@awebai/oats 0.29.2 → 0.29.4

package/bin/oats.mjs

@@ -55,7 +55,8 @@ const rawArgs = process.argv.slice(2);
 const KERNEL_SWITCHES = new Set(["allow-child-spawns", "apply", "check", "clear", "delete-branch", "discard-worktree", "dry-run", "ephemeral", "force", "help", "host", "json", "keep-dir", "keep-env", "no-child-spawns", "no-launch", "no-recursive", "no-yolo", "plan", "policy", "preview", "print", "replace", "self", "verbose", "yes", "yolo"]);
 /** `--flag=value` is `--flag value`: every kernel reader (flag(), valueFlag(), the onboard and
  *  routed-command loops) then applies the spaced form's validation to it. `problem` is an empty
- *  `--flag=` or a switch given a value. */
+ *  `--flag=`, a switch given a value, or a value that is itself an option (`--model=--yolo`):
+ *  expanded, it would be a flag token every reader sees, which the spaced form can never carry. */
 function expandInlineValues(argv) {
   const out = [];
   let problem;
@@ -63,7 +64,7 @@ function expandInlineValues(argv) {
     const eq = a.indexOf("=");
     if (!a.startsWith("--") || eq <= 2) { out.push(a); continue; }
     const name = a.slice(2, eq), value = a.slice(eq + 1);
-    problem ??= KERNEL_SWITCHES.has(name) ? `--${name} takes no value (got ${a})` : value === "" ? `--${name}= needs a value` : undefined;
+    problem ??= KERNEL_SWITCHES.has(name) ? `--${name} takes no value (got ${a})` : value === "" ? `--${name}= needs a value` : value.startsWith("--") ? `--${name}= takes a value, not an option (got ${a})` : undefined;
     out.push(`--${name}`, value);
   }
   return { argv: out, problem };
@@ -2144,7 +2145,7 @@ async function scheduleCmd() {
         if (args.includes("--host")) return out(tickHost({ io, dryRun }));
         const reg = readRegistry();
         const tctx = scopeAutomations(ws(), { io, refresh: !dryRun });
-        const considered = withHostLock(() => [...(tctx.refresh && !tctx.refresh.ok ? [{ workspace: ws(), action: "error", error: `automations refresh: ${tctx.refresh.error}` }] : []), ...tickWorkspace(ws(), { io, reg, wsList: reg.workspaces.includes(ws()) ? reg.workspaces : [...reg.workspaces, ws()], dryRun, ctx: tctx }), ...tickTriggers(ws(), { io, dryRun, ctx: tctx })]);
+        const considered = withHostLock(() => [...(tctx.refresh && !tctx.refresh.ok ? [{ workspace: ws(), action: "error", error: `automations refresh: ${tctx.refresh.error}` }] : []), ...tickWorkspace(ws(), { io, reg, wsList: reg.workspaces.includes(ws()) ? reg.workspaces : [...reg.workspaces, ws()], dryRun, ctx: tctx }), ...tickTriggers(ws(), { io, dryRun, ctx: tctx, reg, wsList: reg.workspaces.includes(ws()) ? reg.workspaces : [...reg.workspaces, ws()] })]);
         return out({ tickedAt: new Date().toISOString(), considered, scheduler: schedulerStatus(ws(), io) });
       }
       case "host": {
@@ -2503,7 +2504,11 @@ async function capabilityCommand() {
     const teamCtx = teamEnv(resolvedFromPrepared(hit.prepared, hit.deployment));
     // No home, so no recorded soul: the soul's per-commit copy is OATS_SOUL when a spawn
     // already fetched exactly this commit; otherwise the command gets none (never ambient).
-    const cachedSoul = hit.soul?.commit ? join(hit.deployment, "agents", hit.soul.name, "souls", String(hit.soul.commit).slice(0, 12)) : null;
+    // The agent directory is the soul entry's own (a package soul's is `<package>--<soul>`), never
+    // the bare name, which a same-named member soul's copy may occupy (as instance-inspect does).
+    const { agentDirOf } = await import("../lib/instance-resolution.mjs");
+    const entry = hit.prepared?.soulEntry;
+    const cachedSoul = entry?.commit ? join(hit.deployment, "agents", agentDirOf(entry), "souls", String(entry.commit).slice(0, 12)) : null;
     return runManifestCommand({ capability: hit.module.name, ...hit.manifest }, { settings: hit.settings, origins: hit.resolution?.payloadOrigins?.[hit.module.name] }, teamCtx, hit.ensureTree, cachedSoul && existsSync(join(cachedSoul, "soul.yaml")) ? realpathSync(cachedSoul) : undefined);
   }
 

package/capabilities/oats-aweb/bin/oats-aweb.mjs

@@ -45,7 +45,6 @@ import { assessCapturedSessionReadiness, querySelectedKernel } from "../lib/sess
 import { runCapturedNative } from "../lib/captured-native.mjs";
 import { CUSTODY_ATTACH_MIN, grantYamlCustodySocket, parseBindingJson } from "../lib/binding-wire.mjs";
 import { custodyPreflight } from "../lib/grant-custody.mjs";
-import { PERSONAL_ROOT_DEFERRED_WARNING, personalRootDeclared } from "../lib/personal-team.mjs";
 import { runtimeDeliveryFor, wakeRegistration } from "../lib/wake-receive.mjs";
 
 /** Run a command as ARGV — never a shell string. Team ids, aliases, instance
@@ -498,7 +497,7 @@ function globalGrantSpawn() {
   const teamWarnings = [];
   const unmappedPrimary = !team ? unmappedPrimaryRow() : undefined;
   if (!team) team = activeTeamAt(custody);
-  if (unmappedPrimary && team) teamWarnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using personal team ${team}`);
+  if (unmappedPrimary && team) teamWarnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using the default team ${team}`);
   if (!team) fatal("identity.mode \"global\" requires settings.oats.aweb.team or an active team at the resident custody root before minting a grant");
   const grantHome = join(home, ".aweb-identity");
   if (existsSync(grantHome)) fatal(`${grantHome} already exists; refusing to overwrite an existing aweb session grant home`);
@@ -758,9 +757,9 @@ function validateJoinLabels(labels, { action = "join" } = {}) {
   const eligible = eligibleTeams();
   const byLabel = new Map(eligible.map((t) => [t.label, t]));
   for (const label of labels) {
-    if (action === "leave" && label === "personal") {
-      const error = new Error(`E_TEAM_PERSONAL: ${label} is the personal team and cannot be left`);
-      error.code = "E_TEAM_PERSONAL";
+    if (action === "leave" && label === "default") {
+      const error = new Error(`E_TEAM_DEFAULT: ${label} is the workspace's default team and cannot be left`);
+      error.code = "E_TEAM_DEFAULT";
       throw error;
     }
     if (!LABEL_RE.test(label) || !byLabel.has(label)) {
@@ -801,14 +800,19 @@ function readCapabilityMeta() {
   if (process.env.OATS_META) { try { return withProviderTeams(JSON.parse(process.env.OATS_META || "{}")); } catch { return withProviderTeams({}); } }
