@agentteams/cli 0.1.92 → 0.1.94

package/dist/commands/init.js

@@ -1,31 +1,29 @@
-import { appendFileSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
 import { constants, createCipheriv, publicEncrypt, randomBytes } from 'node:crypto';
 import { multiselect, isCancel, cancel } from '@clack/prompts';
 import httpClient from '../utils/httpClient.js';
 import open from 'open';
-import { createAuthState, startLocalAuthServer } from '../utils/authServer.js';
-import { DEFAULT_API_URL, saveConfig, saveLegacyApiKeyConfig, } from '../utils/config.js';
-import { performPersonalTokenLogin } from './auth.js';
+import { createAuthState, createPkcePair, isUnifiedSetupMetadataMissing, SETUP_LEGACY_AGENT_KEY_HINT, SETUP_METADATA_MISSING_HINT, startLocalAuthServer, startUnifiedSetupServer, } from '../utils/authServer.js';
+import { DEFAULT_API_URL, findProjectConfig, loadProjectConfig, loadConfigWithCredential, saveConfig, saveLegacyApiKeyConfig, } from '../utils/config.js';
+import { getPersonalTokenClient } from '../auth/personalTokenClient.js';
 import { createSpinner, withSpinner } from '../utils/spinner.js';
 import { withCommandContext } from '../utils/commandContext.js';
-import { conventionDownload } from './convention.js';
-import { resolveGitTopLevel, resolveMainCheckoutRoot } from '../utils/git.js';
+import { conventionDownload, conventionStatus, CONVENTION_MANIFEST_FILE, } from './convention.js';
+import { executeDoctorCommand } from './doctor.js';
+import { resolveGitTopLevel, shouldInstallWorktreeHook } from '../utils/git.js';
 import { canonicalizePath } from '../utils/path.js';
 import { readOrCreateMachineId } from '../utils/machineId.js';
 import { buildAuthHeaders } from '../utils/apiContext.js';
-import { DEFAULT_CONVENTION_REFERENCE, ensureConventionEntryPoints, ensureLocalExclude, ensurePostCheckoutHook, isReadableRegularFile, resolveGitCommonDir, toAnchoredExcludePattern, } from '../utils/conventionLink.js';
+import { AGENT_ENTRY_POINT_FILES, detectAgentEntryPointFiles, parseAgentFilesOption, } from '../utils/agentEntryPoints.js';
+import { bootstrapLinkedWorktree, resolveLinkedWorktreeSource } from './initWorktree.js';
+import { DEFAULT_CONVENTION_REFERENCE, ensurePostCheckoutHook, } from '../utils/conventionLink.js';
+export { bootstrapLinkedWorktree } from './initWorktree.js';
 const AUTH_BASE_URL = process.env.AGENTTEAMS_WEB_URL || 'https://agentteams.run';
-const AGENT_ENTRY_POINT_FILES = [
-    { value: 'CLAUDE.md', label: 'CLAUDE.md', hint: 'Claude Code' },
-    { value: 'AGENTS.md', label: 'AGENTS.md', hint: 'OpenCode / Codex' },
-    { value: 'GEMINI.md', label: 'GEMINI.md', hint: 'Antigravity' },
-    { value: '.cursor/rules/agentteams.mdc', label: '.cursor/rules/agentteams.mdc', hint: 'Cursor' },
-];
 const CONFIG_DIR = '.agentteams';
 const CONFIG_FILE = 'config.json';
 const CONVENTION_FILE = 'convention.md';
-const RELINK_BACKUP_NAME = 'agentteams-relink';
 const AUTH_PATH_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs9s9+n0C8Z099LrOTlKB
 83c2WluO/TxZFxJQ07XgfKJ2RG/8K2kvCwVKeSgzzBP/hmY2qWAgAOrXIoSHNYGt
@@ -72,26 +70,30 @@ export function detectOsType() {
     }
     return undefined;
 }
-export function buildAuthorizeUrl(port, projectName, authPathEnc, osType, state, machineId) {
+export function buildAuthorizeUrl(input) {
     const params = new URLSearchParams({
-        port: String(port),
-        projectName,
+        port: String(input.port),
+        projectName: input.projectName,
     });
-    if (authPathEnc && authPathEnc.length > 0) {
-        params.set('ap', authPathEnc);
+    if (input.authPathEnc && input.authPathEnc.length > 0) {
+        params.set('ap', input.authPathEnc);
     }
-    if (osType && osType.length > 0) {
-        params.set('ot', osType);
+    if (input.osType && input.osType.length > 0) {
+        params.set('ot', input.osType);
     }
     // Machine identity, shared with the runner installed on this machine. It is not a secret and is
     // only used to bind the agent to the runner that can actually reach this workspace.
-    if (machineId && machineId.length > 0) {
-        params.set('mid', machineId);
+    if (input.machineId && input.machineId.length > 0) {
+        params.set('mid', input.machineId);
     }
     // The web page echoes this back through the callback; without it the local
     // server cannot tell this login apart from one someone else started.
-    if (state && state.length > 0) {
-        params.set('state', state);
+    if (input.state && input.state.length > 0) {
+        params.set('state', input.state);
+    }
+    if (input.codeChallenge && input.codeChallenge.length > 0) {
+        params.set('code_challenge', input.codeChallenge);
+        params.set('flow', 'setup');
     }
     return `${AUTH_BASE_URL}/cli/authorize?${params.toString()}`;
 }
@@ -183,29 +185,28 @@ async function fetchConventionTemplate(authResult, apiUrl) {
     return content;
 }
 /**
- * Hand the agent key back at the end of a personal-token init.
+ * Which entry point files this run may write.
  *
- * The browser round trip mints a `key_` no matter which auth mode was asked
- * for — it is the only credential that can read the convention template. On the
- * personal-token path that key is never written to disk, so leaving it live
- * would mean a long-lived secret the user cannot see, use or cancel. The agent
- * config itself stays: it is the project's record of this machine, and only its
- * credential is the liability.
+ * The order is deliberate: an explicit `--agent-files` wins over everything, a
+ * TTY still gets the multiselect (now seeded with what was detected instead of
+ * everything), and a non-TTY run gets the detection result alone. The old
+ * non-TTY branch returned the full catalog, so every automated re-run wrote all
+ * four files — and an `-example` sibling for each one that already existed.
  */
-async function revokeInitAgentKey(authResult, apiUrl) {
-    try {
-        await httpClient.delete(`${apiUrl}/api/projects/${authResult.projectId}/agent-configs/${authResult.configId}/api-keys`, { headers: buildAuthHeaders(authResult.apiKey) });
-        return true;
-    }
-    catch {
-        // Not fatal: init has everything it needs, and the caller warns instead so
-        // the user can revoke it from the web app.
-        return false;
+/**
+ * `allowPrompt` is false on the configured-project repair pass: that path exists
+ * to make a re-run of `agentteams init` actually re-apply the local adapters,
+ * and a fast path that stops to ask a question is no longer a fast path.
+ * Detection still runs there, so a missing entry point is created and an
+ * existing one is reported as untouched.
