runwork 0.8.3 → 0.9.0

package/dist/agents/__tests__/claude-desktop-memory.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/agents/__tests__/claude-desktop-memory.test.js

@@ -0,0 +1,154 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+let mockHomeDir = '/tmp/runwork-cli-cowork-memory-tests';
+vi.mock('os', async () => {
+    const actual = await vi.importActual('os');
+    return {
+        ...actual,
+        homedir: vi.fn(() => mockHomeDir),
+        platform: vi.fn(() => 'darwin'),
+    };
+});
+import { ClaudeDesktopAdapter, getCoworkMemoryClaudeMdPaths } from '../claude-desktop.js';
+const SESSION_A = 'session-a';
+const SESSION_B = 'session-b';
+const ORG_1 = 'org-1';
+const ORG_2 = 'org-2';
+function coworkBase(homeDir) {
+    return join(homeDir, 'Library', 'Application Support', 'Claude', 'local-agent-mode-sessions');
+}
+function makeOrg(homeDir, sessionId, orgId) {
+    const orgDir = join(coworkBase(homeDir), sessionId, orgId);
+    mkdirSync(orgDir, { recursive: true });
+    return orgDir;
+}
+describe('ClaudeDesktopAdapter Cowork memory/CLAUDE.md', () => {
+    let tempHomeDir;
+    beforeEach(() => {
+        tempHomeDir = mkdtempSync(join(tmpdir(), 'runwork-cowork-memory-'));
+        mockHomeDir = tempHomeDir;
+    });
+    afterEach(() => {
+        rmSync(tempHomeDir, { recursive: true, force: true });
+    });
+    describe('getCoworkMemoryClaudeMdPaths', () => {
+        it('returns no paths when the cowork base dir does not exist', () => {
+            expect(getCoworkMemoryClaudeMdPaths()).toEqual([]);
+        });
+        it('collects one path per session/org', () => {
+            makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            makeOrg(tempHomeDir, SESSION_A, ORG_2);
+            makeOrg(tempHomeDir, SESSION_B, ORG_1);
+            const paths = getCoworkMemoryClaudeMdPaths();
+            expect(paths).toHaveLength(3);
+            expect(paths).toContain(join(coworkBase(tempHomeDir), SESSION_A, ORG_1, 'memory', 'CLAUDE.md'));
+            expect(paths).toContain(join(coworkBase(tempHomeDir), SESSION_A, ORG_2, 'memory', 'CLAUDE.md'));
+            expect(paths).toContain(join(coworkBase(tempHomeDir), SESSION_B, ORG_1, 'memory', 'CLAUDE.md'));
+        });
+        it('ignores hidden entries and the skills-plugin sibling directory', () => {
+            const base = coworkBase(tempHomeDir);
+            mkdirSync(join(base, '.DS_Store'), { recursive: true });
+            mkdirSync(join(base, 'skills-plugin'), { recursive: true });
+            makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            expect(getCoworkMemoryClaudeMdPaths()).toEqual([
+                join(base, SESSION_A, ORG_1, 'memory', 'CLAUDE.md'),
+            ]);
+        });
+    });
+    describe('writeInstructionHint', () => {
+        it('writes a marker-delimited hint to each org memory/CLAUDE.md', async () => {
+            makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            makeOrg(tempHomeDir, SESSION_A, ORG_2);
+            const adapter = new ClaudeDesktopAdapter();
+            await adapter.writeInstructionHint('<!-- runwork:start -->\nhello from runwork\n<!-- runwork:end -->', 'user');
+            for (const orgId of [ORG_1, ORG_2]) {
+                const filePath = join(coworkBase(tempHomeDir), SESSION_A, orgId, 'memory', 'CLAUDE.md');
+                expect(existsSync(filePath)).toBe(true);
+                const content = readFileSync(filePath, 'utf-8');
+                expect(content).toContain('<!-- runwork:start -->');
+                expect(content).toContain('hello from runwork');
+                expect(content).toContain('<!-- runwork:end -->');
+            }
+        });
+        it('preserves user-authored content above and below the marker block', async () => {
+            const orgDir = makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            const memoryDir = join(orgDir, 'memory');
+            mkdirSync(memoryDir, { recursive: true });
+            const filePath = join(memoryDir, 'CLAUDE.md');
+            writeFileSync(filePath, 'user-authored line 1\nuser-authored line 2\n');
