@kendoo.agentdesk/agentdesk 0.26.0 → 0.28.0

package/cli/init.mjs

@@ -20,14 +20,18 @@
 import { existsSync, readFileSync, writeFileSync } from "fs";
 import { join } from "path";
 import { loadConfig, pushConfig } from "./config.mjs";
-import { getStoredApiKey } from "./login.mjs";
+import { deriveProjectKey, resolveProjectKey } from "./project-key.mjs";
+import { getTrackerProject, setTrackerProject, resolveTrackerProject, trackerProjectNoun } from "./tracker-project.mjs";
+import { getStoredApiKey, ensureAccountIdentity } from "./login.mjs";
 import { registerLocalProject } from "./projects.mjs";
 import { checkTrackerPermissions } from "./tracker-check.mjs";
 import { autoMatchProject } from "./bootstrap.mjs";
-import { select as promptSelect, ask, promptRequired } from "./prompts.mjs";
+import { select as promptSelect, ask, promptRequired, promptSecret } from "./prompts.mjs";
 import {
   cloneRepoWithToken,
   detectGitRepo,
+  findExistingClone,
+  ensureGitignored,
   fetchGitHubLogin,
   loadDotEnv,
   parseGitHubRef,
@@ -35,10 +39,87 @@ import {
   readLocalConfig,
   runAccessChecks,
   saveEnvVar,
+  stripRemoteCredentials,
 } from "./setup-helpers.mjs";
 
 const SERVER = process.env.AGENTDESK_SERVER || "https://agentdesk.live";
 
+// ---------- Credential prompts ----------
+
+// Prompt for a GitHub token and verify it before accepting. Returns
+// { githubToken, githubLogin } or { cancelled: true }.
+//
+// The old flow saved the token to .env *before* checking it and, on failure,
+// printed "continuing anyway" — so a mistyped token was persisted and the
+// user only found out when the first session failed to push.
+async function promptGitHubTokenVerified({ ownerRepo }) {
+  const repoHint = ownerRepo ? ` (needed to push to ${ownerRepo})` : "";
+  console.log(`  GitHub token${repoHint} — create one at https://github.com/settings/tokens, scope: repo`);
+  while (true) {
+    const token = await promptSecret("GitHub token");
+    const login = await fetchGitHubLogin(token);
+    if (login) {
+      console.log(`  ✓ Token authenticates as @${login}`);
+      return { githubToken: token, githubLogin: login };
+    }
+    console.log("  ✗ Token did not authenticate with GitHub.");
+    const next = await promptSelect({
+      message: "What now?",
+      choices: [
+        { name: "Re-enter the token", value: "retry" },
+        { name: "Use it anyway (couldn't verify — maybe offline)", value: "use" },
+        { name: "Cancel", value: "cancel" },
+      ],
+    });
+    if (next === "cancel") return { cancelled: true };
+    if (next === "use") return { githubToken: token, githubLogin: null };
+  }
+}
+
+// Verify tracker credentials, offering re-entry on failure. Same loop for new
+// and existing projects — existing mode used to print "failed" and carry on,
+// leaving broken credentials saved with no path to fix them in the wizard.
+//
+// Returns { status: "ok" | "skipped" | "cancelled", creds, identity? }.
+async function verifyTrackerWithRetry({ tracker, config, cwd, creds }) {
+  const current = { ...creds };
+  process.stdout.write("  Verifying tracker access... ");
+  while (true) {
+    // Credentials only: the team/project is resolved right after this loop.
+    const check = await checkTrackerPermissions({ tracker, config, credentials: current, requireProject: false });
+    if (check.ok) {
+      console.log("✓");
+      if (check.identity?.name || check.identity?.email) {
+        console.log(`  ✓ Posting as: ${check.identity.name || check.identity.email}`);
+      }
+      console.log("");
+      return { status: "ok", creds: current, identity: check.identity };
+    }
+    console.log("failed");
+    for (const e of check.errors || []) console.log(`    • ${e}`);
+    const next = await promptSelect({
+      message: "What now?",
+      choices: [
+        { name: "Re-enter credentials and try again", value: "retry" },
+        { name: "Save anyway (fix later in .env)", value: "skip" },
+        { name: "Cancel", value: "cancel" },
+      ],
+    });
+    if (next === "cancel") return { status: "cancelled", creds: current };
+    if (next === "skip") { console.log(""); return { status: "skipped", creds: current }; }
+    if (tracker === "linear") {
+      current.LINEAR_API_KEY = await promptSecret("Linear API key");
+      saveEnvVar(cwd, "LINEAR_API_KEY", current.LINEAR_API_KEY);
+    } else if (tracker === "jira") {
+      current.JIRA_EMAIL = await promptRequired("Atlassian login email");
+      current.JIRA_API_TOKEN = await promptSecret("Jira API token");
+      saveEnvVar(cwd, "JIRA_EMAIL", current.JIRA_EMAIL);
+      saveEnvVar(cwd, "JIRA_API_TOKEN", current.JIRA_API_TOKEN);
+    }
+    process.stdout.write("  Re-verifying tracker access... ");
+  }
+}
+
 // ---------- Tracker list helpers (for step 9 in new mode) ----------
 
