@jmanuelcorral/openteam 0.9.4 → 0.11.0

package/dist/cli.js

@@ -101,7 +101,8 @@ var AgentRoleProfileSchema = z.object({
   preferredFrontierModels: z.array(z.union([modelSelectionSchema, z.literal("auto")])),
   localFirst: z.boolean(),
   requiresLocalRuntime: z.boolean().optional(),
-  localRuntimes: z.array(z.enum(["ollama", "lmstudio", "foundry-local", "lemonade"])).optional()
+  localRuntimes: z.array(z.enum(["ollama", "lmstudio", "foundry-local", "lemonade"])).optional(),
+  localModels: z.partialRecord(z.enum(["ollama", "lmstudio", "foundry-local", "lemonade"]), z.string().min(1)).optional()
 }).strict();
 var TEAM_ROLES = {
   architect: {
@@ -392,6 +393,9 @@ var OrchestratorRolesSchema = z2.record(z2.string().min(1), z2.unknown()).defaul
     if (parsed.data.localRuntimes !== undefined) {
       profile.localRuntimes = parsed.data.localRuntimes;
     }
+    if (parsed.data.localModels !== undefined) {
+      profile.localModels = parsed.data.localModels;
+    }
     parsedRoles[roleID] = profile;
   }
   return parsedRoles;
@@ -403,6 +407,7 @@ var defaultFrontierModel = {
   providerID: "anthropic",
   modelID: "claude-sonnet-4-5"
 };
+var DEFAULT_LOCAL_MAX_CONCURRENCY = 4;
 var LocalRuntimeSchema = z2.object({
   id: z2.enum(["ollama", "lmstudio", "foundry-local", "lemonade"]),
   enabled: z2.boolean().default(true),
@@ -473,13 +478,23 @@ var OpenTeamConfigObjectSchema = z2.object({
     localDefault: ModelRefSchema.nullable().default(null),
     trivialPromptMaxChars: z2.number().int().positive().default(280),
     frontierPromptMinChars: z2.number().int().positive().default(2000),
-    frontierOnly: z2.boolean().default(false)
-  }).strict().default({
+    frontierOnly: z2.boolean().default(false),
+    localOnly: z2.boolean().default(false)
+  }).strict().superRefine((router, ctx) => {
+    if (router.frontierOnly && router.localOnly) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["localOnly"],
+        message: "router.localOnly and router.frontierOnly cannot both be true"
+      });
+    }
+  }).default({
     mode: "balanced",
     localDefault: null,
     trivialPromptMaxChars: 280,
     frontierPromptMinChars: 2000,
-    frontierOnly: false
+    frontierOnly: false,
+    localOnly: false
   }),
   local: z2.object({
     runtimes: z2.array(LocalRuntimeSchema).default([])
@@ -863,6 +878,16 @@ function chooseModel(input) {
   if (override === "alwaysFrontier") {
     return finalizeDecision(input, tier, frontier, budgetAction, decision(frontier.model, "frontier", ["explicit-always-frontier"], []));
   }
+  if (input.config.router.localOnly) {
+    if (local === null) {
+      return finalizeDecision(input, tier, frontier, budgetAction, blockedDecision(frontier.model, ["router-local-only", "forced-local-none-configured"], "forced-local-none-configured"));
+    }
+    return finalizeDecision(input, tier, frontier, budgetAction, resolveLocalPrimary(input, local, frontier.model, {
+      baseRationale: ["router-local-only"],
+      allowFrontier: false,
+      noLocalRationale: "forced-local-unavailable"
+    }));
+  }
   if (input.config.router.frontierOnly) {
     return finalizeDecision(input, tier, frontier, budgetAction, decision(frontier.model, "frontier", ["router-frontier-only"], []));
   }
@@ -1485,6 +1510,10 @@ function configuredRuntime(runtimeId, config) {
 function runtimeIdOfModel(model, config) {
   return config.local.runtimes.find((runtime) => sameModel(runtime.defaultModel, model))?.id;
 }
+function roleLocalModel(role, runtimeId, fallback) {
+  const pinned = role.localModels?.[runtimeId];
+  return pinned === undefined ? fallback : { providerID: runtimeId, modelID: pinned };
+}
 function selectDispatchRuntime(role, decision2, reachable, config) {
   if (decision2.routeKind !== "local") {
     return { runtimeId: undefined, decision: decision2 };
@@ -1499,15 +1528,25 @@ function selectDispatchRuntime(role, decision2, reachable, config) {
       if (runtime === undefined) {
         continue;
       }
-      const model = runtime.defaultModel;
+      const model = roleLocalModel(role, runtimeId, runtime.defaultModel);
       return {
         runtimeId,
         decision: { ...decision2, selected: model }
       };
     }
   }
+  const resolvedRuntimeId = runtimeIdOfModel(decision2.selected, config);
+  if (resolvedRuntimeId !== undefined) {
+    const pinned = roleLocalModel(role, resolvedRuntimeId, decision2.selected);
+    if (pinned !== decision2.selected) {
+      return {
+        runtimeId: resolvedRuntimeId,
+        decision: { ...decision2, selected: pinned }
