nexarch 0.12.6 → 0.12.8

package/dist/commands/ingest-infra.js

@@ -0,0 +1,319 @@
+import { readFileSync, existsSync, readdirSync } from "fs";
+import { execFileSync } from "child_process";
+import { resolve } from "path";
+import { callMcpTool } from "../lib/mcp.js";
+import { parseTerraformStateBuffer, projectTerraformState, inferEnvironmentFromTags, environmentSubtypeFor, } from "../lib/terraform-projection.js";
+import { TERRAFORM_CATALOGUE_SEED } from "../lib/terraform-catalogue-seed.js";
+import { discoverRootModules, environmentFromPath } from "../lib/terraform-detect.js";
+const ENTITY_BATCH = 50;
+function readResult(raw) {
+    return JSON.parse(raw.content?.[0]?.text ?? "{}");
+}
+function slug(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 80);
+}
+function parseArgs(args) {
+    const get = (flag) => {
+        const index = args.indexOf(flag);
+        return index >= 0 && args[index + 1] ? args[index + 1] : null;
+    };
+    return {
+        statePath: get("--state"),
+        environmentOverride: get("--environment"),
+        dir: get("--dir") ?? process.cwd(),
+        projectRef: get("--project-ref"),
+        dryRun: args.includes("--dry-run"),
+        asJson: args.includes("--json"),
+    };
+}
+/**
+ * Chooses which root module to read.
+ *
+ * A repository routinely holds a root module per environment plus separate
+ * stacks for shared services, so the working directory is frequently not a root
+ * module at all. When it isn't, discovery decides: one candidate is used, and
+ * several are reported with the exact command for each — the caller is usually
+ * an agent, and an agent can act on a list of commands but not on a request to
+ * choose.
+ */
+function resolveRootModule(dir) {
+    const hasLocalTerraform = existsSync(dir) && readdirSync(dir).some((entry) => entry.endsWith(".tf"));
+    if (hasLocalTerraform)
+        return { dir, note: null };
+    const roots = discoverRootModules(dir);
+    if (roots.length === 1) {
+        return { dir: roots[0].dir, note: `no Terraform in the working directory; using the only root module found, ${roots[0].relative}` };
+    }
+    if (roots.length > 1) {
+        // Annotations go on their own line: the caller is usually an agent, and a
+        // command line with a parenthetical glued to it is not runnable as copied.
+        const lines = roots.flatMap((root) => {
+            const notes = [
+                root.environmentHint ? `${root.environmentHint} environment` : "shared stack",
+                root.initialised ? "initialised" : "run `terraform init` here first",
+            ].join(", ");
+            return [`    # ${root.relative} — ${notes}`, `    nexarch ingest-infra --dir ${root.relative}`];
+        });
+        throw new Error([
+            `This repository has ${roots.length} root modules, each with its own state.`,
+            `  Every root module is a separate estate, so ingest them one at a time:`,
+            ...lines,
+        ].join("\n"));
+    }
+    throw new Error([
+        `No Terraform root module found at or below ${dir}.`,
+        `  Run this inside the repository that provisions the estate, or pass --dir <path> or --state <file>.`,
+    ].join("\n"));
+}
+/** Reads state from a file, or asks Terraform for it when running inside the repo. */
+function loadState(statePath, dir) {
+    if (statePath) {
+        const full = resolve(statePath);
+        if (!existsSync(full))
+            throw new Error(`State file not found: ${full}`);
+        return { document: parseTerraformStateBuffer(readFileSync(full)), source: full };
+    }
+    try {
+        const stdout = execFileSync("terraform", ["show", "-json"], {
+            cwd: dir,
+            maxBuffer: 256 * 1024 * 1024,
+            encoding: "buffer",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return { document: parseTerraformStateBuffer(stdout), source: "terraform show -json" };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not read Terraform state. Run inside the infrastructure repo with terraform available, or pass --state <file>.\n  ${detail.split("\n")[0]}`);
+    }
+}
+function resolveEnvironment(projection, override, dir, rootModuleDir) {
+    if (override)
+        return { environment: override.trim().toLowerCase(), how: "--environment flag" };
+    // A root module living in environments/prod states which estate is being read
+    // more plainly than anything inside the state, and it is available whether or
+    // not anyone remembered to tag.