+ */
+async function resolveAgentFileSelection(cwd, explicitFiles, options) {
+    if (explicitFiles) {
+        return explicitFiles;
     }
-}
-async function promptAgentFileSelection() {
-    if (!process.stdin.isTTY) {
-        return AGENT_ENTRY_POINT_FILES.map((f) => f.value);
+    const detected = detectAgentEntryPointFiles(cwd);
+    if (options?.allowPrompt === false || !process.stdin.isTTY) {
+        return detected;
     }
     const selected = await multiselect({
         message: 'Select agent entry point files to create:',
@@ -214,7 +215,7 @@ async function promptAgentFileSelection() {
             label: f.label,
             hint: f.hint,
         })),
-        initialValues: AGENT_ENTRY_POINT_FILES.map((f) => f.value),
+        initialValues: detected,
         required: false,
     });
     if (isCancel(selected)) {
@@ -258,378 +259,657 @@ function ensureGeminiIgnore(cwd) {
         writeFileSync(geminiIgnorePath, `# Allow AgentTeams convention files\n${entry}\n`, 'utf-8');
     }
 }
-function generateAgentEntryPointFiles(cwd, selectedFiles) {
-    if (selectedFiles.length === 0) {
-        return [];
-    }
+/**
+ * Write the selected entry points, never over an existing file.
+ *
+ * An occupied path is reported as `skipped` rather than answered with a
+ * `<name>-example` sibling: the example write is unconditional, so a repeated
+ * init kept re-creating files nobody merged. `--agent-files-example` restores
+ * the old behavior for the case it was built for — a first-time setup on a repo
+ * that already has its own CLAUDE.md.
+ *
+ * Each file is written under its own try/catch and failures come back alongside
+ * the entries instead of as an exception. Letting one unwritable path throw out
+ * of the loop discarded the record of every file already on disk, so the caller
+ * reported `agentFiles: []` for a run that had in fact created some of them —
+ * the JSON contract and the human output both disagreeing with the filesystem.
+ */
+function generateAgentEntryPointFiles(cwd, selectedFiles, options) {
     const entries = [];
+    const failures = [];
     for (const relativePath of selectedFiles) {
         const fullPath = join(cwd, relativePath);
-        const dir = dirname(fullPath);
-        if (!existsSync(dir)) {
-            mkdirSync(dir, { recursive: true });
-        }
-        if (!existsSync(fullPath)) {
+        try {
+            if (existsSync(fullPath)) {
+                if (!options.createExample) {
+                    entries.push({ relativePath, type: 'skipped' });
+                    continue;
+                }
+                const ext = relativePath.includes('.') ? `.${relativePath.split('.').pop()}` : '';
+                const base = ext ? relativePath.slice(0, -ext.length) : relativePath;
+                const exampleRelativePath = `${base}-example${ext}`;
+                const exampleFullPath = join(cwd, exampleRelativePath);
+                const exampleDir = dirname(exampleFullPath);
+                if (!existsSync(exampleDir)) {
+                    mkdirSync(exampleDir, { recursive: true });
+                }
+                writeFileSync(exampleFullPath, DEFAULT_CONVENTION_REFERENCE, 'utf-8');
+                entries.push({ relativePath: exampleRelativePath, type: 'example' });
+                continue;
+            }
+            const dir = dirname(fullPath);
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true });
+            }
             writeFileSync(fullPath, DEFAULT_CONVENTION_REFERENCE, 'utf-8');
             entries.push({ relativePath, type: 'created' });
         }
-        else {
-            const ext = relativePath.includes('.') ? `.${relativePath.split('.').pop()}` : '';
-            const base = ext ? relativePath.slice(0, -ext.length) : relativePath;
-            const exampleRelativePath = `${base}-example${ext}`;
-            const exampleFullPath = join(cwd, exampleRelativePath);
-            const exampleDir = dirname(exampleFullPath);
-            if (!existsSync(exampleDir)) {
-                mkdirSync(exampleDir, { recursive: true });
-            }
-            writeFileSync(exampleFullPath, DEFAULT_CONVENTION_REFERENCE, 'utf-8');
-            entries.push({ relativePath: exampleRelativePath, type: 'example' });
+        catch (error) {
+            failures.push({ relativePath, message: toErrorMessage(error) });
         }
     }
-    return entries;
+    return { entries, failures };
 }
-function isConfiguredMainCheckout(sourcePath) {
+function toComparablePath(path) {
     try {
-        const config = JSON.parse(readFileSync(join(sourcePath, CONFIG_FILE), 'utf-8'));
-        return ['teamId', 'projectId'].every((field) => typeof config[field] === 'string' && config[field].length > 0);
+        return canonicalizePath(path);
     }
     catch {
-        return false;
+        return path;
     }
 }
 /**
- * Materialize the worktree's `.agentteams` entry as a real link.
- *
- * Windows directory symlinks require SeCreateSymbolicLinkPrivilege (Developer
- * Mode or elevation), so an unprivileged win32 run fails with EPERM and used to
- * fall through to a copy — silently breaking the guarantee that a worktree
- * tracks the main checkout's conventions. Junctions need no privilege, which is
- * why `utils/conventionLink.ts` and the daemon's worktree helper already use
- * them; this is the same documented platform exception.
+ * Does the discovered config actually belong to the directory init was asked to
+ * initialize?
  *
- * The copy fallback stays for environments neither link type supports (UNC
- * paths, filesystems without reparse points). It dereferences because in a
- * non-git-root layout the source is itself a link, and copying a link
- * recursively re-creates it — which fails for exactly the same reason.
+ * `findProjectConfig` walks ancestors — outside a repository all the way to the
+ * filesystem root, which includes the global `~/.agentteams/config.json` that
+ * `mergeConfigSources` reads as a fallback. The new-project path, in contrast,
+ * always writes to `join(cwd, CONFIG_DIR, CONFIG_FILE)`. Reusing an ancestor's
+ * binding as a "configured project" would therefore make `init` in a fresh
+ * folder a silent no-op that reports someone else's project.
  */
-function linkConventionDir(sourcePath, targetPath) {
-    try {
-        if (process.platform === 'win32') {
-            // Junctions only accept absolute targets, so resolve the chain first.
-            symlinkSync(realpathSync(sourcePath), targetPath, 'junction');
-        }
-        else {
-            symlinkSync(sourcePath, targetPath, 'dir');
-        }
-        return { materialization: 'symlink' };
-    }
-    catch (error) {
-        cpSync(sourcePath, targetPath, { recursive: true, dereference: true });
-        return {
-            materialization: 'copy',
-            warning: `Could not create the .agentteams symlink (${error instanceof Error ? error.message : String(error)}). Copied the directory instead.`,
-        };
-    }
+function ownsDiscoveredConfig(resolvedCwd, configPath, userHomeDir) {
+    const configRoot = toComparablePath(dirname(dirname(configPath)));
+    // The global config is a fallback for commands, never a project binding.
+    if (configRoot === toComparablePath(userHomeDir))
+        return false;
+    const owners = new Set([toComparablePath(resolvedCwd)]);
+    const repositoryRoot = resolveGitTopLevel(resolvedCwd);
+    if (repositoryRoot)
+        owners.add(toComparablePath(repositoryRoot));
+    return owners.has(configRoot);
 }
 /**
- * Decide whether a plain directory sitting at the worktree's `.agentteams` may
- * be the copy an earlier failed link attempt left behind, rather than something
- * the user created. Identity is judged by the config file, the one artifact a
- * copy reproduces byte for byte — anything else is treated as the user's and is
- * never touched. This only authorizes moving the directory aside; whether the
- * moved copy may be deleted is decided separately by `findCopyOnlyFiles`.