+      };
+    }
+  }
   return {
-    runtimeId: runtimeIdOfModel(decision2.selected, config),
+    runtimeId: resolvedRuntimeId,
     decision: decision2
   };
 }
@@ -2877,7 +2916,8 @@ var KNOWN_CONFIG_KEYS_BY_PATH = new Map([
       "localDefault",
       "trivialPromptMaxChars",
       "frontierPromptMinChars",
-      "frontierOnly"
+      "frontierOnly",
+      "localOnly"
     ]
   ],
   ["router.localDefault", MODEL_REF_KEYS],
@@ -9899,6 +9939,123 @@ function isGateApplicable(mode) {
   return mode === "active";
 }
 
+// src/messages/commands.ts
+var clearCacheMessages = {
+  header: "openteam clear-cache — frozen plugin cache entries:",
+  columns: {
+    specDir: "spec dir",
+    pinned: "spec-pinned",
+    installed: "installed",
+    mtime: "mtime"
+  },
+  reparseSkipSuffix: "  [SKIP — reparse point]",
+  deletedLabel: "deleted.",
+  lockedLabel: (message) => `[LOCKED] ${message}`,
+  pathOutsideWarning: (specDir, absolutePath) => `  ⚠ ${specDir}: path outside cacheRoot (${absolutePath}), skipped.`,
+  processed: (count) => `${count} entry(ies) processed.`,
+  found: (count) => `${count} entry(ies) found. Use --delete to remove them.`
+};
+var baselineMessages = {
+  effectiveAuto: "cheapest-capable (auto)",
+  pinnedSuffix: (ref) => `${ref} (pinned)`,
+  summary: (params) => [
+    "openteam baseline:",
+    `  mode:      ${params.mode}`,
+    `  pinned:    ${params.pinned}`,
+    `  hardDefault: ${params.hardDefault}`,
+    `  effective: ${params.effective}`
+  ],
+  invalidModel: (input) => `Invalid model "${input}". Use the provider/model format, e.g. anthropic/claude-sonnet-4-5.`,
+  pinnedTo: (ref) => `Baseline pinned to ${ref} (pinned mode).`,
+  autoMode: "Baseline set to auto mode (cheapest-capable)."
+};
+var localMessages = {
+  help: {
+    status: "  openteam local status             Show the routing mode (local-first / local-only / frontier-only)",
+    off: "  openteam local off                Use frontier models only (no local runtime)",
+    only: "  openteam local only               Use local models only (never frontier)",
+    on: "  openteam local on                 Re-enable local-first routing"
+  },
+  noRuntimes: "none",
+  modeFrontierOnly: "frontier-only (frontierOnly)",
+  modeLocalOnly: "local-only (localOnly)",
+  modeLocalFirst: "local-first",
+  summary: (params) => [
+    "openteam local:",
+    `  mode:        ${params.mode}`,
+    `  frontierOnly: ${params.frontierOnly}`,
+    `  localOnly:    ${params.localOnly}`,
+    `  privacy:     ${params.privacy}`,
+    `  runtimes:    ${params.runtimes}`
+  ],
+  frontierOnlyNoChange: "No change: already in frontier-only mode.",
+  privacyAdjustedNote: " Privacy adjusted to 'consentBeforeFrontier' (forceLocalOnSensitive requires a local runtime).",
+  frontierOnlyEnabled: "Frontier-only mode enabled (frontierOnly=true, localOnly=false).",
+  localOnlyNoRuntimes: "Cannot enable local-only mode: no enabled local runtime is configured. Run 'openteam setup' or enable a local runtime in .opencode/openteam.json first.",
+  localOnlyNoChange: "No change: already in local-only mode.",
+  localOnlyEnabled: "Local-only mode enabled (localOnly=true, frontierOnly=false).",
+  localFirstNoChange: "No change: local-first routing is already active.",
+  localFirstReEnabled: "Local-first routing re-enabled (frontierOnly=false, localOnly=false). Make sure a local runtime is reachable.",
+  unknownSubcommand: (subcommand, help) => `Unknown local subcommand: ${subcommand}
+
+${help}`
+};
+var frontierCatalogMessages = {
+  free: "free",
+  costPerMillion: (inputUSD, outputUSD) => `$${inputUSD}/$${outputUSD} per 1M`
+};
+var migrateMessages = {
+  header: "openteam migrate:",
+  nothingToMigrate: "  nothing to migrate — the P15b layout is already in place.",
+  counts: (params) => [
+    `  moved:     ${params.moved} file(s)`,
+    `  deduped:   ${params.deduped} file(s) (destination already identical)`,
+    `  conflicts: ${params.conflicts} file(s)`
+  ],
+  relocatedHeader: "  relocated:",
+  relocatedEntry: (from, to, deduped) => `    · ${from} → ${to}${deduped ? " (deduped)" : ""}`,
+  conflictsHeader: "  ⚠ left in place (destination exists with different content — no data lost):",
+  conflictEntry: (from, to) => `    · ${from} → ${to}`,
+  manualWorktreesHeader: "  ⚠ legacy git worktree(s) need a manual move (run `git worktree move`):",
+  manualWorktreeEntry: (label, from, to) => `    · ${label}: ${from} → ${to}`,
+  success: "  ✓ machine-local runtime output relocated under .opencode/openteam-local/."