 async function listTrackerProjects({ tracker, creds, location }) {
@@ -87,11 +168,12 @@ async function fetchAccountProjects(apiKey) {
 
 // ---------- Legacy migration ----------
 
-async function autoMatchLegacy(cwd, apiKey, localConfig) {
+// Every project on the account paired with its settings. Settings fetches
+// are best-effort — a project whose settings can't be read is returned with
+// `{}` so the caller still sees it exists.
+async function fetchProjectsWithSettings(apiKey) {
   const projects = await fetchAccountProjects(apiKey);
-  if (!projects.length) return null;
-
-  const settingsList = await Promise.all(projects.map(async p => {
+  const settings = await Promise.all(projects.map(async p => {
     try {
       const r = await fetch(`${SERVER}/api/projects/${p.id}/settings`, {
         headers: { "x-api-key": apiKey }, signal: AbortSignal.timeout(5000),
@@ -99,14 +181,18 @@ async function autoMatchLegacy(cwd, apiKey, localConfig) {
       return r.ok ? await r.json() : {};
     } catch { return {}; }
   }));
+  return projects.map((project, i) => ({ project, settings: settings[i] || {} }));
+}
+
+async function autoMatchLegacy(cwd, apiKey, localConfig) {
+  const rows = await fetchProjectsWithSettings(apiKey);
+  if (!rows.length) return null;
 
   const legacyRepo = (localConfig.github?.repo || "").toLowerCase();
   const legacyTeamKey = (localConfig.linear?.teamKey || "").toLowerCase();
   const legacyJiraProject = (localConfig.jira?.project || "").toLowerCase();
 
-  for (let i = 0; i < projects.length; i++) {
-    const p = projects[i];
-    const s = settingsList[i];
+  for (const { project: p, settings: s } of rows) {
     if (legacyRepo && (s?.github?.repo || "").toLowerCase() === legacyRepo) {
       return { projectKey: p.id, name: p.name, reason: `github.repo matches ${s.github.repo}` };
     }
@@ -138,7 +224,10 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
   let serverConfig = null;
   if (isExisting) {
     process.stdout.write("  Fetching project settings from agentdesk.live... ");
-    serverConfig = await loadConfig(currentCwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true });
+    // readOnly: this is a read at the top of a wizard the user may still
+    // cancel. Without it, loadConfig rewrote .agentdesk.json and pushed a
+    // heal-sync to the server before anything had been confirmed.
+    serverConfig = await loadConfig(currentCwd, { apiKey, serverUrl: SERVER, projectName: projectKey, silent: true, readOnly: true });
     console.log("✓");
     console.log(`    Project:   ${projectKey}`);
     console.log(`    Tracker:   ${serverConfig.tracker || "(not set — change in agentdesk.live)"}`);
@@ -150,6 +239,19 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
   // Step 1 — detect git repo (silent).
   const git = detectGitRepo(currentCwd);
 
