@kendoo.agentdesk/agentdesk 0.20.1 → 0.20.3

package/CHANGELOG.md

@@ -13,6 +13,22 @@ Internal refactors, infrastructure changes, and architectural notes are not list
 ### Added
 - `[UI]` Private-session sharing flow. When someone visits a session URL they don't own, they now see a friendly "Shh… this one's private" page with a one-click "Request access" button instead of a blank error. The session owner sees pending requests in a new header inbox and can grant viewer access for just that session or the whole project. Viewer-granted sessions show up in the teammate's sidebar tagged as a viewer.
 
+## [0.20.3] — 2026-04-19
+
+### Fixed
+- `[CLI]` Critical: `loadConfig` no longer lets a server row with `null` or missing fields override a fully-configured local `.agentdesk.json`. The merge now treats `null`/`undefined` from the server as "no value known" — only explicit non-null server values win. Previously a partially-synced project row on agentdesk.live would silently strip local tracker/repo/badge fields during the merge, and the cached-back write then persisted the stripped state to disk. On the next `init` run, the config looked empty even though the user had typed everything in.
+- `[CLI]` Existing-mode save in `init` preserves the full local `.agentdesk.json` — it only ensures `projectKey` is set, never replaces other fields. The previous behavior wrote `{ "projectKey": "..." }` as the entire file, which destroyed any data not also on the server.
+- `[CLI]` Auto-heal sync: when `loadConfig` sees a server row missing fields the local file has, it now pushes the merged config back to the server (fire-and-forget) so both sides converge. Projects that were set up before server-settings-push landed will heal themselves on next init.
+
+## [0.20.2] — 2026-04-19
+
+### Changed
+- `[CLI]` `agentdesk init` is now a single mode-aware wizard instead of branching into separate flows. Two modes, picked automatically: **new** (no matching project on the server) walks every step interactively; **existing** (local `.agentdesk.json` has `projectKey`, or the git remote auto-matches a project on your account) shows the same steps but locks the project-wide ones (repo, tracker type/location/team, signature) as read-only with a "change in agentdesk.live" hint. Only per-machine credential steps (GitHub token, tracker credentials) are editable in existing mode — the CLI never mutates project-wide settings for an already-configured project.
+- `[CLI]` Removed the "Refresh tokens / Cancel" menu. With the mode-aware wizard, the existing flow always surfaces every setting so you can see what's there and update credentials cleanly; nothing is hidden behind a "refresh only" shortcut that silently skipped visibility.
+- `[CLI]` When no local config and the git remote doesn't auto-match, `init` shows a picker of the user's account projects plus "Set up as a new project" plus "Cancel" — no ambiguity about whether you're about to create a duplicate.
+- `[CLI]` Per-machine credential prompts (GitHub token, Linear API key, Jira email/token) now offer a "Keep current / Replace" choice when an existing value is present, instead of blindly re-prompting.
+- `[CLI]` `--force-full` still bypasses detection and runs the full new-mode wizard — useful when the auto-match is wrong or you're intentionally re-pushing settings.
+
 ## [0.20.1] — 2026-04-19
 
 ### Fixed

package/README.md

@@ -43,28 +43,29 @@ Opens your browser to [agentdesk.live](https://agentdesk.live) where you sign up
 agentdesk init
 ```
 
-`agentdesk init` is a single entry point that auto-routes based on what it finds:
+`agentdesk init` is a single mode-aware wizard. It detects whether this clone maps to an existing project on your account and picks a mode accordingly:
 
-- **Modern `.agentdesk.json` (projectKey present)** → arrow-key menu: *Refresh tokens* (default) / Full setup / Cancel.
-- **Legacy `.agentdesk.json` (no projectKey)** → tries to match your account's projects by `github.repo` / git remote / tracker team; migrates the file forward on a confident match.
-- **No local config** → auto-matches the git remote against your account's projects. On a single match, prints `✓ Recognized: <name>` and confirms; otherwise a top-level *Connect to existing / New project / Cancel* menu.
+- **Existing mode** — local `.agentdesk.json` has a `projectKey`, or the git remote matches a project on your account. The wizard walks every step, but project-wide steps (repo, tracker type/location/team, signature) are shown as read-only with a "change in agentdesk.live" hint. Only per-machine credential steps (GitHub token, tracker credentials) are interactive. Rationale: tracker/repo/team are shared state — changing them in one CLI would desync teammates and the dashboard, so those changes belong in project settings on agentdesk.live.
+- **New mode** — no match found. Every step is interactive. On save, the new project row is POSTed to agentdesk.live and its settings are pushed.
 
-The **new-project wizard** is ten tiny steps, each doing one thing:
+When there's no local config and no unique auto-match but the account has other projects, `init` shows a picker of your projects plus *"Set up as a new project"* and *"Cancel"* so you can't accidentally create a duplicate.
+
+The wizard is ten tiny steps, each doing one thing:
 
 1. Detect git repo in cwd.
-2. Ask for GitHub repo (`owner/repo` or URL; GitHub only for now) — skipped when a repo is detected.
-3. Ask for `GITHUB_TOKEN`, fetch `@login` from the GitHub API, echo "Token authenticates as @…".
-4. `git clone` the repo into `./<repo>` — skipped when already in one.
-5. Tracker type — Linear / Jira / GitHub Issues / None.
-6. Tracker location — Linear workspace slug *or* Jira tenant URL.
-7. Tracker credentials — `LINEAR_API_KEY` *or* `JIRA_EMAIL`+`JIRA_API_TOKEN`.
-8. **How should the AI team sign its work?** AgentDesk / Claude Code / Custom… / Skip.
-9. Verify tracker + pick team/project from the fetched list.
+2. GitHub repo (prompted in new mode; locked-display in existing mode).
+3. GitHub token — per-machine, always editable. If present, offers Keep/Replace; if new, prompts. `@login` is fetched from the GitHub API and echoed.
+4. `git clone` the repo into `./<repo>` when cwd isn't already that repo.
+5. Tracker type (locked in existing mode).
+6. Tracker location — Linear workspace / Jira tenant URL (locked in existing mode).
+7. Tracker credentials — per-machine, always editable with Keep/Replace.
+8. "How should the AI team sign its work?" (locked in existing mode).
+9. Verify tracker + (new mode) pick team/project from the fetched list.