+            const adapter = new ClaudeDesktopAdapter();
+            await adapter.writeInstructionHint('<!-- runwork:start -->\nhint\n<!-- runwork:end -->', 'user');
+            const content = readFileSync(filePath, 'utf-8');
+            expect(content).toContain('user-authored line 1');
+            expect(content).toContain('user-authored line 2');
+            expect(content).toContain('hint');
+        });
+        it('replaces an existing Runwork hint block in place', async () => {
+            const orgDir = makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            const memoryDir = join(orgDir, 'memory');
+            mkdirSync(memoryDir, { recursive: true });
+            const filePath = join(memoryDir, 'CLAUDE.md');
+            writeFileSync(filePath, 'before\n<!-- runwork:start -->\nOLD HINT\n<!-- runwork:end -->\nafter\n');
+            const adapter = new ClaudeDesktopAdapter();
+            await adapter.writeInstructionHint('<!-- runwork:start -->\nNEW HINT\n<!-- runwork:end -->', 'user');
+            const content = readFileSync(filePath, 'utf-8');
+            expect(content).toContain('before');
+            expect(content).toContain('after');
+            expect(content).toContain('NEW HINT');
+            expect(content).not.toContain('OLD HINT');
+        });
+    });
+    describe('writeTeamInstructions', () => {
+        it('writes team instructions to each org memory/CLAUDE.md', async () => {
+            makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            const adapter = new ClaudeDesktopAdapter();
+            await adapter.writeTeamInstructions('Always reply in British English.', 'user');
+            const filePath = join(coworkBase(tempHomeDir), SESSION_A, ORG_1, 'memory', 'CLAUDE.md');
+            const content = readFileSync(filePath, 'utf-8');
+            expect(content).toContain('<!-- runwork-team:start -->');
+            expect(content).toContain('Always reply in British English.');
+            expect(content).toContain('<!-- runwork-team:end -->');
+        });
+        it('coexists with a hint block in the same file', async () => {
+            makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            const adapter = new ClaudeDesktopAdapter();
+            await adapter.writeInstructionHint('<!-- runwork:start -->\nhint body\n<!-- runwork:end -->', 'user');
+            await adapter.writeTeamInstructions('team body', 'user');
+            const filePath = join(coworkBase(tempHomeDir), SESSION_A, ORG_1, 'memory', 'CLAUDE.md');
+            const content = readFileSync(filePath, 'utf-8');
+            expect(content).toContain('hint body');
+            expect(content).toContain('<!-- runwork-team:start -->');
+            expect(content).toContain('team body');
+            expect(content).toContain('<!-- runwork-team:end -->');
+        });
+    });
+    describe('cleanup', () => {
+        it('strips both marker blocks from each org memory/CLAUDE.md, preserving user content', async () => {
+            const orgDir = makeOrg(tempHomeDir, SESSION_A, ORG_1);
+            const memoryDir = join(orgDir, 'memory');
+            mkdirSync(memoryDir, { recursive: true });
+            const filePath = join(memoryDir, 'CLAUDE.md');
+            writeFileSync(filePath, [
+                'user content top',
+                '<!-- runwork:start -->',
+                'hint body',
+                '<!-- runwork:end -->',
+                '<!-- runwork-team:start -->',
+                'team body',
+                '<!-- runwork-team:end -->',
+                'user content bottom',
+            ].join('\n'));
+            const adapter = new ClaudeDesktopAdapter();
+            await adapter.cleanup('user');
+            const content = readFileSync(filePath, 'utf-8');
+            expect(content).toContain('user content top');
+            expect(content).toContain('user content bottom');
+            expect(content).not.toContain('runwork:start');
+            expect(content).not.toContain('runwork-team:start');
+            expect(content).not.toContain('hint body');
+            expect(content).not.toContain('team body');
+        });
+    });
+});