+  // Repair clones made by older versions, which embedded the GitHub token in
+  // the origin URL — leaving it in plaintext in .git/config indefinitely.
+  // Sessions authenticate through a credential helper; the remote never
+  // needed the token.
+  if (git.inRepo) {
+    try {
+      if (stripRemoteCredentials(currentCwd)) {
+        console.log("  ✓ Removed embedded credentials from the git remote URL (.git/config)");
+        console.log("");
+      }
+    } catch {}
+  }
+
   // Step 2 — GitHub repo.
   let ownerRepo = git.ownerRepo;
   if (isExisting) {
@@ -171,42 +273,35 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
   }
 
   // Step 3 — GitHub token (always editable, per-machine).
+  //
+  // Nothing is written to disk in this step. The token is persisted once, after
+  // step 4, to whichever directory ends up being the project. Previously a
+  // freshly entered token was saved to the *current* directory's .env, and
+  // then again to the clone's — leaving a copy in a directory that isn't the
+  // project at all.
   let env = loadDotEnv(currentCwd);
-  let githubToken = env.GITHUB_TOKEN;
-  let githubLogin = null;
+  let githubToken = env.GITHUB_TOKEN || null;
+  let githubLogin = githubToken ? await fetchGitHubLogin(githubToken) : null;
 
-  if (githubToken) {
-    githubLogin = await fetchGitHubLogin(githubToken);
-    if (githubLogin) {
-      const choice = await promptSelect({
-        message: `GitHub token — currently authenticates as @${githubLogin}`,
-        default: "keep",
-        choices: [
-          { name: "Keep current token", value: "keep" },
-          { name: "Replace with a new token", value: "new" },
-        ],
-      });
-      if (choice === "new") {
-        githubToken = await promptRequired("GitHub token");
-        saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-        githubLogin = await fetchGitHubLogin(githubToken);
-        if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
-      }
-    } else {
-      console.log("  ⚠  GITHUB_TOKEN in .env doesn't authenticate with GitHub — enter a new one.");
-      githubToken = await promptRequired("GitHub token");
-      saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-      githubLogin = await fetchGitHubLogin(githubToken);
-      if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
+  if (githubToken && githubLogin) {
+    const choice = await promptSelect({
+      message: `GitHub token — currently authenticates as @${githubLogin}`,
+      default: "keep",
+      choices: [
+        { name: "Keep current token", value: "keep" },
+        { name: "Replace with a new token", value: "new" },
+      ],
+    });
+    if (choice === "new") {
+      const r = await promptGitHubTokenVerified({ ownerRepo });
+      if (r.cancelled) return;
+      ({ githubToken, githubLogin } = r);
     }
   } else {
-    const repoHint = ownerRepo ? ` (needed to push to ${ownerRepo})` : "";
-    console.log(`  GitHub token${repoHint} — create one at https://github.com/settings/tokens, scope: repo`);
-    githubToken = await promptRequired("GitHub token");
-    saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
-    githubLogin = await fetchGitHubLogin(githubToken);
-    if (githubLogin) console.log(`  ✓ Token authenticates as @${githubLogin}`);
-    else console.log("  ⚠  Token couldn't be verified against the GitHub API (continuing anyway)");
+    if (githubToken) console.log("  ⚠  GITHUB_TOKEN in .env doesn't authenticate with GitHub — enter a new one.");
+    const r = await promptGitHubTokenVerified({ ownerRepo });
+    if (r.cancelled) return;
+    ({ githubToken, githubLogin } = r);
   }
   console.log("");
 