 10. Review, access-check checklist (`agentdesk.live ✓`, `GitHub ✓`, tracker ✓), confirm save.
 
-The **existing-project flow** (E1–E7) reuses Steps 3, 4 (clone if missing) and Step 10's access checks, plus a server-config fetch and a gap-scan for whichever `.env` credentials are missing. Nothing project-wide is re-asked.
+Legacy `.agentdesk.json` files (without `projectKey`) are auto-migrated: `init` matches your account's projects by `github.repo` / git remote / tracker team, writes the `projectKey` back, and enters existing mode.
 
-Use `agentdesk init --force-full` to bypass every auto-route and always walk the new-project wizard. `agentdesk bootstrap` is an alias that always runs the existing-project flow.
+Use `agentdesk init --force-full` to bypass detection and always run the new-mode wizard (useful when the auto-match is wrong or you're intentionally re-pushing settings). `agentdesk bootstrap` is a compatibility alias.
 
 All menus use arrow-key navigation with color highlighting; Ctrl-C exits cleanly.
 

package/bin/agentdesk.mjs

@@ -58,11 +58,12 @@ if (!command || command === "help" || command === "--help") {
     2. agentdesk init           Guided setup — auto-detects new vs existing projects
     3. agentdesk team TASK-123  Run a team session
 
-  'agentdesk init' branches on what it finds:
-    • Local .agentdesk.json with projectKey  → Refresh tokens (default) / Full setup / Cancel
-    • No local config, git remote matches    → confirms the match, then only asks for tokens
-    • No match                               → Connect to existing / New project (wizard) / Cancel
-    Use 'agentdesk init --force-full' to bypass the fast paths.
+  'agentdesk init' is a mode-aware wizard:
+    • Existing mode (local projectKey / git-remote auto-match) — walks every step;
+      project-wide fields are locked (change them in agentdesk.live), credentials editable.
+    • New mode (no match)                    — every step interactive; project POSTed to the server.
+    • Ambiguous                               — picker of your projects + 'Set up as a new project'.
+    Use 'agentdesk init --force-full' to bypass detection and always run new mode.
 
   Commands:
     agentdesk login                        Sign in to AgentDesk

package/cli/config.mjs

@@ -87,20 +87,32 @@ export async function loadConfig(dir, opts = {}) {
     }
   }
 
-  // Merge: DEFAULTS ← local ← server (UI is the single source of truth)
+  // Merge: DEFAULTS ← local ← server, where the "server overrides local"
+  // rule only kicks in when the server actually has a value. Null /
+  // undefined on the server means "the server doesn't know about this
+  // field yet" — local wins. This is what keeps a partially-configured
+  // server row from silently wiping a fully-configured local file on
+  // next read.
   let config = { ...DEFAULTS };
   if (localConfig) config = deepMerge(config, localConfig);
-  if (serverConfig) config = deepMerge(config, serverConfig);
-
-  // First-time sync: if local exists but server is empty, push local up.
-  if (localConfig && !serverConfig && apiKey && serverUrl && projectName) {
-    pushConfig(apiKey, serverUrl, projectName, localConfig).catch(() => {});
+  if (serverConfig) config = mergeNonNull(config, serverConfig);
+
+  // Auto-heal sync: if local has fields the server is missing (either
+  // no row at all or a partial row), push the merged config up so the
+  // server catches up. Fire-and-forget — we already have the right
+  // answer in `config` for the current caller.
+  const shouldHeal = localConfig && apiKey && serverUrl && projectName && (
+    !serverConfig || hasFieldsServerLacks(localConfig, serverConfig)
+  );
+  if (shouldHeal) {
+    pushConfig(apiKey, serverUrl, projectName, stripCredentials(config)).catch(() => {});
   }
 
-  // Cache the merged, credential-free config back to disk so the local file
-  // stays a readable view of the authoritative state. Only when we actually
-  // fetched from the server — offline runs must not silently mutate the
-  // user's local file.
+  // Cache the merged, credential-free config back to disk so the local
+  // file stays a readable view of the authoritative state. Only when we
+  // actually fetched from the server — offline runs must not silently
+  // mutate the user's local file. With mergeNonNull above, we're
+  // guaranteed this write never strips existing local fields.
   if (serverConfig) {
     writeLocalConfig(configPath, config);
   }
@@ -108,6 +120,23 @@ export async function loadConfig(dir, opts = {}) {
   return config;
 }
 
+// True when `local` has any non-null leaf that's null/missing on `server`.
+// Walked recursively for nested blocks (linear, jira, github). Used to
+// decide whether it's worth pushing a heal sync.
+function hasFieldsServerLacks(local, server) {
+  const isObj = v => v && typeof v === "object" && !Array.isArray(v);
+  for (const [key, v] of Object.entries(local || {})) {
+    if (v === null || v === undefined) continue;
+    const s = server?.[key];
+    if (isObj(v)) {
+      if (!isObj(s) || hasFieldsServerLacks(v, s)) return true;
+    } else {
+      if (s === null || s === undefined) return true;
+    }
+  }
+  return false;
+}
+
 // Push a config object to the server. Caller is responsible for deciding when.
 export async function pushConfig(apiKey, serverUrl, projectName, payload) {
   if (!apiKey || !serverUrl || !projectName) return { ok: false, error: "missing_auth" };
@@ -185,3 +214,19 @@ function deepMerge(defaults, overrides) {
   }
   return result;
 }
+
+// Like deepMerge, but null/undefined on the overrides side never
+// clobbers a non-null value already in base. Used for the local ← server
+// step so an empty server row can't wipe a fully-populated local file.
+function mergeNonNull(base, overrides) {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === null || value === undefined) continue;
+    if (value && typeof value === "object" && !Array.isArray(value) && base[key] && typeof base[key] === "object") {
+      result[key] = mergeNonNull(base[key], value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}

package/cli/init.mjs

@@ -1,28 +1,29 @@
-// `agentdesk init` — unified setup entry point.
+// `agentdesk init` — always the wizard, mode-aware.
 //
-// Three possible outcomes, decided automatically:
-//   1. Modern .agentdesk.json with projectKey → "Refresh tokens" is the
-//      default option in a small menu; picking it runs gapScan.
-//   2. Legacy .agentdesk.json without projectKey → try to match an account
-//      project by github.repo / git remote / tracker team → migrate the
-//      file forward and gapScan.
-//   3. No local config → auto-match by git remote. On match, the user
-//      confirms "use this project?"; on no match the user picks from
-//      their participating projects, or opts into the full new-project
-//      wizard.
+// Two modes, decided automatically at entry time:
+//   • new       — server has no project for this clone. Every step is an
+//                 interactive prompt; save writes a new project row to the
+//                 server and pushes its settings.
