nexarch 0.12.7 → 0.12.9

package/dist/commands/check-in.js

@@ -95,9 +95,9 @@ export async function checkIn(args) {
     }
     if (commands.length > 0) {
         console.log("\nPending application-target commands (preview only; nothing claimed):");
-        console.log(`Company scope is resolved server-side from companyId=${creds.companyId}.`);
+        console.log(`Workspace scope is resolved server-side from companyId=${creds.companyId}.`);
         if (identity.companyId && identity.companyId !== creds.companyId) {
-            console.log(`Note: local identity companyId ${identity.companyId} differs from current credentials companyId ${creds.companyId}.`);
+            console.log(`Note: local identity workspace ${identity.companyId} differs from the credentials in use (${creds.companyId}).`);
         }
         for (const cmd of commands) {
             const claimable = cmd.claimable ? "yes" : "no";

package/dist/commands/setup.js

@@ -1,9 +1,93 @@
+import { createInterface } from "readline";
 import { requireCredentials } from "../lib/credentials.js";
 import { detectClientsFromRegistry, writeClientConfig, nexarchServerBlockFromRegistry } from "../lib/clients.js";
 import { fetchAgentRegistryOrThrow } from "../lib/agent-registry.js";
 import { initAgent } from "./init-agent.js";
 import { installClaudeCodeSkill } from "../lib/skills.js";
 import { login } from "./login.js";
+function argValue(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1)
+        return null;
+    const value = args[idx + 1];
+    return !value || value.startsWith("--") ? null : value;
+}
+/** Drops a flag and the value that belongs to it, so neither is left orphaned. */
+function withoutFlag(args, flag) {
+    const idx = args.indexOf(flag);
+    if (idx === -1)
+        return args;
+    const takesValue = args[idx + 1] && !args[idx + 1].startsWith("--");
+    return [...args.slice(0, idx), ...args.slice(idx + (takesValue ? 2 : 1))];
+}
+/**
+ * Builds the argument list for a login triggered from setup.
+ *
+ * `login` speaks only `--company`, so `--workspace` is translated rather than
+ * passed through to be silently dropped by the flag it does not recognise.
+ */
+function loginArgs(args, company) {
+    const base = withoutFlag(withoutFlag(args, "--company"), "--workspace");
+    return company ? [...base, "--company", company] : base;
+}
+async function askYesNo(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await new Promise((resolve) => rl.question(`${question} [Y/n] `, resolve));
+        return !/^n(o)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Settles which workspace setup is about to write to, out loud.
+ *
+ * Setup reuses a stored session when one exists, which is right — nobody wants
+ * to re-authenticate to reconfigure a client. But the workspace that session is
+ * scoped to was chosen at login, possibly weeks ago and in another repository,
+ * and setup never said which one it was. Running it in a new repo after
+ * creating a new workspace therefore succeeded loudly and wired everything to
+ * the old workspace: fourteen green ticks, not one of them naming the target.
+ *
+ * The browser consent screen already has a workspace picker for accounts with
+ * more than one membership, so switching is a matter of routing back through
+ * login rather than building a second picker here. The CLI deliberately does
+ * not enumerate workspaces itself: its token is scoped to one company, and a
+ * token for company A should not be able to list company B.
+ */
+async function confirmWorkspace(args, credentials) {
+    const requested = argValue(args, "--company") ?? argValue(args, "--workspace");
+    const current = credentials.company || credentials.companyCode || credentials.companyId;
+    const matchesRequest = !requested ||
+        requested === credentials.companyId ||
+        requested.toLowerCase() === (credentials.companyCode ?? "").toLowerCase() ||
+        requested.toLowerCase() === (credentials.company ?? "").toLowerCase();
+    // An explicit --company that the stored session does not satisfy must never
+    // be quietly ignored: the caller stated a target, and setup writes files.
+    if (!matchesRequest) {
+        console.log(`Stored session is for workspace "${current}", but --company ${requested} was requested.`);
+        console.log("Re-authenticating to switch workspace…\n");
+        await login(loginArgs(args, requested));
+        return requireCredentials();
+    }
+    console.log(`\nWorkspace: ${current}`);
+    const nonInteractive = args.includes("--non-interactive") || args.includes("--yes") || !process.stdin.isTTY;
+    if (nonInteractive) {
+        console.log("Everything below is registered here. Pass --company <id> to target a different workspace.\n");
+        return credentials;
+    }
+    console.log("Everything below — MCP client config, agent registration, instruction files — is registered here.");
+    if (await askYesNo("Continue with this workspace?"))
+        return credentials;
+    // No company is forwarded: the browser consent screen lists every workspace
+    // the account belongs to, which is the point of coming back here.
+    console.log("\nSwitching workspace — choose one in the browser…\n");
+    await login(loginArgs(args, null));
+    const switched = requireCredentials();
+    console.log(`\nWorkspace: ${switched.company || switched.companyId}\n`);
+    return switched;
+}
 function instructionRuntimeCodeForClient(code) {
     switch (code) {
         case "continue-dev":
@@ -27,7 +111,7 @@ export async function setup(args) {
         console.log("No active Nexarch session found. Starting login flow…\n");
         await login(args);
     }
-    requireCredentials(); // ensure login succeeded before continuing
+    await confirmWorkspace(args, requireCredentials()); // ensure login succeeded, and name the target
     let registry;
     try {
         registry = await fetchAgentRegistryOrThrow();

package/dist/index.js

@@ -84,6 +84,10 @@ Usage:
   nexarch logout        Remove stored credentials
   nexarch status        Check connection and show architecture summary
   nexarch setup         One-step onboarding: login (if needed) + MCP config + register agent
+                        Names the workspace it will write to and confirms it before
+                        registering anything; answer 'n' to pick a different one.
+                        Options: --company <id|code>  target a workspace directly
+                                 --yes  accept the stored workspace without asking
   nexarch mcp-config    Print MCP server config block for manual setup
                         Client list is registry-managed (see 'nexarch mcp-config --client <code>')
   nexarch mcp-proxy     Run as stdio MCP proxy (used by MCP clients)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexarch",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "description": "Your architecture workspace for AI delivery.",
   "keywords": [
     "nexarch",