@kendoo.agentdesk/agentdesk 0.19.8 → 0.20.0

package/cli/init.mjs

@@ -1,174 +1,49 @@
-// `agentdesk init` — interactive project setup with tracker configuration.
+// `agentdesk init` — unified setup entry point.
 //
-// Run modes:
-//   agentdesk init             → full wizard with inline guidance
-//   agentdesk init --quick     → skip narrative copy for power users / re-runs
-//   (automatic) re-run         → when .agentdesk.json already exists, offer
-//                                 to edit only a specific section
+// Three possible outcomes, decided automatically:
+//   1. Modern .agentdesk.json with projectKey → "Refresh tokens" is the
+//      default option in a small menu; picking it runs gapScan.
+//   2. Legacy .agentdesk.json without projectKey → try to match an account
+//      project by github.repo / git remote / tracker team → migrate the
+//      file forward and gapScan.
+//   3. No local config → auto-match by git remote. On match, the user
+//      confirms "use this project?"; on no match the user picks from
+//      their participating projects, or opts into the full new-project
+//      wizard.
+//
+// The full wizard is 10 tiny steps (git detect, GitHub repo+token,
+// optional clone, tracker type/location/creds, signature, verify+pick,
+// review+save). Each step does one thing so re-entry after Ctrl-C is sane.
 
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
-import { createInterface } from "readline";
 import { execSync } from "child_process";
-import { detectProject } from "./detect.mjs";
 import { loadConfig, pushConfig } from "./config.mjs";
 import { getStoredApiKey } from "./login.mjs";
 import { registerLocalProject } from "./projects.mjs";
-import { checkTrackerPermissions, resolveCredentialsFromEnv } from "./tracker-check.mjs";
-import { autoMatchProject, discoverProject, gapScan, writeProjectConfig } from "./bootstrap.mjs";
-import { select as promptSelect } from "./prompts.mjs";
+import { checkTrackerPermissions } from "./tracker-check.mjs";
+import { autoMatchProject, discoverProject, gapScan } from "./bootstrap.mjs";
+import { select as promptSelect, ask, promptRequired } from "./prompts.mjs";
+import {
+  cloneRepoWithToken,
+  detectGitRepo,
+  fetchGitHubLogin,
+  loadDotEnv,
+  parseGitHubRef,
+  printAccessChecks,
+  readLocalConfig,
+  runAccessChecks,
+  saveEnvVar,
+  writeMinimalLocalConfig,
+} from "./setup-helpers.mjs";
 
 const SERVER = process.env.AGENTDESK_SERVER || "https://agentdesk.live";
 
-// Pretty dividers and tracker-specific "dedicated user" guidance.
-const TRACKER_GUIDANCE = {
-  linear: {
-    name: "Linear",
-    dedicatedSteps: [
-      "1. Open https://linear.app/<your-workspace>/settings/members",
-      "2. Invite a new member named \"AgentDesk\" to an email you control",
-      "3. Accept the invite from that email, log in as the new user",
-      "4. Go to https://linear.app/settings/api → Create key → label it \"AgentDesk\"",
-      "5. Paste the key when prompted below",
-    ],
-    personalNote: "Your own Linear account. Comments on tickets will appear under your name.",
-  },
-  jira: {
-    name: "Jira",
-    dedicatedSteps: [
-      "1. Open https://admin.atlassian.com/ → Directory → Invite users",
-      "2. Invite an email you control (e.g. agentdesk@yourdomain.com) as \"AgentDesk\"",
-      "3. Accept the invite and sign in as the new user",
-      "4. Go to https://id.atlassian.com/manage-profile/security/api-tokens → Create API token",
-      "5. Paste the email + token when prompted below",
-    ],
-    personalNote: "Your own Jira account. Comments on tickets will appear under your name.",
-  },
-  github: {
-    name: "GitHub",
-    dedicatedSteps: [
-      "GitHub enforces one account per human, so a \"dedicated bot user\" must be",
-      "a GitHub App (first-class bot identity, shows as agentdesk[bot] on comments).",
-      "That's a deeper install — not available yet in this wizard. For now:",
-      "  • Option A: Use gh CLI authenticated as yourself (quickest to get started)",
-      "  • Option B: Generate a Personal Access Token scoped to the repo",
-    ],
-    personalNote: "Your own GitHub account via gh CLI or a PAT. Comments appear under your name.",
-  },
-};
-
-function printDedicatedUserChoice(tracker, quick) {
-  if (quick || !tracker) return;
-  const g = TRACKER_GUIDANCE[tracker];
-  if (!g) return;
-  console.log("");
-  console.log(`  ${g.name} account — who will post the comments?`);
-  console.log("  ─────────────────────────────────────────────");
-  console.log("");
-  console.log("  Recommended:  Dedicated \"AgentDesk\" user");
-  console.log("    Clean audit trail, survives team changes, clear attribution.");
-  for (const line of g.dedicatedSteps) console.log(`    ${line}`);
-  console.log("");
-  console.log("  Quick start:  Your own account");
-  console.log(`    ${g.personalNote}`);
-  console.log("");
-  console.log("  (This wizard doesn't care which you pick — it only asks for the");
-  console.log("   credential. You're deciding whose credential to paste.)");
-  console.log("");
-}
-
-function printIdentityEcho(identity) {
-  if (!identity) return;
-  const label = identity.name || identity.login || identity.email || "(unknown)";
-  const extra = identity.email && identity.email !== identity.name ? ` <${identity.email}>` : "";
-  console.log(`  ✓ Posting as: ${label}${extra}`);
-  const looksLikePerson =
-    identity.name && !/agent\s*desk|agentdesk|bot|service/i.test(identity.name) &&
-    !/(^|[.+])(agentdesk|bot|svc|service)(@|$|[.+])/i.test(identity.email || "");
-  if (looksLikePerson) {
-    console.log("    (Looks like a personal account — comments will be attributed to this user.");
-    console.log("     If you'd rather have a dedicated AgentDesk identity, rotate the credential");
-    console.log("     to one generated under a dedicated tracker user and re-run `agentdesk init`.)");
-  }
-}
-
-function loadApiKey(dir) {
-  const envPath = join(dir, ".env");
-  if (!existsSync(envPath)) return getStoredApiKey();
-  const match = readFileSync(envPath, "utf-8").match(/AGENTDESK_API_KEY=(.+)/);
-  return match?.[1]?.trim() || getStoredApiKey();
-}
-
-function ask(rl, question) {
-  return new Promise(resolve => rl.question(question, resolve));
-}
-
-function saveEnvVar(dir, key, value) {
-  const envPath = join(dir, ".env");
-  let content = existsSync(envPath) ? readFileSync(envPath, "utf-8") : "";
-  const re = new RegExp(`^${key}=.*$`, "m");
-  if (re.test(content)) {
-    content = content.replace(re, `${key}=${value}`);
-  } else {
-    content += `${content && !content.endsWith("\n") ? "\n" : ""}${key}=${value}\n`;
-  }
-  writeFileSync(envPath, content);
-}
-
-function loadDotEnv(dir) {
-  const envPath = join(dir, ".env");
-  const dotEnv = {};
-  if (existsSync(envPath)) {
-    for (const line of readFileSync(envPath, "utf-8").split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed.startsWith("#")) continue;
-      const eq = trimmed.indexOf("=");
-      if (eq !== -1) dotEnv[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
-    }
-  }
-  return dotEnv;
-}
-
-async function fetchServerCreds(apiKey, projectKey) {
-  if (!apiKey) return {};
-  try {
-    const res = await fetch(`${SERVER}/api/projects/${projectKey}/settings/credentials`, {
-      headers: { "x-api-key": apiKey },
-      signal: AbortSignal.timeout(5000),
-    });
-    if (res.ok) return await res.json();
-  } catch {}
-  return {};
-}
-
-// Render a numbered-step box of instructions with exact URLs and button names.
-function printSteps(title, steps) {
-  const pad = "  ";
-  console.log(`${pad}${title}`);
-  console.log(`${pad}${"─".repeat(title.length)}`);
-  for (let i = 0; i < steps.length; i++) {
-    console.log(`${pad}  ${i + 1}. ${steps[i]}`);
-  }
-  console.log("");
-}
-
-// Try to detect the current git remote (origin) and parse owner/repo from
-// known GitHub URL forms. Returns "owner/repo" or null. Used as a default
-// suggestion in the GitHub step.
-function detectGitRemote(dir) {
-  try {
-    const url = execSync("git remote get-url origin", { cwd: dir, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
-    let m = url.match(/github\.com[:/]([^/]+)\/([^/.]+?)(?:\.git)?$/);
-    if (m) return `${m[1]}/${m[2]}`;
-  } catch {}
-  return null;
-}
+// ---------- Tracker team/project picker helpers ----------
 