+//   • existing  — server already has a project for this clone (local
+//                 .agentdesk.json has projectKey, or git remote auto-matches
+//                 one). Project-wide steps (repo, tracker type/location,
+//                 team, signature) become read-only display lines with a
+//                 "configured on agentdesk.live — change there" hint;
+//                 only the per-machine credential steps (GitHub token,
+//                 tracker creds) are interactive.
 //
-// The full wizard is 10 tiny steps (git detect, GitHub repo+token,
-// optional clone, tracker type/location/creds, signature, verify+pick,
-// review+save). Each step does one thing so re-entry after Ctrl-C is sane.
+// Rationale for the locks: tracker/repo/team are shared state. Changing
+// them in one CLI would desync teammates and the dashboard. Those
+// changes belong in project settings on agentdesk.live. CLI init is the
+// single, consistent way to get a machine ready — nothing more.
 
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
-import { execSync } from "child_process";
 import { loadConfig, pushConfig } from "./config.mjs";
 import { getStoredApiKey } from "./login.mjs";
 import { registerLocalProject } from "./projects.mjs";
 import { checkTrackerPermissions } from "./tracker-check.mjs";
-import { autoMatchProject, discoverProject, gapScan } from "./bootstrap.mjs";
+import { autoMatchProject } from "./bootstrap.mjs";
 import { select as promptSelect, ask, promptRequired } from "./prompts.mjs";
 import {
   cloneRepoWithToken,
@@ -34,16 +35,12 @@ import {
   readLocalConfig,
   runAccessChecks,
   saveEnvVar,
-  writeMinimalLocalConfig,
 } from "./setup-helpers.mjs";
 
 const SERVER = process.env.AGENTDESK_SERVER || "https://agentdesk.live";
 
-// ---------- Tracker team/project picker helpers ----------
+// ---------- Tracker list helpers (for step 9 in new mode) ----------
 
-// Fetch the pickable list of teams/projects after tracker creds are known.
-// Returns [{ id, name }] or null when the API couldn't answer (caller
-// falls back to a manual key prompt).
 async function listTrackerProjects({ tracker, creds, location }) {
   if (tracker === "linear") {
     if (!creds.LINEAR_API_KEY) return null;
@@ -75,19 +72,24 @@ async function listTrackerProjects({ tracker, creds, location }) {
   return null;
 }
 
-// ---------- Legacy migration: auto-match a config without projectKey ----------
+// ---------- Project picker (when auto-match fails and server has projects) ----------
 
-async function autoMatchLegacy(cwd, apiKey, localConfig) {
-  // Fetch the user's projects once; filter on server-known fields.
-  let projects;
+async function fetchAccountProjects(apiKey) {
   try {
     const res = await fetch(`${SERVER}/api/projects`, {
-      headers: { "x-api-key": apiKey }, signal: AbortSignal.timeout(8000),
+      headers: { "x-api-key": apiKey },
+      signal: AbortSignal.timeout(8000),
     });
-    if (!res.ok) return null;
-    projects = await res.json();
-  } catch { return null; }
-  if (!projects?.length) return null;
+    if (!res.ok) return [];
+    return await res.json();
+  } catch { return []; }
+}
+
+// ---------- Legacy migration ----------
+
+async function autoMatchLegacy(cwd, apiKey, localConfig) {
+  const projects = await fetchAccountProjects(apiKey);
+  if (!projects.length) return null;
 
   const settingsList = await Promise.all(projects.map(async p => {
     try {
@@ -105,223 +107,258 @@ async function autoMatchLegacy(cwd, apiKey, localConfig) {
   for (let i = 0; i < projects.length; i++) {
     const p = projects[i];
     const s = settingsList[i];
-    const serverRepo = (s?.github?.repo || "").toLowerCase();
-    const serverTeam = (s?.linear?.teamKey || "").toLowerCase();
-    const serverJira = (s?.jira?.project || "").toLowerCase();
-
-    if (legacyRepo && serverRepo === legacyRepo) {
+    if (legacyRepo && (s?.github?.repo || "").toLowerCase() === legacyRepo) {
       return { projectKey: p.id, name: p.name, reason: `github.repo matches ${s.github.repo}` };
     }
-    if (legacyTeamKey && serverTeam === legacyTeamKey) {
+    if (legacyTeamKey && (s?.linear?.teamKey || "").toLowerCase() === legacyTeamKey) {
       return { projectKey: p.id, name: p.name, reason: `Linear team matches ${s.linear.teamKey}` };
     }
-    if (legacyJiraProject && serverJira === legacyJiraProject) {
+    if (legacyJiraProject && (s?.jira?.project || "").toLowerCase() === legacyJiraProject) {
       return { projectKey: p.id, name: p.name, reason: `Jira project matches ${s.jira.project}` };
     }
   }
   return null;
 }
 
-// ---------- Existing-project flow (E3–E7) ----------
+// ---------- The unified wizard ----------
 
-async function runExistingFlow(cwd, apiKey, projectKey) {
+async function runWizard({ cwd, apiKey, mode, projectKey }) {
+  const isExisting = mode === "existing";
   let currentCwd = cwd;
 
   console.log("");
-  console.log("  AgentDesk — connecting to existing project");
-  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-  console.log("");
-
-  // --- E3 (was E5): Fetch server config first, so every later prompt can
-  // reference the project's known tracker/repo instead of re-asking.
-  process.stdout.write("  Fetching project settings from agentdesk.live... ");
-  const config = await loadConfig(currentCwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true });
-  console.log("✓");
-  console.log(`    Project:   ${projectKey}`);
-  if (config.tracker) console.log(`    Tracker:   ${config.tracker}`);
-  if (config.github?.repo) console.log(`    Repo:      ${config.github.repo}`);
-  console.log("");
-
-  // --- E4 (was E3): GitHub token. Names the repo it's for so the user
-  //     knows why we're asking.