+ * Classify init before it opens a browser or materializes any local adapters.
+ *
+ * This resolver is intentionally read-only: the linked-worktree branch calls
+ * `bootstrapLinkedWorktree` and the configured-project branch resolves its
+ * credential only after classification, so a classification never touches a
+ * keychain, a token, or the filesystem.
+ *
+ * `userHomeDir` is injectable for the same reason as in
+ * `getConfigurationNotFoundMessage`: `os.homedir()` does not follow a test's
+ * `process.env.HOME`, so the global-config rule would be untestable otherwise.
  */
-function isCopyOfMainCheckout(sourcePath, targetPath) {
-    try {
-        return (readFileSync(join(targetPath, CONFIG_FILE), 'utf-8') === readFileSync(join(sourcePath, CONFIG_FILE), 'utf-8'));
-    }
-    catch {
-        return false;
-    }
+export function detectInitExecutionContext(cwd, explicitAuthMode, userHomeDir = homedir()) {
+    const resolvedCwd = resolve(cwd);
+    const configPath = findProjectConfig(resolvedCwd);
+    const config = configPath ? loadProjectConfig(resolvedCwd) : null;
+    if (resolveLinkedWorktreeSource(resolvedCwd)) {
+        return { kind: 'linked-worktree', configPath, config };
+    }
+    const hasProjectBinding = typeof config?.teamId === 'string' &&
+        config.teamId.length > 0 &&
+        typeof config.projectId === 'string' &&
+        config.projectId.length > 0;
+    // An explicit --auth choice means the caller intends to reconnect instead of
+    // validating the existing binding through the configured-project fast path.
+    const kind = configPath && hasProjectBinding && ownsDiscoveredConfig(resolvedCwd, configPath, userHomeDir) && !explicitAuthMode
+        ? 'configured-project'
+        : 'new-project';
+    return { kind, configPath, config };
 }
 function toErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
-function hasIdenticalFile(sourceFile, backupFile) {
-    try {
-        const sourceStats = statSync(sourceFile);
-        if (!sourceStats.isFile() || sourceStats.size !== statSync(backupFile).size)
-            return false;
-        return readFileSync(sourceFile).equals(readFileSync(backupFile));
-    }
-    catch {
-        return false;
-    }
+export async function executeInitCommand(options) {
+    return withCommandContext('init', () => executeInitCommandWithContext(options));
 }
 /**
- * List every file in the moved-aside copy that the main checkout does not
- * already hold byte for byte. A worktree that ran as a copy accumulates its own
- * artifacts inside `.agentteams` — runner history, evidence, downloaded plans,
- * review findings — and none of them can be regenerated, so the copy is only
- * safe to delete when it is a strict subset of the source. Anything that is not
- * a plain matching file (a symlink, a special file, an unreadable directory)
- * counts as copy-only: it cannot be proven redundant.
+ * Wait for the browser round trip without losing Ctrl+C.
+ *
+ * Shared by both auth paths so the cancel handling — SIGINT plus the raw-mode
+ * ^C read a spinner would otherwise swallow — exists exactly once.
  */
-function findCopyOnlyFiles(backupPath, sourcePath) {
-    const copyOnlyFiles = [];
-    const walk = (relativeDir) => {
-        let entries;
-        try {
-            entries = readdirSync(join(backupPath, relativeDir), { withFileTypes: true });
-        }
-        catch {
-            copyOnlyFiles.push(relativeDir || '.');
+async function waitForBrowserCallback(authContext, spinner) {
+    let restored = false;
+    // Runs on every exit — success, timeout, or server error. Leaving it on the
+    // success path only meant a failed init handed the shell back in raw mode,
+    // with input no longer echoing until the user typed `reset`.
+    const restoreTerminal = () => {
+        if (restored) {
             return;
         }
-        for (const entry of entries) {
-            const relativePath = relativeDir ? join(relativeDir, entry.name) : entry.name;
-            if (entry.isDirectory()) {
-                walk(relativePath);
-            }
-            else if (!entry.isFile() || !hasIdenticalFile(join(sourcePath, relativePath), join(backupPath, relativePath))) {
-                copyOnlyFiles.push(relativePath);
-            }
+        restored = true;
+        process.removeListener('SIGINT', onSigint);
+        if (process.stdin.isTTY) {
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stdin.removeListener('data', onKeypress);
         }
     };
-    walk('');
-    return copyOnlyFiles;
-}
-/**
- * Park the copy outside every tracked surface while the link is created. A
- * backup next to `.agentteams` would show up in `git status` — the anchored
- * `/.agentteams` exclude is an exact match and does not cover a sibling name —
- * and a copied legacy `config.json` may carry the project apiKey.
- * `git-common-dir` is part of no working tree, so nothing can surface from
- * there. A worktree on a different volume cannot be renamed into it, and only
- * then does the in-worktree fallback apply — after registering its own exclude
- * pattern.
- */
-function moveConventionCopyAside(worktreePath, targetPath) {
-    const failures = [];
-    const commonDir = resolveGitCommonDir(worktreePath);
-    if (commonDir) {
-        const backupPath = join(commonDir, `${RELINK_BACKUP_NAME}-${process.pid}`);
-        try {
-            renameSync(targetPath, backupPath);
-            return { backupPath };
+    function onSigint() {
+        restoreTerminal();
+        spinner?.fail('Init cancelled.');
+        if (authContext.server.listening) {
+            authContext.server.close();
         }
-        catch (error) {
-            failures.push(toErrorMessage(error));
+        process.exit(0);
+    }
+    function onKeypress(key) {
+        if (key[0] === 0x03) {
+            onSigint();
         }
     }
-    const excludeResult = ensureLocalExclude(worktreePath, [toAnchoredExcludePattern(`.${RELINK_BACKUP_NAME}`)]);
-    if (excludeResult.status !== 'ready') {
-        failures.push(`the in-worktree backup cannot be kept out of git status (${excludeResult.issue?.message ?? 'local exclude is blocked'})`);
-        return { error: failures.join('; ') };
+    process.on('SIGINT', onSigint);
+    if (process.stdin.isTTY) {
+        process.stdin.setRawMode(true);
+        process.stdin.resume();
+        process.stdin.on('data', onKeypress);
     }
     try {
-        const backupPath = join(worktreePath, `.${RELINK_BACKUP_NAME}`);
-        renameSync(targetPath, backupPath);
-        return { backupPath };
+        return await authContext.waitForCallback();
     }
-    catch (error) {
-        failures.push(toErrorMessage(error));
-        return { error: failures.join('; ') };
-    }
-}
-/** Undo the move-aside. The target may hold a fresh link or a partial copy, and
- * `renameSync` onto a non-empty directory fails with ENOTEMPTY, so clear it
- * first and never let the restore itself escape as an exception. */
-function restoreConventionCopy(backupPath, targetPath) {
-    try {
-        rmSync(targetPath, { recursive: true, force: true });
-        renameSync(backupPath, targetPath);
-        return true;
-    }
-    catch {
-        return false;
+    finally {
+        restoreTerminal();
     }
 }
 /**
- * Replace a copied `.agentteams` directory with a real link so a worktree that
- * predates the link fix starts tracking the main checkout again. Without this
- * the `existing` branch treats the copy as settled and the worktree keeps
- * serving stale conventions forever.