   try { return withProviderTeams(JSON.parse(readFileSync(join(home, "instance.json"), "utf8")).capabilityMeta?.["oats.aweb"] || {}); } catch { return withProviderTeams({}); }
 }
+function defaultTeamSource(meta = {}) {
+  const recorded = meta.defaultTeam?.source;
+  if (recorded === "setting" || recorded === "root") return recorded;
+  return payloadTeam().team ? "setting" : "root";
+}
 function teamsDocument(meta = readCapabilityMeta()) {
   const teams = parseOatsTeams();
   const joined = joinedTeamsOf(meta);
   const joinedLabels = new Set(joined.map((j) => j.label));
   const primary = primaryTeamLabel();
-  const personalTeam = meta.personal?.team || meta.team || meta.identity?.team || payloadTeam().team || null;
+  const defaultTeam = meta.defaultTeam?.team || meta.team || meta.identity?.team || payloadTeam().team || null;
   return {
-    personal: { team: personalTeam, ...(meta.personal?.source ? { source: meta.personal.source } : {}) },
+    defaultTeam: { team: defaultTeam, source: defaultTeamSource(meta) },
     primary,
     eligible: teams.filter((t) => t.mapped && t.team).map((t) => ({ label: t.label, team: t.team, joined: joinedLabels.has(t.label) })),
     joined: joined.map((j) => ({ label: j.label, team: j.team, identityHome: j.identityHome, receive: j.receive || "poll", since: j.since })),
@@ -888,7 +892,7 @@ function parseHomeCommandArgs(argv = process.argv.slice(3)) {
 }
 function outputTeamsDocument(doc, json) {
   if (json) { console.log(JSON.stringify(doc)); return; }
-  console.log(`personal: ${doc.personal.team || "unknown"}`);
+  console.log(`default team: ${doc.defaultTeam.team || "unknown"}`);
   for (const row of doc.eligible) console.log(`${row.joined ? "joined" : "eligible"}: ${row.label} (${row.team})`);
   for (const label of doc.unmapped) console.log(`unmapped: ${label}`);
 }
@@ -934,9 +938,7 @@ function runTeamsCommand(kind) {
 
 /** The primary identity's team and the root that mints it, exactly as 1.14.2:
  *  the config's `team:` (id, then name) wins, else the root's active team.
- *  Per-workspace personal-team enrollment is deferred to 1.16, so this makes no
- *  `aw auth` or `aw team ensure` call and a declared roots.personal is ignored
- *  with a warning. Exits through fatal() on refusal. */
+ *  Exits through fatal() on refusal. */
 function resolvePrimaryTeam() {
   const warnings = [];
   const root = awebRoot();
@@ -945,7 +947,7 @@ function resolvePrimaryTeam() {
   const source = team ? "setting" : "root";
   const unmappedPrimary = !team ? unmappedPrimaryRow() : undefined;
   if (!team) team = JSON.parse(run(["aw", "team", "list", "--json"], root)).active_team;
-  if (unmappedPrimary && team) warnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using personal team ${team}`);
+  if (unmappedPrimary && team) warnings.push(`oats-aweb: team-unmapped — workspace label ${unmappedPrimary.label} is not mapped; using the default team ${team}`);
   if (!team) fatal(`cannot determine target team, so no identity could be minted — ${teamConfigRemedy()}, or activate a team at the aweb root`);
   // A bare team name (no namespace) resolves against the root's memberships.
   if (!team.includes(":")) {
@@ -955,7 +957,6 @@ function resolvePrimaryTeam() {
     else if (match.length > 1) fatal(`team name "${team}" is ambiguous at ${root}: ${match.join(", ")}, so no identity could be minted — ${teamConfigRemedy()}`);
     else fatal(`no membership matching team "${team}" at ${root}, so no identity could be minted — join or create it first (aweb-team-membership skill), or ${teamConfigRemedy()}`);
   }
-  if (personalRootDeclared(settings)) warnings.push(`oats-aweb: personal-root-deferred — ${PERSONAL_ROOT_DEFERRED_WARNING}`);
   return { team, root, source, warnings };
 }
 
@@ -1110,19 +1111,19 @@ if (event === "launch") {
     const deliveryBrief = deliveryMode === "session"
       ? ` Notification delivery: external (AWEB_DELIVERY=session): the host wake broker (aw wake) is registered for this home and nudges you when mail or chat arrives; the native aweb channel is not running. If you have waited long with nothing arriving, check \`aw mail inbox\` and \`aw chat pending\` yourself at task boundaries.`
       : "";
-    let meta = { team: joined.team_id, alias, delivery: deliveryMode, personal: { team: joined.team_id, source: primary.source }, ...(process.env.OATS_RUNTIME ? { runtime: process.env.OATS_RUNTIME } : {}), identity: identityMeta({ mode: "local", alias, team: joined.team_id }) };
+    let meta = { team: joined.team_id, alias, delivery: deliveryMode, defaultTeam: { team: joined.team_id, source: primary.source }, ...(process.env.OATS_RUNTIME ? { runtime: process.env.OATS_RUNTIME } : {}), identity: identityMeta({ mode: "local", alias, team: joined.team_id }) };
     const joinFloorProblem = joinRows.length ? joinedTeamsAwFloorProblem() : undefined;
     if (joinFloorProblem) warnings.push(`oats-aweb: ${joinFloorProblem}`);
     else for (const row of joinRows) { const result = mintJoinedTeam(row, meta); meta = result.meta; spawnMeta = meta; writeProviderTeamsState(meta); if (result.warning) warnings.push(`oats-aweb: ${result.warning}`); }
     if (joinedTeamsOf(meta).length) { const synced = syncWakeReceive(meta); meta = synced.meta; for (const w of synced.warnings) warnings.push(`oats-aweb: ${w}`); }
     writeProviderTeamsState(meta);
-    const personalBrief = meta.personal.source === "setting" ? "the team this deployment configured for you" : "your personal team (the messaging root's active team)";
+    const defaultTeamBrief = meta.defaultTeam.source === "setting" ? "the team this deployment configured for you" : "the workspace's default team (the messaging root's active team)";
     const joinedNow = joinedTeamsOf(meta);
     const joinedBrief = joinedNow.length ? ` Joined teams: ${joinedNow.map((j) => `${j.label} (${j.team}, receive ${j.receive}, send with \`aw --identity-home ${j.identityHome} mail|chat ...\`)`).join("; ")}.` : "";
     out({
       meta,
       env,
-      brief: `Comms: you have an aweb identity — alias "${alias}" on team ${joined.team_id}, ${personalBrief}.${mismatch}${deliveryBrief}${joinedBrief} Load the oats-aweb skill before messaging: \`oats aweb teams --json\` shows your teams, \`oats aweb roster\` who you can reach. Coordination stays in your deployment's task layer.`,
+      brief: `Comms: you have an aweb identity — alias "${alias}" on team ${joined.team_id}, ${defaultTeamBrief}.${mismatch}${deliveryBrief}${joinedBrief} Load the oats-aweb skill before messaging: \`oats aweb teams --json\` shows your teams, \`oats aweb roster\` who you can reach. Coordination stays in your deployment's task layer.`,
       ...(launch ? { launch } : {}),
       ...(joined.team_id !== team ? { warning: `oats-aweb: team mismatch — joined ${joined.team_id}, expected ${team}` } : warnings.length ? { warning: warnings.join(" | ") } : channelWarning ? { warning: channelWarning } : {}),
     });
@@ -1206,7 +1207,7 @@ if (event === "launch") {
   // alias = instance name, so the team's member roster lists live instances
   // wherever they run (plus human members). Local liveness comes from
   // `oats status` in the deployment; this is the network view.
-  // Default: this instance's personal team, listed from the root that minted
+  // Default: this instance's default team, listed from the root that minted
   // it. `--label <label>` lists an eligible (joined or not) workspace team from
   // the host root that holds it.
   const argv = process.argv.slice(3);
@@ -1220,7 +1221,7 @@ if (event === "launch") {
     team = row.team; root = awebRootForTeam(team);
     if (!root) { console.error(`oats aweb roster: ${awebRootProblem(rootSettingCandidate(team))}, so the roster of ${label} cannot be read from this host`); process.exit(1); }
   } else {
-    team = meta.personal?.team || meta.identity?.team || meta.team || process.env.OATS_TEAM_ID;
+    team = meta.defaultTeam?.team || meta.identity?.team || meta.team || process.env.OATS_TEAM_ID;
     root = awebRoot();
     if (!root) { console.error(`oats aweb roster: ${awebRootProblem(rootSettingCandidate())}`); process.exit(1); }
     if (!team) team = JSON.parse(run(["aw", "team", "list", "--json"], root)).active_team;

package/capabilities/oats-aweb/injects/aweb.md

@@ -1,9 +1,9 @@
 ## Messaging: aweb
 
 Your messaging layer is **aweb**. Your identity's alias is your instance name,
-and it lives in the personal team of the person you work for (the `Comms:`
-line of your TASK.md names it). Wider workspace teams are joined explicitly,
-each with its own identity home.
+and it lives in the workspace's default team (the `Comms:` line of your TASK.md
+names it). Wider workspace teams are joined explicitly, each with its own
+identity home.
 
 **Load the `oats-aweb` skill before your first `aw mail`/`aw chat` of a session,
 whenever an aweb wake or channel event arrives, and whenever messaging or a
@@ -14,7 +14,7 @@ memory; if a flag looks wrong run `aw <command> --help`.
 Quick crib (run from your instance home, never from `./work`):
 
 ```bash
-oats aweb teams --json                                     # personal, eligible, joined teams
+oats aweb teams --json                                     # defaultTeam, eligible, joined teams
 oats aweb roster                                           # who you can reach
 aw mail inbox                                              # UNREAD mail only (--show-all: history)
 aw mail send --to <alias> --subject "..." --body-file <f>  # recipient needs --to

package/capabilities/oats-aweb/lib/binding-wire.mjs

@@ -4,7 +4,6 @@ import { isAbsolute, join, resolve } from 'node:path';
 import { TextDecoder } from 'node:util';
 import { assessCapturedSessionReadiness } from './session-readiness.mjs';
 import { custodyPreflight } from './grant-custody.mjs';
-import { PERSONAL_ROOT_DEFERRED_WARNING, personalRootDeclared } from './personal-team.mjs';
 import { joinedReceiveModes } from './wake-receive.mjs';
 import {
   MESSAGING_CONTRACT,
@@ -220,9 +219,8 @@ function readinessDetails(settings,{deployment,env=process.env}={}) {
   const initialTeam=typeof settings.team==='string' && settings.team.trim()?settings.team.trim():undefined;
   const candidate=rootCandidate(settings,initialTeam,{deployment,env}),team=teamFromSettings(settings,candidate,{env}),problems=[],warnings=[];
   if(!candidate.root || !isAbsolute(candidate.root) || !existsSync(join(resolve(candidate.root),'.aw'))) problems.push({code:'needs-configuration',message:`no messaging root at ${candidate.root?resolve(candidate.root):process.cwd()}: run oats aweb setup there or set ${candidate.key}`});
-  const unmapped=unmappedPrimary(env);if(unmapped&&team)warnings.push({code:'team-unmapped',message:`workspace label ${unmapped.label} is not mapped; using personal team ${team}`});
+  const unmapped=unmappedPrimary(env);if(unmapped&&team)warnings.push({code:'team-unmapped',message:`workspace label ${unmapped.label} is not mapped; using the default team ${team}`});
   if(!team) problems.push({code:'needs-configuration',message:'no team: set settings.oats.aweb.team or keep an active team at the aweb root'});
-  if(personalRootDeclared(settings)) warnings.push({code:'personal-root-deferred',message:PERSONAL_ROOT_DEFERRED_WARNING});
   return {team,candidate,warnings,result:checkProblems(problems) || {status:'ready',problems:[]}};
 }
 function readinessFromSettings(settings,options) {return readinessDetails(settings,options).result;}

package/capabilities/oats-aweb/lib/wake-receive.mjs

@@ -30,7 +30,7 @@ export function wakeRegistration({home, primaryIdentityHome, delivery, runtime,
   if (!rt || !joined.length) return null;
   const receive = joined.map((j) => ({identity_home: j.identityHome, label: j.label, event_classes: JOINED_EVENT_CLASSES}));
   const doc = rt === 'external-session'
-    ? {home, delivery: 'session', runtime_delivery: rt, identity_home: primaryIdentityHome, receive_identities: [{identity_home: primaryIdentityHome, label: 'personal', controls: true}, ...receive]}
+    ? {home, delivery: 'session', runtime_delivery: rt, identity_home: primaryIdentityHome, receive_identities: [{identity_home: primaryIdentityHome, label: 'default', controls: true}, ...receive]}
     : {home, delivery: rt, runtime_delivery: rt, primary_identity_home: primaryIdentityHome, receive_identities: receive};
   if (backend) doc.backend = backend;
   return doc;

package/capabilities/oats-aweb/oats.json

@@ -1,7 +1,7 @@
 {
   "capability": "oats.aweb",
   "command": "aweb",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "compatibility": {
     "oats": ">=0.26.0"
   },
@@ -142,7 +142,7 @@
       "description": "channel: the native aweb channel packages wake the instance (default). session: delivery is external (AWEB_DELIVERY=session), no channel flag; the host wake broker registers the instance once it exists."