package/dist/agents/claude-desktop.d.ts

@@ -1,4 +1,12 @@
 import type { AgentAdapter, AgentConfigOverride, AgentUsageStats, CleanupManifest, McpServerEntry, SkillFile } from './types.js';
+/**
+ * Collect every `<session>/<org>/memory/CLAUDE.md` path under the Cowork
+ * base directory. Claude Desktop loads this file on every conversation in
+ * the matching session/org — writing here gets Runwork instructions applied
+ * foundationally, without relying on the agent invoking a skill. We target
+ * every org we find because users may flip between sessions or orgs.
+ */
+export declare function getCoworkMemoryClaudeMdPaths(): string[];
 export interface RpmPluginLocation {
     /** Full path to the rpm plugin directory, e.g. `<org>/rpm/plugin_01YBqw...` */
     pluginPath: string;
@@ -24,7 +32,7 @@ export declare class ClaudeDesktopAdapter implements AgentAdapter {
     supportsSkills(): boolean;
     writeMcpServers(servers: McpServerEntry[], _scope: 'project' | 'user'): Promise<void>;
     writeSkills(skills: SkillFile[], _scope: 'project' | 'user'): Promise<void>;
-    writeInstructionHint(_hint: string, _scope: 'project' | 'user'): Promise<void>;
+    writeInstructionHint(hint: string, _scope: 'project' | 'user'): Promise<void>;
     buildPluginZip(skills: SkillFile[], mcpServers: McpServerEntry[], teamInstructions: string | null, outputPath: string): Promise<void>;
     writeTeamInstructions(instructions: string, _scope: 'project' | 'user'): Promise<void>;
     writeAgentConfig(config: AgentConfigOverride, _scope: 'project' | 'user'): Promise<void>;

package/dist/agents/claude-desktop.js

@@ -2,6 +2,7 @@ import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, w
 import { dirname, join } from 'path';
 import { homedir, platform, tmpdir } from 'os';
 import { mergeJsonMcpServers, readJsonConfig, writeJsonConfig, removeRunworkMcpServers } from './utils/json-config.js';
+import { writeHintToFile, writeTeamInstructionsToFile, removeHintFromFile, removeTeamInstructionsFromFile, } from './utils/instruction-hint.js';
 import { createZipFromDir } from '../utils/zip.js';
 import { writePluginMcpConfig, writePluginMetadata, writePluginSkills, writePluginTeamInstructions, writePluginTree, } from './claude-desktop-plugin-tree.js';
 const PLUGIN_NAME = 'runwork';
@@ -68,6 +69,39 @@ function walkOrgDirs(visit) {
     }
     return null;
 }
+/**
+ * Collect every `<session>/<org>/memory/CLAUDE.md` path under the Cowork
+ * base directory. Claude Desktop loads this file on every conversation in
+ * the matching session/org — writing here gets Runwork instructions applied
+ * foundationally, without relying on the agent invoking a skill. We target
+ * every org we find because users may flip between sessions or orgs.
+ */
+export function getCoworkMemoryClaudeMdPaths() {
+    const paths = [];
+    const baseDir = getCoworkBaseDir();
+    if (!existsSync(baseDir))
+        return paths;
+    try {
+        const sessionDirs = readdirSync(baseDir).filter(d => !d.startsWith('.') && d !== 'skills-plugin');
+        for (const sessionId of sessionDirs) {
+            const sessionPath = join(baseDir, sessionId);
+            let orgDirs;
+            try {
+                orgDirs = readdirSync(sessionPath).filter(d => !d.startsWith('.'));
+            }
+            catch {
+                continue;
+            }
+            for (const orgId of orgDirs) {
+                paths.push(join(sessionPath, orgId, 'memory', 'CLAUDE.md'));
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    return paths;
+}
 /**
