys: tuple[str, ...]) -> None:
+    existing = [item.strip() for item in (env.get("SANDBOX_ENV") or "").split(",") if item.strip()]
+    filtered = [
+        item for item in existing
+        if not any(item.startswith(f"{key}=") for key in keys)
+    ]
+    if filtered:
+        env["SANDBOX_ENV"] = ",".join(filtered)
+    else:
+        env.pop("SANDBOX_ENV", None)
+
+
+def _ensure_node_require(env: dict[str, str], script_path: str) -> None:
+    require_flag = f"--require={script_path}"
+    existing = (env.get("NODE_OPTIONS") or "").strip()
+    if require_flag in existing.split():
+        return
+    env["NODE_OPTIONS"] = f"{existing} {require_flag}".strip()
+
+
+def _remove_node_require(env: dict[str, str], script_path: str) -> None:
+    require_flag = f"--require={script_path}"
+    existing = (env.get("NODE_OPTIONS") or "").split()
+    filtered = [part for part in existing if part != require_flag]
+    if filtered:
+        env["NODE_OPTIONS"] = " ".join(filtered)
+    else:
+        env.pop("NODE_OPTIONS", None)
+
+
 def configured_route(state: dict, tool: str) -> str | None:
     route = state.get("defaults", {}).get(tool)
     if route in VALID_ROUTES:
@@ -463,6 +507,20 @@ def _capture_git_context(cwd: str | None = None) -> tuple[str, str]:
     return branch, commit
 
 
+def _capture_git_remote_url(cwd: str | None = None) -> str:
+    root = cwd or os.getcwd()
+    try:
+        r = subprocess.run(
+            ["git", "-C", root, "remote", "get-url", "origin"],
+            capture_output=True, text=True, timeout=2, check=False,
+        )
+        if r.returncode == 0:
+            return r.stdout.strip()
+    except (OSError, subprocess.SubprocessError):
+        pass
+    return ""
+
+
 def _resolve_matrx_context_overrides(
     state: dict,
     env: dict[str, str],
@@ -511,6 +569,8 @@ def _build_codex_env(
     if route == "matrx":
         if not mx_key:
             raise ValueError("No Matrx key available. Run: mtrx login matrx --key mx_... or set MTRX_KEY")
+        for key in _PROXY_ENV_KEYS:
+            env.pop(key, None)
         provider_bearer = env_openai_key or direct_key or read_codex_access_token()
         if not provider_bearer:
             raise ValueError(
@@ -538,10 +598,13 @@ def _build_codex_env(
         if project_id:
             header_parts.append(f'"X-Matrx-Project-Id" = "{project_id}"')
         _git_branch, _git_commit = _capture_git_context(_workspace_cwd(env))
+        _git_repo_url = _capture_git_remote_url(_workspace_cwd(env))
         if _git_branch:
             header_parts.append(f'"X-Matrx-Branch" = "{_git_branch}"')
         if _git_commit:
             header_parts.append(f'"X-Matrx-Commit" = "{_git_commit}"')
+        if _git_repo_url:
+            header_parts.append(f'"X-Matrx-Repo-Url" = "{_git_repo_url}"')
         if env_b64:
             header_parts.append(f'"X-Matrx-Env" = "{env_b64}"')
         headers_str = ", ".join(header_parts)
@@ -583,10 +646,13 @@ def _build_gemini_env(
     proxy_base = ensure_v1_url(matrx.get("base_url"))
     mx_key, matrx_auth_source = _resolve_matrx_route_key(state, env)
     direct_key = (env.get("GEMINI_API_KEY") or env.get("GOOGLE_API_KEY") or "").strip()
+    bootstrap_script = str(Path(__file__).with_name("gemini_env_bootstrap.cjs").resolve())
 