+ * The default path: one browser screen, no agent API key, one convention write.
  *
- * The copy is moved aside first and is deleted only once the link is in place
- * *and* the copy proves to be a strict subset of the main checkout; otherwise
- * the backup is kept and its path reported. Any failure restores the original
- * directory, and a failed restore reports where the original is.
+ * The browser returns an authorization code plus the connection identifiers, so
+ * the second round trip that used to run here (`performPersonalTokenLogin`) is
+ * gone, and with it the `key_` that only ever existed to read the convention
+ * template once. `agentteams auth login` still owns that helper for the
+ * project-less login.
  */
-function promoteCopiedConventionDir(worktreePath, sourcePath, targetPath) {
-    if (!isCopyOfMainCheckout(sourcePath, targetPath)) {
-        return {
-            materialization: 'existing',
-            issue: {
-                code: 'link-occupied',
-                path: targetPath,
-                message: `The directory at ${targetPath} does not match the main checkout's ${CONFIG_DIR}; leaving it untouched. Remove it manually to restore the convention link.`,
-            },
-        };
+async function runUnifiedSetup(context) {
+    const pkce = createPkcePair();
+    let server;
+    try {
+        server = await startUnifiedSetupServer({ state: createAuthState() });
     }
-    const moved = moveConventionCopyAside(worktreePath, targetPath);
-    if ('error' in moved) {
-        return {
-            materialization: 'existing',
-            issue: {
-                code: 'link-create-failed',
-                path: targetPath,
-                message: `Could not move the copied ${CONFIG_DIR} aside at ${targetPath}: ${moved.error}`,
-            },
-        };
+    catch (error) {
+        throw new Error(`Failed to start local OAuth server: ${error instanceof Error ? error.message : String(error)}`);
     }
-    const { backupPath } = moved;
+    const authUrl = buildAuthorizeUrl({
+        port: server.port,
+        projectName: context.projectName,
+        authPathEnc: context.authPathEnc,
+        osType: detectOsType(),
+        state: server.state,
+        machineId: readOrCreateMachineId() ?? undefined,
+        codeChallenge: pkce.challenge,
+    });
+    await tryOpenBrowser(authUrl);
+    const authSpinner = createSpinner('Waiting for authentication... (Ctrl+C to cancel)');
     try {
-        const { materialization } = linkConventionDir(sourcePath, targetPath);
-        // A copy fallback here would only rebuild the state being replaced.
-        if (materialization !== 'symlink') {
-            throw new Error('the link could not be created and a copy would not restore the convention chain');
+        const callback = await waitForBrowserCallback(server, authSpinner);
+        authSpinner?.succeed();
+        if (isUnifiedSetupMetadataMissing(callback)) {
+            throw new Error(callback.legacyAgentKeyIssued ? SETUP_LEGACY_AGENT_KEY_HINT : SETUP_METADATA_MISSING_HINT);
         }
-    }
-    catch (error) {
-        const restored = restoreConventionCopy(backupPath, targetPath);
+        const setup = callback;
+        // Storing the credential comes before `saveConfig` on purpose: a login that
+        // cannot be kept throws here, so init stops rather than leaving a project
+        // configured for a credential nothing can find.
+        const client = getPersonalTokenClient(context.apiUrl);
+        const session = await client.exchangeAuthorizationCode({
+            code: setup.code,
+            codeVerifier: pkce.verifier,
+            // Must match the redirect the web registered the code against.
+            redirectUri: `http://localhost:${server.port}/callback`,
+        });
+        saveConfig(context.configPath, toConfig(setup, context.apiUrl));
+        // The identifiers are passed explicitly rather than re-read from disk: this
+        // command may run against a `cwd` that is not `process.cwd()`, and the
+        // config resolver only ever looks at the latter.
+        const runtimeConfig = await loadConfigWithCredential({
+            teamId: setup.teamId,
+            projectId: setup.projectId,
+            apiUrl: context.apiUrl,
+            authMode: 'personal-token',
+        });
+        // Falling back to a bare `conventionDownload()` here would undo the sentence
+        // above: with no config passed it re-resolves the project from
+        // `process.cwd()`, so an `init --cwd` (a worktree bootstrap included) would
+        // quietly pull conventions for whichever project the shell happens to sit
+        // in. Fail instead — this only happens if credential resolution regressed.
+        if (!runtimeConfig) {
+            throw new Error('Signed in, but the stored credential could not be read back, so the convention template was not downloaded. ' +
+                'Check `agentteams auth status`, then run `agentteams convention download` in this folder.');
+        }
+        // The convention template is now written by `conventionDownload` alone —
+        // exactly one write of `.agentteams/convention.md` per init — using the
+        // agent this setup actually created instead of "whichever config is first".
+        await conventionDownload({
+            cwd: context.cwd,
+            agentConfigId: setup.configId,
+            config: runtimeConfig,
+        });
         return {
-            materialization: 'existing',
-            issue: {
-                code: 'link-create-failed',
-                path: targetPath,
-                message: restored
-                    ? `Could not relink ${targetPath} to the main checkout: ${toErrorMessage(error)}`
-                    : `Could not relink ${targetPath} to the main checkout: ${toErrorMessage(error)}. The original ${CONFIG_DIR} was left at ${backupPath}; move it back manually.`,
+            authUrl,
+            teamId: setup.teamId,
+            projectId: setup.projectId,
+            agentName: setup.agentName,
+            seedPlanId: setup.seedPlanId ?? null,
+            personalLogin: {
+                email: session.identity.email,
+                nickname: session.identity.nickname,
+                persisted: client.state().persisted,
             },
         };
     }
-    const copyOnlyFiles = findCopyOnlyFiles(backupPath, sourcePath);
-    if (copyOnlyFiles.length > 0) {
-        return {
-            materialization: 'relinked',
-            issue: {
-                code: 'link-backup-retained',
-                path: backupPath,
-                message: `Kept ${copyOnlyFiles.length} file(s) that exist only in the replaced ${CONFIG_DIR} copy (${copyOnlyFiles.slice(0, 3).join(', ')}${copyOnlyFiles.length > 3 ? ', …' : ''}) at ${backupPath}; move what you still need out of it and delete it.`,
-            },
-        };
+    catch (error) {
+        authSpinner?.fail();
+        if (server.server.listening) {
+            server.server.close();
+        }
+        throw error;
     }
-    rmSync(backupPath, { recursive: true, force: true });
-    return { materialization: 'relinked' };
 }
-function isBrokenSymbolicLink(path) {
+/**
+ * The explicit `--auth api-key` compatibility path, unchanged.
+ *
+ * It keeps the legacy authorize URL (no `flow=setup`, no `code_challenge`), the
+ * legacy callback payload with its `key_`, and the direct convention write. CI
+ * users depend on this shape, so it is isolated from the default path rather
+ * than sharing a branch with it.