     },
     "team": {
-      "description": "Target aweb team id for the primary personal identity lifecycle. In workspace v2 spawns this payload value wins over OATS_TEAM_ID; if both are set and differ the hook warns and uses this setting. Unset means the aweb root's active team."
+      "description": "Target aweb team id for the primary identity lifecycle. In workspace v2 spawns this payload value wins over OATS_TEAM_ID; if both are set and differ the hook warns and uses this setting. Unset means the aweb root's active team."
     },
     "root": {
       "hostOnly": true,
@@ -150,7 +150,7 @@
     },
     "roots": {
       "hostOnly": true,
-      "description": "Host-owned map of aweb team id to absolute directory whose .aw is that team's minting root, for deployments that mint into several teams. Put this only in oats-local.yaml settings.oats.aweb.roots. The key \"personal\" is reserved for per-workspace personal-team enrollment (oats.aweb 1.16); 1.15 ignores it with a readiness warning."
+      "description": "Host-owned map of aweb team id to absolute directory whose .aw is that team's minting root, for deployments that mint into several teams. Put this only in oats-local.yaml settings.oats.aweb.roots. Keys are team ids only."
     },
     "identity": {
       "default": {

package/capabilities/oats-aweb/skills/VENDORED.md

@@ -16,7 +16,7 @@ Vendored trees:
 - `aweb-identity/`
 
 Not vendored: `oats-aweb/` is this package's own OATS playbook (identity,
-personal and joined teams, roster, delivery and wakes, etiquette,
+default and joined teams, roster, delivery and wakes, etiquette,
 troubleshooting). Every `aw` invocation it and the vendored skills cite is
 checked against a real published aw by `test/oats-aweb-1-15.test.mjs`.
 

package/capabilities/oats-aweb/skills/aweb-team-membership/SKILL.md

@@ -23,12 +23,12 @@ retire cleanup, readiness, and Desktop operations consistent.
 Use the provider commands from the instance home (or with `--home <path>`):
 
 ```bash
-oats aweb teams --json                  # personal, eligible, joined, unmapped
+oats aweb teams --json                  # defaultTeam, eligible, joined, unmapped
 oats aweb join --labels <label>[,<label>]   # join eligible workspace labels
 oats aweb leave --labels <label>[,<label>]  # leave joined wider-team labels
 ```
 
-- The personal team cannot be left; attempting it is `E_TEAM_PERSONAL`.
+- The workspace's default team cannot be left; attempting it with label `default` is `E_TEAM_DEFAULT`.
 - A label that is not eligible for this soul/workspace is `E_TEAM_NOT_ELIGIBLE`.
 - Joined wider teams use a local identity home such as
   `<home>/.aweb-identity-<label>`. Joined teams require aw >= 1.36.12. The
@@ -62,15 +62,15 @@ aw id cert show
 
 Interpret common states:
 
-- `teams.personal.team` is the primary identity's team, wired to the harness:
-  the aweb root's active team (`personal.source: root`) or a deployment-pinned
-  team (`setting`). A team per workspace arrives in oats.aweb 1.16.
+- `teams.defaultTeam.team` is the primary identity's team, wired to the harness:
+  the aweb root's active team (`defaultTeam.source: root`) or a deployment-pinned
+  team (`setting`).
 - `eligible[]` are labels this soul/workspace may explicitly join; the primary
   label may appear here and is joinable/leavable like any other wider team.
 - `joined[]` are provider-created wider-team memberships; each has an
   `identityHome`, `since`, and `receive` (`native` or `poll`).
 - `unmapped[]` labels are present on the soul but not mapped by the workspace.
-  An unmapped primary falls back to the personal/root active team with a
+  An unmapped primary falls back to the default/root active team with a
   `team-unmapped` warning; it is not a spawn blocker.
 - `teams-unverified` on launch means the kernel supplied recorded/unknown team
   data, so the provider kept memberships instead of leaving anything.
@@ -81,9 +81,9 @@ Interpret common states:
   `default:oats.aweb.ai`).
 - **Team certificate**: a signed membership statement for an identity; stored in
   `.aw/team-certs/` for native identities.
-- **Personal team**: the default team for the instance's primary identity: the
-  aweb root's active team, or `settings.oats.aweb.team` when the deployment
-  pins one. Per-workspace personal-team enrollment arrives in oats.aweb 1.16.
+- **Default team**: the workspace default team for the instance's primary identity:
+  the aweb root's active team, or `settings.oats.aweb.team` when the deployment
+  pins one.
 - **Joined team**: an explicit wider team joined through `oats aweb join`, with a
   separate local identity home.
 

package/capabilities/oats-aweb/skills/aweb-team-membership/references/team-membership-reference.md

@@ -13,7 +13,7 @@ These layers can combine in multiple ways. Do not assume one from another. The c
 
 Fully Hosted means aweb operates namespace and team authority for hosted domains such as `*.aweb.ai`. It can mint hosted team certificates and provide simple onboarding. This is the simple default for most users.
 
-Hosted OAuth/MCP flows provision custodial addressed/global identities, personal team membership, and harness credentials before a local CLI workspace exists. Team API-key CLI bootstrap is different: it creates a local self-custodial CLI workspace in a hosted team. In OAuth/MCP flows, use CLI checks for diagnosis only when a local workspace is actually involved; do not force BYOT setup.
+Hosted OAuth/MCP flows provision custodial addressed/global identities, default team membership, and harness credentials before a local CLI workspace exists. Team API-key CLI bootstrap is different: it creates a local self-custodial CLI workspace in a hosted team. In OAuth/MCP flows, use CLI checks for diagnosis only when a local workspace is actually involved; do not force BYOT setup.
 
 ## BYOT
 

package/capabilities/oats-aweb/skills/oats-aweb/SKILL.md

@@ -23,16 +23,16 @@ joined team, put `--identity-home <identityHome>` before the subcommand.
 | Fact | Where to read it |
 |---|---|
 | Your alias | your instance name; the `Comms:` line of `TASK.md`; `aw whoami` |
-| Your personal team | `oats aweb teams --json` → `personal.team` (`personal.source`) |
+| Your default team | `oats aweb teams --json` → `defaultTeam.team` (`defaultTeam.source`) |
 | Teams you may join | `oats aweb teams --json` → `eligible[]` |
 | Teams you have joined | `oats aweb teams --json` → `joined[]` (each with `identityHome`, `receive`) |
 | How mail reaches you | the `Comms:` line of `TASK.md` (see section 4) |
 
-- **Personal team.** Your primary identity lives in the personal team of the
-  person you work for: the aweb root's active team (`personal.source: root`),
-  or the team the deployment pinned (`source: setting`). Everyone this
-  deployment spawns into that team is there with you. (A separate team per
-  workspace arrives in oats.aweb 1.16.)
+- **Default team.** Your primary identity lives in the workspace's default team:
+  the aweb root's active team (`defaultTeam.source: root`), or the team the
+  deployment pinned (`defaultTeam.source: setting`). `defaultTeam.source` is
+  always present and is only `root` or `setting`. Everyone this deployment
+  spawns into that team is there with you.
 - **Joined teams.** A wider team the workspace defines, joined explicitly. Each
   gives you a **separate identity** with the same alias in that team, kept
   under `<home>/.aweb-identity-<label>`. You act as that team only with
@@ -42,7 +42,7 @@ joined team, put `--identity-home <identityHome>` before the subcommand.
 ## 2. Find who to talk to
 
 ```bash
-oats aweb roster                 # your personal team's members (instances + humans), across machines
+oats aweb roster                 # your default team's members (instances + humans), across machines
 oats aweb roster --label <label> # an eligible workspace team's members
 oats status                      # live OATS instances on this machine
 ```
@@ -52,7 +52,7 @@ oats status                      # live OATS instances on this machine
 - Outside your team use a full address, `namespace/alias` (`--to-address`), only
   when you were given one.
 - A name that is not on the roster of the team you send from will not resolve:
-  pick the identity (personal or joined) whose team holds the recipient.
+  pick the identity (default-team or joined) whose team holds the recipient.
 
 ## 3. Send, reply, chat
 
@@ -126,7 +126,7 @@ mail (`--show-all`).
 ## 5. Teams: join and leave
 
 ```bash
-oats aweb teams --json                  # {personal, primary, eligible, joined, unmapped}
+oats aweb teams --json                  # {defaultTeam, primary, eligible, joined, unmapped}
 oats aweb join --labels <label>[,<label>]
 oats aweb leave --labels <label>[,<label>]
 ```
@@ -134,7 +134,7 @@ oats aweb leave --labels <label>[,<label>]
 - Join only when your human, coordinator or task asks you to work with that
   team. Joining mints a new identity for you in that team.
 - You may join only `eligible[]` labels; anything else is `E_TEAM_NOT_ELIGIBLE`.
-- Your personal team cannot be left (`E_TEAM_PERSONAL`).
+- The workspace's default team cannot be left (`E_TEAM_DEFAULT` when the label is `default`).
 - When the workspace stops mapping a team, your next session start leaves it.
 - Do not run native `aw team join|switch|leave|invite` for your identities; the
   provider keeps homes, broker registration and retire cleanup consistent.
@@ -165,7 +165,7 @@ Check your own state first:
 ```bash
 aw whoami                          # identity you act as here
 aw workspace status                # connection of the primary identity
-oats aweb teams --json             # personal/joined teams and receive modes
+oats aweb teams --json             # defaultTeam/joined teams and receive modes
 oats readiness --home "$PWD" --json   # the provider's readiness answer for this home
 ```
 
@@ -173,8 +173,7 @@ oats readiness --home "$PWD" --json   # the provider's readiness answer for this
 
 | Code | Meaning | Who fixes it |
 |---|---|---|
-| `personal-root-deferred` | the host set `settings.oats.aweb.roots.personal`; 1.15 ignores it (per-workspace enrollment arrives in 1.16) | nobody; the host may remove the setting |
-| `team-unmapped` | your soul's primary label is not mapped by the workspace; you are in the personal team | workspace owner, if a shared team was meant |
+| `team-unmapped` | your soul's primary label is not mapped by the workspace; you are in the default team | workspace owner, if a shared team was meant |
 | `joined-team-receive` | a joined team receives live through the broker (informational) | nobody |
 | `joined-team-poll-only` | a joined team does not wake you; the message says why | poll that team at task boundaries; human may start the wake daemon |
 | `wake-daemon-not-running` / `-outdated` / `-version-unknown` | host wake broker is down or older than 1.36.5 | human: upgrade aw, restart the host wake daemon |
@@ -185,7 +184,7 @@ oats readiness --home "$PWD" --json   # the provider's readiness answer for this
 
 - `E_TEAM_NOT_ELIGIBLE` — the label is not one of your eligible teams; the
   message lists them. Check the spelling against `oats aweb teams --json`.