-  let env = loadDotEnv(currentCwd);
-  let githubToken = env.GITHUB_TOKEN;
-  if (!githubToken) {
-    const repoHint = config.github?.repo ? ` (needed to push to ${config.github.repo})` : "";
-    console.log(`  GitHub token${repoHint} — create one at https://github.com/settings/tokens, scope: repo`);
-    githubToken = await promptRequired("GitHub token");
-    saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-    console.log("  ✓ Saved GITHUB_TOKEN to .env");
-  }
-  const githubLogin = await fetchGitHubLogin(githubToken);
-  if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
-  else console.log("  ⚠  Token couldn't be verified against the GitHub API (continuing anyway)");
+  console.log(isExisting
+    ? `  AgentDesk — configuring existing project`
+    : `  AgentDesk — setting up a new project`);
+  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
   console.log("");
 
-  // --- E4: Ensure correct repo is locally present ---
-  const serverRepo = config.github?.repo ? parseGitHubRef(config.github.repo) : null;
-  if (serverRepo) {
-    const here = detectGitRepo(currentCwd);
-    const expected = `${serverRepo.owner}/${serverRepo.repo}`.toLowerCase();
-    const haveHere = (here.ownerRepo || "").toLowerCase();
-    if (!here.inRepo || haveHere !== expected) {
-      if (here.inRepo && haveHere && haveHere !== expected) {
-        console.log(`  Current directory holds ${haveHere} — cloning ${expected} into ./${serverRepo.repo} instead.`);
-      } else {
-        console.log(`  Cloning ${expected} into ./${serverRepo.repo}...`);
-      }
-      try {
-        currentCwd = cloneRepoWithToken({ cwd: currentCwd, owner: serverRepo.owner, repo: serverRepo.repo, token: githubToken });
-      } catch (err) {
-        console.log(`  ✗ ${err.message}`);
-        return;
-      }
-      // Re-save the token into the cloned working tree's .env (previous
-      // save was into the parent dir).
-      saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-      console.log("");
-    }
+  // Server config for existing mode. Fetched up front so every subsequent
+  // step knows what's already set on agentdesk.live.
+  let serverConfig = null;
+  if (isExisting) {
+    process.stdout.write("  Fetching project settings from agentdesk.live... ");
+    serverConfig = await loadConfig(currentCwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true });
+    console.log("✓");
+    console.log(`    Project:   ${projectKey}`);
+    console.log(`    Tracker:   ${serverConfig.tracker || "(not set — change in agentdesk.live)"}`);
+    console.log(`    Repo:      ${serverConfig.github?.repo || "(not set)"}`);
+    console.log(`    Signature: ${serverConfig.identityBadge || "(not set)"}`);
+    console.log("");
   }
 
-  // Ensure .agentdesk.json in currentCwd carries the projectKey so loadConfig
-  // works on subsequent runs without needing discovery.
-  writeMinimalLocalConfig(currentCwd, projectKey);
-
-  // --- E6: Fill missing tracker creds + verify (gapScan handles both) ---
-  await gapScan({ cwd: currentCwd, apiKey, projectKey });
-
-  // --- E7: Final access-checks summary ---
-  env = loadDotEnv(currentCwd);
-  const results = await runAccessChecks({ apiKey, serverUrl: SERVER, cwd: currentCwd, config, creds: env });
-  printAccessChecks(results, { tracker: config.tracker });
-  console.log("");
-}
-
-// ---------- New-project wizard (steps 1–10) ----------
-
-async function runNewProjectWizard(cwd, apiKey) {
-  let currentCwd = cwd;
-
-  console.log("");
-  console.log("  AgentDesk — new project setup");
-  console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-  console.log("");
-
-  // --- Step 1: Detect git repo ---
+  // Step 1 — detect git repo (silent).
   const git = detectGitRepo(currentCwd);
-  let ownerRepo = git.ownerRepo;
 
-  // --- Step 2: Ask for the GitHub repo (only if no git repo) ---
-  if (!git.inRepo) {
-    console.log("  No git repo here yet.\n");
+  // Step 2 — GitHub repo.
+  let ownerRepo = git.ownerRepo;
+  if (isExisting) {
+    if (serverConfig.github?.repo) {
+      ownerRepo = serverConfig.github.repo;
+      console.log(`  Repo:           ${ownerRepo}    (configured — change in agentdesk.live)`);
+      console.log("");
+    }
+  } else if (!git.inRepo) {
+    console.log("  No git repo here yet.");
+    console.log("");
     while (!ownerRepo) {
       const input = await promptRequired("GitHub repo (owner/repo or URL)");
       const parsed = parseGitHubRef(input);
-      if (parsed) { ownerRepo = `${parsed.owner}/${parsed.repo}`; }
+      if (parsed) ownerRepo = `${parsed.owner}/${parsed.repo}`;
       else console.log("  Not a valid GitHub repo. Only github.com is supported right now.");
     }
     console.log("");
   }
 
-  // --- Step 3: GitHub token ---
+  // Step 3 — GitHub token (always editable, per-machine).
   let env = loadDotEnv(currentCwd);
   let githubToken = env.GITHUB_TOKEN;
-  if (!githubToken) {
-    console.log("  GitHub token (create one at https://github.com/settings/tokens — scope: repo)");
+  let githubLogin = null;
+
+  if (githubToken) {
+    githubLogin = await fetchGitHubLogin(githubToken);
+    if (githubLogin) {
+      const choice = await promptSelect({
+        message: `GitHub token — currently authenticates as @${githubLogin}`,
+        default: "keep",
+        choices: [
+          { name: "Keep current token", value: "keep" },
+          { name: "Replace with a new token", value: "new" },
+        ],
+      });
+      if (choice === "new") {
+        githubToken = await promptRequired("GitHub token");
+        saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+        githubLogin = await fetchGitHubLogin(githubToken);
+        if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
+      }
+    } else {
+      console.log("  ⚠  GITHUB_TOKEN in .env doesn't authenticate with GitHub — enter a new one.");
+      githubToken = await promptRequired("GitHub token");
+      saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+      githubLogin = await fetchGitHubLogin(githubToken);
+      if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
+    }
+  } else {
+    const repoHint = ownerRepo ? ` (needed to push to ${ownerRepo})` : "";
+    console.log(`  GitHub token${repoHint} — create one at https://github.com/settings/tokens, scope: repo`);
     githubToken = await promptRequired("GitHub token");
     saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-    console.log("  ✓ Saved GITHUB_TOKEN to .env");
+    githubLogin = await fetchGitHubLogin(githubToken);
+    if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
+    else console.log("  ⚠  Token couldn't be verified against the GitHub API (continuing anyway)");
   }
-  const githubLogin = await fetchGitHubLogin(githubToken);
-  if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
-  else console.log("  ⚠  Token couldn't be verified against the GitHub API (continuing anyway)");
   console.log("");
 
-  // --- Step 4: Clone (only if no git repo) ---
-  if (!git.inRepo) {
-    const [owner, repo] = ownerRepo.split("/");
-    console.log(`  Cloning ${ownerRepo} into ./${repo}...`);
-    try {
-      currentCwd = cloneRepoWithToken({ cwd: currentCwd, owner, repo, token: githubToken });
-    } catch (err) {
-      console.log(`  ✗ ${err.message}`);
-      return;
+  // Step 4 — Clone if the correct repo isn't here locally.