     if route == "matrx":
         if not mx_key:
             raise ValueError("No Matrx key available. Run: mtrx login matrx --key mx_... or set MTRX_KEY")
+        for key in _PROXY_ENV_KEYS:
+            env.pop(key, None)
         env.pop("MTRX_KEY", None)
         group_id, project_id = _resolve_matrx_context_overrides(state, env)
         session_id = str(uuid.uuid4())
@@ -602,6 +668,7 @@ def _build_gemini_env(
         if runtime_agent_id:
             ctx_params.append(f"mtrx_agent={runtime_agent_id}")
         git_branch, git_commit = _capture_git_context(_workspace_cwd(env))
+        git_repo_url = _capture_git_remote_url(_workspace_cwd(env))
         if git_branch:
             ctx_params.append(f"mtrx_branch={git_branch}")
         if git_commit:
@@ -624,6 +691,8 @@ def _build_gemini_env(
             custom_headers.append(f"x-matrx-branch: {git_branch}")
         if git_commit:
             custom_headers.append(f"x-matrx-commit: {git_commit}")
+        if git_repo_url:
+            custom_headers.append(f"x-matrx-repo-url: {git_repo_url}")
         if env_b64:
             custom_headers.append(f"x-matrx-env: {env_b64}")
 
@@ -633,6 +702,27 @@ def _build_gemini_env(
         env["CODE_ASSIST_ENDPOINT"] = proxy_base
         env["GEMINI_CLI_CUSTOM_HEADERS"] = ", ".join(custom_headers)
         env["GEMINI_API_KEY_AUTH_MECHANISM"] = "bearer"
+        _ensure_node_require(env, bootstrap_script)
+        _append_sandbox_env(
+            env,
+            "MTRX_GEMINI_CUSTOM_HEADERS_B64",
+            base64.b64encode(env["GEMINI_CLI_CUSTOM_HEADERS"].encode("utf-8")).decode("ascii"),
+        )
+        _append_sandbox_env(
+            env,
+            "MTRX_CODE_ASSIST_ENDPOINT_B64",
+            base64.b64encode(env["CODE_ASSIST_ENDPOINT"].encode("utf-8")).decode("ascii"),
+        )
+        _append_sandbox_env(
+            env,
+            "MTRX_GEMINI_API_ENDPOINT_B64",
+            base64.b64encode(env["GEMINI_API_ENDPOINT"].encode("utf-8")).decode("ascii"),
+        )
+        _append_sandbox_env(
+            env,
+            "MTRX_GEMINI_API_KEY_AUTH_MECHANISM",
+            env["GEMINI_API_KEY_AUTH_MECHANISM"],
+        )
 
         return env, matrx_auth_source
 
@@ -647,6 +737,16 @@ def _build_gemini_env(
         value = (env.get(key) or "").strip()
         if "matrx" in value.lower() or "mtrx.so" in value.lower():
             env.pop(key, None)
+    _remove_node_require(env, bootstrap_script)
+    _remove_sandbox_env_keys(
+        env,
+        (
+            "MTRX_GEMINI_CUSTOM_HEADERS_B64",
+            "MTRX_CODE_ASSIST_ENDPOINT_B64",
+            "MTRX_GEMINI_API_ENDPOINT_B64",
+            "MTRX_GEMINI_API_KEY_AUTH_MECHANISM",
+        ),
+    )
 
     custom_headers = (env.get("GEMINI_CLI_CUSTOM_HEADERS") or "").strip().lower()
     if "x-matrx-" in custom_headers:
@@ -680,6 +780,8 @@ def _build_claude_env(
     if route == "matrx":
         if not mx_key:
             raise ValueError("No Matrx key available. Run: mtrx login matrx --key mx_... or set MTRX_KEY")
+        for key in _PROXY_ENV_KEYS:
+            env.pop(key, None)
         env.pop("MTRX_KEY", None)
         env.pop("MATRX_CLAUDE_MODE", None)
         env["MATRX_BASE_URL"] = proxy_root
@@ -708,10 +810,13 @@ def _build_claude_env(
         if project_id:
             custom_headers += f"\nx-matrx-project-id: {project_id}"
         _git_branch, _git_commit = _capture_git_context(_workspace_cwd(env))
+        _git_repo_url = _capture_git_remote_url(_workspace_cwd(env))
         if _git_branch:
             custom_headers += f"\nx-matrx-branch: {_git_branch}"
         if _git_commit:
             custom_headers += f"\nx-matrx-commit: {_git_commit}"
+        if _git_repo_url:
+            custom_headers += f"\nx-matrx-repo-url: {_git_repo_url}"
         if env_b64:
             custom_headers += f"\nx-matrx-env: {env_b64}"
         env["ANTHROPIC_CUSTOM_HEADERS"] = custom_headers
@@ -963,6 +1068,12 @@ def _validate_gemini_launch_plan(plan: LaunchPlan, state: dict) -> None:
     if "x-matrx-agent-id:" not in custom_headers:
         raise ValueError("Gemini Matrx route is missing GEMINI_CLI_CUSTOM_HEADERS with X-Matrx-Agent-Id")
 