+};
+var rolesInitMessages = {
+  header: "openteam roles init:",
+  title: "openteam roles init",
+  noRoster: (path) => `  ✗ no roster at ${path}.`,
+  noRosterRemedy: "    Cast the team first: run `openteam setup`, then ask the orchestrator to register the cast.",
+  unparseableRoster: (path, error) => `  ✗ ${path} is present but unparseable: ${error}`,
+  unparseableRosterRemedy: "    Run `openteam doctor` for the remedy, then re-run this command.",
+  allProfiled: (count) => `  ✓ ${count} roster role(s) checked; no unprofiled roles — every role resolves a routing profile.`,
+  whyTitle: "Why you are being asked",
+  why: (count) => [
+    `${count} roster role(s) resolve no routing profile.`,
+    "Until a profile exists they are frontier-eligible: their work can escalate",
+    "to a frontier model. A 'local only' note in the roster prose does not",
+    "prevent this — prose outside the JSON fence is never read."
+  ].join(`
+`),
+  policyQuestion: (roleID, agentName) => `Routing policy for "${roleID}" (${agentName})`,
+  localOnlyLabel: (roleID, agentName) => `Local only — ${roleID} (${agentName}) never leaves this machine`,
+  localOnlyHint: "sets requiresLocalRuntime; the role fails closed when no local runtime is reachable",
+  frontierOkLabel: "Local first, frontier allowed",
+  frontierOkHint: "records today's implicit behaviour: cheapest-capable frontier when the task warrants it",
+  skipLabel: "Skip for now",
+  skipHint: "leaves the role unprofiled, so it stays frontier-eligible and doctor keeps reporting it",
+  runtimeQuestion: (roleID) => `Preferred local runtime(s) for "${roleID}" (in failover order)`,
+  runtimeHint: "machine-local — written to the git-ignored overlay",
+  cancelled: (reason) => `  ✗ cancelled (${reason}); nothing was written.`,
+  invalidResult: (reason) => `  ✗ refusing to write: the resulting config is invalid — ${reason}`,
+  nothingWritten: (skipped) => `  · skipped ${skipped}; nothing written.`,
+  nothingToWriteOutro: "Nothing to write.",
+  pinnedLocal: (roleIDs, path) => `  ✓ pinned local-only: ${roleIDs} → ${path} (tracked, travels with the roster)`,
+  frontierAllowed: (roleIDs, path) => `  ✓ frontier allowed: ${roleIDs} → ${path} (model choice stays "auto": cheapest-capable per task)`,
+  runtimeBinding: (path) => `  ✓ runtime binding: ${path} (git-ignored, machine-local)`,
+  skippedSummary: (roleIDs) => `  · skipped: ${roleIDs} — still frontier-eligible; re-run this command to revisit.`,
+  outro: "Role policy updated."
+};
+
 // src/orchestrator/ralphLoop.ts
 var RALPH_ROLE_ID = "ralph";
 var DEFAULT_RALPH_MAX_ITERATIONS = 10;
@@ -10253,74 +10410,6 @@ function describeOtelBackendForDoctor(config, env) {
   };
 }
 
-// src/messages/commands.ts
-var clearCacheMessages = {
-  header: "openteam clear-cache — frozen plugin cache entries:",
-  columns: {
-    specDir: "spec dir",
-    pinned: "spec-pinned",
-    installed: "installed",
-    mtime: "mtime"
-  },
-  reparseSkipSuffix: "  [SKIP — reparse point]",
-  deletedLabel: "deleted.",
-  lockedLabel: (message) => `[LOCKED] ${message}`,
-  pathOutsideWarning: (specDir, absolutePath) => `  ⚠ ${specDir}: path outside cacheRoot (${absolutePath}), skipped.`,
-  processed: (count) => `${count} entry(ies) processed.`,
-  found: (count) => `${count} entry(ies) found. Use --delete to remove them.`
-};
-var baselineMessages = {
-  effectiveAuto: "cheapest-capable (auto)",
-  pinnedSuffix: (ref) => `${ref} (pinned)`,
-  summary: (params) => [
-    "openteam baseline:",
-    `  mode:      ${params.mode}`,
-    `  pinned:    ${params.pinned}`,
-    `  hardDefault: ${params.hardDefault}`,
-    `  effective: ${params.effective}`
-  ],
-  invalidModel: (input) => `Invalid model "${input}". Use the provider/model format, e.g. anthropic/claude-sonnet-4-5.`,
-  pinnedTo: (ref) => `Baseline pinned to ${ref} (pinned mode).`,
-  autoMode: "Baseline set to auto mode (cheapest-capable)."
-};
-var localMessages = {
-  noRuntimes: "none",
-  modeFrontierOnly: "frontier-only (frontierOnly)",
-  modeLocalFirst: "local-first",
-  summary: (params) => [
-    "openteam local:",
-    `  mode:        ${params.mode}`,
-    `  frontierOnly: ${params.frontierOnly}`,
-    `  privacy:     ${params.privacy}`,
-    `  runtimes:    ${params.runtimes}`
-  ],
-  frontierOnlyNoChange: "No change: already in frontier-only mode.",
-  privacyAdjustedNote: " Privacy adjusted to 'consentBeforeFrontier' (forceLocalOnSensitive requires a local runtime).",
-  frontierOnlyEnabled: "Frontier-only mode enabled (frontierOnly=true).",
-  localFirstNoChange: "No change: local-first routing is already active.",
-  localFirstReEnabled: "Local-first routing re-enabled (frontierOnly=false). Make sure a local runtime is reachable."