-// Fetch the set of "things to pick from" per tracker once the auth has been
-// verified. For Linear this is teams; Jira is projects; GitHub Issues is
-// repos (filtered to ones the token can access). Returns an array of
-// { id, name, raw } or null if listing failed — caller falls back to a
-// manual prompt.
+// Fetch the pickable list of teams/projects after tracker creds are known.
+// Returns [{ id, name }] or null when the API couldn't answer (caller
+// falls back to a manual key prompt).
 async function listTrackerProjects({ tracker, creds, location }) {
   if (tracker === "linear") {
     if (!creds.LINEAR_API_KEY) return null;
@@ -181,12 +56,11 @@ async function listTrackerProjects({ tracker, creds, location }) {
       });
       if (!res.ok) return null;
       const data = await res.json();
-      const nodes = data?.data?.teams?.nodes || [];
-      return nodes.map(t => ({ id: t.key, name: `${t.name} (${t.key})`, raw: t }));
+      return (data?.data?.teams?.nodes || []).map(t => ({ id: t.key, name: `${t.name} (${t.key})` }));
     } catch { return null; }
   }
-  if (tracker === "jira") {
-    if (!creds.JIRA_EMAIL || !creds.JIRA_API_TOKEN || !location) return null;
+  if (tracker === "jira" && location) {
+    if (!creds.JIRA_EMAIL || !creds.JIRA_API_TOKEN) return null;
     try {
       const auth = "Basic " + Buffer.from(`${creds.JIRA_EMAIL}:${creds.JIRA_API_TOKEN}`).toString("base64");
       const res = await fetch(`${location.replace(/\/+$/, "")}/rest/api/3/project/search?maxResults=50`, {
@@ -195,195 +69,186 @@ async function listTrackerProjects({ tracker, creds, location }) {
       });
       if (!res.ok) return null;
       const data = await res.json();
-      const values = data?.values || [];
-      return values.map(p => ({ id: p.key, name: `${p.name} (${p.key})`, raw: p }));
+      return (data?.values || []).map(p => ({ id: p.key, name: `${p.name} (${p.key})` }));
     } catch { return null; }
   }
-  if (tracker === "github") {
-    // GitHub has potentially thousands of repos; don't try to list — rely on
-    // the explicit repo prompt (which has a git-remote default anyway).
-    return null;
-  }
   return null;
 }
 
-async function pickFromList(_rl, prompt, items, { allowManual = true } = {}) {
-  const choices = items.map(it => ({ name: it.name, value: it.id }));
-  if (allowManual) choices.push({ name: "Type it manually instead", value: "__manual__" });
-  const value = await promptSelect({ message: prompt, choices });
-  if (value === "__manual__") return null;
-  return value;
-}
+// ---------- Legacy migration: auto-match a config without projectKey ----------
+
+async function autoMatchLegacy(cwd, apiKey, localConfig) {
+  // Fetch the user's projects once; filter on server-known fields.
+  let projects;
+  try {
+    const res = await fetch(`${SERVER}/api/projects`, {
+      headers: { "x-api-key": apiKey }, signal: AbortSignal.timeout(8000),
+    });
+    if (!res.ok) return null;
+    projects = await res.json();
+  } catch { return null; }
+  if (!projects?.length) return null;
 