+ */
+async function runLegacyApiKeySetup(context) {
+    let authContext;
     try {
-        return lstatSync(path).isSymbolicLink() && !existsSync(path);
-    }
-    catch {
-        return false;
+        authContext = await startLocalAuthServer({ state: createAuthState() });
     }
-}
-export function bootstrapLinkedWorktree(cwd) {
-    let worktreePath;
-    try {
-        worktreePath = canonicalizePath(resolve(cwd));
+    catch (error) {
+        throw new Error(`Failed to start local OAuth server: ${error instanceof Error ? error.message : String(error)}`);
     }
-    catch {
-        return null;
-    }
-    if (resolveGitTopLevel(worktreePath) !== worktreePath)
-        return null;
-    const mainCheckoutRoot = resolveMainCheckoutRoot(worktreePath);
-    if (!mainCheckoutRoot)
-        return null;
-    const sourcePath = join(mainCheckoutRoot, CONFIG_DIR);
-    if (!existsSync(sourcePath) || !isConfiguredMainCheckout(sourcePath))
-        return null;
-    // The convention root is the parent of the canonical .agentteams directory.
-    // Following the canonical path resolves double links as well
-    // (worktree/.agentteams → member/.agentteams → non-git-root/.agentteams),
-    // so the entry point set is read from the actual root — not the member repo.
-    let conventionRoot = null;
+    const authUrl = buildAuthorizeUrl({
+        port: authContext.port,
+        projectName: context.projectName,
+        authPathEnc: context.authPathEnc,
+        osType: detectOsType(),
+        state: authContext.state,
+        machineId: readOrCreateMachineId() ?? undefined,
+    });
+    await tryOpenBrowser(authUrl);
+    const authSpinner = createSpinner('Waiting for authentication... (Ctrl+C to cancel)');
     try {
-        conventionRoot = dirname(canonicalizePath(sourcePath));
+        const authResult = await waitForBrowserCallback(authContext, authSpinner);
+        authSpinner?.succeed();
+        const runtimeConfig = {
+            teamId: authResult.teamId,
+            projectId: authResult.projectId,
+            apiKey: authResult.apiKey,
+            apiUrl: context.apiUrl,
+        };
+        const conventionContent = await withSpinner('Fetching convention template...', () => fetchConventionTemplate(authResult, context.apiUrl));
+        saveLegacyApiKeyConfig(context.configPath, toLegacyApiKeyConfig(authResult, context.apiUrl));
+        writeFileSync(context.conventionPath, conventionContent, 'utf-8');
+        await conventionDownload({ cwd: context.cwd, config: runtimeConfig });
+        return {
+            authUrl,
+            teamId: authResult.teamId,
+            projectId: authResult.projectId,
+            agentName: authResult.agentName,
+            seedPlanId: authResult.seedPlanId ?? null,
+        };
     }
-    catch {
-        conventionRoot = null;
-    }
-    const selectedEntryPoints = conventionRoot
-        ? AGENT_ENTRY_POINT_FILES.map((f) => f.value).filter((relativePath) => isReadableRegularFile(join(conventionRoot, relativePath)))
-        : [];
-    // Local exclude registration comes before creating any managed path so a
-    // bootstrap never dirties the shared repository state.
-    const issues = [];
-    const excludeResult = ensureLocalExclude(worktreePath, [
-        toAnchoredExcludePattern(CONFIG_DIR),
-        ...selectedEntryPoints.map(toAnchoredExcludePattern),
-    ]);
-    if (excludeResult.status === 'blocked' && excludeResult.issue) {
-        issues.push(excludeResult.issue);
-    }
-    const excludeReady = excludeResult.status === 'ready';
-    const targetPath = join(worktreePath, CONFIG_DIR);
-    let materialization;
-    let warning;
-    if (!excludeReady) {
-        materialization = existsSync(targetPath) ? 'existing' : 'blocked';
-    }
-    else if (isBrokenSymbolicLink(targetPath)) {
-        unlinkSync(targetPath);
-        ({ materialization, warning } = linkConventionDir(sourcePath, targetPath));
-    }
-    else if (existsSync(targetPath)) {
-        // An entry that is already a link is settled; a plain directory is either a
-        // copy left by a failed link attempt or something the user put there.
-        if (lstatSync(targetPath).isSymbolicLink()) {
-            materialization = 'existing';
-        }
-        else {
-            const promotion = promoteCopiedConventionDir(worktreePath, sourcePath, targetPath);
-            materialization = promotion.materialization;
-            if (promotion.issue) {
-                issues.push(promotion.issue);
-            }
+    catch (error) {
+        authSpinner?.fail();
+        if (authContext.server.listening) {
+            authContext.server.close();
         }
+        throw error;
     }
-    else {
-        ({ materialization, warning } = linkConventionDir(sourcePath, targetPath));
-    }
-    const entryPointResult = ensureConventionEntryPoints(worktreePath, selectedEntryPoints, {
-        allowCreate: excludeReady,
-        validateExistingReference: false,
+}
+async function runConfiguredProjectInit(cwd, executionContext, adapterOptions) {
+    const configPath = executionContext.configPath;
+    const projectConfig = executionContext.config;
+    if (!configPath || !projectConfig) {
+        throw new Error('The configured project could not be read. Run `agentteams init --auth personal-token` to relink it.');
+    }
+    // Only the identifiers are forwarded as overrides. Handing the whole config
+    // document to `loadConfigWithCredential` would put it above the environment in
+    // `mergeConfigSources` (global → project → env → options), so AGENTTEAMS_*
+    // would be ignored on this path alone, and a leftover legacy `apiKey` would be
+    // read as an *explicit* key — skipping the migration warning and the refresh
+    // slot. `apiUrl` follows the same env-first rule as `resolveApiUrl()`.
+    const runtimeConfig = await loadConfigWithCredential({
+        teamId: projectConfig.teamId,
+        projectId: projectConfig.projectId,
+        apiUrl: normalizeApiUrl(process.env.AGENTTEAMS_API_URL || projectConfig.apiUrl || DEFAULT_API_URL),
+        // `loadConfigWithCredential` normally discovers the project from
+        // `process.cwd()`, but init may repair an explicit `options.cwd`. An empty
+        // override is intentional: it prevents a legacy key from an unrelated
+        // ambient project from becoming this binding's fallback credential.
+        apiKey: process.env.AGENTTEAMS_API_KEY || projectConfig.apiKey || '',
+        ...(projectConfig.authMode ? { authMode: projectConfig.authMode } : {}),
     });
-    issues.push(...entryPointResult.issues);
-    const entryPoints = entryPointResult.entries.map(({ relativePath, state }) => ({ relativePath, state }));
-    const result = {
+    if (!runtimeConfig) {
+        throw new Error("The existing project binding has no usable credential. Run 'agentteams auth login'.");
+    }
+    // `checkConventionFreshness` reports "no changes" when the download manifest is
+    // absent, which is exactly the state of a project that has never synced. Left
+    // alone it would report READY while `.agentteams/convention.md` and
+    // `.agentteams/platform/*` — the rules every runner loads as always_on — are
+    // missing, so init treats that state as "sync required" instead.