-};
-var frontierCatalogMessages = {
-  free: "free",
-  costPerMillion: (inputUSD, outputUSD) => `$${inputUSD}/$${outputUSD} per 1M`
-};
-var migrateMessages = {
-  header: "openteam migrate:",
-  nothingToMigrate: "  nothing to migrate — the P15b layout is already in place.",
-  counts: (params) => [
-    `  moved:     ${params.moved} file(s)`,
-    `  deduped:   ${params.deduped} file(s) (destination already identical)`,
-    `  conflicts: ${params.conflicts} file(s)`
-  ],
-  relocatedHeader: "  relocated:",
-  relocatedEntry: (from, to, deduped) => `    · ${from} → ${to}${deduped ? " (deduped)" : ""}`,
-  conflictsHeader: "  ⚠ left in place (destination exists with different content — no data lost):",
-  conflictEntry: (from, to) => `    · ${from} → ${to}`,
-  manualWorktreesHeader: "  ⚠ legacy git worktree(s) need a manual move (run `git worktree move`):",
-  manualWorktreeEntry: (label, from, to) => `    · ${label}: ${from} → ${to}`,
-  success: "  ✓ machine-local runtime output relocated under .opencode/openteam-local/."
-};
-
 // src/commands/baseline.ts
 function formatRef(ref) {
   return ref === null ? "—" : `${ref.providerID}/${ref.modelID}`;
@@ -10463,10 +10552,23 @@ function renderConsoleStatus(console_) {
 }
 
 // src/commands/doctor.ts
-function runtimeLine(snapshot) {
+function runtimeLine(snapshot, runtime) {
   const mark = snapshot.reachable ? "✓" : "✗";
   const detail = snapshot.reachable ? `${snapshot.models.length} model(s)` : snapshot.error ?? "unreachable";
-  return `  ${mark} ${snapshot.id.padEnd(14)} ${snapshot.baseURL || "(no baseURL)"} — ${detail}`;
+  const declared = runtime?.maxConcurrency;
+  const slots = declared === undefined ? ` · ${DEFAULT_LOCAL_MAX_CONCURRENCY} slot(s) (default)` : ` · ${declared} slot(s) (declared)`;
+  return `  ${mark} ${snapshot.id.padEnd(14)} ${snapshot.baseURL || "(no baseURL)"} — ${detail}${slots}`;
+}
+function isNetworkRuntime(baseURL) {
+  if (baseURL.length === 0) {
+    return false;
+  }
+  try {
+    const host = new URL(baseURL).hostname.toLowerCase();
+    return host !== "localhost" && host !== "127.0.0.1" && host !== "::1" && host !== "[::1]" && !host.endsWith(".localhost");
+  } catch {
+    return false;
+  }
 }
 function failureReasonText(reason, searchedPaths) {
   switch (reason) {
@@ -10622,7 +10724,8 @@ function rosterHealthSection(audit, loadError, rosterRoleCount) {
   if (unprofiled.length > 0) {
     const roleIDs = unprofiled.map((entry) => entry.roleID).join(", ");
     lines.push(`    · unprofiled roleID(s): ${roleIDs}`);
-    lines.push("      remedy: if intentional project roles, no action is required; for curated routing, change roleID to a TEAM_ROLES key or add a profile under orchestrator.roles in .opencode/openteam.json.");
+    lines.push("      routing: no profile means frontier-eligible — work for these roles can escalate to a frontier model. A 'local only' note in the roster prose does NOT prevent this: prose outside the JSON fence is never read.");
+    lines.push('      remedy: run `openteam roles init` to compose a profile interactively, or add one by hand under orchestrator.roles in .opencode/openteam.json with "requiresLocalRuntime": true to pin the role local; for curated routing, change roleID to a TEAM_ROLES key instead.');
   }
   return lines;
 }
@@ -10657,8 +10760,16 @@ function renderDoctor(input) {
     lines.push("    (no runtime enabled)");
   } else {
     for (const snapshot of input.snapshots) {
-      lines.push(runtimeLine(snapshot));
+      lines.push(runtimeLine(snapshot, enabledRuntimes.find((r) => r.id === snapshot.id)));
+    }
+  }
+  for (const snapshot of input.snapshots) {
+    if (!isNetworkRuntime(snapshot.baseURL)) {
+      continue;
     }
+    const runtime = enabledRuntimes.find((r) => r.id === snapshot.id);
+    const cap = runtime?.maxConcurrency ?? DEFAULT_LOCAL_MAX_CONCURRENCY;
+    lines.push(`  ⚠ ${snapshot.id} is reached over the network: its ${cap}-slot cap is enforced per openteam process, so`, "    two processes at once (an opencode session plus 'openteam console') can together exceed it.");
   }
   lines.push(`  telemetry: ${input.telemetryPath} — ${input.telemetryRecords} record(s)`);
   if (input.diagnostics !== undefined) {
@@ -10800,6 +10911,9 @@ function renderWorktreeReconciliation(report) {
 }
 
 // src/commands/local.ts
+function hasEnabledLocalRuntime(config) {
+  return config.local.runtimes.some((runtime) => runtime.enabled);
+}
 function enabledRuntimesSummary(config) {
   const enabled = config.local.runtimes.filter((runtime) => runtime.enabled);
   if (enabled.length === 0) {