-// Prompt for a value, showing instructions first, looping until non-empty.
-async function promptRequired(rl, label, instructions) {
-  if (instructions) printSteps(instructions.title, instructions.steps);
-  while (true) {
-    const v = (await ask(rl, `  ${label}: `)).trim();
-    if (v) return v;
-    console.log(`  ${label} is required. Ctrl+C to abort.`);
+  const settingsList = await Promise.all(projects.map(async p => {
+    try {
+      const r = await fetch(`${SERVER}/api/projects/${p.id}/settings`, {
+        headers: { "x-api-key": apiKey }, signal: AbortSignal.timeout(5000),
+      });
+      return r.ok ? await r.json() : {};
+    } catch { return {}; }
+  }));
+
+  const legacyRepo = (localConfig.github?.repo || "").toLowerCase();
+  const legacyTeamKey = (localConfig.linear?.teamKey || "").toLowerCase();
+  const legacyJiraProject = (localConfig.jira?.project || "").toLowerCase();
+
+  for (let i = 0; i < projects.length; i++) {
+    const p = projects[i];
+    const s = settingsList[i];
+    const serverRepo = (s?.github?.repo || "").toLowerCase();
+    const serverTeam = (s?.linear?.teamKey || "").toLowerCase();
+    const serverJira = (s?.jira?.project || "").toLowerCase();
+
+    if (legacyRepo && serverRepo === legacyRepo) {
+      return { projectKey: p.id, name: p.name, reason: `github.repo matches ${s.github.repo}` };
+    }
+    if (legacyTeamKey && serverTeam === legacyTeamKey) {
+      return { projectKey: p.id, name: p.name, reason: `Linear team matches ${s.linear.teamKey}` };
+    }
+    if (legacyJiraProject && serverJira === legacyJiraProject) {
+      return { projectKey: p.id, name: p.name, reason: `Jira project matches ${s.jira.project}` };
+    }
   }
+  return null;
 }
 
-// Verify tracker auth with what we have in .env + server, then fetch
-// available teams/projects and let the user pick from a list.
-async function verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker, config, location }) {
-  console.log("  Verifying tracker access...");
-  const dotEnv = loadDotEnv(cwd);
-  const apiKey = loadApiKey(cwd);
-  const serverCreds = await fetchServerCreds(apiKey, finalProjectKey);
-  // .env wins over server credentials — fresh local rotation beats stale server state.
-  const credentials = resolveCredentialsFromEnv({ ...serverCreds, ...dotEnv });
-  const check = await checkTrackerPermissions({ tracker, config, credentials });
-  if (!check.ok) {
-    console.log("  ⚠  " + (check.errors[0] || "Verification failed"));
-    for (const e of check.errors.slice(1)) console.log(`     • ${e}`);
-    console.log("");
-    return { ok: false };
-  }
-  console.log("  ✓ Tracker access verified");
-  printIdentityEcho(check.identity);
-  console.log("");
+// ---------- Existing-project flow (E3–E7) ----------
 
-  // GitHub Issues — project = repo, already collected above. Skip the pick.
-  if (tracker === "github") return { ok: true, trackerProjectId: null };
+async function runExistingFlow(cwd, apiKey, projectKey) {
+  let currentCwd = cwd;
 
-  // Fetch selectable items (Linear teams / Jira projects) and let user pick.
-  const items = await listTrackerProjects({ tracker, creds: credentials, location });
-  if (!items || items.length === 0) {
-    console.log("  Couldn't list projects automatically — type the key manually.");
-    const label = tracker === "linear" ? "Linear team key (e.g. KEN)" : "Jira project key (e.g. PROJ)";
-    const manual = await promptRequired(rl, label);
-    console.log("");
-    return { ok: true, trackerProjectId: manual };
-  }
   console.log("");
-  const picked = await pickFromList(rl, `Pick the ${tracker === "linear" ? "team" : "project"} this agentdesk project maps to:`, items);
+  console.log("  AgentDesk — connecting to existing project");
+  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
   console.log("");
-  if (picked) return { ok: true, trackerProjectId: picked };
-  const label = tracker === "linear" ? "Linear team key" : "Jira project key";
-  const manual = await promptRequired(rl, label);
+
+  // Fetch server config early so we know the project's github.repo and tracker.
+  const config = await loadConfig(currentCwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true });
+  console.log(`  Project:   ${projectKey}`);
+  if (config.tracker) console.log(`  Tracker:   ${config.tracker}`);
+  if (config.github?.repo) console.log(`  Repo:      ${config.github.repo}`);
   console.log("");
-  return { ok: true, trackerProjectId: manual };
-}
 
-export async function runInit(cwd, opts = {}) {
-  const quick = !!opts.quick;
-  const forceFull = !!opts.forceFull;
-  const project = detectProject(cwd);
-  const existingConfig = loadConfig(cwd);
-  const projectId = project.name || cwd.split("/").pop();
-  const configPath = join(cwd, ".agentdesk.json");
-  const hasConfig = existsSync(configPath);
-  let editScope = "full";
-
-  // Fast path A: `.agentdesk.json` already has a projectKey. Offer token
-  // refresh (bootstrap) as the default action so second-machine users — or
-  // anyone just rotating a token — don't have to walk the whole wizard.
-  if (hasConfig && !quick && !forceFull) {
-    let localKey = null;
-    try { localKey = JSON.parse(readFileSync(configPath, "utf-8"))?.projectKey || null; } catch {}
-    if (localKey) {
-      console.log("");
-      console.log("  AgentDesk — existing project detected");
-      console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-      console.log("");
-      const choice = await promptSelect({
-        message: "What would you like to do?",
-        default: "refresh",
-        choices: [
-          { name: "Refresh tokens (update .env only — recommended)", value: "refresh" },
-          { name: "Tracker only (change tracker or credentials)", value: "tracker" },
-          { name: "Full setup (walk the whole wizard)", value: "full" },
-          { name: "Cancel", value: "cancel" },
-        ],
-      });
-      console.log("");
-      if (choice === "cancel") return;
-      if (choice === "refresh") {
-        const apiKey = getStoredApiKey();
-        await gapScan({ cwd, apiKey, projectKey: localKey });
-        return;
-      }
-      editScope = choice; // "full" or "tracker"
-    }
+  // --- E3: GitHub token ---
+  let env = loadDotEnv(currentCwd);
+  let githubToken = env.GITHUB_TOKEN;
+  if (!githubToken) {
+    console.log("  GitHub token (needed for clone + agent pushes — https://github.com/settings/tokens, scope: repo)");
+    githubToken = await promptRequired("GitHub token");
+    saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+    console.log("  ✓ Saved GITHUB_TOKEN to .env");
   }
+  const githubLogin = await fetchGitHubLogin(githubToken);
+  if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
+  else console.log("  ⚠  Token couldn't be verified against the GitHub API (continuing anyway)");
+  console.log("");
 