+    sandbox_env = (plan.env.get("SANDBOX_ENV") or "").strip()
+    if "MTRX_GEMINI_CUSTOM_HEADERS_B64=" not in sandbox_env:
+        raise ValueError("Gemini Matrx route is missing sandbox bootstrap for GEMINI_CLI_CUSTOM_HEADERS")
+    if "MTRX_CODE_ASSIST_ENDPOINT_B64=" not in sandbox_env:
+        raise ValueError("Gemini Matrx route is missing sandbox bootstrap for CODE_ASSIST_ENDPOINT")
+
 
 def _validate_codex_launch_plan(plan: LaunchPlan, state: dict) -> None:
     if plan.route != "matrx":

package/src/matrx/cli/main.py

@@ -144,7 +144,7 @@ def _build_parser() -> argparse.ArgumentParser:
     cursor.add_argument(
         "--launch",
         action="store_true",
-        help="Launch Cursor with proxy env (required for traffic to flow)",
+        help="Launch Cursor after applying the current Matrx settings",
     )
 
     return parser
@@ -932,6 +932,7 @@ def _cmd_launch(tool: str, route: str | None, remainder: list[str]) -> int:
 
 def _cmd_cursor(args) -> int:
     from matrx.cli.cursor_hooks import install_mtrx_hooks, is_mtrx_hooks_installed
+    from matrx.cli.cursor_service import is_proxy_running
     from matrx.cli.cursor_launcher import find_cursor_executable
 
     route = args.route
@@ -942,10 +943,13 @@ def _cmd_cursor(args) -> int:
         hooks_installed = is_mtrx_hooks_installed()
         base_url = ensure_v1_url(state.get("auth", {}).get("matrx", {}).get("base_url"))
         prev_path = config_dir() / "cursor-previous-settings.json"
+        legacy_proxy_prev_path = config_dir() / "cursor-proxy-previous-settings.json"
         configured = prev_path.exists()
+        legacy_proxy_active = is_proxy_running() or legacy_proxy_prev_path.exists()
         print("MTRX Cursor integration:")
         print(f"  mode: {'Base URL override (all models)' if configured else 'not configured'}")
         print(f"  hooks: {'active (sessionEnd, stop → telemetry)' if hooks_installed else 'not installed'}")
+        print(f"  legacy MITM proxy: {'active' if legacy_proxy_active else 'not active'}")
         if configured:
             print(f"  matrx: {base_url}")
         return 0
@@ -1001,6 +1005,11 @@ def _cmd_cursor(args) -> int:
             "Use `mtrx use cursor direct` to opt out.",
         )
 
+    # Ensure legacy MITM routing is fully torn down before enabling the
+    # current Cursor base-URL override flow. Leaving both active causes
+    # Cursor traffic to keep flowing through the old telemetry proxy.
+    _restore_cursor_if_needed()
+
     # Configure Cursor's Override Base URL — sends chat to MTRX (any model: Claude, GPT-5, Gemini, etc.)
     prev_path = config_dir() / "cursor-previous-settings.json"
     previous = configure_cursor_for_proxy(matrx_proxy_url, mx_key)