+  if (ownerRepo) {
+    const parsed = parseGitHubRef(ownerRepo);
+    if (parsed) {
+      const expected = `${parsed.owner}/${parsed.repo}`.toLowerCase();
+      const haveHere = (git.ownerRepo || "").toLowerCase();
+      if (!git.inRepo || haveHere !== expected) {
+        console.log(`  Cloning ${parsed.owner}/${parsed.repo} into ./${parsed.repo}...`);
+        try {
+          currentCwd = cloneRepoWithToken({ cwd: currentCwd, owner: parsed.owner, repo: parsed.repo, token: githubToken });
+          saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+        } catch (err) {
+          console.log(`  ✗ ${err.message}`);
+          return;
+        }
+        console.log("");
+      }
     }
-    saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-    console.log("");
   }
 
-  // --- Step 5: Tracker type ---
-  const tracker = await promptSelect({
-    message: "Task tracker",
-    choices: [
-      { name: "Linear", value: "linear" },
-      { name: "Jira", value: "jira" },
-      { name: "GitHub Issues", value: "github" },
-      { name: "None (use descriptions only)", value: null },
-    ],
-  });
-  console.log("");
+  // Step 5 — Tracker type.
+  let tracker;
+  if (isExisting) {
+    tracker = serverConfig.tracker || null;
+    console.log(`  Tracker:        ${tracker || "none"}    (configured — change in agentdesk.live)`);
+    console.log("");
+  } else {
+    tracker = await promptSelect({
+      message: "Task tracker",
+      choices: [
+        { name: "Linear", value: "linear" },
+        { name: "Jira", value: "jira" },
+        { name: "GitHub Issues", value: "github" },
+        { name: "None (use descriptions only)", value: null },
+      ],
+    });
+    console.log("");
+  }
 
-  // --- Step 6: Tracker location ---
+  // Step 6 — Tracker location.
   let linearWorkspace = null;
   let jiraBaseUrl = null;
-  if (tracker === "linear") {
-    linearWorkspace = await promptRequired("Linear workspace slug (the 'kendoo' in linear.app/kendoo)");
-    console.log("");
-  } else if (tracker === "jira") {
-    const raw = await promptRequired("Jira tenant URL (e.g. https://yourco.atlassian.net)");
-    jiraBaseUrl = raw.replace(/\/+$/, "");
-    console.log("");
+  if (isExisting) {
+    linearWorkspace = serverConfig.linear?.workspace || null;
+    jiraBaseUrl = serverConfig.jira?.baseUrl || null;
+    if (tracker === "linear") {
+      console.log(`  Linear workspace: ${linearWorkspace || "(not set)"}  (configured — change in agentdesk.live)`);
+      console.log("");
+    } else if (tracker === "jira") {
+      console.log(`  Jira URL:        ${jiraBaseUrl || "(not set)"}  (configured — change in agentdesk.live)`);
+      console.log("");
+    }
+  } else {
+    if (tracker === "linear") {
+      linearWorkspace = await promptRequired("Linear workspace slug (the 'kendoo' in linear.app/kendoo)");
+      console.log("");
+    } else if (tracker === "jira") {
+      const raw = await promptRequired("Jira tenant URL (e.g. https://yourco.atlassian.net)");
+      jiraBaseUrl = raw.replace(/\/+$/, "");
+      console.log("");
+    }
   }
 
-  // --- Step 7: Tracker credentials ---
+  // Step 7 — Tracker credentials (always editable, per-machine).
   env = loadDotEnv(currentCwd);
   let linearApiKey = env.LINEAR_API_KEY;
   let jiraEmail = env.JIRA_EMAIL;
   let jiraApiToken = env.JIRA_API_TOKEN;
 
-  if (tracker === "linear" && !linearApiKey) {
-    console.log("  (Get a Linear API key: https://linear.app/settings/api)");
-    linearApiKey = await promptRequired("Linear API key");
-    saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
-    console.log("  ✓ Saved LINEAR_API_KEY to .env\n");
-  } else if (tracker === "jira") {
-    if (!jiraEmail) {
-      console.log("  (Create a Jira API token: https://id.atlassian.com/manage-profile/security/api-tokens)");
-      jiraEmail = await promptRequired("Atlassian login email");
-      saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
+  if (tracker === "linear") {
+    if (linearApiKey) {
+      const choice = await promptSelect({
+        message: "Linear API key — already in .env",
+        default: "keep",
+        choices: [
+          { name: "Keep current", value: "keep" },
+          { name: "Replace with a new one", value: "new" },
+        ],
+      });
+      if (choice === "new") {
+        linearApiKey = await promptRequired("Linear API key");
+        saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
+      }
+    } else {
+      console.log("  (Get a Linear API key: https://linear.app/settings/api)");
+      linearApiKey = await promptRequired("Linear API key");
+      saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
     }
-    if (!jiraApiToken) {
-      jiraApiToken = await promptRequired("Jira API token");
-      saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
+    console.log("");
+  } else if (tracker === "jira") {
+    if (jiraEmail && jiraApiToken) {
+      const choice = await promptSelect({
+        message: `Jira credentials — ${jiraEmail} / token in .env`,
+        default: "keep",
+        choices: [
+          { name: "Keep current", value: "keep" },
+          { name: "Replace with new credentials", value: "new" },
+        ],
+      });
+      if (choice === "new") {
+        jiraEmail = await promptRequired("Atlassian login email");
+        jiraApiToken = await promptRequired("Jira API token");
+        saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
+        saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
+      }
+    } else {
+      if (!jiraEmail) {
+        console.log("  (Create a Jira API token: https://id.atlassian.com/manage-profile/security/api-tokens)");
+        jiraEmail = await promptRequired("Atlassian login email");
+        saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
+      }
+      if (!jiraApiToken) {
+        jiraApiToken = await promptRequired("Jira API token");
+        saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
+      }
     }
-    console.log("  ✓ Saved JIRA credentials to .env\n");
+    console.log("");
   }
 
-  // --- Step 8: Signature ---
-  const badgeValue = await promptSelect({
-    message: "How should the AI team sign its work?",
-    default: "AgentDesk",
-    choices: [
-      { name: "AgentDesk", value: "AgentDesk" },
-      { name: "Claude Code", value: "Claude Code" },
-      { name: "Custom…", value: "__custom__" },
-      { name: "Skip (no signature)", value: null },
-    ],
-  });
-  let identityBadge = badgeValue;
-  if (badgeValue === "__custom__") {
-    const v = (await ask("  Custom signature: ")).trim();
-    identityBadge = v || null;
+  // Step 8 — Signature.
