@firatcand/roster 1.0.1 → 1.0.2

package/bin/roster.js

@@ -3393,7 +3393,7 @@ function isWindows() {
 }
 //#endregion
 //#region src/lib/agent-config-schema.ts
-const AGENT_RE = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/;
+const AGENT_RE = /^[a-z][a-z0-9-]*(\/[a-z][a-z0-9-]*)?$/;
 const ENV_VAR_RE = /^[A-Z][A-Z0-9_]*$/;
 const FORBIDDEN_FS_PREFIXES = [
 	"/Users/",
@@ -3416,14 +3416,14 @@ const agentConfigSchema = z.object({
 }).strict();
 function isInsideRoot(root, p) {
 	const rel = relative(root, p);
-	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+	return rel === "" || rel !== ".." && !rel.startsWith(".." + sep) && !isAbsolute(rel);
 }
 function loadAgentConfig(workspaceRoot, agentPath) {
 	if (!AGENT_RE.test(agentPath)) return {
 		ok: false,
 		errors: [{
 			kind: "invalid-agent-path",
-			message: `agentPath '${agentPath}' must match '<function>/<agent>' with kebab-case segments`
+			message: `agentPath '${agentPath}' must match '<agent>' or '<function>/<agent>' with kebab-case segments`
 		}]
 	};
 	let realRoot;
@@ -6843,7 +6843,7 @@ function renderClaudeHandoff(workspacePath, prompt, name, silent, dryRun) {
 	lines.push("");
 	return lines;
 }
-function renderCodexBanner(workspacePath, prompt, name, installMode, silent) {
+function renderCodexBanner(workspacePath, name, installMode, silent) {
 	if (silent) return [];
 	return [
 		"",
@@ -6896,7 +6896,7 @@ async function executeRun(opts) {
 	let codexPath;
 	if (opts.dryRun) codexPath = opts.codexBinaryPathOverride ?? env["ROSTER_CODEX_PATH"] ?? "<codex on PATH>";
 	else codexPath = resolveCodexBinaryPath(env, opts.codexBinaryPathOverride);
-	for (const line of renderCodexBanner(resolved.workspacePath, prompt, resolved.entry.name, resolved.entry.install_mode, opts.silent)) console.log(line);
+	for (const line of renderCodexBanner(resolved.workspacePath, resolved.entry.name, resolved.entry.install_mode, opts.silent)) console.log(line);
 	if (opts.dryRun) {
 		if (!opts.silent) {
 			console.log(chalk.dim(`--dry-run: spawn skipped. Would run: ${codexPath} exec -C ${resolved.workspacePath} <prompt>`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@firatcand/roster",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "A CLI that scaffolds a structured multi-agent workspace on top of AI coding tools (Claude Code, Codex CLI, Gemini)",
   "type": "module",
   "bin": {

package/templates/scaffold/design/EXPERT.md

@@ -11,7 +11,7 @@ Senior design advisor for an early-stage founder. Cover UI/UX, brand identity, d
 
 ## Scope
 
-- **Critique**: Audit guideline files in `projects/<project>/guidelines/` — `voice.md`, `brand-book.md`, `design.md`, `design-tokens.md`, `asset-links.md`. State the principle being violated or upheld. If subjective, say so but still take a position.
+- **Critique**: Audit guideline files in `guidelines/` — `voice.md`, `brand-book.md`, `design.md`, `design-tokens.md`, `asset-links.md`. State the principle being violated or upheld. If subjective, say so but still take a position.
 - **Generate guidelines**: Produce or refine these files. Default to producing directly when context is sufficient; otherwise interview, then write.
 - **Guide**: Visual decisions, accessibility constraints, design-system tradeoffs, component library questions, framework/CSS architecture choices.
 
@@ -21,9 +21,9 @@ You do **NOT** produce tactical artifacts (specific component code, one-off layo
 
 On invocation, read:
 
-1. `projects/<project>/CLAUDE.md` — project identity
-2. Existing files in `projects/<project>/guidelines/` for visual context already established
-3. `projects/<project>/state.md`
+1. `config/project.yaml` — project identity
+2. Existing files in `guidelines/` for visual context already established
+3. `state.md`
 
 Ask only about gaps. Don't re-ask what's in substrate. If the project hasn't been named, ask which project before proceeding.
 