@@ -10812,10 +10926,11 @@ function enabledRuntimesSummary(config) {
   }).join(", ");
 }
 function showLocal(config) {
-  const mode = config.router.frontierOnly ? localMessages.modeFrontierOnly : localMessages.modeLocalFirst;
+  const mode = config.router.localOnly ? localMessages.modeLocalOnly : config.router.frontierOnly ? localMessages.modeFrontierOnly : localMessages.modeLocalFirst;
   const lines = localMessages.summary({
     mode,
     frontierOnly: config.router.frontierOnly,
+    localOnly: config.router.localOnly,
     privacy: config.privacyMode,
     runtimes: enabledRuntimesSummary(config)
   });
@@ -10823,13 +10938,13 @@ function showLocal(config) {
 `) };
 }
 function setFrontierOnly(config) {
-  if (config.router.frontierOnly) {
+  if (config.router.frontierOnly && !config.router.localOnly) {
     return { message: localMessages.frontierOnlyNoChange };
   }
   const flipsPrivacy = config.privacyMode === "forceLocalOnSensitive";
   const next = {
     ...config,
-    router: { ...config.router, frontierOnly: true },
+    router: { ...config.router, frontierOnly: true, localOnly: false },
     privacyMode: flipsPrivacy ? "consentBeforeFrontier" : config.privacyMode
   };
   const privacyNote = flipsPrivacy ? localMessages.privacyAdjustedNote : "";
@@ -10838,13 +10953,29 @@ function setFrontierOnly(config) {
     message: `${localMessages.frontierOnlyEnabled}${privacyNote}`
   };
 }
+function setLocalOnly(config) {
+  if (!hasEnabledLocalRuntime(config)) {
+    return { message: localMessages.localOnlyNoRuntimes };
+  }
+  if (config.router.localOnly && !config.router.frontierOnly) {
+    return { message: localMessages.localOnlyNoChange };
+  }
+  const next = {
+    ...config,
+    router: { ...config.router, frontierOnly: false, localOnly: true }
+  };
+  return {
+    config: next,
+    message: localMessages.localOnlyEnabled
+  };
+}
 function setLocalFirst(config) {
-  if (!config.router.frontierOnly) {
+  if (!config.router.frontierOnly && !config.router.localOnly) {
     return { message: localMessages.localFirstNoChange };
   }
   const next = {
     ...config,
-    router: { ...config.router, frontierOnly: false }
+    router: { ...config.router, frontierOnly: false, localOnly: false }
   };
   return {
     config: next,
@@ -11162,7 +11293,8 @@ function buildOpenTeamConfig(answers) {
     const runtime = {
       id: choice.id,
       enabled: choice.enabled,
-      defaultModel: { providerID: choice.id, modelID: choice.defaultModelID }
+      defaultModel: { providerID: choice.id, modelID: choice.defaultModelID },
+      maxConcurrency: choice.maxConcurrency ?? DEFAULT_LOCAL_MAX_CONCURRENCY
     };
     if (choice.baseURL !== undefined) {
       runtime.baseURL = choice.baseURL;
@@ -11173,6 +11305,7 @@ function buildOpenTeamConfig(answers) {
   });
   const primaryLocal = firstEnabled(answers.runtimes);
   const localDefault2 = primaryLocal !== undefined ? { providerID: primaryLocal.id, modelID: primaryLocal.defaultModelID } : null;
+  const localOnly = answers.localOnly === true && primaryLocal !== undefined;
   return OpenTeamConfigSchema.parse({
     baseline: {
       mode: "auto",
@@ -11182,7 +11315,8 @@ function buildOpenTeamConfig(answers) {
     router: {
       mode: answers.routerMode,
       localDefault: localDefault2,
-      frontierOnly: primaryLocal === undefined
+      frontierOnly: primaryLocal === undefined,
+      localOnly
     },
     local: { runtimes },
     privacyMode: answers.privacyMode,
@@ -11212,15 +11346,17 @@ function buildOpencodeConfig(answers) {
       models
     };
   }
+  const primaryLocal = firstEnabled(answers.runtimes);
+  const localOnly = answers.localOnly === true && primaryLocal !== undefined;
+  const mainModel = localOnly && primaryLocal !== undefined ? `${primaryLocal.id}/${primaryLocal.defaultModelID}` : `${answers.frontier.providerID}/${answers.frontier.modelID}`;
   const config = {
     $schema: "https://opencode.ai/config.json",
     plugin: [OPENTEAM_PLUGIN_SPEC],
-    model: `${answers.frontier.providerID}/${answers.frontier.modelID}`
+    model: mainModel
   };
   if (Object.keys(provider).length > 0) {
     config.provider = provider;
   }
-  const primaryLocal = firstEnabled(answers.runtimes);
   if (primaryLocal !== undefined) {
     config.small_model = `${primaryLocal.id}/${primaryLocal.defaultModelID}`;
   }
@@ -11281,6 +11417,13 @@ async function browseFrontier(prompt, profiles) {
   const modelID = await prompt.select(opts);
   return { providerID, modelID };
 }
+function cheapestFrontier(profiles) {
+  const first = sortFrontierByCost(profiles)[0];