  * Find the cowork_plugins directory by discovering the session/org ID structure.
  * Path: local-agent-mode-sessions/<session-id>/<org-id>/cowork_plugins/
@@ -241,9 +275,18 @@ export class ClaudeDesktopAdapter {
         // Sync should recover a previously disabled plugin so it shows up in Customize.
         setCoworkPluginEnabled(pluginsDir, true);
     }
-    async writeInstructionHint(_hint, _scope) {
-        // Claude Desktop/Cowork uses project instructions within the app UI, not files.
-        // The plugin system handles skill discovery.
+    async writeInstructionHint(hint, _scope) {
+        // Cowork loads `<session>/<org>/memory/CLAUDE.md` on every conversation.
+        // This is the same always-on memory surface Claude Code uses with
+        // `~/.claude/CLAUDE.md`, so it's the right home for foundational hints.
+        // Merge into marker blocks so any user-authored content above/below our
+        // block is preserved.
+        for (const path of getCoworkMemoryClaudeMdPaths()) {
+            try {
+                writeHintToFile(path, hint);
+            }
+            catch { /* best-effort per org */ }
+        }
     }
     async buildPluginZip(skills, mcpServers, teamInstructions, outputPath) {
         // Materialise the plugin tree into a temp dir, zip it, then clean up.
@@ -273,10 +316,19 @@ export class ClaudeDesktopAdapter {
         }
     }
     async writeTeamInstructions(instructions, _scope) {
-        // Write team instructions as a skill in the Cowork plugin system.
-        // This makes them available to Claude Desktop sessions via the plugin.
-        // Prefer an rpm upload location when present, fall back to the legacy
-        // cowork_plugins cache + marketplace layout.
+        // Primary surface: `<org>/memory/CLAUDE.md`. Cowork auto-loads this on
+        // every conversation, matching the Claude Code convention. Write through
+        // the team-instructions marker block so user-authored content is safe.
+        for (const path of getCoworkMemoryClaudeMdPaths()) {
+            try {
+                writeTeamInstructionsToFile(path, instructions);
+            }
+            catch { /* best-effort per org */ }
+        }
+        // Secondary surface: the plugin's `runwork-team-instructions` SKILL.md.
+        // Kept for the build-plugin zip flow and as a slash-command fallback
+        // when users inspect plugin skills. Prefer the rpm upload location when
+        // present, otherwise fall back to the legacy cowork_plugins layout.
         const rpm = findRpmPluginByName(PLUGIN_NAME);
         if (rpm) {
             writePluginTeamInstructions(rpm.pluginPath, instructions);
@@ -324,6 +376,18 @@ export class ClaudeDesktopAdapter {
     async cleanup(_scope, _manifest) {
         // 1. Remove MCP entries from claude_desktop_config.json
         removeRunworkMcpServers(getMcpConfigPath(), 'mcpServers');
+        // Remove Runwork marker blocks from each org's memory/CLAUDE.md, leaving
+        // any user-authored content in that file intact.
+        for (const path of getCoworkMemoryClaudeMdPaths()) {
+            try {
+                removeHintFromFile(path);
+            }
+            catch { /* best-effort per org */ }
+            try {
+                removeTeamInstructionsFromFile(path);
+            }
+            catch { /* best-effort per org */ }
+        }
         // 2. Remove the uploaded rpm plugin if the user installed via
         //    Customize > Create plugin > Upload plugin. We delete both the
         //    plugin directory and the manifest entry so Claude Desktop does