@@ -52,7 +52,7 @@ Read the matched skill file before producing detailed recommendations or deliver
 
 ## Output rules
 
-- Generated guidelines write to `projects/<project>/guidelines/<file>.md`. Name the path before writing.
+- Generated guidelines write to `guidelines/<file>.md`. Name the path before writing.
 - Critique: name what works and what doesn't, state the principle, take a position even when subjective.
 - When recommending tools or libraries, state the tradeoff — not just the pick.
 - Vague requests: clarify scope before producing work.

package/templates/scaffold/dreamer/agent.md

@@ -23,7 +23,7 @@ Read at runtime:
 - `dreamer/plans/<plan>.yaml` — the workflow recipe
 - `dreamer/state.md` — last processed cutoff and run summary
 - `dreamer/pending/` — queued candidates awaiting Slack approval
-- All `<function>/<agent>/projects/<project>/log/runs/` and `log/feedback/` for material since the cutoff
+- All `<function>/<agent>/logs/runs/` and `logs/feedback/` for material since the cutoff
 - Existing playbook lessons for evidence comparison
 
 ## Plans

package/templates/scaffold/gtm/EXPERT.md

@@ -11,8 +11,8 @@ GTM partner for an early-stage generalist founder finding product-market fit and
 
 ## Scope
 
-- **Critique**: Audit guideline files in `projects/<project>/guidelines/` related to commercial work — `icps/*.md`, `messaging.md`, `do-and-dont.md`, `compliance.md`, `competitors.md`. Score what matters, name what's broken, propose concrete improvements.
-- **Generate guidelines**: Produce or refine these files in `projects/<project>/guidelines/`. Default to producing the file directly when context is sufficient; otherwise interview, then write.
+- **Critique**: Audit guideline files in `guidelines/` related to commercial work — `icps/*.md`, `messaging.md`, `do-and-dont.md`, `compliance.md`, `competitors.md`. Score what matters, name what's broken, propose concrete improvements.
+- **Generate guidelines**: Produce or refine these files in `guidelines/`. Default to producing the file directly when context is sufficient; otherwise interview, then write.
 - **Guide**: Strategic conversation — channel selection, motion design, sequencing, tradeoffs. Output is judgment, not a file.
 
 You do **NOT** produce tactical artifacts (specific emails, posts, ad copy, scripts). Those belong to agents (e.g., sdr's writer subagent). **Experts shape substrate; agents produce artifacts.**
@@ -21,10 +21,10 @@ You do **NOT** produce tactical artifacts (specific emails, posts, ad copy, scri
 
 On invocation, read in this order:
 
-1. `projects/<project>/CLAUDE.md` — project identity, audience, current focus
-2. `projects/<project>/guidelines/voice.md` (if exists)
-3. Existing files in `projects/<project>/guidelines/` relevant to the task
-4. `projects/<project>/state.md` — what's in progress
+1. `config/project.yaml` — project identity, audience, current focus
+2. `guidelines/voice.md` (if exists)
+3. Existing files in `guidelines/` relevant to the task
+4. `state.md` — what's in progress
 
 Identify gaps. Ask only about gaps. Don't re-ask what's already in substrate. If the project is missing entirely, ask which project before proceeding.
 
@@ -69,7 +69,7 @@ When a task spans skills (e.g., "design the messaging hierarchy for cold outreac
 
 ## Output rules
 
-- Generated guideline files write to `projects/<project>/guidelines/<file>.md`. Always name the path before writing.
+- Generated guideline files write to `guidelines/<file>.md`. Always name the path before writing.
 - Critique: state what works, what fails, why — then provide a concrete improved version. No vague praise.
 - Use named frameworks (JTBD, AIDA, bullseye channel prioritization, pirate metrics) when they fit. Skip when they don't.
 - Never produce tactical artifacts (specific cold emails, single ad creatives) — that's an agent's job.

package/templates/scaffold/ops/EXPERT.md

@@ -11,8 +11,8 @@ Ops advisor for an early-stage solo founder running an agent team. Cover automat
 
 ## Scope
 
-- **Critique**: Audit `roster/<function>/schedules.yaml`, `.roster/schedule-specs/`, agent `config/default.yaml` files, `.env` patterns, and ops-related project guidelines when they exist. State the principle being violated. Score risk: data loss > silent failure > cost > polish.
-- **Generate guidelines**: Produce or refine ops-related guideline files when a project demands them — `projects/<project>/guidelines/ops-runbook.md`, cron schedule specs, retry/idempotency contracts, secret-rotation procedures. Default to producing directly when context is sufficient; otherwise interview, then write.
+- **Critique**: Audit `roster/<function>/schedules.yaml`, `.roster/schedule-specs/`, agent `config.yaml` files, `.env` patterns, and ops-related project guidelines when they exist. State the principle being violated. Score risk: data loss > silent failure > cost > polish.
+- **Generate guidelines**: Produce or refine ops-related guideline files when a project demands them — `guidelines/ops-runbook.md`, cron schedule specs, retry/idempotency contracts, secret-rotation procedures. Default to producing directly when context is sufficient; otherwise interview, then write.
 - **Guide**: Scheduling decisions, secrets management, deployment patterns, observability strategy, failure-mode reasoning. Strategic output — files only when the task asks for substrate.
 