+  if (first === undefined) {
+    throw new Error("no frontier profile available for the baseline");
+  }
+  return { providerID: first.ref.providerID, modelID: first.ref.modelID };
+}
 async function chooseFrontier(prompt, profiles) {
   const sorted = sortFrontierByCost(profiles);
   const first = sorted[0];
@@ -11467,6 +11610,10 @@ async function runSetup(deps) {
       runtimes.push(await resolveEnabledRuntime(deps, meta, info));
     }
     const hasLocalEnabled = enabled.size > 0;
+    const localOnly = hasLocalEnabled ? await prompt.confirm({
+      message: "Run without frontier models? (local runtimes only; openteam never escalates)",
+      initial: false
+    }) : false;
     let frontierProfiles;
     try {
       const loaded = await deps.loadFrontierProfiles();
@@ -11474,7 +11621,18 @@ async function runSetup(deps) {
     } catch {
       frontierProfiles = [...CURATED_FRONTIER_PROFILES];
     }
-    const frontier = await chooseFrontier(prompt, frontierProfiles);
+    const frontier = localOnly ? cheapestFrontier(frontierProfiles) : await chooseFrontier(prompt, frontierProfiles);
+    if (localOnly) {
+      prompt.note([
+        "openteam will never escalate to a frontier model.",
+        "opencode's main model is pointed at your local runtime too, so the",
+        "session itself does not reach a frontier provider either.",
+        "",
+        `A baseline is still recorded (${frontier.providerID}/${frontier.modelID})`,
+        "but stays unused. Set router.localOnly to false to re-enable it."
+      ].join(`
+`), "Local-only mode");
+    }
     const routerMode = await prompt.select({
       message: "Routing mode",
       choices: [
@@ -11519,7 +11677,8 @@ async function runSetup(deps) {
       frontier,
       routerMode,
       privacyMode,
-      yolo
+      yolo,
+      localOnly
     };
     const openTeamConfig = buildOpenTeamConfig(answers);
     const opencodeConfig = buildOpencodeConfig(answers);
@@ -11587,14 +11746,14 @@ async function runSetup(deps) {
       return `${runtime.id} (${runtime.defaultModelID})${remote}`;
     }).join(", ");
     prompt.note([
-      `Baseline frontier: ${frontier.providerID}/${frontier.modelID}`,
+      `Baseline frontier: ${localOnly ? `${frontier.providerID}/${frontier.modelID} (recorded but unused — local-only)` : `${frontier.providerID}/${frontier.modelID}`}`,
       `Local runtimes: ${enabledSummary || "none (frontier-only)"}`,
       `YOLO mode: ${yolo ? "enabled (auto-approves permissions)" : "disabled"}`,
       "Web Console: launched separately from the CLI with 'openteam console' (multi-session, loopback)",
       `Wrote: ${opencodePath}, ${DEFAULT_CONFIG_PATH}, ${ORCHESTRATOR_AGENT_PATH}, ${AGENT_DIR}/*.md (${roleAgentFiles.length} standard subagents), ${OPENTEAM_COMMAND_DIR}/*.md (${slashCommands.length} commands); ensured ${OPENCODE_GITIGNORE_PATH}`,
       "",
       "Next steps:",
-      `  1. Authenticate the frontier provider: opencode auth login`,
+      localOnly ? "  1. No frontier auth needed; openteam runs entirely on your local runtimes" : `  1. Authenticate the frontier provider: opencode auth login`,
       hasLocalEnabled ? "  2. Make sure your local runtime (local or on the network) is reachable; openteam routes local-first automatically" : "  2. Open opencode in this repo; openteam will use frontier models only",
       "  3. Press Tab and pick the 'openteam' agent, or type / and pick an /openteam… command"
     ].join(`
@@ -12281,10 +12440,12 @@ var HELP = [
   "  openteam baseline show            Show the effective baseline",
   "  openteam baseline set <p/model>   Pin the baseline (pinned mode)",
   "  openteam baseline auto            Cheapest-capable baseline (auto mode)",
-  "  openteam local status             Show the routing mode (local-first / frontier-only)",
-  "  openteam local off                Use frontier models only (no local runtime)",
-  "  openteam local on                 Re-enable local-first routing",
+  localMessages.help.status,
+  localMessages.help.off,
+  localMessages.help.only,
+  localMessages.help.on,
   "  openteam doctor                   Diagnose runtimes and config",
+  "  openteam roles init               Compose per-role routing policy for unprofiled roster roles",
   "  openteam migrate                  Relocate pre-P15b artifacts to their split homes (idempotent)",
   "  openteam agents                   List agents and each one's LLM (local/frontier)",
   "  openteam console                  Launch the multi-session web Console (Ctrl+C to stop; --open opens the browser)",
@@ -12453,23 +12614,40 @@ ${HELP}`
 }