package/dist/agents/codex.d.ts

@@ -14,4 +14,15 @@ export declare class CodexAdapter implements AgentAdapter {
     cleanup(scope: 'project' | 'user', manifest?: CleanupManifest): Promise<void>;
     readUsageStats(lastSyncAt: string | null): Promise<AgentUsageStats | null>;
     readVersion(): Promise<string | null>;
+    /**
+     * Register a workspace directory in the Codex desktop app's project list.
+     * Adds the path to electron-saved-workspace-roots, project-order, and
+     * electron-workspace-root-labels. Skips active-workspace-roots to avoid
+     * force-switching the user's active project.
+     *
+     * Returns 'written' if changes were made, 'already_registered' if the
+     * path was already present, or 'app_running' if Codex is open and would
+     * overwrite our changes.
+     */
+    registerDesktopWorkspace(workspacePath: string, label: string): 'written' | 'already_registered' | 'app_running';
 }

package/dist/agents/codex.js

@@ -10,7 +10,7 @@ function isRunworkManagedCodexKey(key) {
 }
 import { writeHintToFile, writeTeamInstructionsToFile, removeHintFromFile, removeTeamInstructionsFromFile } from './utils/instruction-hint.js';
 import { querySqlite } from '../utils/sqlite.js';
-import { whichBinary } from '../utils/which.js';
+import { whichBinary, isAppRunning } from '../utils/which.js';
 export class CodexAdapter {
     name = 'Codex';
     slug = 'codex';
@@ -107,6 +107,18 @@ export class CodexAdapter {
             };
             parsed.approval_policy = modeMap[config.permissionRules.defaultMode] ?? config.permissionRules.defaultMode;
         }
+        // Apply minimum permission floors: only upgrade, never downgrade
+        if (config.minimumPermissions) {
+            for (const { field, order, minimum } of config.minimumPermissions) {
+                const current = typeof parsed[field] === 'string' ? parsed[field] : '';
+                const currentIdx = order.indexOf(current);
+                const minimumIdx = order.indexOf(minimum);
+                // Upgrade if current is unknown (not in order) or more restrictive than minimum
+                if (currentIdx < minimumIdx) {
+                    parsed[field] = minimum;
+                }
+            }
+        }
         mkdirSync(join(configPath, '..'), { recursive: true });
         writeFileSync(configPath, stringify(parsed));
     }
@@ -225,4 +237,60 @@ export class CodexAdapter {
         catch { /* best-effort */ }
         return null;
     }
+    // ── Codex Desktop app workspace registration ──────────────────────
+    /**
+     * Register a workspace directory in the Codex desktop app's project list.
+     * Adds the path to electron-saved-workspace-roots, project-order, and
+     * electron-workspace-root-labels. Skips active-workspace-roots to avoid
+     * force-switching the user's active project.
+     *
+     * Returns 'written' if changes were made, 'already_registered' if the
+     * path was already present, or 'app_running' if Codex is open and would
+     * overwrite our changes.
+     */
+    registerDesktopWorkspace(workspacePath, label) {
+        const statePath = join(homedir(), '.codex', '.codex-global-state.json');
+        // Read current state (or start fresh if file doesn't exist)
+        let state = {};
+        if (existsSync(statePath)) {
+            try {
+                state = JSON.parse(readFileSync(statePath, 'utf-8'));
+            }
+            catch {
+                return 'app_running'; // corrupt file, don't touch
+            }
+        }
+        // Check if already registered in all required keys
+        const savedRoots = (Array.isArray(state['electron-saved-workspace-roots'])
+            ? state['electron-saved-workspace-roots'] : []);
+        const projectOrder = (Array.isArray(state['project-order'])
+            ? state['project-order'] : []);
+        const labels = (state['electron-workspace-root-labels'] && typeof state['electron-workspace-root-labels'] === 'object'
+            ? state['electron-workspace-root-labels'] : {});
+        const inSaved = savedRoots.includes(workspacePath);
+        const inOrder = projectOrder.includes(workspacePath);
+        const inLabels = labels[workspacePath] === label;
+        if (inSaved && inOrder && inLabels) {
+            return 'already_registered';
+        }
+        // Codex desktop app holds this file in memory and overwrites on any state
+        // change. Writing while it's open is futile. Check if it's running.
+        if (isAppRunning('Codex')) {
+            return 'app_running';
+        }
+        // Merge our workspace into the state
+        if (!inSaved) {
+            savedRoots.push(workspacePath);
+            state['electron-saved-workspace-roots'] = savedRoots;
+        }
+        if (!inOrder) {
+            projectOrder.push(workspacePath);
+            state['project-order'] = projectOrder;
+        }
+        labels[workspacePath] = label;
+        state['electron-workspace-root-labels'] = labels;
+        mkdirSync(join(statePath, '..'), { recursive: true });
+        writeFileSync(statePath, JSON.stringify(state));
+        return 'written';
+    }
 }

package/dist/agents/types.d.ts

@@ -75,6 +75,18 @@ export interface AgentConfigOverride {
     };
     /** Domains to allowlist in the agent's sandbox/network config (e.g. for Cursor CLI sandbox) */
     networkAllowlist?: string[];
+    /**
+     * Minimum permission levels required for Runwork tools to function.
+     * Adapters should only UPGRADE restrictive settings, never downgrade
+     * more permissive ones. Keys are agent-specific config field names,
+     * values are ordered arrays from most restrictive to least, plus
+     * the minimum required value.
+     */
+    minimumPermissions?: Array<{
+        field: string;
+        order: string[];
+        minimum: string;
+    }>;
 }
 export interface AgentUsageStats {
     hasNewActivity: boolean;

package/dist/auth/store.js

@@ -44,7 +44,18 @@ export function clearCredentials() {
 export function requireAuth() {
     const creds = getCredentials();
     if (!creds) {
-        console.error('Not logged in. Run `runwork login` first.');
+        const isTTY = process.stdin.isTTY;
+        if (isTTY) {
+            console.error('Not logged in. Run `runwork login` first.');
+        }
+        else {
+            // Headless / sandbox / AI agent environment: provide actionable guidance
+            console.error('Not logged in. In a sandbox or headless environment, authenticate using one of:\n' +
+                '  1. Call the get_cli_setup MCP tool, then write the returned credentials to ~/.runwork/.credentials\n' +
+                '  2. Set the RUNWORK_API_KEY environment variable\n' +
+                '  3. Run: runwork login --api-key <your-api-key>\n' +
+                '  4. Run: runwork login --no-open --print-only  (prints a URL for browser auth)');
+        }
         process.exit(1);
     }
     return creds;

package/dist/commands/__tests__/setup.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/commands/__tests__/setup.test.js