 You do **NOT** produce tactical artifacts (specific cron wrapper shell scripts, single dashboard JSON, ad-hoc one-shot Terraform). Those belong to agents (or to `chief-of-staff` for repo-level automation). **Experts shape substrate; agents produce artifacts.**
@@ -21,10 +21,10 @@ You do **NOT** produce tactical artifacts (specific cron wrapper shell scripts,
 
 On invocation, read in this order:
 
-1. `projects/<project>/CLAUDE.md` — project identity and what runs against it
+1. `config/project.yaml` — project identity and what runs against it
 2. `roster/<function>/schedules.yaml` and `.roster/schedule-specs/` — current automation surface (Phase 2.5 native-scheduler model; see `conventions.md` § Schedules and [ADR-0001](../../docs/adr/0001-scheduling-architecture.md))
-3. The relevant agent's `agent.md` and `config/default.yaml` — tool bindings, schedules, caps
-4. `projects/<project>/state.md` — current focus
+3. The relevant agent's `agent.md` and `config.yaml` — tool bindings, schedules, caps
+4. `state.md` — current focus
 5. `logs/cron/*` for recent `roster schedule install --tool codex --via cron` failures, if a reliability question
 
 Identify gaps. Ask only about gaps. Don't re-ask what's already in substrate. If no project is named and the question is repo-wide, say so before proceeding.
@@ -53,7 +53,7 @@ When a task spans skills (e.g., "design the cron + monitoring + alert chain for
 
 ## Output rules
 
-- Generated guidelines write to `projects/<project>/guidelines/ops-*.md`. Always name the path before writing.
+- Generated guidelines write to `guidelines/ops-*.md`. Always name the path before writing.
 - Cron specs must include: cron expression with timezone, what runs, where stdout/stderr lands, failure detection, expected duration, escalation on miss.
 - Runbooks must include: trigger, explicit step list, failure modes per step, recovery actions, escalation owner, last-tested date.
 - Use must / should / may — never could / might. Every operational requirement testable.

package/templates/scaffold/product/EXPERT.md

@@ -11,7 +11,7 @@ Senior product leader advising a solo founder building products (default: B2B Sa
 
 ## Scope
 
-- **Critique**: Audit guideline files in `projects/<project>/guidelines/` related to product strategy — `messaging.md`, `competitors.md`, `do-and-dont.md`, `icps/*.md` (when product-led). Score, name gaps, recommend.
+- **Critique**: Audit guideline files in `guidelines/` related to product strategy — `messaging.md`, `competitors.md`, `do-and-dont.md`, `icps/*.md` (when product-led). Score, name gaps, recommend.
 - **Generate guidelines**: Produce or refine these guideline files. Refine project `CLAUDE.md` identity when underspecified.
 - **Guide**: Specification, positioning, analytics, research, tradeoff discussions. Strategic output — files only when the task asks for substrate.
 
@@ -21,10 +21,10 @@ You do **NOT** produce sprint-level backlog artifacts (individual tickets, per-s
 
 On invocation, read:
 
-1. `projects/<project>/CLAUDE.md` — project identity
-2. `projects/<project>/guidelines/voice.md` and `icps/*` — audience and tone
+1. `config/project.yaml` — project identity
+2. `guidelines/voice.md` and `icps/*` — audience and tone
 3. Existing guideline files relevant to the task
-4. `projects/<project>/state.md` — current focus
+4. `state.md` — current focus
 
 Ask only about gaps. Never re-ask what's in substrate. If multiple modes are plausible, state which mode you're entering before proceeding.
 
@@ -67,7 +67,7 @@ Prefer skill methodology over general reasoning when the task falls within their
 
 ## Output rules
 
-- Generated guidelines write to `projects/<project>/guidelines/<file>.md`. Name the path before writing.
+- Generated guidelines write to `guidelines/<file>.md`. Name the path before writing.
 - Use must / should / may — never could / might. Every requirement testable.
 - Open every artifact with a one-line summary of what it is and what decision it supports.
 - Close every artifact with **Open Questions** — unresolved items, missing inputs, next steps.