 async function runLocal(positionals, deps, configPath, configResolution) {
   const sub = positionals[1] ?? "status";
-  if (sub !== "status" && sub !== "off" && sub !== "on") {
+  if (sub !== "status" && sub !== "off" && sub !== "only" && sub !== "on") {
     return {
       exitCode: 1,
-      stdout: `Unknown local subcommand: ${sub}
-
-${HELP}`
+      stdout: localMessages.unknownSubcommand(sub, HELP)
     };
   }
   const config = await deps.loadConfig(configPath, configResolution);
   if (sub === "status") {
     return { exitCode: 0, stdout: showLocal(config).message };
   }
-  const outcome = sub === "off" ? setFrontierOnly(config) : setLocalFirst(config);
+  let outcome;
+  switch (sub) {
+    case "off":
+      outcome = setFrontierOnly(config);
+      break;
+    case "only":
+      outcome = setLocalOnly(config);
+      break;
+    case "on":
+      outcome = setLocalFirst(config);
+      break;
+    default:
+      return {
+        exitCode: 1,
+        stdout: localMessages.unknownSubcommand(sub, HELP)
+      };
+  }
   if (outcome.config !== undefined) {
     await deps.saveConfig(outcome.config, configPath, configResolution);
   }
-  return { exitCode: 0, stdout: outcome.message };
+  return {
+    exitCode: sub === "only" && !hasEnabledLocalRuntime(config) ? 1 : 0,
+    stdout: outcome.message
+  };
 }
 async function runYolo(positionals, deps, opencodeConfigPaths) {
   const sub = positionals[1] ?? "status";
@@ -13216,6 +13394,178 @@ ${HELP}`
   }
 }
 
+// src/commands/rolesInit.ts
+var ROLES_INIT_LOCAL_ONLY = "local-only";
+var ROLES_INIT_FRONTIER_OK = "frontier-ok";
+var ROLES_INIT_SKIP = "skip";
+function isJsonRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function serialize(value) {
+  return `${JSON.stringify(value, null, 2)}
+`;
+}
+async function readJsonFile(deps, path3) {
+  const content = await deps.readFile(path3);
+  if (content === undefined)
+    return {};
+  const raw = parseConfigFileJson(path3, content);
+  return isJsonRecord2(raw) ? raw : {};
+}
+function existingRoles(config) {
+  const orchestrator = config.orchestrator;
+  if (!isJsonRecord2(orchestrator))
+    return {};
+  const roles = orchestrator.roles;
+  return isJsonRecord2(roles) ? roles : {};
+}
+function withRole(config, roleID, profile) {
+  const orchestrator = isJsonRecord2(config.orchestrator) ? config.orchestrator : {};
+  const roles = isJsonRecord2(orchestrator.roles) ? orchestrator.roles : {};
+  return {
+    ...config,
+    orchestrator: {
+      ...orchestrator,
+      roles: { ...roles, [roleID]: profile }
+    }
+  };
+}
+function localOnlyProfile(roleID) {
+  const base = synthesiseFallbackProfile(roleID);
+  return {
+    ...base,
+    preferredFrontierModels: [],
+    localFirst: true,
+    requiresLocalRuntime: true
+  };
+}
+function frontierEligibleProfile(roleID) {
+  return { ...synthesiseFallbackProfile(roleID) };
+}
+function policyChoices(roleID, agentName) {
+  return [
+    {
+      value: ROLES_INIT_LOCAL_ONLY,
+      label: rolesInitMessages.localOnlyLabel(roleID, agentName),
+      hint: rolesInitMessages.localOnlyHint
+    },
+    {
+      value: ROLES_INIT_FRONTIER_OK,
+      label: rolesInitMessages.frontierOkLabel,
+      hint: rolesInitMessages.frontierOkHint
+    },
+    {
+      value: ROLES_INIT_SKIP,
+      label: rolesInitMessages.skipLabel,
+      hint: rolesInitMessages.skipHint
+    }
+  ];
+}
+async function runRolesInit(deps) {
+  const lines = [rolesInitMessages.header];
+  const rosterContent = await deps.readFile(OPENTEAM_ROSTER_PATH);
+  if (rosterContent === undefined) {
+    lines.push(rolesInitMessages.noRoster(OPENTEAM_ROSTER_PATH), rolesInitMessages.noRosterRemedy);
+    return { stdout: lines.join(`
+`), exitCode: 1 };
+  }
+  const parsed = parseRosterResult(rosterContent);
+  if (!parsed.ok) {
+    lines.push(rolesInitMessages.unparseableRoster(OPENTEAM_ROSTER_PATH, parsed.error.message), rolesInitMessages.unparseableRosterRemedy);
+    return { stdout: lines.join(`
+`), exitCode: 1 };
+  }
+  const baseConfig = await readJsonFile(deps, DEFAULT_CONFIG_PATH);
+  const configuredRoles = existingRoles(baseConfig);
+  const unprofiled = parsed.roster.entries.filter((entry) => getRoleProfile(entry.roleID, configuredRoles) === undefined && !isKnownNonWorkerRole(entry.roleID));
+  if (unprofiled.length === 0) {
+    lines.push(rolesInitMessages.allProfiled(parsed.roster.entries.length));
+    return { stdout: lines.join(`
+`), exitCode: 0 };
+  }
+  deps.prompt.intro(rolesInitMessages.title);
+  deps.prompt.note(rolesInitMessages.why(unprofiled.length), rolesInitMessages.whyTitle);