package/src/matrx/cli/project_cmds.py

@@ -0,0 +1,526 @@
+"""
+CLI commands for managing Matrx projects.
+
+mtrx project list         — list all projects in your org
+mtrx project current      — show which project is active in this workspace
+mtrx project switch <name>— bind this workspace to a project
+mtrx project create <name>— create a new project and optionally bind workspace
+mtrx project init         — interactive: link this git repo to a Matrx project
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import httpx
+
+from matrx.cli.state import (
+    ensure_root_url,
+    get_workspace_binding,
+    normalize_matrx_key,
+    resolve_workspace_root,
+    set_workspace_binding,
+    load_state,
+    save_state,
+)
+
+
+# ---------------------------------------------------------------------------
+# Internal API helper
+# ---------------------------------------------------------------------------
+
+def _api(
+    state: dict,
+    *,
+    method: str,
+    path: str,
+    key: str,
+    json_body: dict | None = None,
+) -> dict:
+    base_url = ensure_root_url(state.get("auth", {}).get("matrx", {}).get("base_url"))
+    url = f"{base_url.rstrip('/')}/v1{path}"
+    headers: dict[str, str] = {"X-Matrx-Key": key}
+    if json_body is not None:
+        headers["Content-Type"] = "application/json"
+    try:
+        with httpx.Client(timeout=15) as client:
+            response = client.request(method, url, headers=headers, json=json_body)
+    except httpx.HTTPError as exc:
+        raise ValueError(f"Matrx API request failed: {exc}") from exc
+    if response.status_code >= 400:
+        detail = response.text.strip() or response.reason_phrase
+        raise ValueError(f"Matrx API error ({response.status_code}) for {path}: {detail}")
+    if response.status_code == 204 or not response.content:
+        return {}
+    return response.json()
+
+
+def _resolve_key(state: dict) -> str:
+    env_key = normalize_matrx_key(os.environ.get("MTRX_KEY"))
+    if env_key:
+        return env_key
+    binding = get_workspace_binding(state, cwd=os.getcwd()) or {}
+    binding_key = normalize_matrx_key(binding.get("matrx_key"))
+    if binding_key:
+        return binding_key
+    saved = normalize_matrx_key(state.get("auth", {}).get("matrx", {}).get("key"))
+    return saved
+
+
+def _require_key(state: dict) -> str:
+    key = _resolve_key(state)
+    if not key:
+        raise ValueError("No Matrx key found. Run: mtrx login matrx --key mx_...")
+    return key
+
+
+# ---------------------------------------------------------------------------
+# project list
+# ---------------------------------------------------------------------------
+
+def cmd_list(args) -> int:
+    state = load_state()
+    try:
+        key = _require_key(state)
+        ctx = _api(state, method="GET", path="/auth/context", key=key)
+        org_id = (ctx.get("org_id") or "").strip()
+        if not org_id:
+            print("Could not determine org_id from auth context.", file=sys.stderr)
+            return 1
+        projects = _api(state, method="GET", path=f"/orgs/{org_id}/projects", key=key)
+    except ValueError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    items = projects if isinstance(projects, list) else projects.get("projects", [])
+    if not items:
+        print("No projects found. Create one with: mtrx project create <name>")
+        return 0
+
+    # Determine which project is active for this workspace
+    binding = get_workspace_binding(state, cwd=os.getcwd()) or {}
+    active_project_id = (
+        os.environ.get("MTRX_PROJECT_ID")
+        or binding.get("project_id")
+        or ""
+    ).strip()
+
+    print(f"{'  ':2}{'NAME':<30} {'SLUG':<25} {'ID'}")
+    print("-" * 80)
+    for p in items:
+        pid = p.get("id", "")
+        name = p.get("name", "")
+        slug = p.get("slug", "")
+        marker = "* " if pid == active_project_id else "  "
+        default_tag = " [default]" if p.get("is_default") else ""
+        print(f"{marker}{name:<30} {slug:<25} {pid}{default_tag}")
+
+    if active_project_id:
+        print(f"\n* = active project for this workspace")
+    else:
+        print("\nNo project bound to this workspace. Run: mtrx project switch <name>")
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# project current
+# ---------------------------------------------------------------------------
+
+def cmd_current(args) -> int:
+    state = load_state()
+    binding = get_workspace_binding(state, cwd=os.getcwd()) or {}