-- `E_TEAM_PERSONAL` — the personal team cannot be left.
+- `E_TEAM_DEFAULT` — the workspace's default team cannot be left.
 - `E_TEAM_GLOBAL_MODE` — this home acts as a resident identity through a
   session grant; joined teams need local identities. Report it.
 - `E_TEAM_AW_FLOOR` — the host `aw` is too old: joined teams need aw >= 1.36.12.

package/capabilities/oats-okf/bin/oats-okf.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { fs, join, resolve, readJSON, safePath, oats, fail, unlock } from '../lib/io.mjs';
+import { fs, join, resolve, readJSON, safePath, oats, fail, unlock, redactUrls } from '../lib/io.mjs';
 import { loadBindings } from '../lib/config.mjs';
-import { register, registerCaptured, loadInvocationSourceReceipt, homeSource, loadSource, loadStatus, saveStatus, updateStatus, capture, scheduleSource, settleRetiredSchedule, service, markerPath, harvestOffRecord } from '../lib/sources.mjs';
+import { register, registerCaptured, loadInvocationSourceReceipt, homeSource, loadSource, loadStatus, saveStatus, updateStatus, capture, scheduleSource, settleRetiredSchedule, service, markerPath, harvestOffRecord, sourceSwitch, retireHarvestOff } from '../lib/sources.mjs';
 import { harvestStatus, setupHarvest } from '../lib/harvest-status.mjs';
 import { settings } from '../lib/config.mjs';
 import { CONSULT } from '../lib/consult.mjs';
@@ -151,7 +151,10 @@ else {
         if(['STATE.md','log.md','notes','.okf-harvest-record.json','.okf-harvest-record.next.json'].some(p=>fs.existsSync(join(home,p)))) fail('E_MIGRATION','unregistered/legacy source has memory; explicitly migrate/register before retirement');
         result={meta:{retired:true,reason:'nothing-to-delete'}};
       } else {
-        const s=src();scheduleSource(s);const r=capture(s,{final:true});const schedule=settleRetiredSchedule(s);result={meta:{retired:r.complete===true,source:s.file,capture:r,schedule},brief:'Final input is in durable custody. Delivery remains asynchronous.'};
+        const s=src(),sw=sourceSwitch(s);
+        // okf 4.0.1 #6: harvest switched off since spawn (deployment or soul) → no final capture.
+        if(sw.effective!=='on') result={meta:retireHarvestOff(s,sw),brief:`Harvest is now off (${sw.reason}): no final capture was taken; earlier inputs stay in custody.`};
+        else {scheduleSource(s);const r=capture(s,{final:true});const schedule=settleRetiredSchedule(s);result={meta:{retired:r.complete===true,source:s.file,capture:r,schedule},brief:'Final input is in durable custody. Delivery remains asynchronous.'};}
       }
     } else if(event==='harvest') {
       if(capturedHarvest) {
@@ -169,8 +172,8 @@ else {
       // The deployment can switch harvest off after a source registered: the
       // job then captures and processes nothing (the soul's opt-out was already
       // applied at registration). Nothing drains when it is switched back on.
-      const source=src();
-      result=settings().harvest!=='on'?{status:'harvest-off',source:source.file,reason:'the deployment does not switch harvest on (settings.oats.okf.harvest); nothing was captured'}
+      const source=src(),sw=sourceSwitch(source);
+      result=sw.effective!=='on'?{status:'harvest-off',source:source.file,reason:`${sw.reason}; nothing was captured`}
         :runSource(source,{manual:!!flags.manual,noLaunch:!!flags['no-launch']});
     }
     else if(event==='complete') {const s=src();if(captured) retainedRun(s);result=complete(s,flags.run,flags.judgment && resolve(flags.judgment));}
@@ -196,7 +199,7 @@ else {
     } else if(event==='unlock') result=unlock(resolve(flags.lock),flags.token);
     else fail('E_USAGE',`unknown command ${event}; see --help`);
     answer=hook?result:{schemaVersion:1,ok:true,result};
-  } catch(e) {const code=e.code || 'E_OKF';exit=1;answer=hook?{meta:{...(event==='retire'?{retired:false,reason:e.message}:{})},warning:`oats-okf ${code}: ${e.message}`}:{schemaVersion:1,ok:false,error:{code,message:e.message}};}
+  } catch(e) {const code=e.code || 'E_OKF',message=redactUrls(e.message);exit=1;answer=hook?{meta:{...(event==='retire'?{retired:false,reason:message}:{})},warning:`oats-okf ${code}: ${message}`}:{schemaVersion:1,ok:false,error:{code,message}};}
   // Consult commands print text unless --json; every other answer is JSON.
   // Let Node drain the pipe; no process.exit after a possibly large answer.
   if(textMode && exit) process.stderr.write(`oats okf ${event}: ${answer.error.code}: ${answer.error.message}\n`);

package/capabilities/oats-okf/lib/config.mjs

@@ -1,5 +1,5 @@
 import { isAbsolute } from 'node:path';
-import { fs, join, resolve, dirname, fail, readJSON, safePath, relPath, identifier, overlaps, hash } from './io.mjs';
+import { fs, join, resolve, dirname, fail, readJSON, safePath, relPath, identifier, overlaps, hash, embedsCredential } from './io.mjs';
 const obj = v => v && typeof v === 'object' && !Array.isArray(v);
 function keys(value, allowed, label, code='E_CONFIG') {
   if(!obj(value)) fail(code, `${label} must be an object`);
@@ -48,6 +48,7 @@ export function validateBindings(doc, file, { sourceHome, sourceWork } = {}) {
       keys(raw,['id','kind','repository','root','acceptedBranch','pr'],'git base');
       keys(raw.pr,['repository'],'git pr');
       if(typeof raw.repository !== 'string' || !raw.repository || raw.repository.startsWith('-') || /[\r\n\0]/.test(raw.repository) || 'path' in raw) fail('E_CONFIG', 'git base requires repository');
+      if(embedsCredential(raw.repository)) fail('E_CONFIG', `git base "${alias}": the repository locator embeds a credential (user:token@); bind the plain URL and let a Git credential helper or SSH key supply access`);
       const root = relPath(raw.root, true);
       if (typeof raw.acceptedBranch !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9._/-]*$/.test(raw.acceptedBranch) || raw.acceptedBranch.includes('..') || raw.acceptedBranch.endsWith('/') || raw.acceptedBranch.endsWith('.lock')) fail('E_CONFIG','invalid acceptedBranch');
       if (!obj(raw.pr) || typeof raw.pr.repository !== 'string' || !/^[\w.-]+\/[\w.-]+$/.test(raw.pr.repository)) fail('E_CONFIG','git pr requires repository: owner/repo (same-repository PRs)');

package/capabilities/oats-okf/lib/consult.mjs

@@ -5,7 +5,7 @@
 import { randomUUID } from 'node:crypto';
 import { hostname } from 'node:os';
 import { spawnSync } from 'node:child_process';
-import { fs, join, dirname, safePath, readJSON, save, digest, tree, withLock, fail, syncDir, identifier } from './io.mjs';
+import { fs, join, dirname, resolve, safePath, readJSON, save, digest, tree, withLock, fail, syncDir, identifier, relPath, within, displayRepo } from './io.mjs';
 import { noGit, gitTimeoutMs, consultMaxAgeMs, splitRef, resolveNodes } from './config.mjs';
 import { git, gitEnv, validateBase, baseLock, journalPath, preflightLocalRepository, requireNotShallow, verifyRemote, unavailable } from './stores.mjs';
 
@@ -248,6 +248,23 @@ export function withBase(bindings, alias, { fresh = false } = {}, fn) {
 }
 
 // ---------------------------------------------------------------- validation
+/** A tree entry name, from an untrusted accepted tree, as a path under the base
+ *  root. Git accepts literal `..`, absolute-looking and control-character entry
+ *  names (`hash-object --literally`), and they survive a partial clone, so every
+ *  name gets relPath's canonical rules (no empty, `.`, `..`, absolute, backslash,
+ *  NUL or `.git` segment) plus no control characters or percent-escapes. */
+export function treeEntryPath(name) {
+  const bad = () => fail('E_PATH', `invalid tree entry in knowledge base: ${JSON.stringify(String(name)).slice(0, 200)}`);
+  if (typeof name !== 'string' || /[\u0000-\u001f\u007f]/.test(name) || /%[0-9a-fA-F]{2}/.test(name)) bad();
+  try { return relPath(name); } catch { return bad(); }
+}
+/** Where a tree entry lands under `root`, refused unless it stays strictly
+ *  inside it after resolution (the second, independent guard). */
+export function containedTarget(root, name) {
+  const target = resolve(root, treeEntryPath(name));
+  if (target === resolve(root) || !within(root, target)) fail('E_PATH', `tree entry escapes its materialization root: ${JSON.stringify(name).slice(0, 200)}`);
+  return safePath(target);
+}
 const VALIDATION_CODES = new Set(['E_VALIDATION', 'E_BASE', 'E_PATH', 'E_ID', 'E_CONFIG']);
 /** Whether the accepted state is a valid OKF base. Git verdicts are cached per
  *  commit inside the host cache; computing one materializes the base root into
@@ -264,10 +281,15 @@ export function verdict(ctx) {
   try {
     const result = judge(() => {
       const rows = lsTree(ctx, '', { recursive: true });
-      for (const r of rows) if (!['100644', '100755'].includes(r.mode) || r.type !== 'blob') fail('E_PATH', 'symlink or submodule in knowledge base is not allowed');
+      // Every entry is judged before anything is written: the first bad name or
+      // mode refuses the whole base, and nothing lands outside the scratch.
+      for (const r of rows) {
+        if (!['100644', '100755'].includes(r.mode) || r.type !== 'blob') fail('E_PATH', 'symlink or submodule in knowledge base is not allowed');
+        r.target = containedTarget(scratch, r.name);
+      }
       prefetch(ctx, '');
       for (const r of rows) {
-        const target = safePath(join(scratch, r.name)); fs.mkdirSync(dirname(target), { recursive: true });
+        const target = r.target; fs.mkdirSync(dirname(target), { recursive: true });
         const fd = fs.openSync(target, 'wx', 0o600);
         let w; try { w = spawnSync('git', ['--no-replace-objects', '-c', 'core.hooksPath=/dev/null', '-C', ctx.cache, 'cat-file', 'blob', r.oid], { env: gitEnv(), timeout: gitTimeoutMs(), stdio: ['ignore', fd, 'pipe'] }); } finally { fs.closeSync(fd); }
         if (w.error || w.status !== 0) unavailable(ctx.base, ctx.alias, 'read', gitError(w));
@@ -346,7 +368,7 @@ export function bases(source, flags) {
   const rows = [], receipts = [];
   for (const [alias, base] of Object.entries(source.bindings.bases)) withBase(source.bindings, alias, { fresh: !!flags.fresh }, ctx => {
     const v = verdict(ctx), mine = relation => source.decl[relation].filter(ref => splitRef(ref)[0] === alias).map(ref => splitRef(ref)[1]);
-    rows.push({ alias, id: base.id, kind: base.kind, ...(base.kind === 'git' ? { repository: base.repository, acceptedBranch: base.acceptedBranch, root: base.root, commit: ctx.commit } : { path: base.path, digest: ctx.receipt.digest }),
+    rows.push({ alias, id: base.id, kind: base.kind, ...(base.kind === 'git' ? { repository: displayRepo(base.repository), acceptedBranch: base.acceptedBranch, root: base.root, commit: ctx.commit } : { path: base.path, digest: ctx.receipt.digest }),
       fetchedAt: ctx.receipt.fetchedAt, stale: ctx.receipt.stale, ...(ctx.receipt.reason ? { reason: ctx.receipt.reason } : {}),
       validated: v.ok ? { ok: true } : { ok: false, error: v.error }, nodes: v.ok ? Object.keys(v.nodes) : null, owns: mine('owns'), reads: mine('reads'), receipt: ctx.receipt });
     receipts.push(ctx.receipt);

package/capabilities/oats-okf/lib/harvest-switch.mjs

@@ -60,11 +60,24 @@ function shaped(value) {
  *  A soul `on` is ignored and reported: a soul cannot switch a host on. It also
  *  hides the host's value (the kernel's merged `harvest` is then the soul's),
  *  so with a soul `on` the switch stays off until the soul drops the line. */
-export function harvestSwitch({ settings = {}, soulDir = process.env.OATS_SOUL } = {}) {
-  const deployment = VALUES.includes(settings.harvest) ? settings.harvest : 'off';
+/** OATS_SETTINGS_ORIGINS (kernel 0.29.0): JSON pointer → { kind, at } of the LAST
+ *  layer that set each leaf. {} when absent or unreadable. */
+export function parseOrigins(text = process.env.OATS_SETTINGS_ORIGINS) {
+  try { const o = JSON.parse(text || '{}'); return o && typeof o === 'object' && !Array.isArray(o) ? o : {}; } catch { return {}; }
+}
+/** okf 4.0.1: origins name the last layer only, and the host's settings merge
+ *  AFTER the soul's slot, so a host `harvest: on` hides a soul's `off` there.