+  const runtimes = (await deps.detectRuntimes?.())?.filter((runtime) => runtime.available);
+  let nextConfig = baseConfig;
+  let nextOverlay;
+  const pinned = [];
+  const relaxed = [];
+  const skipped = [];
+  try {
+    for (const entry of unprofiled) {
+      const choice = await deps.prompt.select({
+        message: rolesInitMessages.policyQuestion(entry.roleID, entry.agentName),
+        choices: policyChoices(entry.roleID, entry.agentName),
+        initial: ROLES_INIT_LOCAL_ONLY
+      });
+      if (choice === ROLES_INIT_SKIP) {
+        skipped.push(entry.roleID);
+        continue;
+      }
+      if (choice === ROLES_INIT_FRONTIER_OK) {
+        nextConfig = withRole(nextConfig, entry.roleID, frontierEligibleProfile(entry.roleID));
+        relaxed.push(entry.roleID);
+        continue;
+      }
+      nextConfig = withRole(nextConfig, entry.roleID, localOnlyProfile(entry.roleID));
+      pinned.push(entry.roleID);
+      if (runtimes !== undefined && runtimes.length > 0) {
+        const selected = await deps.prompt.multiselect({
+          message: rolesInitMessages.runtimeQuestion(entry.roleID),
+          choices: runtimes.map((runtime) => ({
+            value: runtime.id,
+            label: runtime.id,
+            hint: rolesInitMessages.runtimeHint
+          }))
+        });
+        if (selected.length > 0) {
+          nextOverlay = withRole(nextOverlay ?? {}, entry.roleID, {
+            localRuntimes: selected
+          });
+        }
+      }
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    lines.push(rolesInitMessages.cancelled(message));
+    return { stdout: lines.join(`
+`), exitCode: 1 };
+  }
+  if (pinned.length === 0 && relaxed.length === 0) {
+    lines.push(rolesInitMessages.nothingWritten(skipped.join(", ")));
+    deps.prompt.outro(rolesInitMessages.nothingToWriteOutro);
+    return { stdout: lines.join(`
+`), exitCode: 0 };
+  }
+  const merged = mergeConfigInputs(nextConfig, nextOverlay);
+  try {
+    loadOpenTeamConfig(merged);
+  } catch (error) {
+    lines.push(rolesInitMessages.invalidResult(error instanceof Error ? error.message : String(error)));
+    return { stdout: lines.join(`
+`), exitCode: 1 };
+  }
+  await deps.writeFile(DEFAULT_CONFIG_PATH, serialize(nextConfig));
+  if (nextOverlay !== undefined) {
+    await deps.writeFile(DEFAULT_LOCAL_OVERLAY_PATH, serialize(nextOverlay));
+  }
+  if (pinned.length > 0) {
+    lines.push(rolesInitMessages.pinnedLocal(pinned.join(", "), DEFAULT_CONFIG_PATH));
+  }
+  if (relaxed.length > 0) {
+    lines.push(rolesInitMessages.frontierAllowed(relaxed.join(", "), DEFAULT_CONFIG_PATH));
+  }
+  if (nextOverlay !== undefined) {
+    lines.push(rolesInitMessages.runtimeBinding(DEFAULT_LOCAL_OVERLAY_PATH));
+  }
+  if (skipped.length > 0) {
+    lines.push(rolesInitMessages.skippedSummary(skipped.join(", ")));
+  }
+  deps.prompt.outro(rolesInitMessages.outro);
+  return { stdout: lines.join(`
+`), exitCode: 0 };
+}
+
 // src/config/legacyMigration.ts
 async function relocateNode(from, to, port, files) {
   if (!await port.exists(from)) {
@@ -14965,7 +15315,7 @@ async function buildMemoryRuntimeFromConfig(config, deps, options = {}) {
 // package.json
 var package_default = {
   name: "@jmanuelcorral/openteam",
-  version: "0.9.4",
+  version: "0.11.0",
   packageManager: "bun@1.3.14",
   description: "Cost-aware, local-first routing plugin for opencode with cheapest-capable frontier fallback and multi-agent orchestration.",
   license: "MIT",
@@ -15382,6 +15732,20 @@ function createSetupDeps() {
     }
   };
 }
+function createRolesInitDeps() {
+  const detect = createDetect(nodeExec2);
+  return {
+    prompt: clackPrompter,
+    readFile: (path4) => storage.read(path4),
+    writeFile: async (path4, contents) => {
+      await storage.write(path4, contents);
+    },
+    detectRuntimes: async () => (await detect()).map((runtime) => ({
+      id: runtime.id,
+      available: runtime.reachable
+    }))
+  };
+}
 async function main() {
   const argv = process.argv.slice(2);
   const configSelection = parseConfigSelection(argv);
@@ -15389,6 +15753,15 @@ async function main() {
     const result2 = await runSetup(createSetupDeps());
     if (result2.stdout.length > 0) {
       process.stdout.write(`${result2.stdout}
+`);
+    }
+    process.exitCode = result2.exitCode;
+    return;
+  }
+  if (argv[0] === "roles" && argv[1] === "init") {
+    const result2 = await runRolesInit(createRolesInitDeps());
+    if (result2.stdout.length > 0) {
+      process.stdout.write(`${result2.stdout}
 `);
     }
     process.exitCode = result2.exitCode;