+    const conventionDir = dirname(configPath);
+    const conventionsNeverSynced = !existsSync(join(conventionDir, CONVENTION_MANIFEST_FILE)) || !existsSync(join(conventionDir, CONVENTION_FILE));
+    let freshness;
+    let conventionError;
+    let conventionsUpdated = false;
+    try {
+        freshness = await conventionStatus({ cwd, config: runtimeConfig });
+        if (freshness.conventionUpdateAvailable || conventionsNeverSynced) {
+            await conventionDownload({ cwd, config: runtimeConfig });
+            conventionsUpdated = true;
+        }
+    }
+    catch (error) {
+        conventionError = toErrorMessage(error);
+    }
+    // The same adapters the new-project path runs. Without them a re-run of
+    // `agentteams init` — which is exactly what every adapter retry command tells
+    // the user to do — verified the binding and changed nothing else.
+    const adapterPass = await runLocalAdapterPass(cwd, adapterOptions);
+    const doctor = await executeDoctorCommand({ cwd, installWorktreeHook: adapterOptions.installWorktreeHook });
+    const configuredAuthMode = runtimeConfig.credentialSource === 'personal-token' ? 'personal-token' : 'api-key';
+    const readiness = buildConfiguredProjectReadiness(conventionError, doctor, adapterPass.adapters);
+    return {
         success: true,
-        mode: 'worktree',
-        worktreePath,
-        sourcePath,
-        targetPath,
-        materialization,
-        entryPoints,
-        issues,
+        mode: 'configured-project',
+        configPath,
+        conventionPath: join(dirname(configPath), CONVENTION_FILE),
+        teamId: runtimeConfig.teamId,
+        projectId: runtimeConfig.projectId,
+        authMode: configuredAuthMode,
+        credentialSource: runtimeConfig.credentialSource,
+        conventionsUpdated,
+        ...(freshness ? { conventionStatus: freshness } : {}),
+        ...(conventionError ? { conventionError } : {}),
+        doctor,
+        readiness,
+        agentFiles: adapterPass.agentFiles,
+        localAdapters: adapterPass.adapters,
+        ...(adapterPass.postCheckoutHook ? { postCheckoutHook: adapterPass.postCheckoutHook } : {}),
+    };
+}
+/**
+ * Roll the doctor verdict *and* the local adapter outcomes into one
+ * `local-adapters` step.
+ *
+ * Both sources matter: the doctor owns the layout-level diagnosis (member repo
+ * links, config permissions) while the adapters own the files this command
+ * writes, and a step that reported only one of them would call the stage READY
+ * while the other was degraded.
+ */
+function buildConfiguredProjectReadiness(conventionError, doctor, adapters) {
+    const conventionStep = conventionError
+        ? {
+            stage: 'convention-sync',
+            status: 'DEGRADED',
+            issues: [{ code: 'convention-sync-failed', message: conventionError }],
+            retryCommand: 'agentteams convention download',
+        }
+        : { stage: 'convention-sync', status: 'READY', issues: [] };
+    const degradedAdapters = adapters.filter((adapter) => adapter.status === 'DEGRADED');
+    const doctorDegraded = doctor.status === 'DEGRADED';
+    // A NOT_APPLICABLE doctor still contributes its reason: `printReadiness` shows
+    // issues at every status, so the note survives even when an adapter succeeded
+    // and the step as a whole is READY.
+    const issues = [
+        ...(doctor.status === 'READY' ? [] : doctor.issues.map(({ code, message }) => ({ code, message }))),
+        ...adapters.filter((adapter) => adapter.status !== 'READY').flatMap((adapter) => adapter.issues),
+    ];
+    const status = doctorDegraded || degradedAdapters.length > 0
+        ? 'DEGRADED'
+        : adapters.some((adapter) => adapter.status === 'READY')
+            ? 'READY'
+            : 'SKIPPED';
+    const localAdaptersStep = {
+        stage: 'local-adapters',
+        status,
+        issues: status === 'DEGRADED' && issues.length === 0
+            ? [{ code: 'doctor-degraded', message: 'Local adapters still need attention.' }]
+            : issues,
+        ...(status === 'DEGRADED' ? { retryCommand: degradedAdapters[0]?.retryCommand ?? 'agentteams doctor' } : {}),
     };
-    if (warning) {
-        result.warning = warning;
+    return [
+        { stage: 'project-binding', status: 'READY', issues: [] },
+        { stage: 'credential', status: 'READY', issues: [] },
+        conventionStep,
+        localAdaptersStep,
+    ];
+}
+/**
+ * Roll the per-adapter outcomes into the single `local-adapters` readiness step.
+ *
+ * A degraded adapter dominates, and `SKIPPED` requires *every* adapter to have
+ * skipped — which the always-on `.gitignore` adapter makes unreachable today.
+ * The rule is kept honest for the day that adapter becomes conditional, but it
+ * is deliberately not what makes a partial skip visible: one green
+ * `[READY] local-adapters` line above a hook that was never installed is exactly
+ * the mismatch this list exists to prevent, so `printReadiness` prints the
+ * issues of every step regardless of its status. Every non-READY adapter
+ * contributes its issues, so the reason travels with the line.
+ */
+function buildNewProjectReadiness(adapters) {
+    const degraded = adapters.filter((adapter) => adapter.status === 'DEGRADED');
+    const status = degraded.length > 0 ? 'DEGRADED' : adapters.some((adapter) => adapter.status === 'READY') ? 'READY' : 'SKIPPED';
+    const localAdaptersStep = {
+        stage: 'local-adapters',
+        status,
+        issues: adapters.filter((adapter) => adapter.status !== 'READY').flatMap((adapter) => adapter.issues),
+        ...(degraded.length > 0 ? { retryCommand: degraded[0].retryCommand ?? 'agentteams doctor' } : {}),
+    };
+    return [
+        { stage: 'project-binding', status: 'READY', issues: [] },
+        { stage: 'credential', status: 'READY', issues: [] },
+        { stage: 'convention-sync', status: 'READY', issues: [] },
+        localAdaptersStep,
+    ];
+}
+/**
+ * Run one local adapter without letting it fail the init that already
+ * succeeded.
+ *
+ * By the time these run, the credential is in the OS store and the config is on
+ * disk. An exception escaping from here used to surface as
+ * `Initialization failed: EACCES ...` for a project that was, in fact, fully
+ * connected — so every adapter is isolated and reports `DEGRADED` with its own
+ * retry command instead. Failures are never swallowed: an adapter that throws
+ * always produces an issue.
+ */
+async function runLocalAdapter(adapter, retryCommand, run) {
+    try {
+        const outcome = await run();
+        return {
+            adapter,
+            status: outcome.status,
+            issues: outcome.issues,
+            ...(outcome.status === 'DEGRADED' ? { retryCommand } : {}),
+        };
+    }
+    catch (error) {
+        return {
+            adapter,
+            status: 'DEGRADED',
+            issues: [{ code: `${adapter}-failed`, message: toErrorMessage(error) }],
+            retryCommand,
+        };
     }
-    return result;
 }
-export async function executeInitCommand(options) {
-    return withCommandContext('init', () => executeInitCommandWithContext(options));
+/**
+ * The four local adapters, run identically by both init paths.