-  // Fast path B: no local config, but the user's account has a project that
-  // silently matches this clone (git remote → project id/name). Switch to
-  // bootstrap mode without opening the wizard.
-  if (!hasConfig && !forceFull) {
-    const apiKey = getStoredApiKey();
-    if (apiKey) {
-      const match = await autoMatchProject(cwd, apiKey);
-      if (match) {
-        console.log("");
-        console.log(`  ✓ Detected project "${match.name}" on your account — ${match.reason}`);
-        console.log("    Switching to token-refresh mode. Use `agentdesk init --force-full` to walk the wizard instead.");
-        console.log("");
-        writeProjectConfig(cwd, match.projectKey);
-        await gapScan({ cwd, apiKey, projectKey: match.projectKey });
-        return;
+  // --- E4: Ensure correct repo is locally present ---
+  const serverRepo = config.github?.repo ? parseGitHubRef(config.github.repo) : null;
+  if (serverRepo) {
+    const here = detectGitRepo(currentCwd);
+    const expected = `${serverRepo.owner}/${serverRepo.repo}`.toLowerCase();
+    const haveHere = (here.ownerRepo || "").toLowerCase();
+    if (!here.inRepo || haveHere !== expected) {
+      if (here.inRepo && haveHere && haveHere !== expected) {
+        console.log(`  Current directory holds ${haveHere} — cloning ${expected} into ./${serverRepo.repo} instead.`);
+      } else {
+        console.log(`  Cloning ${expected} into ./${serverRepo.repo}...`);
       }
-
-      // No auto-match. Offer an explicit choice between connecting this
-      // clone to an existing server-side project (bootstrap) and creating
-      // a new one (full wizard). Prevents users from accidentally creating
-      // a duplicate project when they just wanted to attach a second machine.
-      console.log("");
-      console.log("  AgentDesk — new directory");
-      console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━");
-      console.log("");
-      const topChoice = await promptSelect({
-        message: "What would you like to do?",
-        choices: [
-          { name: "Connect this repo to an existing project on my account (bootstrap)", value: "connect" },
-          { name: "Set up this as a new project (full wizard)", value: "new" },
-          { name: "Cancel", value: "cancel" },
-        ],
-      });
-      console.log("");
-      if (topChoice === "cancel") return;
-      if (topChoice === "connect") {
-        const projectKey = await discoverProject(cwd, apiKey);
-        if (!projectKey) return;
-        console.log("");
-        await gapScan({ cwd, apiKey, projectKey });
+      try {
+        currentCwd = cloneRepoWithToken({ cwd: currentCwd, owner: serverRepo.owner, repo: serverRepo.repo, token: githubToken });
+      } catch (err) {
+        console.log(`  ✗ ${err.message}`);
         return;
       }
-      // "new" falls through to the wizard below.
+      // Re-save the token into the cloned working tree's .env (previous
+      // save was into the parent dir).
+      saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+      console.log("");
     }
   }
 
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  // Ensure .agentdesk.json in currentCwd carries the projectKey so loadConfig
+  // works on subsequent runs without needing discovery.
+  writeMinimalLocalConfig(currentCwd, projectKey);
+
+  // --- E6: Fill missing tracker creds + verify (gapScan handles both) ---
+  await gapScan({ cwd: currentCwd, apiKey, projectKey });
 
+  // --- E7: Final access-checks summary ---
+  env = loadDotEnv(currentCwd);
+  const results = await runAccessChecks({ apiKey, serverUrl: SERVER, cwd: currentCwd, config, creds: env });
+  printAccessChecks(results, { tracker: config.tracker });
   console.log("");
-  console.log("  AgentDesk — Project Setup");
-  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━");
+}
+
+// ---------- New-project wizard (steps 1–10) ----------
+
+async function runNewProjectWizard(cwd, apiKey) {
+  let currentCwd = cwd;
+
   console.log("");
-  console.log(`  Project:      ${project.name || "unknown"}`);
-  console.log(`  Type:         ${project.label}`);
-  console.log(`  Directory:    ${project.dir}`);
-  console.log(`  Git:          ${project.hasGit ? "yes" : "no"}`);
-  console.log(`  CLAUDE.md:    ${project.hasClaudeMd ? "yes" : "no (recommended)"}`);
+  console.log("  AgentDesk — new project setup");
+  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
   console.log("");
 
-  if (project.testCommand) console.log(`  Test:         ${project.testCommand}`);
-  if (project.buildCommand) console.log(`  Build:        ${project.buildCommand}`);
-  if (project.lintCommand) console.log(`  Lint:         ${project.lintCommand}`);
-  if (project.testCommand || project.buildCommand || project.lintCommand) console.log("");
-
-  // --- Tracker step: platform → location → auth → verify → pick project ---
-  const config = {};
-  // Initial default for the agentdesk project key. Gets overwritten with the
-  // tracker's project/team key if we learn one during verification, and the
-  // user can override at the final review screen.
-  let finalProjectKey = existingConfig.projectKey || projectId;
+  // --- Step 1: Detect git repo ---
+  const git = detectGitRepo(currentCwd);
+  let ownerRepo = git.ownerRepo;
+
+  // --- Step 2: Ask for the GitHub repo (only if no git repo) ---
+  if (!git.inRepo) {
+    console.log("  No git repo here yet.\n");
+    while (!ownerRepo) {
+      const input = await promptRequired("GitHub repo (owner/repo or URL)");
+      const parsed = parseGitHubRef(input);
+      if (parsed) { ownerRepo = `${parsed.owner}/${parsed.repo}`; }
+      else console.log("  Not a valid GitHub repo. Only github.com is supported right now.");
+    }
+    console.log("");
+  }
 
-  if (!quick) console.log(editScope === "tracker" ? "  Tracker" : "  Step 1 of 3 — Task tracker");
+  // --- Step 3: GitHub token ---
+  let env = loadDotEnv(currentCwd);
+  let githubToken = env.GITHUB_TOKEN;
+  if (!githubToken) {
+    console.log("  GitHub token (create one at https://github.com/settings/tokens — scope: repo)");
+    githubToken = await promptRequired("GitHub token");
+    saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+    console.log("  ✓ Saved GITHUB_TOKEN to .env");
+  }
+  const githubLogin = await fetchGitHubLogin(githubToken);
+  if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
+  else console.log("  ⚠  Token couldn't be verified against the GitHub API (continuing anyway)");
   console.log("");
+
+  // --- Step 4: Clone (only if no git repo) ---
+  if (!git.inRepo) {
+    const [owner, repo] = ownerRepo.split("/");
+    console.log(`  Cloning ${ownerRepo} into ./${repo}...`);
+    try {
+      currentCwd = cloneRepoWithToken({ cwd: currentCwd, owner, repo, token: githubToken });
+    } catch (err) {
+      console.log(`  ✗ ${err.message}`);
+      return;
+    }
+    saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+    console.log("");
+  }
+
+  // --- Step 5: Tracker type ---
   const tracker = await promptSelect({
-    message: "Task tracker:",
+    message: "Task tracker",
     choices: [
       { name: "Linear", value: "linear" },
       { name: "Jira", value: "jira" },
@@ -392,284 +257,299 @@ export async function runInit(cwd, opts = {}) {
     ],
   });
   console.log("");
-  if (tracker) config.tracker = tracker;
-
-  if (tracker) printDedicatedUserChoice(tracker, quick);
 