+ *  soul.yaml therefore stays the authority for the absolute opt-out; origins
+ *  are an extra signal: a merged value whose origin is the soul is never the
+ *  deployment switching harvest on (a soul `on` is ignored, a soul `off` is off). */
+export function harvestSwitch({ settings = {}, soulDir = process.env.OATS_SOUL, origins = parseOrigins() } = {}) {
+  const origin = origins?.['/harvest'] && typeof origins['/harvest'] === 'object' ? origins['/harvest'] : null;
+  const fromSoul = origin?.kind === 'soul';
+  const deployment = !fromSoul && VALUES.includes(settings.harvest) ? settings.harvest : 'off';
   const soul = soulHarvest(soulDir);
+  if (fromSoul && VALUES.includes(settings.harvest) && soul.value === null) Object.assign(soul, { value: settings.harvest, readable: true, why: `OATS_SETTINGS_ORIGINS: harvest: ${settings.harvest} came from the soul (${String(origin.at || 'soul.yaml')})` });
   const rows = [
-    { layer: 'deployment', value: deployment, why: settings.harvest === undefined ? 'harvest is not set (default off)' : `settings.oats.okf.harvest: ${settings.harvest}` },
+    { layer: 'deployment', value: deployment, ...(origin ? { origin: origin.kind } : {}), why: fromSoul ? 'the merged harvest value came from the soul, so the deployment does not switch harvest on' : settings.harvest === undefined ? 'harvest is not set (default off)' : `settings.oats.okf.harvest: ${settings.harvest}` },
     { layer: 'soul', value: soul.value, readable: soul.readable, why: soul.why },
   ];
   const warnings = [];

package/capabilities/oats-okf/lib/io.mjs

@@ -8,6 +8,14 @@ export const fail = (code, message) => { throw Object.assign(new Error(message),
 export const hash = value => createHash('sha256').update(typeof value === 'string' || Buffer.isBuffer(value) ? value : JSON.stringify(value)).digest('hex');
 export const readJSON = path => JSON.parse(fs.readFileSync(path, 'utf8'));
 export const within = (root, path) => { const r = relative(root, path); return r === '' || (!r.startsWith('..' + sep) && r !== '..' && !isAbsolute(r)); };
+// okf 4.0.1 #2: a URL's userinfo is a credential (https://user:token@host).
+// Strip it from anything shown to agents or users; an SSH user alone
+// (ssh://git@host) is not a secret and stays.
+const USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@'"]+)@/gi;
+export const redactUrls = text => String(text).replace(USERINFO, (m, scheme, info) => /^ssh:/i.test(scheme) && !info.includes(':') ? m : scheme);
+export const displayRepo = repository => typeof repository === 'string' ? redactUrls(repository) : repository;
+/** Whether a repository locator embeds a credential (any userinfo except a bare SSH user). */
+export const embedsCredential = repository => { USERINFO.lastIndex = 0; return typeof repository === 'string' && redactUrls(repository) !== repository; };
 export const overlaps = (a, b) => within(a, b) || within(b, a);
 export function safePath(path) {
   path = resolve(path);
@@ -77,7 +85,7 @@ export function unlock(path, token) {
   try { process.kill(o.pid, 0); fail('E_LOCKED', 'lock owner is still alive'); } catch (e) { if(e.code !== 'ESRCH') throw e; }
   fs.rmSync(path, { recursive: true }); syncDir(dirname(path)); return { unlocked: path };
 }
-export const identityKeys = ['OATS_INSTANCE','OATS_INSTANCE_HOME','OATS_HOME','PI_AGENT_HOME','PI_AGENT_NAME','PI_AGENT_INSTANCE','PI_AGENTS_ROOT','OATS_ROOT','OATS_SOUL','OATS_SOUL_ID','OATS_AGENT','OATS_KIND','OATS_EVENT','OATS_CONTEXT','OATS_REPO','OATS_WORK','OATS_BRANCH','OATS_META','OATS_SETTINGS','OATS_BINDING_FILE','OATS_SOURCE_RECEIPT_FILE','OATS_INVOCATION_CONTEXT_FILE','OATS_DEPLOYMENT','OATS_RESOLUTION'];
+export const identityKeys = ['OATS_INSTANCE','OATS_INSTANCE_HOME','OATS_HOME','PI_AGENT_HOME','PI_AGENT_NAME','PI_AGENT_INSTANCE','PI_AGENTS_ROOT','OATS_ROOT','OATS_SOUL','OATS_SOUL_ID','OATS_AGENT','OATS_KIND','OATS_EVENT','OATS_CONTEXT','OATS_REPO','OATS_WORK','OATS_BRANCH','OATS_META','OATS_SETTINGS','OATS_SETTINGS_ORIGINS','OATS_BINDING_FILE','OATS_SOURCE_RECEIPT_FILE','OATS_INVOCATION_CONTEXT_FILE','OATS_DEPLOYMENT','OATS_RESOLUTION'];
 export function cleanEnv(env = process.env) {
   return Object.fromEntries(Object.entries(env).filter(([k]) => !/^(OATS_(?!HOME_DIR$|PACKAGE_CATALOG$)|PI_AGENT|GIT_)/.test(k)));
 }