+    const fromPath = rootModuleDir ? environmentFromPath(rootModuleDir) : null;
+    if (fromPath)
+        return { environment: fromPath, how: "root module path" };
+    const inferred = inferEnvironmentFromTags(projection.resources);
+    if (inferred && inferred.confidence >= 0.6) {
+        return { environment: inferred.environment, how: `inferred from resource tags (${Math.round(inferred.confidence * 100)}% agreement)` };
+    }
+    try {
+        const workspace = execFileSync("terraform", ["workspace", "show"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        if (workspace && workspace !== "default")
+            return { environment: workspace.toLowerCase(), how: "terraform workspace" };
+    }
+    catch {
+        // Terraform not available; fall through to the error below.
+    }
+    // Say what was actually seen. A pipeline failure that only restates the
+    // options costs an hour; one that reports the evidence costs a minute.
+    const tagged = projection.resources.filter((r) => Object.keys(r.tags).length > 0).length;
+    const detail = [
+        `read ${projection.stats.resourcesSeen} resources from state`,
+        `${projection.stats.resourcesProjected} matched the catalogue`,
+        `${tagged} of those carried any tags`,
+    ];
+    if (inferred)
+        detail.push(`environment tags disagreed (strongest: "${inferred.environment}" at ${Math.round(inferred.confidence * 100)}%)`);
+    else if (projection.stats.resourcesProjected > 0)
+        detail.push("none carried an environment or env tag");
+    throw new Error(`Could not determine the environment — ${detail.join("; ")}.\n` +
+        `  Fix by tagging resources with \`environment\`, selecting a named Terraform workspace, or passing --environment <name>.`);
+}
+/** Builds the entity and relationship payloads for the existing upsert contract. */
+export function buildIngestPayload(params) {
+    const { projection, environment, platformRef, platformName } = params;
+    const environmentRef = `environment:${slug(environment)}`;
+    const entities = [
+        {
+            entityRef: platformRef,
+            entityTypeCode: "platform",
+            name: platformName,
+            description: `Cloud platform hosting the ${environment} environment.`,
+            attributes: { source: "terraform_ingest" },
+        },
+        {
+            entityRef: environmentRef,
+            entityTypeCode: "environment",
+            entitySubtypeCode: environmentSubtypeFor(environment),
+            name: environment,
+            description: `The ${environment} environment, as provisioned by Terraform.`,
+            attributes: { source: "terraform_ingest", terraform_version: projection.terraformVersion },
+        },
+    ];
+    const relationships = [];
+    for (const resource of projection.resources) {
+        const entityRef = `${resource.entityTypeCode}:${slug(resource.name ?? resource.address)}`;
+        entities.push({
+            entityRef,
+            entityTypeCode: resource.entityTypeCode,
+            ...(resource.entitySubtypeCode ? { entitySubtypeCode: resource.entitySubtypeCode } : {}),
+            name: resource.name ?? resource.address,
+            description: `${resource.role.replace(/_/g, " ")} provisioned by Terraform (${resource.resourceType}) in ${environment}.`,
+            attributes: {
+                source: "terraform_ingest",
+                terraform_address: resource.address,
+                terraform_type: resource.resourceType,
+                terraform_mode: resource.mode,
+                infrastructure_role: resource.role,
+                environment,
+                ...resource.attributes,
+                ...(Object.keys(resource.tags).length > 0 ? { tags: resource.tags } : {}),
+                ...(resource.identityIds.length > 0 ? { identity_ids: resource.identityIds } : {}),
+            },
+        });
+        // Only the directions the ontology permits: components deploy to an
+        // environment and belong to a platform; data stores run on both.