-  // Tracker location + auth with exact instructions, then verify.
+  // --- Step 6: Tracker location ---
+  let linearWorkspace = null;
+  let jiraBaseUrl = null;
   if (tracker === "linear") {
-    if (!quick) printSteps("Create a Linear API key", [
-      "Open https://linear.app/settings/api in your browser (log in first if needed).",
-      "Click \"Create key\" (top right of the API page).",
-      "Label the key: AgentDesk",
-      "Expiration: set a value matching your policy, or choose \"No expiration\".",
-      "Click \"Create\". Copy the key shown (starts with lin_api_). You will NOT see it again.",
-    ]);
-    const ws = await promptRequired(rl, "Linear workspace slug (the 'kendoo' in linear.app/kendoo)");
-    const key = await promptRequired(rl, "Linear API key you just copied");
-    saveEnvVar(cwd, "LINEAR_API_KEY", key);
-    console.log("  ✓ Saved LINEAR_API_KEY to .env");
+    linearWorkspace = await promptRequired("Linear workspace slug (the 'kendoo' in linear.app/kendoo)");
+    console.log("");
+  } else if (tracker === "jira") {
+    const raw = await promptRequired("Jira tenant URL (e.g. https://yourco.atlassian.net)");
+    jiraBaseUrl = raw.replace(/\/+$/, "");
     console.log("");
-    config.linear = { workspace: ws };
   }
 
-  if (tracker === "jira") {
-    if (!quick) printSteps("Create a Jira API token", [
-      "Open https://id.atlassian.com/manage-profile/security/api-tokens",
-      "Click \"Create API token\".",
-      "Label: AgentDesk",
-      "Click \"Create\". Copy the token (shown once).",
-      "You'll also need the email you sign into Atlassian with.",
-    ]);
-    const baseUrl = await promptRequired(rl, "Jira tenant URL (e.g. https://yourco.atlassian.net)");
-    const email = await promptRequired(rl, "Your Atlassian login email");
-    const token = await promptRequired(rl, "Jira API token you just created");
-    saveEnvVar(cwd, "JIRA_EMAIL", email);
-    saveEnvVar(cwd, "JIRA_API_TOKEN", token);
-    console.log("  ✓ Saved JIRA_EMAIL and JIRA_API_TOKEN to .env");
-    console.log("");
-    config.jira = { baseUrl: baseUrl.replace(/\/+$/, "") };
+  // --- Step 7: Tracker credentials ---
+  env = loadDotEnv(currentCwd);
+  let linearApiKey = env.LINEAR_API_KEY;
+  let jiraEmail = env.JIRA_EMAIL;
+  let jiraApiToken = env.JIRA_API_TOKEN;
+
+  if (tracker === "linear" && !linearApiKey) {
+    console.log("  (Get a Linear API key: https://linear.app/settings/api)");
+    linearApiKey = await promptRequired("Linear API key");
+    saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
+    console.log("  ✓ Saved LINEAR_API_KEY to .env\n");
+  } else if (tracker === "jira") {
+    if (!jiraEmail) {
+      console.log("  (Create a Jira API token: https://id.atlassian.com/manage-profile/security/api-tokens)");
+      jiraEmail = await promptRequired("Atlassian login email");
+      saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
+    }
+    if (!jiraApiToken) {
+      jiraApiToken = await promptRequired("Jira API token");
+      saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
+    }
+    console.log("  ✓ Saved JIRA credentials to .env\n");
   }
 
-  if (tracker === "github") {
-    // The GitHub-issues credential doubles as the git-push credential below,
-    // so we collect a full repo/login/token block up front.
-    if (!quick) printSteps("Create a GitHub personal access token", [
-      "Open https://github.com/settings/tokens (classic tokens).",
-      "Click \"Generate new token\" → \"Generate new token (classic)\".",
-      "Name: AgentDesk",
-      "Expiration: match your policy.",
-      "Scopes: check \"repo\" (full control of private repositories).",
-      "Click \"Generate token\" at the bottom. Copy the token (shown once).",
-    ]);
-    const detected = detectGitRemote(cwd);
-    const repoDefault = existingConfig.github?.repo || detected || "";
-    const repo = (await ask(rl, `  GitHub repo (owner/repo)${repoDefault ? ` [${repoDefault}]` : ""}: `)).trim() || repoDefault;
-    const loginDefault = existingConfig.github?.login || "";
-    const login = (await ask(rl, `  GitHub username (the @handle that owns the token)${loginDefault ? ` [${loginDefault}]` : ""}: `)).trim() || loginDefault;
-    const token = await promptRequired(rl, "GitHub token");
-    saveEnvVar(cwd, "GITHUB_TOKEN", token);
-    console.log("  ✓ Saved GITHUB_TOKEN to .env");
-    console.log("");
-    config.github = { repo, login };
+  // --- Step 8: Signature ---
+  const badgeValue = await promptSelect({
+    message: "How should the AI team sign its work?",
+    default: "AgentDesk",
+    choices: [
+      { name: "AgentDesk", value: "AgentDesk" },
+      { name: "Claude Code", value: "Claude Code" },
+      { name: "Custom…", value: "__custom__" },
+      { name: "Skip (no signature)", value: null },
+    ],
+  });
+  let identityBadge = badgeValue;
+  if (badgeValue === "__custom__") {
+    const v = (await ask("  Custom signature: ")).trim();
+    identityBadge = v || null;
   }
+  console.log("");
 