@@ -216,11 +311,37 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
     if (parsed) {
       const expected = `${parsed.owner}/${parsed.repo}`.toLowerCase();
       const haveHere = (git.ownerRepo || "").toLowerCase();
-      if (!git.inRepo || haveHere !== expected) {
+      const needClone = !git.inRepo || haveHere !== expected;
+      const reuse = needClone
+        ? findExistingClone({ cwd: currentCwd, owner: parsed.owner, repo: parsed.repo })
+        : null;
+      if (reuse) {
+        // The wizard was run from the directory that contains the clone
+        // (the parent of ./<repo>). Use it rather than failing with
+        // "already exists and is not empty".
+        console.log(`  ✓ ./${parsed.repo} is already a clone of ${parsed.owner}/${parsed.repo} — using it.`);
+        currentCwd = reuse;
+        try {
+          if (stripRemoteCredentials(currentCwd)) {
+            console.log("  ✓ Removed embedded credentials from the git remote URL (.git/config)");
+          }
+        } catch {}
+        console.log("");
+      } else if (needClone) {
+        if (git.inRepo) {
+          // Cloning here nests one git repo inside another — almost always a
+          // sign the user ran init from the wrong directory. Confirm first.
+          const here = git.ownerRepo ? ` (${git.ownerRepo})` : "";
+          console.log(`  This directory is already a git repo${here}, not ${parsed.owner}/${parsed.repo}.`);
+          const go = (await ask(`  Clone ${parsed.owner}/${parsed.repo} into ./${parsed.repo} here anyway? [y/N]: `)).trim().toLowerCase();
+          if (go !== "y" && go !== "yes") {
+            console.log("  Cancelled — cd to the directory that should contain the clone and re-run `agentdesk init`.");
+            return;
+          }
+        }
         console.log(`  Cloning ${parsed.owner}/${parsed.repo} into ./${parsed.repo}...`);
         try {
           currentCwd = cloneRepoWithToken({ cwd: currentCwd, owner: parsed.owner, repo: parsed.repo, token: githubToken });
-          saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
         } catch (err) {
           console.log(`  ✗ ${err.message}`);
           return;
@@ -230,6 +351,10 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
     }
   }
 
+  // Persist the GitHub token exactly once, to the directory that is the
+  // project. Also tightens an existing .env to 0600.
+  if (githubToken) saveEnvVar(currentCwd, "GITHUB_TOKEN", githubToken);
+
   // Step 5 — Tracker type.
   let tracker;
   if (isExisting) {
@@ -290,12 +415,12 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
         ],
       });
       if (choice === "new") {
-        linearApiKey = await promptRequired("Linear API key");
+        linearApiKey = await promptSecret("Linear API key");
         saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
       }
     } else {
       console.log("  (Get a Linear API key: https://linear.app/settings/api)");
-      linearApiKey = await promptRequired("Linear API key");
+      linearApiKey = await promptSecret("Linear API key");
       saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
     }
     console.log("");
@@ -311,7 +436,7 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
       });
       if (choice === "new") {
         jiraEmail = await promptRequired("Atlassian login email");
-        jiraApiToken = await promptRequired("Jira API token");
+        jiraApiToken = await promptSecret("Jira API token");
         saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
         saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
       }
@@ -322,7 +447,7 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
         saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
       }
       if (!jiraApiToken) {
-        jiraApiToken = await promptRequired("Jira API token");
+        jiraApiToken = await promptSecret("Jira API token");
         saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
       }
     }
@@ -356,7 +481,7 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
 
   // Build the in-memory config (used for verification + summary; written
   // to disk only in new mode).
-  const config = {
+  let config = {
     tracker,
     github: { repo: ownerRepo || null, login: githubLogin || null },
   };
@@ -366,85 +491,45 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
 
   let trackerTeamOrProjectId = null;
   let trackerTeamOrProjectName = null;
+  // Existing mode: set when the server had no team/project and the user
+  // supplied one here — the one project-wide field init is allowed to
+  // fill in, because leaving it empty breaks every session.
+  let trackerProjectFilledIn = false;
 
-  // Step 9 — Verify tracker + (new mode) pick team/project.
+  // Step 9 — Verify tracker + resolve team/project.
   if (tracker && tracker !== "github") {
-    if (isExisting) {
-      trackerTeamOrProjectId = serverConfig.linear?.teamKey || serverConfig.jira?.project || null;
-      trackerTeamOrProjectName = trackerTeamOrProjectId;
-      if (tracker === "linear" && trackerTeamOrProjectId) config.linear.teamKey = trackerTeamOrProjectId;
-      if (tracker === "jira" && trackerTeamOrProjectId) config.jira.project = trackerTeamOrProjectId;
-
-      process.stdout.write("  Verifying tracker access... ");
-      const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
-      const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
-      if (check.ok) {
-        console.log("✓");
-        if (check.identity?.name || check.identity?.email) {
-          console.log(`  ✓ Posting as: ${check.identity.name || check.identity.email}`);
-        }
-      } else {
-        console.log("failed");
-        for (const e of check.errors || []) console.log(`    • ${e}`);
-      }
-      console.log("");
-    } else {
-      process.stdout.write("  Verifying tracker access... ");
-      let verified = false;
-      while (!verified) {
-        const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
-        const check = await checkTrackerPermissions({ tracker, config, credentials: creds });
-        if (check.ok) {
-          console.log("✓");
-          if (check.identity?.name || check.identity?.email) {
-            console.log(`  ✓ Posting as: ${check.identity.name || check.identity.email}`);
-          }
-          verified = true;
-          break;
-        }
-        console.log("failed");
-        for (const e of check.errors || []) console.log(`    • ${e}`);
-        const next = await promptSelect({
-          message: "What now?",
-          choices: [
-            { name: "Re-enter credentials and try again", value: "retry" },
-            { name: "Save anyway (fix later in .env)", value: "skip" },
-            { name: "Cancel", value: "cancel" },
-          ],
-        });
-        if (next === "cancel") return;
-        if (next === "skip") break;
-        if (tracker === "linear") {
-          linearApiKey = await promptRequired("Linear API key");
-          saveEnvVar(currentCwd, "LINEAR_API_KEY", linearApiKey);
-        } else if (tracker === "jira") {
-          jiraEmail = await promptRequired("Atlassian login email");
-          jiraApiToken = await promptRequired("Jira API token");
-          saveEnvVar(currentCwd, "JIRA_EMAIL", jiraEmail);
-          saveEnvVar(currentCwd, "JIRA_API_TOKEN", jiraApiToken);
-        }
-        process.stdout.write("  Re-verifying tracker access... ");
-      }
+    const serverProject = isExisting ? getTrackerProject(tracker, serverConfig) : null;
+    if (serverProject) {
+      config = setTrackerProject(tracker, config, serverProject);
+    }
 
-      if (verified) {
-        const creds = { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken };
-        const items = await listTrackerProjects({ tracker, creds, location: jiraBaseUrl });
-        if (items && items.length > 0) {
-          const pickedId = await promptSelect({
-            message: `Pick the ${tracker === "linear" ? "team" : "project"} this project maps to`,
-            choices: items.map(it => ({ name: it.name, value: it.id })),
-          });
-          trackerTeamOrProjectId = pickedId;
-          trackerTeamOrProjectName = items.find(it => it.id === pickedId)?.name || pickedId;
-        } else {
-          trackerTeamOrProjectId = await promptRequired(tracker === "linear" ? "Linear team key (e.g. KEN)" : "Jira project key (e.g. PROJ)");
-          trackerTeamOrProjectName = trackerTeamOrProjectId;
-        }
-        if (tracker === "linear") config.linear = { ...config.linear, teamKey: trackerTeamOrProjectId };
-        if (tracker === "jira") config.jira = { ...config.jira, project: trackerTeamOrProjectId };
-        console.log("");
-      }
+    // Credentials only at this point — the project is picked right after,
+    // so the check must not demand it yet.
+    const outcome = await verifyTrackerWithRetry({
+      tracker, config, cwd: currentCwd,
+      creds: { LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken },
+    });
+    if (outcome.status === "cancelled") return;
+    ({ LINEAR_API_KEY: linearApiKey, JIRA_EMAIL: jiraEmail, JIRA_API_TOKEN: jiraApiToken } = outcome.creds);
+
+    if (isExisting && !serverProject) {
+      console.log(`  ⚠  This project has no ${trackerProjectNoun(tracker)} configured on agentdesk.live — pick one now.`);
     }
+    const resolved = await resolveTrackerProject({
+      tracker, isExisting, serverProject,
+      verified: outcome.status === "ok",
+      listProjects: () => listTrackerProjects({ tracker, creds: outcome.creds, location: jiraBaseUrl }),
+      promptSelect, promptRequired,
+    });
+    trackerTeamOrProjectId = resolved.id;
+    trackerTeamOrProjectName = resolved.name;
+    config = setTrackerProject(tracker, config, resolved.id);
+    if (resolved.source === "server") {
+      console.log(`  ${tracker === "linear" ? "Team:      " : "Project:   "}     ${resolved.id}    (configured — change in agentdesk.live)`);
+    } else if (isExisting) {
+      trackerProjectFilledIn = true;
+    }
+    console.log("");
   }
 
   // Derive projectName + projectKey (only used in new mode).
@@ -457,8 +542,20 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
     projectName = trackerTeamOrProjectName
       ? `${repoShort} — ${String(trackerTeamOrProjectName).split(" (")[0]}`
       : repoShort;
-    const keySource = trackerTeamOrProjectId || repoShort;
-    computedKey = String(keySource).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+
+    // The tracker-derived key is not unique across repos: a second repo on
+    // the same Linear team used to get the same key, and its settings push
+    // overwrote the first repo's. Check the account before committing to it.
+    const baseKey = deriveProjectKey({ trackerId: trackerTeamOrProjectId, repoShort });
+    const existing = (await fetchProjectsWithSettings(apiKey))
+      .map(({ project, settings }) => ({ id: project.id, repo: settings?.github?.repo || null }));
+    const resolved = resolveProjectKey({ baseKey, repo: ownerRepo, repoShort, existing });
+    computedKey = resolved.key;
+    if (resolved.renamed) {
+      console.log(`  ⚠  Project id "${baseKey}" already belongs to ${resolved.collidedWith.repo} on your account.`);
+      console.log(`     Using "${computedKey}" for this repo so the two don't overwrite each other.`);
+      console.log("");
+    }
   }
   config.projectKey = computedKey;
 
@@ -477,10 +574,24 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
   console.log(`    .env:          ${envNames.join(", ") || "(none)"}`);
   console.log("");
 
-  const save = (await ask("  Save this config? [Y/n]: ")).trim().toLowerCase();
-  if (save && save !== "y" && save !== "yes") {
-    console.log("  Cancelled.");
-    return;
+  // Default the confirmation to "no" when any access check failed. Saving a
+  // config that can't reach GitHub or the tracker just moves the failure to
+  // the first session, where it is much harder to diagnose.
+  const anyFailed = !results.agentdesk?.ok || !results.claude?.ok || !results.github?.ok
+    || (results.tracker && !results.tracker.ok && !results.tracker.skipped);
+  if (anyFailed) {
+    console.log("  ⚠  Some access checks failed. Sessions will not run until they pass.");
+    const save = (await ask("  Save this config anyway? [y/N]: ")).trim().toLowerCase();
+    if (save !== "y" && save !== "yes") {
+      console.log("  Cancelled.");
+      return;
+    }
+  } else {
+    const save = (await ask("  Save this config? [Y/n]: ")).trim().toLowerCase();
+    if (save && save !== "y" && save !== "yes") {
+      console.log("  Cancelled.");
+      return;
+    }
   }
   console.log("");
 
@@ -497,50 +608,85 @@ async function runWizard({ cwd, apiKey, mode, projectKey }) {
     if (existsSync(configPath)) {
       try { existingOnDisk = JSON.parse(readFileSync(configPath, "utf-8")); } catch {}
     }
-    const merged = { ...existingOnDisk, projectKey: computedKey };
+    let merged = { ...existingOnDisk, projectKey: computedKey };
+    if (trackerProjectFilledIn) merged = setTrackerProject(tracker, merged, trackerTeamOrProjectId);
     writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n");
   } else {
     writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
   }
   console.log("  ✓ Saved .agentdesk.json");
 
-  // Ensure .agentdesk/ is gitignored (runtime state).
-  const gitignorePath = join(currentCwd, ".gitignore");
+  // .env now holds a GitHub token and tracker credentials; .agentdesk/ is
+  // runtime state. Neither may be committed. Only .agentdesk/ used to be
+  // added here — on a fresh clone with no .gitignore, the next `git add .`
+  // would have committed every token this wizard just collected.
   try {
-    const existing = existsSync(gitignorePath) ? readFileSync(gitignorePath, "utf-8") : "";
-    if (!existing.split("\n").some(line => line.trim() === ".agentdesk/" || line.trim() === ".agentdesk")) {
-      const nl = existing.endsWith("\n") || !existing ? "" : "\n";
-      writeFileSync(gitignorePath, `${existing}${nl}.agentdesk/\n`);
-      console.log("  ✓ Added .agentdesk/ to .gitignore");
-    }
+    const added = ensureGitignored(currentCwd, [".env", ".agentdesk/"]);
+    for (const entry of added) console.log(`  ✓ Added ${entry} to .gitignore`);
   } catch {}
 
-  // Server sync — new mode only. Existing mode doesn't push anything
-  // because every project-wide field was locked and unchanged.
+  // Server sync.
+  //   • Existing mode pushes nothing — every project-wide field was locked
+  //     and unchanged — except when the server had no team/project and the
+  //     user just filled it in. That one field goes up, merged into the
+  //     server's own settings so nothing else is touched.
+  //   • New mode registers the project and pushes the full config.
+  if (isExisting && trackerProjectFilledIn) {
+    const payload = setTrackerProject(tracker, serverConfig, trackerTeamOrProjectId);
+    const push = await pushConfig(apiKey, SERVER, computedKey, payload);
+    if (push.ok) {
+      console.log(`  ✓ Saved ${trackerProjectNoun(tracker)} "${trackerTeamOrProjectId}" to agentdesk.live`);
+    } else if (push.error !== "missing_auth") {
+      console.log(`  ⚠  Could not save the ${trackerProjectNoun(tracker)} to agentdesk.live: ${push.error}`);
+      console.log("     It is in .agentdesk.json; the next session will retry the sync.");
+    }
+  }
   if (!isExisting) {
     try {
-      await fetch(`${SERVER}/api/projects`, {
+      const reg = await fetch(`${SERVER}/api/projects`, {
         method: "POST",
         headers: { "Content-Type": "application/json", "x-api-key": apiKey },
         body: JSON.stringify({ id: computedKey, name: projectName, path: currentCwd, tracker }),
+        signal: AbortSignal.timeout(8000),
       });
-      const push = await pushConfig(apiKey, SERVER, computedKey, config);
-      if (!push.ok && push.error !== "missing_auth") {
-        console.log(`  ⚠  Could not push settings to agentdesk.live: ${push.error}`);
+      if (!reg.ok) {
+        // This response used to go unchecked, so a 403 ("id belongs to
+        // another account") still ended with "✓ Registered".
+        let detail = `HTTP ${reg.status}`;
+        try { const d = await reg.json(); if (d?.error) detail = d.error; } catch {}
+        console.log(`  ✗ Could not register "${computedKey}" on agentdesk.live: ${detail}`);
+        if (reg.status === 403) {
+          console.log("    That project id belongs to another account. Re-run `agentdesk init --force-full`");
+          console.log("    and pick a different tracker team/project, or ask the owner to add you.");
+        }
+        console.log("    Local config saved; nothing was pushed to the server.");
       } else {
-        console.log("  ✓ Registered with agentdesk.live");
+        const push = await pushConfig(apiKey, SERVER, computedKey, config);
+        if (!push.ok && push.error !== "missing_auth") {
+          console.log(`  ⚠  Registered, but could not push settings to agentdesk.live: ${push.error}`);
+        } else {
+          console.log("  ✓ Registered with agentdesk.live");
+        }
       }
     } catch {
       console.log("  ⚠  Couldn't reach agentdesk.live — local config saved, retry later.");
     }
   }
 
-  registerLocalProject(computedKey, projectName, currentCwd);
+  // AD-64: tag the registry entry with the account so the daemon can scope
+  // its project list per login.
+  const accountId = (await ensureAccountIdentity())?.accountId || null;
+  registerLocalProject(computedKey, projectName, currentCwd, accountId);
 
   console.log("");
-  const cmdPrefix = trackerTeamOrProjectId || computedKey.toUpperCase();
   console.log("  Ready. Run a team session:");
-  console.log(`    agentdesk team ${cmdPrefix}-123`);
+  if (trackerTeamOrProjectId) {
+    console.log(`    agentdesk team ${trackerTeamOrProjectId}-123`);
+  } else if (tracker === "github") {
+    console.log("    agentdesk team 123            (a GitHub issue number)");
+  } else {
+    console.log('    agentdesk team -d "Describe the task"');
+  }
   console.log("");
 }