+        if (resource.entityTypeCode === "platform_component") {
+            relationships.push({ relationshipTypeCode: "deployed_to", fromEntityRef: entityRef, toEntityRef: environmentRef });
+            relationships.push({ relationshipTypeCode: "part_of", fromEntityRef: entityRef, toEntityRef: platformRef });
+        }
+        else if (resource.entityTypeCode === "data_store") {
+            relationships.push({ relationshipTypeCode: "runs_on", fromEntityRef: entityRef, toEntityRef: environmentRef });
+            relationships.push({ relationshipTypeCode: "runs_on", fromEntityRef: entityRef, toEntityRef: platformRef });
+        }
+    }
+    return { entities, relationships, environmentRef };
+}
+function chunk(items, size) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+export async function ingestInfra(args) {
+    const { statePath, environmentOverride, dir, projectRef, dryRun, asJson } = parseArgs(args);
+    // Only resolve a root module when Terraform must be run; an explicit --state
+    // file is authoritative and needs no repository at all.
+    let workingDir = dir;
+    if (!statePath) {
+        const resolved = resolveRootModule(dir);
+        workingDir = resolved.dir;
+        if (resolved.note && !asJson)
+            console.log(`  ${resolved.note}`);
+    }
+    const { document, source } = loadState(statePath, workingDir);
+    const projection = projectTerraformState({ document, catalogue: TERRAFORM_CATALOGUE_SEED, environment: "unknown" });
+    // Terraform emits a valid but empty document when it cannot see state, which
+    // is a different problem from anything downstream and deserves its own
+    // message rather than surfacing later as a confusing tagging complaint.
+    if (projection.stats.resourcesSeen === 0) {
+        throw new Error(`No resources found in Terraform state (read from ${source}).\n` +
+            `  Terraform ran but reported an empty state. Establish which, in this order:\n` +
+            `    1. run \`terraform state list\` in ${workingDir} — empty output confirms there is no state here\n` +
+            `    2. if there is no .terraform directory, run \`terraform init\`, then retry\n` +
+            `    3. run \`terraform workspace list\` and select the one that was applied\n` +
+            `    4. if this repository has several root modules, ingest each separately with --dir\n` +
+            `  The estate may also simply not have been applied yet.`);
+    }
+    const { environment, how } = resolveEnvironment(projection, environmentOverride, workingDir, statePath ? null : workingDir);
+    projection.environment = environment;
+    // Azure is the only provider the seed catalogue covers today; resolving it
+    // through the reference library keeps the platform entity canonical rather
+    // than inventing a second "Azure" for every tenant.
+    let platformRef = "platform:azure";
+    let platformName = "Microsoft Azure";
+    if (!dryRun) {
+        try {
+            const raw = await callMcpTool("nexarch_resolve_reference", { names: ["azure"] });
+            const resolved = readResult(raw);
+            const hit = (resolved.results ?? []).find((r) => r.resolved && r.entityTypeCode === "platform" && r.canonicalExternalRef);
+            if (hit?.canonicalExternalRef) {
+                platformRef = hit.canonicalExternalRef;
+                platformName = hit.canonicalName ?? platformName;
+            }
+        }
+        catch {
+            // Reference resolution is an optimisation, not a requirement.
+        }
+    }
+    const { entities, relationships } = buildIngestPayload({ projection, environment, platformRef, platformName });
+    const report = {
+        ok: true,
+        source,
+        environment,
+        environmentSource: how,
+        terraformVersion: projection.terraformVersion,
+        resourcesSeen: projection.stats.resourcesSeen,
+        resourcesProjected: projection.stats.resourcesProjected,
+        attributesDropped: {
+            notAllowlisted: projection.stats.attributesDroppedNotAllowlisted,
+            flaggedSensitive: projection.stats.attributesDroppedSensitive,
+        },
+        entities: entities.length,
+        relationships: relationships.length,
+        unknownTypes: projection.unknownTypes,
+        dryRun,
+        projectRef: projectRef ?? null,
+        written: null,
+    };
+    if (dryRun) {
+        if (asJson)