-  // Verify tracker + fetch available projects to pick from. If verification
-  // fails (bad email, revoked token, typo in base URL), loop back and let the
-  // user re-enter credentials rather than silently saving broken config.
-  let trackerLocation = null;
-  if (tracker === "jira") trackerLocation = config.jira?.baseUrl;
-  let verified = { ok: true };
-  if (tracker) {
-    while (true) {
-      verified = await verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker, config, location: trackerLocation });
-      if (verified.ok) break;
-      console.log("");
+  // --- Step 9: Verify tracker + pick team/project ---
+  // Build an in-progress config we mutate as we learn more.
+  const config = {
+    tracker,
+    github: { repo: ownerRepo, login: githubLogin || null },
+  };
+  if (tracker === "linear") config.linear = { workspace: linearWorkspace };
+  if (tracker === "jira") config.jira = { baseUrl: jiraBaseUrl };
+  if (identityBadge) config.identityBadge = identityBadge;
+
+  let trackerTeamOrProjectId = null;
+  let trackerTeamOrProjectName = null;
+
+  if (tracker && tracker !== "github") {
+    process.stdout.write("  Verifying tracker access... ");
+    let verified = false;
+    while (!verified) {
+      const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
+      const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
+      if (check.ok) {
+        console.log("✓");
+        if (check.identity?.name || check.identity?.email) {
+          console.log(`  ✓ Posting as: ${check.identity.name || check.identity.email}`);
+        }
+        verified = true;
+        break;
+      }
+      console.log("failed");
+      for (const e of check.errors || []) console.log(`    • ${e}`);
       const next = await promptSelect({
         message: "What now?",
         choices: [
           { name: "Re-enter credentials and try again", value: "retry" },
-          { name: "Save config anyway (will need to fix before `agentdesk team`)", value: "skip" },
-          { name: "Cancel init", value: "cancel" },
+          { name: "Save anyway (fix later in .env)", value: "skip" },
+          { name: "Cancel", value: "cancel" },
         ],
       });
-      console.log("");
-      if (next === "cancel") {
-        rl.close();
-        return;
-      }
+      if (next === "cancel") return;
       if (next === "skip") break;
-      // Retry: re-prompt only the tracker auth fields, not the whole wizard.
       if (tracker === "linear") {
-        const key = await promptRequired(rl, "Linear API key");
-        saveEnvVar(cwd, "LINEAR_API_KEY", key);
-        console.log("  ✓ Updated LINEAR_API_KEY in .env");
-        console.log("");
+        linearApiKey = await promptRequired("Linear API key");
+        saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
       } else if (tracker === "jira") {
-        const baseUrl = (await ask(rl, `  Jira tenant URL [${config.jira?.baseUrl || ""}]: `)).trim() || config.jira?.baseUrl;
-        const email = await promptRequired(rl, "Your Atlassian login email");
-        const token = await promptRequired(rl, "Jira API token");
-        saveEnvVar(cwd, "JIRA_EMAIL", email);
-        saveEnvVar(cwd, "JIRA_API_TOKEN", token);
-        if (baseUrl) {
-          config.jira = { ...(config.jira || {}), baseUrl: baseUrl.replace(/\/+$/, "") };
-          trackerLocation = config.jira.baseUrl;
-        }
-        console.log("  ✓ Updated JIRA_EMAIL and JIRA_API_TOKEN in .env");
-        console.log("");
-      } else if (tracker === "github") {
-        const token = await promptRequired(rl, "GitHub token");
-        saveEnvVar(cwd, "GITHUB_TOKEN", token);
-        console.log("  ✓ Updated GITHUB_TOKEN in .env");
-        console.log("");
+        jiraEmail = await promptRequired("Atlassian login email");
+        jiraApiToken = await promptRequired("Jira API token");
+        saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
+        saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
       }
+      process.stdout.write("  Re-verifying tracker access... ");
     }
-    if (verified.ok && verified.trackerProjectId) {
-      if (tracker === "linear") config.linear = { ...(config.linear || {}), teamKey: verified.trackerProjectId };
-      if (tracker === "jira") config.jira = { ...(config.jira || {}), project: verified.trackerProjectId };
-      // Use the tracker's project key as the default agentdesk project key.
-      if (!existingConfig.projectKey) finalProjectKey = verified.trackerProjectId.toLowerCase();
-    }
-  }
 
-  // --- GitHub block (always — even when tracker is Linear/Jira/None) ---
-  // This configures the credential agents use for git push, PRs, and
-  // GitHub API calls. When tracker is already GitHub Issues the block
-  // above already collected repo+login+token, so skip the duplicate.
-  let githubLogin = config.github?.login || null;
-  if (tracker !== "github") {
-    if (!quick) {
-      console.log("  ─".repeat(30));
-      console.log("  GitHub access (required — agents push code and open PRs here)");
+    if (verified) {
+      const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
+      const items = await listTrackerProjects({ tracker, creds, location: jiraBaseUrl });
       console.log("");
-    }
-    if (!quick) printSteps("Create a GitHub personal access token", [
-      "Open https://github.com/settings/tokens (classic tokens).",
-      "Click \"Generate new token\" → \"Generate new token (classic)\".",
-      "Name: AgentDesk",
-      "Expiration: match your policy.",
-      "Scopes: check \"repo\" (full control of private repositories).",
-      "Click \"Generate token\" at the bottom. Copy the token (shown once).",
-    ]);
-    const detected = detectGitRemote(cwd);
-    const repoDefault = existingConfig.github?.repo || detected || "";
-    const repo = (await ask(rl, `  GitHub repo (owner/repo)${repoDefault ? ` [${repoDefault}]` : ""}: `)).trim() || repoDefault;
-    const loginDefault = existingConfig.github?.login || "";
-    const login = (await ask(rl, `  GitHub username (the @handle that owns the token)${loginDefault ? ` [${loginDefault}]` : ""}: `)).trim() || loginDefault;
-    const token = await promptRequired(rl, "GitHub token");
-    saveEnvVar(cwd, "GITHUB_TOKEN", token);
-    console.log("  ✓ Saved GITHUB_TOKEN to .env");
-    console.log("");
-    config.github = { repo, login };
-    githubLogin = login;
-
-    // Verify token matches the user-stated login.
-    try {
-      const env = { ...process.env, GH_TOKEN: token };
-      const who = execSync("gh api user --jq .login", { env, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
-      if (who && login && who.toLowerCase() !== login.toLowerCase()) {
-        console.log(`  ⚠  Token is valid but authenticates as @${who}, not @${login}. Agents will post as @${who}.`);
-      } else if (who) {
-        console.log(`  ✓ GitHub verified as @${who}`);
+      if (items && items.length > 0) {
+        const pickedId = await promptSelect({
+          message: `Pick the ${tracker === "linear" ? "team" : "project"} this project maps to`,
+          choices: items.map(it => ({ name: it.name, value: it.id })),
+        });
+        trackerTeamOrProjectId = pickedId;
+        const pickedItem = items.find(it => it.id === pickedId);
+        trackerTeamOrProjectName = pickedItem?.name || pickedId;
+      } else {
+        trackerTeamOrProjectId = await promptRequired(tracker === "linear" ? "Linear team key (e.g. KEN)" : "Jira project key (e.g. PROJ)");
+        trackerTeamOrProjectName = trackerTeamOrProjectId;
       }
-    } catch {
-      console.log("  ⚠  Could not verify the GitHub token (gh CLI missing or network unreachable). Saved anyway — verify later in the dashboard.");
+      if (tracker === "linear") config.linear = { ...config.linear, teamKey: trackerTeamOrProjectId };
+      if (tracker === "jira") config.jira = { ...config.jira, project: trackerTeamOrProjectId };
+      console.log("");
     }
-    console.log("");
   }
 
-  // Identity badge — always ask (optional).
-  const badgeDefault = existingConfig.identityBadge || "";
-  const badge = (await ask(rl, `  Identity badge (display name for AgentDesk)${badgeDefault ? ` [${badgeDefault}]` : ""} [optional]: `)).trim() || badgeDefault;
-  if (badge) config.identityBadge = badge;
+  // Derive projectName + projectKey silently.
+  const repoShort = ownerRepo.split("/").pop();
+  const projectName = trackerTeamOrProjectName
+    ? `${repoShort} — ${String(trackerTeamOrProjectName).split(" (")[0]}`
+    : repoShort;
+  const keySource = trackerTeamOrProjectId || repoShort;
+  const projectKey = String(keySource).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  config.projectKey = projectKey;
+
+  // --- Step 10: Review + access checks + save ---
+  const credsAll = loadDotEnv(currentCwd);
+  const results = await runAccessChecks({ apiKey, serverUrl: SERVER, cwd: currentCwd, config, creds: credsAll });
+  printAccessChecks(results, { tracker });
+  console.log("");
+  console.log("  Summary");
+  console.log("  ───────");
+  console.log(`    Project:       ${projectName} (${projectKey})`);
+  console.log(`    Tracker:       ${tracker || "none"}${trackerTeamOrProjectId ? ` (${trackerTeamOrProjectId})` : ""}`);
+  console.log(`    GitHub:        ${ownerRepo}${githubLogin ? ` (@${githubLogin})` : ""}`);
+  console.log(`    Signature:     ${identityBadge || "(skipped)"}`);
+  const envNames = Object.keys(credsAll).filter(k => ["LINEAR_API_KEY","JIRA_EMAIL","JIRA_API_TOKEN","GITHUB_TOKEN"].includes(k));
+  console.log(`    .env written:  ${envNames.join(", ") || "(none)"}`);
   console.log("");
 
-  // --- Final step: agentdesk project key (with the tracker-derived default) ---
-  if (!quick) {
-    const keyAnswer = await ask(rl, `  AgentDesk project key [${finalProjectKey}]: `);
-    if (keyAnswer.trim()) finalProjectKey = keyAnswer.trim();
-    console.log("");
-  }
-
-  // --- Summary + confirm before write ---
-  let merged = {};
-  if (hasConfig) {
-    try { merged = JSON.parse(readFileSync(configPath, "utf-8")); } catch {}
-  }
-
-  merged.projectKey = finalProjectKey;
-
-  if (tracker) merged.tracker = tracker;
-  else delete merged.tracker;
-  if (config.linear) merged.linear = config.linear; else if (!tracker) delete merged.linear;
-  if (config.jira) merged.jira = config.jira; else if (!tracker) delete merged.jira;
-  if (config.github) merged.github = config.github;
-  if (config.identityBadge) merged.identityBadge = config.identityBadge;
-
-  if (!quick) {
-    console.log("  Review");
-    console.log("  ──────");
-    console.log(`    Project key:      ${merged.projectKey}`);
-    console.log(`    Tracker:          ${merged.tracker || "none"}`);
-    if (merged.linear) console.log(`    Linear:           workspace=${merged.linear.workspace || "-"}, team=${merged.linear.teamKey || "-"}`);
-    if (merged.jira) console.log(`    Jira:             ${merged.jira.baseUrl || "-"}, project=${merged.jira.project || "-"}`);
-    if (merged.github) console.log(`    GitHub:           repo=${merged.github.repo || "-"}, user=@${merged.github.login || "-"}`);
-    if (merged.identityBadge) console.log(`    Identity badge:   ${merged.identityBadge}`);
-    console.log("");
-    const confirm = (await ask(rl, "  Save this config? [Y/n]: ")).trim().toLowerCase();
-    if (confirm && confirm !== "y" && confirm !== "yes") {
-      console.log("  Cancelled — nothing written.");
-      rl.close();
-      return;
-    }
-    console.log("");
+  const save = (await ask("  Save this config? [Y/n]: ")).trim().toLowerCase();
+  if (save && save !== "y" && save !== "yes") {
+    console.log("  Cancelled — nothing written to .agentdesk.json.");
+    return;
   }
+  console.log("");
 
-  writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n");
-  console.log(`  Saved .agentdesk.json`);
+  // Write .agentdesk.json
+  writeFileSync(join(currentCwd, ".agentdesk.json"), JSON.stringify(config, null, 2) + "\n");
+  console.log("  ✓ Saved .agentdesk.json");
 
-  // Ensure .agentdesk/ is gitignored (local runtime state — memory, cache, etc.)
-  const gitignorePath = join(project.dir, ".gitignore");
+  // .gitignore — add .agentdesk/
+  const gitignorePath = join(currentCwd, ".gitignore");
   try {
     const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
     if (!existing.split("\n").some(line => line.trim() === ".agentdesk/" || line.trim() === ".agentdesk")) {
       const nl = existing.endsWith("\n") || !existing ? "" : "\n";
       writeFileSync(gitignorePath, `${existing}${nl}.agentdesk/\n`);
-      console.log(`  Added .agentdesk/ to .gitignore`);
+      console.log("  ✓ Added .agentdesk/ to .gitignore");
     }
   } catch {}
 