@@ -0,0 +1,81 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+vi.mock('../../auth/store.js', () => ({
+    getCredentials: vi.fn(),
+    saveCredentials: vi.fn(),
+    requireAuth: vi.fn(),
+}));
+import { getCredentials, saveCredentials } from '../../auth/store.js';
+import { resolveAndPersistWorkspace } from '../setup.js';
+const mockedGetCredentials = vi.mocked(getCredentials);
+const mockedSaveCredentials = vi.mocked(saveCredentials);
+const baseCreds = {
+    apiKey: 'rw_test',
+    email: 'user@example.com',
+    baseUrl: 'https://runwork.ai',
+};
+function buildClient(overrides = {}) {
+    return {
+        listWorkspaces: overrides.listWorkspaces ?? vi.fn().mockResolvedValue([
+            { id: 'ws-motaword', name: 'MotaWord', slug: 'motaword' },
+            { id: 'ws-personal', name: 'Murat Boyraz\'s Workspace', slug: 'murat' },
+        ]),
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    };
+}
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockedGetCredentials.mockReturnValue(baseCreds);
+    vi.spyOn(console, 'error').mockImplementation(() => { });
+    vi.spyOn(console, 'log').mockImplementation(() => { });
+});
+describe('resolveAndPersistWorkspace', () => {
+    it('persists the workspace picked via --workspace flag into credentials', async () => {
+        const client = buildClient();
+        const result = await resolveAndPersistWorkspace(client, { workspace: 'ws-motaword' });
+        expect(result).toEqual({
+            workspaceId: 'ws-motaword',
+            workspaceName: 'MotaWord',
+            workspaceSlug: 'motaword',
+        });
+        expect(mockedSaveCredentials).toHaveBeenCalledTimes(1);
+        expect(mockedSaveCredentials).toHaveBeenCalledWith({
+            ...baseCreds,
+            defaultWorkspaceId: 'ws-motaword',
+            defaultWorkspaceName: 'MotaWord',
+        });
+    });
+    it('exits with error when --workspace id is not in the user\'s accessible workspaces', async () => {
+        const client = buildClient();
+        const exitSpy = vi.spyOn(process, 'exit').mockImplementation(((code) => {
+            throw new Error(`process.exit(${code})`);
+        }));
+        await expect(resolveAndPersistWorkspace(client, { workspace: 'ws-unknown' })).rejects.toThrow('process.exit(1)');
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        expect(mockedSaveCredentials).not.toHaveBeenCalled();
+        expect(console.error).toHaveBeenCalledWith(expect.stringContaining('ws-unknown'));
+    });
+    it('does not overwrite other credential fields when persisting', async () => {
+        const richCreds = {
+            ...baseCreds,
+            defaultWorkspaceId: 'ws-old',
+            defaultWorkspaceName: 'Old',
+        };
+        mockedGetCredentials.mockReturnValue(richCreds);
+        const client = buildClient();
+        await resolveAndPersistWorkspace(client, { workspace: 'ws-motaword' });
+        expect(mockedSaveCredentials).toHaveBeenCalledWith({
+            apiKey: 'rw_test',
+            email: 'user@example.com',
+            baseUrl: 'https://runwork.ai',
+            defaultWorkspaceId: 'ws-motaword',
+            defaultWorkspaceName: 'MotaWord',
+        });
+    });
+    it('skips persistence when no credentials are present', async () => {
+        mockedGetCredentials.mockReturnValue(null);
+        const client = buildClient();
+        const result = await resolveAndPersistWorkspace(client, { workspace: 'ws-motaword' });
+        expect(result.workspaceId).toBe('ws-motaword');
+        expect(mockedSaveCredentials).not.toHaveBeenCalled();
+    });
+});

package/dist/commands/init.js

@@ -107,6 +107,10 @@ export async function runCreateFlow(name, workspaceFlag, options = {}) {
     if (workspaceFlag) {
         workspace = await resolveWorkspace(client, workspaceFlag);
     }
+    else if (creds.defaultWorkspaceId) {
+        // Auto-select default workspace from credentials (set during login/onboarding)
+        workspace = { id: creds.defaultWorkspaceId, name: creds.defaultWorkspaceName || creds.defaultWorkspaceId };
+    }
     else {
         const workspaces = await client.listWorkspaces();
         if (workspaces.length === 0) {

package/dist/commands/setup.d.ts

@@ -1,2 +1,20 @@
 import { Command } from 'commander';
+import { ApiClient } from '../api/client.js';
+/**
+ * Resolve the workspace for `setup` and persist it as the default in credentials.
+ *
+ * `setup` is the canonical "configure this machine for this workspace" command, so
+ * the choice should stick across subsequent commands (including the desktop app,
+ * which reads `defaultWorkspaceId` to pick the initial workspace on the Workspace tab).
+ *
+ * When `--workspace <id>` is passed, the id is validated against the user's accessible
+ * workspaces and the command exits with a non-zero code if it isn't found.
+ */
+export declare function resolveAndPersistWorkspace(client: ApiClient, opts: {
+    workspace?: string;
+}): Promise<{
+    workspaceId: string;
+    workspaceName: string;
+    workspaceSlug?: string;
+}>;
 export declare const setupCommand: Command;

package/dist/commands/setup.js

@@ -2,12 +2,47 @@ import { Command } from 'commander';
 import { writeFileSync, mkdirSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
-import { requireAuth } from '../auth/store.js';
+import { requireAuth, getCredentials, saveCredentials } from '../auth/store.js';
 import { ApiClient } from '../api/client.js';
 import { resolveWorkspace, hasProjectConfig } from '../workspace/resolve.js';
 import { promptSelect, promptConfirm } from '../utils/prompt.js';
 import { detectAgents, printNoAgentsMessage } from '../agents/detect.js';
 import { syncFromState } from './sync.js';
+/**
+ * Resolve the workspace for `setup` and persist it as the default in credentials.
+ *
+ * `setup` is the canonical "configure this machine for this workspace" command, so
+ * the choice should stick across subsequent commands (including the desktop app,
+ * which reads `defaultWorkspaceId` to pick the initial workspace on the Workspace tab).
+ *
+ * When `--workspace <id>` is passed, the id is validated against the user's accessible
+ * workspaces and the command exits with a non-zero code if it isn't found.
+ */
+export async function resolveAndPersistWorkspace(client, opts) {
+    const resolved = await resolveWorkspace(client, opts);
+    const { workspaceId } = resolved;
+    let allWorkspaces = [];
+    try {
+        allWorkspaces = await client.listWorkspaces();
+    }
+    catch { /* best-effort */ }
+    const workspaceMeta = allWorkspaces.find(w => w.id === workspaceId);
+    if (opts.workspace && allWorkspaces.length > 0 && !workspaceMeta) {
+        console.error(`Workspace "${opts.workspace}" not found or not accessible.`);
+        process.exit(1);
+    }
+    const workspaceName = resolved.workspaceName || workspaceMeta?.name || '';
+    const workspaceSlug = workspaceMeta?.slug;
+    const freshCreds = getCredentials();
+    if (freshCreds) {
+        saveCredentials({
+            ...freshCreds,
+            defaultWorkspaceId: workspaceId,
+            defaultWorkspaceName: workspaceName,
+        });
+    }
+    return { workspaceId, workspaceName, workspaceSlug };
+}
 export const setupCommand = new Command('setup')
     .description('Configure local AI agents with workspace skills and MCP servers')
     .option('--workspace <id>', 'Workspace ID')
@@ -17,8 +52,8 @@ export const setupCommand = new Command('setup')
     .action(async (opts) => {
     const credentials = requireAuth();
     const client = new ApiClient(credentials);
-    // 1. Resolve workspace
-    const { workspaceId, workspaceName } = await resolveWorkspace(client, opts);
+    // 1. Resolve workspace + persist as default
+    const { workspaceId, workspaceName, workspaceSlug } = await resolveAndPersistWorkspace(client, opts);
     console.log(`\nWorkspace: ${workspaceName || workspaceId}\n`);
     // 2. Detect agents
     let agents = await detectAgents();
@@ -75,13 +110,6 @@ export const setupCommand = new Command('setup')
         const chosen = await promptSelect('Configure for:', scopeChoices);
         scope = chosen.value;
     }
-    // 4. Get workspace slug
-    let workspaceSlug;
-    try {
-        const workspaces = await client.listWorkspaces();
-        workspaceSlug = workspaces.find(w => w.id === workspaceId)?.slug;
-    }
-    catch { /* best-effort */ }
     // 5. Save setup state (minimal, sync populates the rest)
     const state = {
         workspaceId,

package/dist/commands/sync.js

@@ -5,6 +5,7 @@ import { homedir } from 'os';
 import { requireAuth } from '../auth/store.js';
 import { ApiClient } from '../api/client.js';
 import { getAdapterBySlug } from '../agents/detect.js';
+import { CodexAdapter } from '../agents/codex.js';
 import { RUNWORK_MCP_PREFIX, RUNWORK_WORKSPACE_MCP_NAME } from '../agents/types.js';
 import { collectTelemetryEvents, printTelemetryVerbose, summarizeTelemetryForDryRun, } from './sync-telemetry.js';
 import { generateIntroSkill, generateInstructionHint, buildAppSkillDescription } from '../agents/intro-skill.js';
@@ -360,12 +361,31 @@ export async function syncFromState(state, statePath, credentials, opts) {
         if (!adapter.writeAgentConfig)
             continue;
         try {
-            await adapter.writeAgentConfig({ networkAllowlist: networkDomains }, 'user');
+            await adapter.writeAgentConfig({
+                networkAllowlist: networkDomains,
+                minimumPermissions: [
+                    { field: 'approval_policy', order: ['always', 'untrusted', 'on-request', 'never'], minimum: 'on-request' },
+                    { field: 'sandbox_mode', order: ['full', 'read-only', 'workspace-write', 'off'], minimum: 'workspace-write' },
+                ],
+            }, 'user');
         }
         catch {
             // Best-effort
         }
     }
+    // Register ~/.runwork as a project in the Codex desktop app (best-effort).
+    // Only attempts when Codex adapter is configured and the desktop app is closed.
+    for (const adapter of adapters) {
+        if (adapter instanceof CodexAdapter) {
+            const runworkDir = join(homedir(), '.runwork');
+            const result = adapter.registerDesktopWorkspace(runworkDir, 'Runwork');
+            if (result === 'written') {
+                console.log(`  [${adapter.name}] Registered workspace in Codex desktop app`);
+            }
+            // 'app_running' and 'already_registered' are silently skipped
+            break;
+        }
+    }
     // Update state
     state.lastSyncAt = new Date().toISOString();
     state.mcpServers = mcpEntries.map(e => e.name);

package/dist/generated/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.8.3";
+export declare const VERSION = "0.9.0";

package/dist/generated/version.js

@@ -1,2 +1,2 @@
 // Auto-generated by scripts/embed-types.ts -- do not edit
-export const VERSION = "0.8.3";
+export const VERSION = "0.9.0";

package/dist/utils/which.d.ts

@@ -4,3 +4,11 @@
  * Returns the resolved path on success, null if not found.
  */
 export declare function whichBinary(name: string): string | null;
+/**
+ * Check if a desktop app is currently running by process name.
+ * On macOS: checks for the .app bundle process via pgrep.
+ * On Windows: uses tasklist to find the .exe.
+ * On Linux: uses pgrep for the binary name.
+ * Returns true if the process is found, false otherwise.
+ */
+export declare function isAppRunning(appName: string): boolean;

package/dist/utils/which.js

@@ -16,3 +16,32 @@ export function whichBinary(name) {
         return null;
     }
 }
+/**
+ * Check if a desktop app is currently running by process name.
+ * On macOS: checks for the .app bundle process via pgrep.
+ * On Windows: uses tasklist to find the .exe.
+ * On Linux: uses pgrep for the binary name.
+ * Returns true if the process is found, false otherwise.
+ */
+export function isAppRunning(appName) {
+    try {
+        const os = platform();
+        if (os === 'darwin') {
+            // pgrep -f matches against the full command line, catching Electron apps
+            execFileSync('pgrep', ['-f', `${appName}.app`], { stdio: 'pipe' });
+            return true;
+        }
+        else if (os === 'win32') {
+            const result = execFileSync('tasklist', ['/FI', `IMAGENAME eq ${appName}.exe`, '/NH'], { stdio: 'pipe' }).toString();
+            return result.includes(`${appName}.exe`);
+        }
+        else {
+            execFileSync('pgrep', ['-x', appName.toLowerCase()], { stdio: 'pipe' });
+            return true;
+        }
+    }
+    catch {
+        // pgrep exits non-zero when no processes match
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runwork",
-  "version": "0.8.3",
+  "version": "0.9.0",
   "description": "CLI for Runwork: develop, preview, and deploy Runwork apps from your local machine.",
   "license": "UNLICENSED",
   "author": "Runwork <info@runwork.ai> (https://www.runwork.ai)",