+            process.stdout.write(`${JSON.stringify({ ...report, payload: { entities, relationships } }, null, 2)}\n`);
+        else
+            printHuman(report, entities.length, relationships.length);
+        return;
+    }
+    const policiesRaw = await callMcpTool("nexarch_get_applied_policies", {});
+    const policyBundleHash = readResult(policiesRaw).policyBundleHash ?? null;
+    if (!policyBundleHash)
+        throw new Error("Policy bootstrap is missing for this workspace. Complete workspace setup before ingesting infrastructure.");
+    const agentContext = {
+        agentId: "nexarch-cli:ingest-infra",
+        agentRunId: `ingest-infra-${Date.now()}`,
+        repoRef: projectRef ?? dir,
+        repoPath: dir,
+        observedAt: new Date().toISOString(),
+        source: "nexarch-cli",
+        model: "n/a",
+        provider: "n/a",
+    };
+    const policyContext = { policyBundleHash, alignmentSummary: { score: 1, violations: [], waivers: [] } };
+    let failed = 0;
+    for (const batch of chunk(entities, ENTITY_BATCH)) {
+        const raw = await callMcpTool("nexarch_upsert_entities", { entities: batch, agentContext, policyContext });
+        failed += (readResult(raw).summary?.failed ?? 0);
+    }
+    for (const batch of chunk(relationships, ENTITY_BATCH)) {
+        const raw = await callMcpTool("nexarch_upsert_relationships", { relationships: batch, agentContext, policyContext });
+        failed += (readResult(raw).summary?.failed ?? 0);
+    }
+    report.written = { entities: entities.length, relationships: relationships.length, failed };
+    if (asJson)
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    else
+        printHuman(report, entities.length, relationships.length);
+}
+function printHuman(report, entityCount, relationshipCount) {
+    const dropped = report.attributesDropped;
+    console.log(`\nInfrastructure ingest — ${report.environment} (${report.environmentSource})`);
+    console.log(`  Source: ${report.source}${report.terraformVersion ? ` · terraform ${report.terraformVersion}` : ""}`);
+    console.log(`  Projected ${report.resourcesProjected} of ${report.resourcesSeen} resources to the contract surface.`);
+    console.log(`  Dropped ${dropped.notAllowlisted} attributes not on the allowlist, ${dropped.flaggedSensitive} flagged sensitive by Terraform.`);
+    const unknown = report.unknownTypes;
+    if (unknown.length > 0) {
+        console.log(`\n  Not yet in the catalogue (reported so coverage can grow):`);
+        for (const item of unknown.slice(0, 8))
+            console.log(`    ${String(item.count).padStart(3)}  ${item.resourceType}`);
+        if (unknown.length > 8)
+            console.log(`    …and ${unknown.length - 8} more types`);
+    }
+    if (report.dryRun) {
+        console.log(`\n  Dry run — nothing was written. Would send ${entityCount} entities and ${relationshipCount} relationships.`);
+        return;
+    }
+    const written = report.written;
+    if (written) {
+        console.log(`\n  Wrote ${written.entities} entities and ${written.relationships} relationships.`);
+        if (written.failed > 0)
+            console.log(`  ${written.failed} were refused — see the workspace dashboard for what governance blocked.`);
+    }
+}

package/dist/commands/init-project-infra.js

@@ -0,0 +1,170 @@
+import { basename } from "path";
+import { createInterface } from "readline";
+import { callMcpTool } from "../lib/mcp.js";
+import { detectInfrastructureProject, ciSnippetFor } from "../lib/terraform-detect.js";
+import { environmentSubtypeFor } from "../lib/terraform-projection.js";
+import { ingestInfra } from "./ingest-infra.js";
+function readResult(raw) {
+    return JSON.parse(raw.content?.[0]?.text ?? "{}");
+}
+function slugify(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 80);
+}
+async function confirm(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await new Promise((resolveAnswer) => rl.question(`${question} [Y/n] `, resolveAnswer));
+        return !/^n(o)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Shows what a real run would write.
+ *
+ * A preview that prints "✓ Registered" is worse than no preview: the caller
+ * reads a completed action and moves on, when the whole point was to decide
+ * whether to take it. Everything here is phrased as intent, and no MCP call is
+ * made — not even the policy read, since a dry run should be inert.
+ */
+function reportDryRun(params) {
+    const { asJson, projectRef, detection, entities, relationships } = params;
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify({ ok: true, dryRun: true, wrote: false, projectRef, detection, plan: { entities, relationships } }, null, 2)}\n`);
+        return;
+    }
+    console.log(`\nWould write ${entities.length} entit${entities.length === 1 ? "y" : "ies"}:`);
+    for (const entity of entities)
+        console.log(`    ${entity.entityRef}  (${entity.entityTypeCode} / ${entity.entitySubtypeCode})`);
+    if (relationships.length > 0) {
+        console.log(`\nWould write ${relationships.length} relationship${relationships.length === 1 ? "" : "s"}:`);
+        for (const rel of relationships)
+            console.log(`    ${rel.fromEntityRef} --${rel.relationshipTypeCode}--> ${rel.toEntityRef}`);
+    }
+    console.log(`\nNothing was written. Re-run without --dry-run to register.`);
+}
+export async function runInfrastructureOnboarding(options, detection) {
+    const { dir, nameOverride, asJson, nonInteractive, skipIngest, dryRun } = options;
+    const displayName = nameOverride ?? basename(dir);
+    const projectRef = `project:${slugify(displayName)}`;
+    if (!asJson) {
+        console.log(`\nDetected an infrastructure repository — ${detection.signals.join(", ")}.`);
+        console.log(dryRun
+            ? `Dry run — nothing below is written. ${displayName} would be registered as ${projectRef} (project_infrastructure).`
+            : `Registering ${displayName} as ${projectRef} (project_infrastructure).`);
+        console.log("The dependency scan is skipped: this repo provisions infrastructure rather than consuming it.");
+    }
+    // Every environment the repository defines is sourced from it. Recording this
+    // at registration is what stops the project being an orphan: without it the
+    // graph holds a node that provisions nothing, and no reader can get from an
+    // environment back to the code that defines it. The root module paths carry
+    // this before any state is read, so it costs no Terraform run.
+    const environments = [...new Set(detection.rootModules.map((root) => root.environmentHint).filter((hint) => Boolean(hint)))];
+    const entities = [
+        {
+            entityRef: projectRef,
+            entityTypeCode: "project",
+            entitySubtypeCode: "project_infrastructure",
+            name: displayName,
+            description: `Infrastructure-as-code repository provisioning the estate (${detection.signals.join(", ")}).`,
+            attributes: {
+                source: "nexarch_cli_init_project",
+                iac_tool: "terraform",
+                terraform_file_count: detection.terraformFileCount,
+                has_remote_backend: detection.hasRemoteBackend,
+                root_module_count: detection.rootModules.length,
+                ...(detection.ciSystem ? { ci_system: detection.ciSystem } : {}),
+                ...(detection.moduleDirectories.length > 0 ? { terraform_modules: detection.moduleDirectories.slice(0, 25) } : {}),
+            },
+        },
+        ...environments.map((environment) => ({
+            entityRef: `environment:${environment}`,
+            entityTypeCode: "environment",
+            entitySubtypeCode: environmentSubtypeFor(environment),
+            name: environment,
+            description: `Environment defined by the ${displayName} infrastructure repository.`,
+            attributes: { source: "nexarch_cli_init_project", iac_tool: "terraform" },
+        })),
+    ];
+    const relationships = environments.map((environment) => ({
+        fromEntityRef: `environment:${environment}`,
+        toEntityRef: projectRef,
+        relationshipTypeCode: "sourced_from",
+        attributes: { source: "nexarch_cli_init_project" },
+    }));
+    if (dryRun) {
+        reportDryRun({ asJson, projectRef, detection, entities, relationships });
+        return;
+    }
+    const policiesRaw = await callMcpTool("nexarch_get_applied_policies", {});
+    const policyBundleHash = readResult(policiesRaw).policyBundleHash ?? null;
+    if (!policyBundleHash) {
+        throw new Error("Policy bootstrap is missing for this workspace. Complete workspace setup before registering a project.");
+    }
+    const agentContext = {
+        agentId: "nexarch-cli:init-project",
+        agentRunId: `init-project-infra-${Date.now()}`,
+        repoRef: dir,
+        repoPath: dir,
+        observedAt: new Date().toISOString(),
+        source: "nexarch-cli",
+        model: "n/a",
+        provider: "n/a",
+    };
+    const policyContext = { policyBundleHash, alignmentSummary: { score: 1, violations: [], waivers: [] } };
+    await callMcpTool("nexarch_upsert_entities", { entities, agentContext, policyContext });
+    if (relationships.length > 0) {
+        await callMcpTool("nexarch_upsert_relationships", { relationships, agentContext, policyContext });
+    }
+    if (!asJson) {
+        console.log(`  ✓ Registered ${projectRef}`);
+        for (const environment of environments) {
+            console.log(`  ✓ Registered environment:${environment} (sourced_from ${projectRef})`);
+        }
+    }
+    // Each root module owns its own state, so each is a separate ingest. Showing
+    // the map up front — rather than letting the caller discover it through a
+    // failure — is what lets an agent finish the job unaided.
+    const roots = detection.rootModules;
+    if (!asJson && roots.length > 1) {
+        console.log(`\nThis repository has ${roots.length} root modules, each with its own state.`);
+        console.log("Ingest them one at a time — every root module is a separate estate:\n");
+        for (const root of roots) {
+            const notes = [root.environmentHint ? `${root.environmentHint} environment` : "shared stack", root.initialised ? "initialised" : "run `terraform init` here first"].join(", ");
+            console.log(`    # ${root.relative} — ${notes}`);
+            console.log(`    nexarch ingest-infra --dir ${root.relative} --project-ref ${projectRef}`);
+        }
+    }
+    let ingested = false;
+    if (!skipIngest && roots.length <= 1) {
+        const shouldIngest = nonInteractive ? false : await confirm("\nRead the current state and populate the graph now?");
+        if (shouldIngest) {
+            try {
+                await ingestInfra(["--dir", dir, "--project-ref", projectRef]);
+                ingested = true;
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.log(`\n  Could not ingest now — ${message}`);
+                console.log("  This is not a problem: the pipeline step below is what keeps the graph true.");
+            }
+        }
+    }
+    const { file, snippet } = ciSnippetFor(detection.ciSystem, detection.ciFile);
+    if (asJson) {
+        process.stdout.write(`${JSON.stringify({ ok: true, projectRef, detection, ingested, ci: { file, snippet } }, null, 2)}\n`);
+        return;
+    }
+    console.log(`\nInfrastructure changes continuously, so ingestion belongs in the pipeline, not in someone's memory.`);
+    console.log(`Add this to ${file}:\n`);
+    console.log(snippet);
+    console.log(`\nNEXARCH_TOKEN is a service credential — create one in the workspace under`);
+    console.log(`Discovery → Agents, then store it as a masked CI variable.`);
+}
+export { detectInfrastructureProject };

package/dist/commands/init-project.js

@@ -5,6 +5,8 @@ import { basename, join, relative, resolve as resolvePath } from "node:path";
 import { requireCredentials } from "../lib/credentials.js";
 import { callMcpTool } from "../lib/mcp.js";
 import { buildVersionAttributes } from "../lib/version-normalization.js";
+import { detectInfrastructureProject } from "../lib/terraform-detect.js";
+import { runInfrastructureOnboarding } from "./init-project-infra.js";
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 function parseFlag(args, flag) {
     return args.includes(flag);
@@ -1115,6 +1117,23 @@ export async function initProject(args) {
     const refreshMode = parseFlag(args, "--refresh");
     const creds = requireCredentials();
     const mcpOpts = { companyId: creds.companyId };
+    // An infrastructure repository is onboarded differently: its content lives in
+    // Terraform state, not in a manifest, so the dependency scan below would
+    // describe the wrong thing entirely (ADR: infrastructure-as-code ingestion).
+    if (!parseFlag(args, "--as-application")) {
+        const infrastructure = detectInfrastructureProject(dir);
+        if (infrastructure.isInfrastructure) {
+            await runInfrastructureOnboarding({
+                dir,
+                nameOverride,
+                asJson,
+                nonInteractive: parseFlag(args, "--non-interactive"),
+                skipIngest: parseFlag(args, "--no-ingest"),
+                dryRun,
+            }, infrastructure);
+            return;
+        }
+    }
     if (!asJson)
         console.log(`Scanning ${dir}…`);
     logProgress("scan.start", dir);

package/dist/commands/setup.js

@@ -1,9 +1,93 @@
+import { createInterface } from "readline";
 import { requireCredentials } from "../lib/credentials.js";
 import { detectClientsFromRegistry, writeClientConfig, nexarchServerBlockFromRegistry } from "../lib/clients.js";
 import { fetchAgentRegistryOrThrow } from "../lib/agent-registry.js";
 import { initAgent } from "./init-agent.js";
 import { installClaudeCodeSkill } from "../lib/skills.js";
 import { login } from "./login.js";
+function argValue(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1)
+        return null;
+    const value = args[idx + 1];
+    return !value || value.startsWith("--") ? null : value;
+}
+/** Drops a flag and the value that belongs to it, so neither is left orphaned. */
+function withoutFlag(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1)
+        return args;
+    const takesValue = args[idx + 1] && !args[idx + 1].startsWith("--");
+    return [...args.slice(0, idx), ...args.slice(idx + (takesValue ? 2 : 1))];
+}
+/**
+ * Builds the argument list for a login triggered from setup.
+ *
+ * `login` speaks only `--company`, so `--workspace` is translated rather than
+ * passed through to be silently dropped by the flag it does not recognise.
+ */
+function loginArgs(args, company) {
+    const base = withoutFlag(withoutFlag(args, "--company"), "--workspace");
+    return company ? [...base, "--company", company] : base;
+}
+async function askYesNo(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await new Promise((resolve) => rl.question(`${question} [Y/n] `, resolve));
+        return !/^n(o)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Settles which workspace setup is about to write to, out loud.
+ *
+ * Setup reuses a stored session when one exists, which is right — nobody wants
+ * to re-authenticate to reconfigure a client. But the workspace that session is
+ * scoped to was chosen at login, possibly weeks ago and in another repository,
+ * and setup never said which one it was. Running it in a new repo after
+ * creating a new workspace therefore succeeded loudly and wired everything to
+ * the old workspace: fourteen green ticks, not one of them naming the target.
+ *
+ * The browser consent screen already has a workspace picker for accounts with
+ * more than one membership, so switching is a matter of routing back through
+ * login rather than building a second picker here. The CLI deliberately does
+ * not enumerate workspaces itself: its token is scoped to one company, and a
+ * token for company A should not be able to list company B.
+ */
+async function confirmWorkspace(args, credentials) {
+    const requested = argValue(args, "--company") ?? argValue(args, "--workspace");
+    const current = credentials.company || credentials.companyCode || credentials.companyId;
+    const matchesRequest = !requested ||
+        requested === credentials.companyId ||
+        requested.toLowerCase() === (credentials.companyCode ?? "").toLowerCase() ||
+        requested.toLowerCase() === (credentials.company ?? "").toLowerCase();
+    // An explicit --company that the stored session does not satisfy must never
+    // be quietly ignored: the caller stated a target, and setup writes files.
+    if (!matchesRequest) {
+        console.log(`Stored session is for workspace "${current}", but --company ${requested} was requested.`);
+        console.log("Re-authenticating to switch workspace…\n");
+        await login(loginArgs(args, requested));
+        return requireCredentials();
+    }
+    console.log(`\nWorkspace: ${current}`);
+    const nonInteractive = args.includes("--non-interactive") || args.includes("--yes") || !process.stdin.isTTY;
+    if (nonInteractive) {
+        console.log("Everything below is registered here. Pass --company <id> to target a different workspace.\n");
+        return credentials;
+    }
+    console.log("Everything below — MCP client config, agent registration, instruction files — is registered here.");
+    if (await askYesNo("Continue with this workspace?"))
+        return credentials;
+    // No company is forwarded: the browser consent screen lists every workspace
+    // the account belongs to, which is the point of coming back here.
+    console.log("\nSwitching workspace — choose one in the browser…\n");
+    await login(loginArgs(args, null));
+    const switched = requireCredentials();
+    console.log(`\nWorkspace: ${switched.company || switched.companyId}\n`);
+    return switched;
+}
 function instructionRuntimeCodeForClient(code) {
     switch (code) {
         case "continue-dev":
@@ -27,7 +111,7 @@ export async function setup(args) {
         console.log("No active Nexarch session found. Starting login flow…\n");
         await login(args);
     }
-    requireCredentials(); // ensure login succeeded before continuing
+    await confirmWorkspace(args, requireCredentials()); // ensure login succeeded, and name the target
     let registry;
     try {
         registry = await fetchAgentRegistryOrThrow();