-  // Register in local project index (for daemon discovery)
-  registerLocalProject(finalProjectKey, project.name || finalProjectKey, project.dir);
-
-  // --- Register with server ---
+  // Register with server + push settings
   try {
-    const res = await fetch(`${SERVER}/api/projects`, {
+    await fetch(`${SERVER}/api/projects`, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...(loadApiKey(cwd) ? { "x-api-key": loadApiKey(cwd) } : {}),
-      },
-      body: JSON.stringify({
-        id: finalProjectKey,
-        name: project.name || finalProjectKey,
-        path: project.dir,
-        type: project.type,
-        tracker,
-      }),
+      headers: { "Content-Type": "application/json", "x-api-key": apiKey },
+      body: JSON.stringify({ id: projectKey, name: projectName, path: currentCwd, tracker }),
     });
-    if (res.ok) {
-      console.log("  Registered with agentdesk.live");
-    }
-    // Push settings to server via the shared helper so error surfacing is consistent.
-    const key = loadApiKey(cwd);
-    if (key) {
-      const push = await pushConfig(key, SERVER, finalProjectKey, merged);
-      if (!push.ok && push.error !== "missing_auth") {
-        console.log(`  ⚠  Could not push settings to agentdesk.live: ${push.error}`);
-        console.log("     Your local .agentdesk.json is saved; retry from the UI or re-run init.");
-      }
+    const push = await pushConfig(apiKey, SERVER, projectKey, config);
+    if (!push.ok && push.error !== "missing_auth") {
+      console.log(`  ⚠  Could not push settings to agentdesk.live: ${push.error}`);
+    } else {
+      console.log("  ✓ Registered with agentdesk.live");
     }
   } catch {
-    // Server not available
+    console.log("  ⚠  Couldn't reach agentdesk.live — local config saved, retry from the UI later.");
   }
 
+  registerLocalProject(projectKey, projectName, currentCwd);
+
   console.log("");
-  console.log("  Ready! Run a team session:");
+  const cmdPrefix = trackerTeamOrProjectId || projectKey.toUpperCase();
+  console.log("  Ready. Run a team session:");
+  console.log(`    agentdesk team ${cmdPrefix}-123`);
   console.log("");
-  if (tracker) {
-    const prefix = config.linear?.teamKey || config.jira?.project || finalProjectKey.toUpperCase();
-    console.log(`    agentdesk team ${prefix}-123`);
-    console.log(`    agentdesk team ${prefix}-123 -d "Optional extra context"`);
-  } else {
-    console.log(`    agentdesk team my-feature -d "Add dark mode support"`);
+}
+
+// ---------- Entry: routing (E1) ----------
+
+export async function runInit(cwd, opts = {}) {
+  const forceFull = !!opts.forceFull;
+  const apiKey = getStoredApiKey();
+  if (!apiKey) {
+    console.log("\n  Not logged in. Run `agentdesk login` first.\n");
+    process.exit(1);
   }
-  console.log("");
 
-  if (!project.hasClaudeMd) {
-    console.log("  Tip: Create a CLAUDE.md to help the agents understand your codebase.");
+  const local = readLocalConfig(cwd);
+
+  // --- E1: Detection ---
+  if (!forceFull && local?.projectKey) {
+    // Modern config — gap-scan by default.
+    console.log("");
+    console.log("  AgentDesk — existing project detected");
+    console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
     console.log("");
+    const choice = await promptSelect({
+      message: "What would you like to do?",
+      default: "refresh",
+      choices: [
+        { name: "Refresh tokens (update .env only — recommended)", value: "refresh" },
+        { name: "Walk through the full setup again", value: "full" },
+        { name: "Cancel", value: "cancel" },
+      ],
+    });
+    if (choice === "cancel") return;
+    if (choice === "refresh") {
+      await runExistingFlow(cwd, apiKey, local.projectKey);
+      return;
+    }
+    // choice === "full" → fall through to new-project wizard
+    return await runNewProjectWizard(cwd, apiKey);
+  }
+
+  if (!forceFull && local && !local.projectKey) {
+    // Legacy config — try to migrate.
+    const match = await autoMatchLegacy(cwd, apiKey, local);
+    if (match) {
+      console.log(`\n  ✓ Legacy .agentdesk.json recognized — ${match.reason}. Migrating to project "${match.name}" (${match.projectKey}).`);
+      const migrated = { ...local, projectKey: match.projectKey };
+      writeFileSync(join(cwd, ".agentdesk.json"), JSON.stringify(migrated, null, 2) + "\n");
+      await runExistingFlow(cwd, apiKey, match.projectKey);
+      return;
+    }
+    console.log("\n  ⚠  Legacy .agentdesk.json has no projectKey and no confident match found.");
+    // Fall through to Connect/New menu.
+  }
+
+  if (!forceFull) {
+    // No local config (or legacy-unmatched). Try git-remote auto-match.
+    const match = await autoMatchProject(cwd, apiKey);
+    if (match) {
+      console.log("");
+      console.log(`  ✓ Recognized: ${match.name} (${match.projectKey}) — ${match.reason}`);
+      const confirm = await promptSelect({
+        message: "Use this project?",
+        default: "yes",
+        choices: [
+          { name: "Yes, continue with this project", value: "yes" },
+          { name: "No, pick another from my account", value: "other" },
+          { name: "Cancel", value: "cancel" },
+        ],
+      });
+      if (confirm === "cancel") return;
+      if (confirm === "yes") {
+        await runExistingFlow(cwd, apiKey, match.projectKey);
+        return;
+      }
+      // "other" — fall through to picker below
+    }
+
+    console.log("");
+    const top = await promptSelect({
+      message: "What would you like to do?",
+      choices: [
+        { name: "Connect to an existing project on my account", value: "connect" },
+        { name: "Set up this as a new project (full wizard)", value: "new" },
+        { name: "Cancel", value: "cancel" },
+      ],
+    });
+    if (top === "cancel") return;
+    if (top === "connect") {
+      const projectKey = await discoverProject(cwd, apiKey);
+      if (!projectKey) return;
+      console.log("");
+      await runExistingFlow(cwd, apiKey, projectKey);
+      return;
+    }
+    // "new" falls through to the wizard
   }
 
-  rl.close();
+  await runNewProjectWizard(cwd, apiKey);
 }