+  let identityBadge;
+  if (isExisting) {
+    identityBadge = serverConfig.identityBadge || null;
+    console.log(`  Signature:      ${identityBadge || "(not set)"}    (configured — change in agentdesk.live)`);
+    console.log("");
+  } else {
+    const badgeValue = await promptSelect({
+      message: "How should the AI team sign its work?",
+      default: "AgentDesk",
+      choices: [
+        { name: "AgentDesk", value: "AgentDesk" },
+        { name: "Claude Code", value: "Claude Code" },
+        { name: "Custom…", value: "__custom__" },
+        { name: "Skip (no signature)", value: null },
+      ],
+    });
+    identityBadge = badgeValue;
+    if (badgeValue === "__custom__") {
+      const v = (await ask("  Custom signature: ")).trim();
+      identityBadge = v || null;
+    }
+    console.log("");
   }
-  console.log("");
 
-  // --- Step 9: Verify tracker + pick team/project ---
-  // Build an in-progress config we mutate as we learn more.
+  // Build the in-memory config (used for verification + summary; written
+  // to disk only in new mode).
   const config = {
     tracker,
-    github: { repo: ownerRepo, login: githubLogin || null },
+    github: { repo: ownerRepo || null, login: githubLogin || null },
   };
   if (tracker === "linear") config.linear = { workspace: linearWorkspace };
   if (tracker === "jira") config.jira = { baseUrl: jiraBaseUrl };
@@ -330,10 +367,15 @@ async function runNewProjectWizard(cwd, apiKey) {
   let trackerTeamOrProjectId = null;
   let trackerTeamOrProjectName = null;
 
+  // Step 9 — Verify tracker + (new mode) pick team/project.
   if (tracker && tracker !== "github") {
-    process.stdout.write("  Verifying tracker access... ");
-    let verified = false;
-    while (!verified) {
+    if (isExisting) {
+      trackerTeamOrProjectId = serverConfig.linear?.teamKey || serverConfig.jira?.project || null;
+      trackerTeamOrProjectName = trackerTeamOrProjectId;
+      if (tracker === "linear" && trackerTeamOrProjectId) config.linear.teamKey = trackerTeamOrProjectId;
+      if (tracker === "jira" && trackerTeamOrProjectId) config.jira.project = trackerTeamOrProjectId;
+
+      process.stdout.write("  Verifying tracker access... ");
       const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
       const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
       if (check.ok) {
@@ -341,91 +383,128 @@ async function runNewProjectWizard(cwd, apiKey) {
         if (check.identity?.name || check.identity?.email) {
           console.log(`  ✓ Posting as: ${check.identity.name || check.identity.email}`);
         }
-        verified = true;
-        break;
-      }
-      console.log("failed");
-      for (const e of check.errors || []) console.log(`    • ${e}`);
-      const next = await promptSelect({
-        message: "What now?",
-        choices: [
-          { name: "Re-enter credentials and try again", value: "retry" },
-          { name: "Save anyway (fix later in .env)", value: "skip" },
-          { name: "Cancel", value: "cancel" },
-        ],
-      });
-      if (next === "cancel") return;
-      if (next === "skip") break;
-      if (tracker === "linear") {
-        linearApiKey = await promptRequired("Linear API key");
-        saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
-      } else if (tracker === "jira") {
-        jiraEmail = await promptRequired("Atlassian login email");
-        jiraApiToken = await promptRequired("Jira API token");
-        saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
-        saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
+      } else {
+        console.log("failed");
+        for (const e of check.errors || []) console.log(`    • ${e}`);
       }
-      process.stdout.write("  Re-verifying tracker access... ");
-    }
-
-    if (verified) {
-      const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
-      const items = await listTrackerProjects({ tracker, creds, location: jiraBaseUrl });
       console.log("");
-      if (items && items.length > 0) {
-        const pickedId = await promptSelect({
-          message: `Pick the ${tracker === "linear" ? "team" : "project"} this project maps to`,
-          choices: items.map(it => ({ name: it.name, value: it.id })),
+    } else {
+      process.stdout.write("  Verifying tracker access... ");
+      let verified = false;
+      while (!verified) {
+        const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
+        const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
+        if (check.ok) {
+          console.log("✓");
+          if (check.identity?.name || check.identity?.email) {
+            console.log(`  ✓ Posting as: ${check.identity.name || check.identity.email}`);
+          }
+          verified = true;
+          break;
+        }
+        console.log("failed");
+        for (const e of check.errors || []) console.log(`    • ${e}`);
+        const next = await promptSelect({
+          message: "What now?",
+          choices: [
+            { name: "Re-enter credentials and try again", value: "retry" },
+            { name: "Save anyway (fix later in .env)", value: "skip" },
+            { name: "Cancel", value: "cancel" },
+          ],
         });
-        trackerTeamOrProjectId = pickedId;
-        const pickedItem = items.find(it => it.id === pickedId);
-        trackerTeamOrProjectName = pickedItem?.name || pickedId;
-      } else {
-        trackerTeamOrProjectId = await promptRequired(tracker === "linear" ? "Linear team key (e.g. KEN)" : "Jira project key (e.g. PROJ)");
-        trackerTeamOrProjectName = trackerTeamOrProjectId;
+        if (next === "cancel") return;
+        if (next === "skip") break;
+        if (tracker === "linear") {
+          linearApiKey = await promptRequired("Linear API key");
+          saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
+        } else if (tracker === "jira") {
+          jiraEmail = await promptRequired("Atlassian login email");
+          jiraApiToken = await promptRequired("Jira API token");
+          saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
+          saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
+        }
+        process.stdout.write("  Re-verifying tracker access... ");
+      }
+
+      if (verified) {
+        const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
+        const items = await listTrackerProjects({ tracker, creds, location: jiraBaseUrl });
+        if (items && items.length > 0) {
+          const pickedId = await promptSelect({
+            message: `Pick the ${tracker === "linear" ? "team" : "project"} this project maps to`,
+            choices: items.map(it => ({ name: it.name, value: it.id })),
+          });
+          trackerTeamOrProjectId = pickedId;
+          trackerTeamOrProjectName = items.find(it => it.id === pickedId)?.name || pickedId;
+        } else {
+          trackerTeamOrProjectId = await promptRequired(tracker === "linear" ? "Linear team key (e.g. KEN)" : "Jira project key (e.g. PROJ)");
+          trackerTeamOrProjectName = trackerTeamOrProjectId;
+        }
+        if (tracker === "linear") config.linear = { ...config.linear, teamKey: trackerTeamOrProjectId };
+        if (tracker === "jira") config.jira = { ...config.jira, project: trackerTeamOrProjectId };
+        console.log("");
       }
-      if (tracker === "linear") config.linear = { ...config.linear, teamKey: trackerTeamOrProjectId };
-      if (tracker === "jira") config.jira = { ...config.jira, project: trackerTeamOrProjectId };
-      console.log("");
     }
   }
 
-  // Derive projectName + projectKey silently.