+ *
+ * This is shared rather than duplicated because the adapters advertise retry
+ * commands (`agentteams init`, `agentteams init --agent-files <list>`) and those
+ * are all `agentteams init`. A project that has just been configured takes the
+ * configured-project fast path on the *next* run, so while this pass lived only
+ * in the new-project branch every retry command it printed was a no-op: the
+ * user was told how to fix a degraded `.gitignore` — the single thing keeping a
+ * legacy `--auth api-key` config's agent key out of the repository — by running
+ * a command that would not touch `.gitignore` at all.
+ */
+async function runLocalAdapterPass(cwd, options) {
+    const adapters = [];
+    adapters.push(
+    // `.gitignore` is not conditional and never will be: it is what keeps
+    // `.agentteams` — including a legacy config carrying an apiKey — out of the
+    // repository.
+    await runLocalAdapter('gitignore', 'agentteams init', () => {
+        ensureGitignore(cwd);
+        return { status: 'READY', issues: [] };
+    }));
+    let selectedFiles = [];
+    let agentFiles = [];
+    adapters.push(await runLocalAdapter('agent-entry-points', 'agentteams init --agent-files <list>', async () => {
+        selectedFiles = await resolveAgentFileSelection(cwd, options.explicitAgentFiles, {
+            allowPrompt: options.allowPrompt,
+        });
+        if (selectedFiles.length === 0) {
+            return {
+                status: 'SKIPPED',
+                issues: [
+                    {
+                        code: 'agent-entry-points-not-selected',
+                        message: 'No agent entry point file was created. Pass --agent-files (CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules/agentteams.mdc) to create them explicitly.',
+                    },
+                ],
+            };
+        }
+        // Assigned before the failure check so a partially failed write still
+        // reports the files that actually reached disk.
+        const written = generateAgentEntryPointFiles(cwd, selectedFiles, {
+            createExample: options.agentFilesExample,
+        });
+        agentFiles = written.entries;
+        if (written.failures.length > 0) {
+            return {
+                status: 'DEGRADED',
+                issues: written.failures.map((failure) => ({
+                    code: 'agent-entry-point-write-failed',
+                    message: `${failure.relativePath} could not be written: ${failure.message}`,
+                })),
+            };
+        }
+        const skipped = agentFiles.filter((file) => file.type === 'skipped');
+        if (skipped.length === agentFiles.length) {
+            return {
+                status: 'SKIPPED',
+                issues: [
+                    {
+                        code: 'agent-entry-points-exist',
+                        message: `Left ${skipped.map((file) => file.relativePath).join(', ')} untouched because the file already exists.`,
+                    },
+                ],
+            };
+        }
+        return { status: 'READY', issues: [] };
+    }));
+    adapters.push(await runLocalAdapter('gemini-ignore', 'agentteams init --agent-files GEMINI.md', () => {
+        if (!selectedFiles.includes('GEMINI.md')) {
+            return {
+                status: 'SKIPPED',
+                issues: [{ code: 'gemini-ignore-not-selected', message: 'GEMINI.md was not selected.' }],
+            };
+        }
+        ensureGeminiIgnore(cwd);
+        return { status: 'READY', issues: [] };
+    }));
+    // A git-root project shares one hooks directory with all its worktrees, so the
+    // managed post-checkout hook lets future `git worktree add` runs bootstrap
+    // conventions automatically (via `agentteams init`). It is no longer installed
+    // unconditionally: a repository that never uses linked worktrees got its
+    // shared `.git/hooks` written for a hook it would never fire. The gate itself
+    // lives in `shouldInstallWorktreeHook` so `agentteams doctor` — which this
+    // command's own fast path invokes — applies the same rule.
+    let postCheckoutHook;
+    adapters.push(await runLocalAdapter('post-checkout-hook', 'agentteams doctor', () => {
+        if (resolveGitTopLevel(cwd) === null) {
+            // Non-git roots (a parent folder grouping member repos) have no
+            // git-common dir; doctor owns their per-member hooks instead.
+            return {
+                status: 'SKIPPED',
+                issues: [
+                    {
+                        code: 'post-checkout-hook-not-a-git-root',
+                        message: "Not a git repository root, so no worktree bootstrap hook was installed. Run 'agentteams doctor' to set up member repository hooks.",
+                    },
+                ],
+            };
+        }
+        if (!shouldInstallWorktreeHook(cwd, { force: options.installWorktreeHook })) {
+            return {
+                status: 'SKIPPED',
+                issues: [
+                    {
+                        code: 'post-checkout-hook-no-worktrees',
+                        message: "This repository has no linked git worktrees, so the worktree bootstrap hook was not installed. Run 'agentteams init --install-worktree-hook' (or 'agentteams doctor --install-worktree-hook') to install it anyway.",
+                    },
+                ],
+            };
+        }
+        postCheckoutHook = ensurePostCheckoutHook(cwd);
+        if (postCheckoutHook.status === 'blocked') {
+            // The existing issue code and message, verbatim — the user hook
+            // protection in `ensurePostCheckoutHook` is what produced them.
+            return {
+                status: 'DEGRADED',
+                issues: [
+                    {
+                        code: postCheckoutHook.issue?.code ?? 'post-checkout-hook-blocked',
+                        message: postCheckoutHook.issue?.message ?? 'The worktree bootstrap hook could not be installed.',
+                    },
+                ],
+            };
+        }
+        return { status: 'READY', issues: [] };
+    }));
+    return { adapters, agentFiles, ...(postCheckoutHook ? { postCheckoutHook } : {}) };
 }
 async function executeInitCommandWithContext(options) {
     const cwd = resolve(options?.cwd ?? process.cwd());
-    // Only an explicit compatibility request persists the callback's agent key.
+    // Only an explicit compatibility request goes through the agent-key round trip.
     const authMode = options?.authMode === 'api-key' ? 'api-key' : 'personal-token';
-    const worktreeResult = bootstrapLinkedWorktree(cwd);
-    if (worktreeResult)
-        return worktreeResult;
-    const configPath = join(cwd, CONFIG_DIR, CONFIG_FILE);
-    const conventionPath = join(cwd, CONFIG_DIR, CONVENTION_FILE);
-    const projectName = basename(cwd);
-    let authContext;
-    try {
-        authContext = await startLocalAuthServer({ state: createAuthState() });
+    // Parsed before anything opens a browser: a typo in --agent-files must not be
+    // discovered after the user has already signed in.
+    const explicitAgentFiles = parseAgentFilesOption(options?.agentFiles);
+    const adapterOptions = {
+        explicitAgentFiles,
+        agentFilesExample: options?.agentFilesExample === true,
+        installWorktreeHook: options?.installWorktreeHook === true,
+        // Overridden per path below: only a first-time setup may prompt.
+        allowPrompt: true,
+    };
+    const executionContext = detectInitExecutionContext(cwd, options?.authMode);
+    if (executionContext.kind === 'linked-worktree') {
+        const worktreeResult = bootstrapLinkedWorktree(cwd);
+        if (worktreeResult)
+            return worktreeResult;
     }
-    catch (error) {
-        throw new Error(`Failed to start local OAuth server: ${error instanceof Error ? error.message : String(error)}`);
+    if (executionContext.kind === 'configured-project') {
+        try {
+            return await runConfiguredProjectInit(cwd, executionContext, { ...adapterOptions, allowPrompt: false });
+        }
+        catch (error) {
+            throw new Error(`Initialization failed: ${toErrorMessage(error)}`);
+        }
     }
+    const configPath = join(cwd, CONFIG_DIR, CONFIG_FILE);
+    const conventionPath = join(cwd, CONFIG_DIR, CONVENTION_FILE);
     let authPathEnc;
     try {
         authPathEnc = encryptAuthPath(cwd);
@@ -637,125 +917,42 @@ async function executeInitCommandWithContext(options) {
     catch {
         authPathEnc = undefined;
     }
-    const authUrl = buildAuthorizeUrl(authContext.port, projectName, authPathEnc, detectOsType(), authContext.state, readOrCreateMachineId() ?? undefined);
-    await tryOpenBrowser(authUrl);
-    const authSpinner = createSpinner('Waiting for authentication... (Ctrl+C to cancel)');
-    const cleanup = () => {
-        if (authContext.server.listening) {
-            authContext.server.close();
-        }
+    const context = {
+        cwd,
+        projectName: basename(cwd),
+        apiUrl: resolveApiUrl(),
+        configPath,
+        conventionPath,
+        authPathEnc,
     };
+    let setup;
     try {
-        const authResult = await new Promise((resolve, reject) => {
-            const onSigint = () => {
-                authSpinner?.fail('Init cancelled.');
-                cleanup();
-                process.exit(0);
-            };
-            process.on('SIGINT', onSigint);
-            if (process.stdin.isTTY) {
-                process.stdin.setRawMode(true);
-                process.stdin.resume();
-                process.stdin.on('data', (key) => {
-                    if (key[0] === 0x03) {
-                        process.stdin.setRawMode(false);
-                        process.stdin.pause();
-                        onSigint();
-                    }
-                });
-            }
-            authContext
-                .waitForCallback()
-                .then((result) => {
-                process.removeListener('SIGINT', onSigint);
-                if (process.stdin.isTTY) {
-                    process.stdin.setRawMode(false);
-                    process.stdin.pause();
-                    process.stdin.removeAllListeners('data');
-                }
-                resolve(result);
-            })
-                .catch(reject);
-        });
-        authSpinner?.succeed();
-        const apiUrl = resolveApiUrl();
-        const runtimeConfig = {
-            teamId: authResult.teamId,
-            projectId: authResult.projectId,
-            apiKey: authResult.apiKey,
-            apiUrl,
-        };
-        const conventionContent = await withSpinner('Fetching convention template...', () => fetchConventionTemplate(authResult, apiUrl));
-        // The project is known now, so the personal login can run before anything is
-        // written: a failed login must not leave a config with no usable credential.
-        // A login that cannot be stored throws here, which is the point — init stops
-        // before `saveConfig` rather than leaving a half-configured project behind.
-        let personalLogin;
-        const warnings = [];
-        if (authMode === 'personal-token') {
-            const outcome = await performPersonalTokenLogin({ apiUrl, projectName });
-            personalLogin = {
-                email: outcome.identity.email,
-                nickname: outcome.identity.nickname,
-                persisted: outcome.persisted,
-            };
-        }
-        if (authMode === 'api-key') {
-            saveLegacyApiKeyConfig(configPath, toLegacyApiKeyConfig(authResult, apiUrl));
-        }
-        else {
-            saveConfig(configPath, toConfig(authResult, apiUrl));
-        }
-        writeFileSync(conventionPath, conventionContent, 'utf-8');
-        await conventionDownload({ cwd, config: runtimeConfig });
-        // Last use of the agent key is the convention download above.
-        let agentKeyRevoked;
-        if (authMode === 'personal-token') {
-            agentKeyRevoked = await revokeInitAgentKey(authResult, apiUrl);
-            if (!agentKeyRevoked) {
-                warnings.push(`The agent key created for "${authResult.agentName}" could not be revoked and is still valid. ` +
-                    'Revoke it in the AgentTeams web app (project settings → agents) — it was never written to this repository.');
-            }
-        }
-        ensureGitignore(cwd);
-        const selectedFiles = await promptAgentFileSelection();
-        if (selectedFiles.includes('GEMINI.md')) {
-            ensureGeminiIgnore(cwd);
-        }
-        const agentFiles = generateAgentEntryPointFiles(cwd, selectedFiles);
-        const seedPlanId = authResult.seedPlanId ?? null;
-        const seedPlanWebUrl = seedPlanId ? `${AUTH_BASE_URL.replace(/\/+$/, '')}/go?type=plan&id=${seedPlanId}` : null;
-        // A git-root project shares one hooks directory with all its worktrees, so
-        // installing the managed post-checkout hook here lets future `git worktree
-        // add` runs bootstrap conventions automatically (via `agentteams init`).
-        // Non-git roots (a parent folder grouping member repos) have no git-common
-        // dir; `agentteams doctor` owns their per-member hooks instead, so skip.
-        let postCheckoutHook;
-        if (resolveGitTopLevel(cwd) !== null) {
-            postCheckoutHook = ensurePostCheckoutHook(cwd);
-        }
-        return {
-            success: true,
-            authUrl,
-            configPath,
-            conventionPath,
-            teamId: authResult.teamId,
-            projectId: authResult.projectId,
-            agentName: authResult.agentName,
-            agentFiles,
-            seedPlanId,
-            seedPlanWebUrl,
-            postCheckoutHook,
-            authMode,
-            ...(personalLogin ? { personalLogin } : {}),
-            ...(agentKeyRevoked === undefined ? {} : { agentKeyRevoked }),
-            ...(warnings.length > 0 ? { warning: warnings.join(' ') } : {}),
-        };
+        setup = authMode === 'api-key' ? await runLegacyApiKeySetup(context) : await runUnifiedSetup(context);
     }
     catch (error) {
-        authSpinner?.fail();
-        cleanup();
         throw new Error(`Initialization failed: ${error instanceof Error ? error.message : String(error)}`);
     }
+    // Everything below runs *after* the credential and the config are stored, so
+    // none of it may fail the init. Each adapter reports itself.
+    const { adapters: localAdapters, agentFiles, postCheckoutHook } = await runLocalAdapterPass(cwd, adapterOptions);
+    const seedPlanId = setup.seedPlanId;
+    const seedPlanWebUrl = seedPlanId ? `${AUTH_BASE_URL.replace(/\/+$/, '')}/go?type=plan&id=${seedPlanId}` : null;
+    return {
+        success: true,
+        authUrl: setup.authUrl,
+        configPath,
+        conventionPath,
+        teamId: setup.teamId,
+        projectId: setup.projectId,
+        agentName: setup.agentName,
+        agentFiles,
+        seedPlanId,
+        seedPlanWebUrl,
+        postCheckoutHook,
+        authMode,
+        readiness: buildNewProjectReadiness(localAdapters),
+        localAdapters,
+        ...(setup.personalLogin ? { personalLogin: setup.personalLogin } : {}),
+    };
 }
 //# sourceMappingURL=init.js.map