+    workspace_root = resolve_workspace_root(os.getcwd())
+
+    env_project_id = (os.environ.get("MTRX_PROJECT_ID") or "").strip()
+    env_group_id = (os.environ.get("MTRX_GROUP_ID") or "").strip()
+    binding_project_id = (binding.get("project_id") or "").strip()
+    binding_group_id = (binding.get("group_id") or "").strip()
+
+    print(f"Workspace: {workspace_root}")
+
+    # Try to fetch project name from API
+    active_project_id = env_project_id or binding_project_id
+    if active_project_id:
+        try:
+            key = _require_key(state)
+            ctx = _api(state, method="GET", path="/auth/context", key=key)
+            org_id = (ctx.get("org_id") or "").strip()
+            if org_id:
+                projects = _api(state, method="GET", path=f"/orgs/{org_id}/projects", key=key)
+                items = projects if isinstance(projects, list) else projects.get("projects", [])
+                match = next((p for p in items if p.get("id") == active_project_id), None)
+                if match:
+                    source = "env var" if env_project_id else "workspace binding"
+                    print(f"Active project: {match['name']} ({match['slug']}) [{source}]")
+                    print(f"  project_id: {active_project_id}")
+                    if active_project_id == env_project_id:
+                        print(f"  override: MTRX_PROJECT_ID env var takes priority")
+                    if env_group_id or binding_group_id:
+                        print(f"  group_id: {env_group_id or binding_group_id}")
+                    return 0
+        except ValueError:
+            pass
+
+        source = "env var" if env_project_id else "workspace binding"
+        print(f"Active project: {active_project_id} [{source}] (could not fetch name)")
+    else:
+        print("No project bound to this workspace.")
+        print("  Run: mtrx project switch <name>  to bind a project")
+        print("  Run: mtrx project list           to see available projects")
+
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# project switch
+# ---------------------------------------------------------------------------
+
+def cmd_switch(args) -> int:
+    name_or_slug = (getattr(args, "name", "") or "").strip()
+    if not name_or_slug:
+        print("Usage: mtrx project switch <name-or-slug>", file=sys.stderr)
+        return 1
+
+    state = load_state()
+    try:
+        key = _require_key(state)
+        ctx = _api(state, method="GET", path="/auth/context", key=key)
+        org_id = (ctx.get("org_id") or "").strip()
+        if not org_id:
+            print("Could not determine org_id from auth context.", file=sys.stderr)
+            return 1
+        projects = _api(state, method="GET", path=f"/orgs/{org_id}/projects", key=key)
+    except ValueError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    items = projects if isinstance(projects, list) else projects.get("projects", [])
+    needle = name_or_slug.lower()
+    match = next(
+        (
+            p for p in items
+            if p.get("name", "").lower() == needle
+            or p.get("slug", "").lower() == needle
+            or p.get("id", "").lower() == needle
+        ),
+        None,
+    )
+    if match is None:
+        print(f"Project '{name_or_slug}' not found.", file=sys.stderr)
+        print(f"Available: {', '.join(p.get('slug') or p.get('name', '') for p in items)}", file=sys.stderr)
+        return 1
+
+    changed = set_workspace_binding(state, cwd=os.getcwd(), project_id=match["id"])
+    if changed:
+        save_state(state)
+
+    workspace_root = resolve_workspace_root(os.getcwd())
+    print(f"Switched to project: {match['name']} ({match['slug']})")
+    print(f"  project_id: {match['id']}")
+    if match.get("repo_url"):
+        print(f"  repo_url:   {match['repo_url']}")
+    print(f"  workspace:  {workspace_root}")
+    print(f"  This workspace will now route all LLM calls to this project.")
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# project create
+# ---------------------------------------------------------------------------
+
+def cmd_create(args) -> int:
+    name = (getattr(args, "name", "") or "").strip()
+    if not name:
+        print("Usage: mtrx project create <name> [--description TEXT]", file=sys.stderr)
+        return 1
+    description = (getattr(args, "description", "") or "").strip() or None
+
+    state = load_state()
+    try:
+        key = _require_key(state)
+        ctx = _api(state, method="GET", path="/auth/context", key=key)
+        org_id = (ctx.get("org_id") or "").strip()
+        if not org_id:
+            print("Could not determine org_id from auth context.", file=sys.stderr)
+            return 1
+
+        body: dict = {"name": name}
+        if description:
+            body["description"] = description
+
+        project = _api(
+            state,
+            method="POST",
+            path=f"/orgs/{org_id}/projects",
+            key=key,
+            json_body=body,
+        )
+    except ValueError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    print(f"Created project: {project.get('name')} ({project.get('slug')})")
+    print(f"  project_id: {project.get('id')}")
+
+    # Ask if they want to bind this workspace
+    if sys.stdin.isatty() and sys.stdout.isatty():
+        answer = input("Bind this workspace to the new project? [Y/n] ").strip().lower()
+        if answer in {"", "y", "yes"}:
+            changed = set_workspace_binding(state, cwd=os.getcwd(), project_id=project["id"])
+            if changed:
+                save_state(state)
+            print(f"  Workspace bound to: {project.get('name')}")
+    else:
+        # Non-interactive: auto-bind
+        changed = set_workspace_binding(state, cwd=os.getcwd(), project_id=project["id"])
+        if changed:
+            save_state(state)
+        print(f"  Workspace auto-bound to: {project.get('name')}")
+
+    return 0
+
+
+# ---------------------------------------------------------------------------
+# project init
+# ---------------------------------------------------------------------------
+
+def _git_remote_url() -> str | None:
+    try:
+        result = subprocess.run(
+            ["git", "remote", "get-url", "origin"],
+            capture_output=True,
+            text=True,
+            timeout=3,
+            check=False,
+        )
+        if result.returncode == 0:
+            return result.stdout.strip() or None
+    except (OSError, subprocess.SubprocessError):
+        pass
+    return None
+
+
+def _git_current_branch() -> str | None:
+    try:
+        result = subprocess.run(
+            ["git", "branch", "--show-current"],
+            capture_output=True,
+            text=True,
+            timeout=3,
+            check=False,
+        )
+        if result.returncode == 0:
+            return result.stdout.strip() or None
+    except (OSError, subprocess.SubprocessError):
+        pass
+    return None
+
+
+def _is_interactive() -> bool:
+    return sys.stdin.isatty() and sys.stdout.isatty()
+
+
+def _prompt(prompt: str, default: str = "") -> str:
+    if not _is_interactive():
+        return default
+    result = input(prompt).strip()
+    return result or default
+
+
+def _patch_project_repo_metadata(
+    state: dict,
+    *,
+    key: str,
+    org_id: str,
+    project: dict,
+    repo_url: str | None,
+    branch: str | None,
+) -> None:
+    if not repo_url or not project.get("id"):
+        return
+    try:
+        _api(
+            state,
+            method="PATCH",
+            path=f"/orgs/{org_id}/projects/{project['id']}",
+            key=key,
+            json_body={
+                "repo_url": repo_url,
+                "default_branch": branch or "main",
+            },
+        )
+    except ValueError:
+        pass
+
+
+def cmd_init(args) -> int:
+    state = load_state()
+    try:
+        key = _require_key(state)
+    except ValueError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    workspace_root = resolve_workspace_root(os.getcwd())
+    repo_url = _git_remote_url()
+    branch = _git_current_branch()
+
+    print(f"Matrx project init")
+    print(f"  workspace: {workspace_root}")
+    if repo_url:
+        print(f"  git remote: {repo_url}")
+    if branch:
+        print(f"  branch: {branch}")
+    print()
+
+    # Check if already bound
+    binding = get_workspace_binding(state, cwd=os.getcwd()) or {}
+    existing_project_id = (binding.get("project_id") or "").strip()
+    if existing_project_id:
+        print(f"This workspace is already bound to project: {existing_project_id}")
+        if _is_interactive():
+            answer = _prompt("Rebind to a different project? [y/N] ", "n")
+            if answer.lower() not in {"y", "yes"}:
+                print("No changes made.")
+                return 0
+
+    try:
+        ctx = _api(state, method="GET", path="/auth/context", key=key)
+        org_id = (ctx.get("org_id") or "").strip()
+        if not org_id:
+            print("Could not determine org_id from auth context.", file=sys.stderr)
+            return 1
+        projects = _api(state, method="GET", path=f"/orgs/{org_id}/projects", key=key)
+    except ValueError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    items = projects if isinstance(projects, list) else projects.get("projects", [])
+
+    if not items:
+        print("No projects found in your org.")
+        if _is_interactive():
+            answer = _prompt("Create a new project now? [Y/n] ", "y")
+            if answer.lower() in {"", "y", "yes"}:
+                return _create_and_bind(state, key, org_id, workspace_root, repo_url, branch)
+        return 1
+
+    # Show existing projects
+    print("Available projects:")
+    for i, p in enumerate(items, 1):
+        default_tag = " [default]" if p.get("is_default") else ""
+        print(f"  {i}. {p.get('name')} ({p.get('slug')}){default_tag}")
+    print(f"  {len(items) + 1}. Create a new project")
+    print()
+
+    if not _is_interactive():
+        # Non-interactive: bind to default project
+        default_proj = next((p for p in items if p.get("is_default")), items[0])
+        changed = set_workspace_binding(state, cwd=os.getcwd(), project_id=default_proj["id"])
+        if changed:
+            save_state(state)
+        _patch_project_repo_metadata(
+            state,
+            key=key,
+            org_id=org_id,
+            project=default_proj,
+            repo_url=repo_url,
+            branch=branch,
+        )
+        print(f"Bound to default project: {default_proj['name']}")
+        return 0
+
+    choice_str = _prompt(f"Select project [1-{len(items) + 1}]: ", "1")
+    try:
+        choice = int(choice_str)
+    except ValueError:
+        print("Invalid selection.", file=sys.stderr)
+        return 1
+
+    if choice == len(items) + 1:
+        return _create_and_bind(state, key, org_id, workspace_root, repo_url, branch)
+
+    if not (1 <= choice <= len(items)):
+        print("Invalid selection.", file=sys.stderr)
+        return 1
+
+    selected = items[choice - 1]
+    changed = set_workspace_binding(state, cwd=os.getcwd(), project_id=selected["id"])
+    if changed:
+        save_state(state)
+    _patch_project_repo_metadata(
+        state,
+        key=key,
+        org_id=org_id,
+        project=selected,
+        repo_url=repo_url,
+        branch=branch,
+    )
+
+    print(f"\nBound workspace to project: {selected['name']} ({selected['slug']})")
+    print(f"  project_id: {selected['id']}")
+    print(f"  workspace:  {workspace_root}")
+    print(f"\nAll LLM calls from this directory will now route to this project.")
+    return 0
+
+
+def _create_and_bind(
+    state: dict,
+    key: str,
+    org_id: str,
+    workspace_root: str,
+    repo_url: str | None,
+    branch: str | None,
+) -> int:
+    repo_name = None
+    if repo_url:
+        # Derive a default name from the repo URL (e.g. github.com/org/my-repo -> my-repo)
+        repo_name = repo_url.rstrip("/").split("/")[-1]
+        if repo_name.endswith(".git"):
+            repo_name = repo_name[:-4]
+
+    default_name = repo_name or Path(workspace_root).name
+    if _is_interactive():
+        name = _prompt(f"Project name [{default_name}]: ", default_name)
+        description = _prompt("Description (optional): ", "")
+    else:
+        name = default_name
+        description = ""
+
+    name = name.strip() or default_name
+    body: dict = {"name": name}
+    if description.strip():
+        body["description"] = description.strip()
+
+    try:
+        project = _api(
+            state,
+            method="POST",
+            path=f"/orgs/{org_id}/projects",
+            key=key,
+            json_body=body,
+        )
+    except ValueError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    changed = set_workspace_binding(state, cwd=os.getcwd(), project_id=project["id"])
+    if changed:
+        save_state(state)
+    _patch_project_repo_metadata(
+        state,
+        key=key,
+        org_id=org_id,
+        project=project,
+        repo_url=repo_url,
+        branch=branch,
+    )
+
+    print(f"\nCreated and bound project: {project.get('name')} ({project.get('slug')})")
+    print(f"  project_id: {project.get('id')}")
+    print(f"  workspace:  {workspace_root}")
+    print(f"\nAll LLM calls from this directory will now route to this project.")
+    return 0