-  const repoShort = ownerRepo.split("/").pop();
-  const projectName = trackerTeamOrProjectName
-    ? `${repoShort} — ${String(trackerTeamOrProjectName).split(" (")[0]}`
-    : repoShort;
-  const keySource = trackerTeamOrProjectId || repoShort;
-  const projectKey = String(keySource).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
-  config.projectKey = projectKey;
+  // Derive projectName + projectKey (only used in new mode).
+  let projectName, computedKey;
+  if (isExisting) {
+    projectName = serverConfig.name || projectKey;
+    computedKey = projectKey;
+  } else {
+    const repoShort = ownerRepo ? ownerRepo.split("/").pop() : "project";
+    projectName = trackerTeamOrProjectName
+      ? `${repoShort} — ${String(trackerTeamOrProjectName).split(" (")[0]}`
+      : repoShort;
+    const keySource = trackerTeamOrProjectId || repoShort;
+    computedKey = String(keySource).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+  }
+  config.projectKey = computedKey;
 
-  // --- Step 10: Review + access checks + save ---
+  // Step 10 — Review + access checks + save.
   const credsAll = loadDotEnv(currentCwd);
   const results = await runAccessChecks({ apiKey, serverUrl: SERVER, cwd: currentCwd, config, creds: credsAll });
   printAccessChecks(results, { tracker });
   console.log("");
   console.log("  Summary");
   console.log("  ───────");
-  console.log(`    Project:       ${projectName} (${projectKey})`);
+  console.log(`    Project:       ${projectName} (${computedKey})`);
   console.log(`    Tracker:       ${tracker || "none"}${trackerTeamOrProjectId ? ` (${trackerTeamOrProjectId})` : ""}`);
-  console.log(`    GitHub:        ${ownerRepo}${githubLogin ? ` (@${githubLogin})` : ""}`);
-  console.log(`    Signature:     ${identityBadge || "(skipped)"}`);
-  const envNames = Object.keys(credsAll).filter(k => ["LINEAR_API_KEY","JIRA_EMAIL","JIRA_API_TOKEN","GITHUB_TOKEN"].includes(k));
-  console.log(`    .env written:  ${envNames.join(", ") || "(none)"}`);
+  console.log(`    GitHub:        ${ownerRepo || "(not set)"}${githubLogin ? ` (@${githubLogin})` : ""}`);
+  console.log(`    Signature:     ${identityBadge || "(none)"}`);
+  const envNames = Object.keys(credsAll).filter(k => ["LINEAR_API_KEY", "JIRA_EMAIL", "JIRA_API_TOKEN", "GITHUB_TOKEN"].includes(k));
+  console.log(`    .env:          ${envNames.join(", ") || "(none)"}`);
   console.log("");
 
   const save = (await ask("  Save this config? [Y/n]: ")).trim().toLowerCase();
   if (save && save !== "y" && save !== "yes") {
-    console.log("  Cancelled — nothing written to .agentdesk.json.");
+    console.log("  Cancelled.");
     return;
   }
   console.log("");
 
-  // Write .agentdesk.json
-  writeFileSync(join(currentCwd, ".agentdesk.json"), JSON.stringify(config, null, 2) + "\n");
+  // Write local .agentdesk.json.
+  //   • Existing mode: preserve whatever's already on disk, ensuring
+  //     only that `projectKey` is set. Never clobber tracker/github/
+  //     badge fields the user may have locally even when the server
+  //     hasn't caught up yet (auto-heal push in config.mjs will
+  //     reconcile the server side).
+  //   • New mode: write the full config we just built.
+  const configPath = join(currentCwd, ".agentdesk.json");
+  if (isExisting) {
+    let existingOnDisk = {};
+    if (existsSync(configPath)) {
+      try { existingOnDisk = JSON.parse(readFileSync(configPath, "utf-8")); } catch {}
+    }
+    const merged = { ...existingOnDisk, projectKey: computedKey };
+    writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n");
+  } else {
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+  }
   console.log("  ✓ Saved .agentdesk.json");
 
-  // .gitignore — add .agentdesk/
+  // Ensure .agentdesk/ is gitignored (runtime state).
   const gitignorePath = join(currentCwd, ".gitignore");
   try {
     const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
@@ -436,124 +515,105 @@ async function runNewProjectWizard(cwd, apiKey) {
     }
   } catch {}
 
-  // Register with server + push settings
-  try {
-    await fetch(`${SERVER}/api/projects`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", "x-api-key": apiKey },
-      body: JSON.stringify({ id: projectKey, name: projectName, path: currentCwd, tracker }),
-    });
-    const push = await pushConfig(apiKey, SERVER, projectKey, config);
-    if (!push.ok && push.error !== "missing_auth") {
-      console.log(`  ⚠  Could not push settings to agentdesk.live: ${push.error}`);
-    } else {
-      console.log("  ✓ Registered with agentdesk.live");
+  // Server sync — new mode only. Existing mode doesn't push anything
+  // because every project-wide field was locked and unchanged.
+  if (!isExisting) {
+    try {
+      await fetch(`${SERVER}/api/projects`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "x-api-key": apiKey },
+        body: JSON.stringify({ id: computedKey, name: projectName, path: currentCwd, tracker }),
+      });
+      const push = await pushConfig(apiKey, SERVER, computedKey, config);
+      if (!push.ok && push.error !== "missing_auth") {
+        console.log(`  ⚠  Could not push settings to agentdesk.live: ${push.error}`);
+      } else {
+        console.log("  ✓ Registered with agentdesk.live");
+      }
+    } catch {
+      console.log("  ⚠  Couldn't reach agentdesk.live — local config saved, retry later.");
     }
-  } catch {
-    console.log("  ⚠  Couldn't reach agentdesk.live — local config saved, retry from the UI later.");
   }
 
-  registerLocalProject(projectKey, projectName, currentCwd);
+  registerLocalProject(computedKey, projectName, currentCwd);
 
   console.log("");
-  const cmdPrefix = trackerTeamOrProjectId || projectKey.toUpperCase();
+  const cmdPrefix = trackerTeamOrProjectId || computedKey.toUpperCase();
   console.log("  Ready. Run a team session:");
   console.log(`    agentdesk team ${cmdPrefix}-123`);
   console.log("");
 }
 
-// ---------- Entry: routing (E1) ----------
+// ---------- Entry: mode detection ----------
 
 export async function runInit(cwd, opts = {}) {
   const forceFull = !!opts.forceFull;
+  const forceNew = !!opts.forceNew;
   const apiKey = getStoredApiKey();
   if (!apiKey) {
     console.log("\n  Not logged in. Run `agentdesk login` first.\n");
     process.exit(1);
   }
 
+  // Step 1 of mode detection: look at local config.
   const local = readLocalConfig(cwd);
 
-  // --- E1: Detection ---
-  if (!forceFull && local?.projectKey) {
-    // Modern config — gap-scan by default. No "Full setup" option here:
-    // walking the new-project wizard on an already-configured project
-    // would re-ask for the tracker as if it weren't on the server, which
-    // was the classic footgun. Users who genuinely want to reconfigure
-    // from scratch should pass --force-full (or delete .agentdesk.json).
-    console.log("");
-    console.log("  AgentDesk — existing project detected");
-    console.log("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━");
-    console.log("");
-    const choice = await promptSelect({
-      message: "What would you like to do?",
-      default: "refresh",
-      choices: [
-        { name: "Refresh tokens (update .env only)", value: "refresh" },
-        { name: "Cancel", value: "cancel" },
-      ],
-    });
-    if (choice === "cancel") return;
-    await runExistingFlow(cwd, apiKey, local.projectKey);
+  // --force-new / --force-full → treat as new no matter what the local/remote state says.
+  if (forceFull || forceNew) {
+    await runWizard({ cwd, apiKey, mode: "new" });
+    return;
+  }
+
+  // Modern local config with projectKey → existing mode.
+  if (local?.projectKey) {
+    await runWizard({ cwd, apiKey, mode: "existing", projectKey: local.projectKey });
     return;
   }
 
-  if (!forceFull && local && !local.projectKey) {
-    // Legacy config — try to migrate.
+  // Legacy local config — try to migrate.
+  if (local && !local.projectKey) {
     const match = await autoMatchLegacy(cwd, apiKey, local);
     if (match) {
-      console.log(`\n  ✓ Legacy .agentdesk.json recognized — ${match.reason}. Migrating to project "${match.name}" (${match.projectKey}).`);
+      console.log(`\n  ✓ Legacy .agentdesk.json recognized — ${match.reason}. Migrating to project "${match.name}".`);
       const migrated = { ...local, projectKey: match.projectKey };
       writeFileSync(join(cwd, ".agentdesk.json"), JSON.stringify(migrated, null, 2) + "\n");
-      await runExistingFlow(cwd, apiKey, match.projectKey);
+      await runWizard({ cwd, apiKey, mode: "existing", projectKey: match.projectKey });
       return;
     }
-    console.log("\n  ⚠  Legacy .agentdesk.json has no projectKey and no confident match found.");
-    // Fall through to Connect/New menu.
+    // Fall through to git-remote auto-match / picker.
   }
 
-  if (!forceFull) {
-    // No local config (or legacy-unmatched). Try git-remote auto-match.
-    const match = await autoMatchProject(cwd, apiKey);
-    if (match) {
-      console.log("");
-      console.log(`  ✓ Recognized: ${match.name} (${match.projectKey}) — ${match.reason}`);
-      const confirm = await promptSelect({
-        message: "Use this project?",
-        default: "yes",
-        choices: [
-          { name: "Yes, continue with this project", value: "yes" },
-          { name: "No, pick another from my account", value: "other" },
-          { name: "Cancel", value: "cancel" },
-        ],
-      });
-      if (confirm === "cancel") return;
-      if (confirm === "yes") {
-        await runExistingFlow(cwd, apiKey, match.projectKey);
-        return;
-      }
-      // "other" — fall through to picker below
-    }
+  // No local config (or legacy-unmatched). Try auto-match by git remote.
+  const match = await autoMatchProject(cwd, apiKey);
+  if (match) {
+    console.log(`\n  ✓ Recognized "${match.name}" (${match.projectKey}) — ${match.reason}.`);
+    await runWizard({ cwd, apiKey, mode: "existing", projectKey: match.projectKey });
+    return;
+  }
 
+  // No unique auto-match. If the account has other projects, offer to
+  // pick one; otherwise go straight to new mode.
+  const projects = await fetchAccountProjects(apiKey);
+  if (projects.length > 0) {
     console.log("");
-    const top = await promptSelect({
-      message: "What would you like to do?",
+    const picked = await promptSelect({
+      message: "Which project is this clone?",
       choices: [
-        { name: "Connect to an existing project on my account", value: "connect" },
-        { name: "Set up this as a new project (full wizard)", value: "new" },
-        { name: "Cancel", value: "cancel" },
+        ...projects.map(p => ({ name: `${p.name} (${p.id})`, value: p.id })),
+        { name: "Set up as a new project", value: "__new__" },
+        { name: "Cancel", value: "__cancel__" },
       ],
     });
-    if (top === "cancel") return;
-    if (top === "connect") {
-      const projectKey = await discoverProject(cwd, apiKey);
-      if (!projectKey) return;
-      console.log("");
-      await runExistingFlow(cwd, apiKey, projectKey);
+    console.log("");
+    if (picked === "__cancel__") return;
+    if (picked === "__new__") {
+      await runWizard({ cwd, apiKey, mode: "new" });
       return;
     }
-    // "new" falls through to the wizard
+    await runWizard({ cwd, apiKey, mode: "existing", projectKey: picked });
+    return;
   }
 
-  await runNewProjectWizard(cwd, apiKey);
+  // Account has no projects — must be a first-time user.
+  await runWizard({ cwd, apiKey, mode: "new" });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {