@openthink/team 0.0.11 → 0.0.13

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command6 } from "commander";
+import { Command as Command6, Option as Option3 } from "commander";
 
 // src/commands/pull.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -333,7 +333,7 @@ function resolveModelForTicket(args) {
 }
 
 // src/lib/normalise.ts
-var SYSTEM_PROMPT = `You normalise unstructured work-item payloads (GitHub issues, Linear tickets, etc.) into well-formed product-vault tickets.
+var SYSTEM_PROMPT = `You normalise unstructured work-item payloads (GitHub issues, Linear tickets, etc.) into well-formed workspace tickets.
 
 Output contract \u2014 return EXACTLY this JSON, nothing else:
 
@@ -364,7 +364,7 @@ ${payload.pr.files.slice(0, 25).map(
 
 For a PR, the Problem Statement should describe the proposed change and its rationale (1-2 sentences). The Acceptance Criteria should describe what "we are willing to take this PR through stamp" means \u2014 e.g., CI passes, no unrelated changes, scope matches title.
 ` : "";
-  const userMessage = `Normalise this ${kindLabel} item into a vault ticket.
+  const userMessage = `Normalise this ${kindLabel} item into a workspace ticket.
 
 <source>
 Title: ${payload.title}
@@ -436,9 +436,9 @@ function nextTicketID(vaultPath) {
   let highest = 0;
   for (const sub of ["tickets", "archive"]) {
     const dir = join(vaultPath, sub);
-    walk(dir, (basename6) => {
-      if (!basename6.startsWith("AGT-") || !basename6.endsWith(".md")) return;
-      const trimmed = basename6.slice("AGT-".length);
+    walk(dir, (basename5) => {
+      if (!basename5.startsWith("AGT-") || !basename5.endsWith(".md")) return;
+      const trimmed = basename5.slice("AGT-".length);
       const digits = trimmed.match(/^\d+/)?.[0];
       if (!digits) return;
       const n = parseInt(digits, 10);
@@ -509,6 +509,7 @@ import {
 import { homedir } from "os";
 import { basename, isAbsolute, resolve, join as join2 } from "path";
 var DEFAULT_PRODUCT_DOWNSHIFT = true;
+var DEFAULT_PUSH = "on";
 function configDir() {
   return join2(homedir(), ".open-team");
 }
@@ -535,6 +536,9 @@ function writeConfig(config) {
     default: config.default,
     stamp: config.stamp
   };
+  if (Object.keys(config.repos).length > 0) {
+    onDisk.repos = config.repos;
+  }
   const onDiskModels = { ...config.models };
   if (config.productDownshift !== DEFAULT_PRODUCT_DOWNSHIFT) {
     onDiskModels.productDownshift = config.productDownshift;
@@ -545,6 +549,12 @@ function writeConfig(config) {
   if (!config.telemetry.enabled) {
     onDisk.telemetry = config.telemetry;
   }
+  if (config.botIdentity.length > 0) {
+    onDisk.botIdentity = config.botIdentity;
+  }
+  if (config.push !== DEFAULT_PUSH) {
+    onDisk.push = config.push;
+  }
   const body = JSON.stringify(onDisk, null, 2) + "\n";
   writeFileSync(configPath(), body);
 }
@@ -553,9 +563,12 @@ function emptyConfig() {
     vaults: {},
     default: null,
     stamp: null,
+    repos: {},
     models: {},
     productDownshift: DEFAULT_PRODUCT_DOWNSHIFT,
-    telemetry: { enabled: true }
+    telemetry: { enabled: true },
+    botIdentity: "",
+    push: DEFAULT_PUSH
   };
 }
 function addVault(rawPath, options = {}) {
@@ -589,7 +602,7 @@ function removeVault(nameOrPath) {
   const config = readConfig();
   const name = findEntry(config, nameOrPath);
   if (!name) {
-    throw new Error(`no vault registered as "${nameOrPath}"`);
+    throw new Error(`no workspace registered as "${nameOrPath}"`);
   }
   delete config.vaults[name];
   let cleared = false;
@@ -604,7 +617,7 @@ function setDefault(nameOrPath) {
   const config = readConfig();
   const name = findEntry(config, nameOrPath);
   if (!name) {
-    throw new Error(`no vault registered as "${nameOrPath}"`);
+    throw new Error(`no workspace registered as "${nameOrPath}"`);
   }
   config.default = name;
   writeConfig(config);
@@ -655,11 +668,17 @@ function normalise(parsed) {
     vaults,
     default: def,
     stamp: normaliseStamp(obj.stamp),
+    repos: normaliseRepos(obj.repos),
     models: normaliseModels(obj.models),
     productDownshift: normaliseProductDownshift(obj.models),
-    telemetry: normaliseTelemetry(obj.telemetry)
+    telemetry: normaliseTelemetry(obj.telemetry),
+    botIdentity: typeof obj.botIdentity === "string" ? obj.botIdentity.trim() : "",
+    push: normalisePush(obj.push)
   };
 }
+function normalisePush(value) {
+  return value === "off" ? "off" : DEFAULT_PUSH;
+}
 function normaliseProductDownshift(value) {
   if (!value || typeof value !== "object") return DEFAULT_PRODUCT_DOWNSHIFT;
   const v = value;
@@ -694,6 +713,27 @@ function normaliseStamp(value) {
 function stripTrailingSlash(s) {
   return s.replace(/\/+$/, "");
 }
+var REPO_SLUG_RE = /^[^/]+\/[^/]+$/;
+function validateSlug(slug) {
+  if (!REPO_SLUG_RE.test(slug.trim())) {
+    throw new Error(
+      `invalid repo slug "${slug}" \u2014 expected <owner>/<name> (e.g. OpenThinkAi/open-team)`
+    );
+  }
+}
+function normaliseRepos(value) {
+  if (!value || typeof value !== "object") return {};
+  const out = {};
+  for (const [slug, entry] of Object.entries(value)) {
+    if (!REPO_SLUG_RE.test(slug)) continue;
+    if (!entry || typeof entry !== "object") continue;
+    const e = entry;
+    if (typeof e["clone-uri"] !== "string" || e["clone-uri"].trim().length === 0) continue;
+    if (typeof e.added !== "string") continue;
+    out[slug] = { "clone-uri": e["clone-uri"].trim(), added: e.added };
+  }
+  return out;
+}
 function getStampConfig() {
   return readConfig().stamp;
 }
@@ -792,6 +832,82 @@ function setTelemetryEnabled(enabled) {
   writeConfig(config);
   return config.telemetry;
 }
+function getPush() {
+  return readConfig().push;
+}
+function setPush(flag) {
+  const config = readConfig();
+  config.push = flag;
+  writeConfig(config);
+  return config.push;
+}
+function getBotIdentity() {
+  return readConfig().botIdentity;
+}
+function setBotIdentity(login) {
+  const trimmed = login.trim();
+  if (trimmed.length === 0) {
+    throw new Error(
+      "bot identity cannot be empty \u2014 pass a GitHub login (use `oteam config bot-identity clear` to remove)"
+    );
+  }
+  const config = readConfig();
+  config.botIdentity = trimmed;
+  writeConfig(config);
+  return trimmed;
+}
+function clearBotIdentity() {
+  const config = readConfig();
+  config.botIdentity = "";
+  writeConfig(config);
+}
+function getRepoEntry(slug, config = readConfig()) {
+  const key = findRepoKey(config, slug);
+  return key ? config.repos[key] ?? null : null;
+}
+function setRepoCloneUri(slug, cloneUri) {
+  validateSlug(slug);
+  const trimmedUri = cloneUri.trim();
+  if (trimmedUri.length === 0) {
+    throw new Error(
+      `clone URI for "${slug}" cannot be empty \u2014 pass a valid git URL`
+    );
+  }
+  const config = readConfig();
+  const existingKey = findRepoKey(config, slug);
+  const key = existingKey ?? slug;
+  const existing = existingKey ? config.repos[existingKey] : void 0;
+  config.repos[key] = {
+    "clone-uri": trimmedUri,
+    added: existing?.added ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+  writeConfig(config);
+  return config.repos[key];
+}
+function listRepoEntries() {
+  const config = readConfig();
+  return Object.entries(config.repos).map(([slug, entry]) => ({ slug, entry })).sort((a, b) => a.slug.localeCompare(b.slug));
+}
+function removeRepoEntry(slug) {
+  const config = readConfig();
+  const key = findRepoKey(config, slug);
+  if (!key) return false;
+  delete config.repos[key];
+  writeConfig(config);
+  return true;
+}
+function findRepoKey(config, slug) {
+  const lower = slug.toLowerCase();
+  for (const key of Object.keys(config.repos)) {
+    if (key.toLowerCase() === lower) return key;
+  }
+  return null;
+}
+function resolveBotIdentity(config = readConfig()) {
+  const env = process.env.OTEAM_BOT_IDENTITY;
+  if (typeof env === "string" && env.trim().length > 0) return env.trim();
+  return config.botIdentity;
+}
 function clearModel(phase) {
   if (!isPhase(phase)) {
     throw new Error(
@@ -934,7 +1050,7 @@ function resolveVault(opts = {}) {
     const fromFlag = resolveByNameOrPath(opts.flagValue, config);
     if (!fromFlag) {
       throw new Error(
-        `--vault: "${opts.flagValue}" is not a registered name and not a path`
+        `--workspace: "${opts.flagValue}" is not a registered workspace name or path`
       );
     }
     return fromFlag;
@@ -979,7 +1095,7 @@ function findTicketFileByID(vaultPath, ticketID) {
     });
   } catch {
     throw new Error(
-      `vault has no tickets/ directory at ${ticketsRoot}`
+      `workspace has no tickets/ directory at ${ticketsRoot}`
     );
   }
   for (const state of stateDirs) {
@@ -1101,17 +1217,81 @@ function parseTicket(path) {
   };
 }
 
+// src/lib/prompt-clone-uri.ts
+import { createInterface } from "readline";
+async function promptCloneUri(slug, defaultUri, opts, onNoTTY) {
+  if (!opts.isTTY) {
+    if (onNoTTY === "refuse") {
+      throw new NoTTYError(slug);
+    }
+    return { uri: defaultUri, recorded: true };
+  }
+  const rl = opts.readLine ?? defaultReadLine;
+  const raw = await rl(
+    `Clone URI for ${slug}? (default: ${defaultUri})
+> `
+  );
+  const trimmed = raw.trim();
+  const uri = trimmed.length > 0 ? trimmed : defaultUri;
+  return { uri, recorded: true };
+}
+var NoTTYError = class extends Error {
+  slug;
+  constructor(slug) {
+    super(
+      [
+        `oteam assign: no clone URI recorded for "${slug}" and stdin is not a TTY.`,
+        `  Fix: run  oteam config repo add ${slug} <git-url>`,
+        `  Or assign interactively (with a TTY) to be prompted once.`
+      ].join("\n")
+    );
+    this.name = "NoTTYError";
+    this.slug = slug;
+  }
+};
+async function defaultReadLine(prompt2) {
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: true
+  });
+  return new Promise((resolve5) => {
+    rl.question(prompt2, (answer) => {
+      rl.close();
+      resolve5(answer);
+    });
+  });
+}
+
 // src/commands/pull.ts
 async function runPull(opts) {
   const vault = resolveVaultPath({ flagValue: opts.vault });
   const triageDir = join4(vault, "tickets", "triage");
   if (!existsSync2(triageDir)) {
     throw new Error(
-      `vault triage dir missing at ${triageDir} \u2014 create it or set PRODUCT_VAULT_PATH`
+      `workspace triage dir missing at ${triageDir} \u2014 create it or set PRODUCT_VAULT_PATH`
     );
   }
   const ingestor = getIngestor(opts.source);
   const payload = await ingestor.fetch(opts.ref);
+  if (payload.repo) {
+    const config = readConfig();
+    const existing2 = getRepoEntry(payload.repo, config);
+    if (!existing2) {
+      if (opts.cloneUri) {
+        setRepoCloneUri(payload.repo, opts.cloneUri);
+      } else {
+        const defaultUri = `https://github.com/${payload.repo}.git`;
+        const result = await promptCloneUri(
+          payload.repo,
+          defaultUri,
+          { isTTY: process.stdin.isTTY === true },
+          "default"
+        );
+        setRepoCloneUri(payload.repo, result.uri);
+      }
+    }
+  }
   const existing = readAllTickets(vault).find(
     (t) => t.source.id === payload.id
   );
@@ -1217,8 +1397,72 @@ function formatTicket(t) {
 }
 
 // src/commands/archive.ts
-import { mkdirSync as mkdirSync3, renameSync } from "fs";
-import { basename as basename2, join as join5 } from "path";
+import { mkdirSync as mkdirSync4, renameSync, rmSync as rmSync2 } from "fs";
+import { basename as basename2, join as join6 } from "path";
+
+// src/lib/workspace.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync3, rmSync } from "fs";
+import { spawnSync } from "child_process";
+import { join as join5 } from "path";
+var WORKSPACE_ROOT = "/tmp/open-team-issues";
+var TICKET_ID_RE = /^AGT-\d+$/;
+var ORPHAN_DIR_RE = /^agt-\d+$/;
+function prepareAgentWorkspace(opts) {
+  if (!TICKET_ID_RE.test(opts.ticketId)) {
+    throw new Error(
+      `prepareAgentWorkspace: refusing to operate on non-AGT ticket id "${opts.ticketId}" (expected AGT-NNN)`
+    );
+  }
+  const root = opts.rootDir ?? WORKSPACE_ROOT;
+  mkdirSync3(root, { recursive: true });
+  if (opts.activeTicketIds) gcOrphanWorkspaces(root, opts.activeTicketIds);
+  const ticketDir = join5(root, opts.ticketId.toLowerCase());
+  const repoDir = join5(ticketDir, "repo");
+  rmSync(ticketDir, { recursive: true, force: true });
+  mkdirSync3(ticketDir, { recursive: true });
+  const cloneRunner = opts.cloneRunner ?? defaultCloneRunner;
+  const r = cloneRunner(opts.cloneUri, repoDir);
+  if (r.status !== 0) {
+    throw new Error(
+      `oteam assign: clone failed (git clone ${opts.cloneUri}):
+${r.stderr.trim() || "(no stderr)"}`
+    );
+  }
+  return { path: repoDir, originUrl: opts.cloneUri };
+}
+var defaultCloneRunner = (url, dest) => {
+  const r = spawnSync("git", ["clone", "--quiet", "--", url, dest], {
+    encoding: "utf8",
+    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
+  });
+  return {
+    status: r.status ?? -1,
+    stderr: r.stderr ?? ""
+  };
+};
+function gcOrphanWorkspaces(root, activeTicketIds) {
+  if (!existsSync3(root)) return [];
+  const removed = [];
+  let entries;
+  try {
+    entries = readdirSync3(root);
+  } catch {
+    return [];
+  }
+  for (const name of entries) {
+    if (!ORPHAN_DIR_RE.test(name)) continue;
+    if (activeTicketIds.has(name)) continue;
+    const target = join5(root, name);
+    try {
+      rmSync(target, { recursive: true, force: true });
+      removed.push(target);
+    } catch {
+    }
+  }
+  return removed;
+}
+
+// src/commands/archive.ts
 function runArchive(opts) {
   const vault = resolveVaultPath({ flagValue: opts.vault });
   const tickets = readAllTickets(vault);
@@ -1232,10 +1476,13 @@ function runArchive(opts) {
     );
   }
   const yearMonth = (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
-  const archiveDir = join5(vault, "archive", yearMonth);
-  mkdirSync3(archiveDir, { recursive: true });
-  const target = join5(archiveDir, basename2(match.filePath));
+  const archiveDir = join6(vault, "archive", yearMonth);
+  mkdirSync4(archiveDir, { recursive: true });
+  const target = join6(archiveDir, basename2(match.filePath));
   renameSync(match.filePath, target);
+  if (isAgtId(match.id)) {
+    rmSync2(join6(WORKSPACE_ROOT, match.id.toLowerCase()), { recursive: true, force: true });
+  }
   return target;
 }
 
@@ -1245,57 +1492,65 @@ function buildConfigCommand() {
   const config = new Command("config").description(
     "Manage oteam config (~/.open-team/config.json)"
   );
-  const vault = new Command("vault").description(
-    "Manage registered vault paths and the default vault"
-  );
-  vault.command("add <path>").description("Register a vault path under a name").option("--name <name>", "Override the auto-derived name").action((rawPath, opts) => {
-    const result = addVault(rawPath, { name: opts.name });
-    const promoted = result.promotedToDefault ? "\n   (set as default \u2014 first vault registered)" : "";
-    process.stdout.write(
-      `\u2705 Registered "${result.name}" \u2192 ${result.path}${promoted}
-`
-    );
-  });
-  vault.command("list").description("List registered vaults").action(() => {
-    const { vaults, default: def } = listVaults();
-    if (vaults.length === 0) {
+  function attachWorkspaceSubcommands(parent) {
+    parent.command("add <path>").description("Register a workspace path under a name").option("--name <name>", "Override the auto-derived name").action((rawPath, opts) => {
+      const result = addVault(rawPath, { name: opts.name });
+      const promoted = result.promotedToDefault ? "\n   (set as default \u2014 first workspace registered)" : "";
       process.stdout.write(
-        `(no vaults registered)
-   config: ${configPath()}
+        `\u2705 Registered "${result.name}" \u2192 ${result.path}${promoted}
 `
       );
-      return;
-    }
-    const width = Math.max(...vaults.map((v) => v.name.length));
-    const lines = vaults.map((v) => {
-      const tag = v.name === def ? "  (default)" : "";
-      return `${v.name.padEnd(width)}  ${v.path}${tag}`;
     });
-    process.stdout.write(lines.join("\n") + "\n");
-  });
-  vault.command("remove <name-or-path>").description("Remove a vault registration").action((nameOrPath) => {
-    const result = removeVault(nameOrPath);
-    const note = result.clearedDefault ? '\n   default cleared \u2014 pass --vault until you set a new one with "oteam config vault default --set <name>"' : "";
-    process.stdout.write(`\u2705 Removed "${result.name}"${note}
+    parent.command("list").description("List registered workspaces").action(() => {
+      const { vaults, default: def } = listVaults();
+      if (vaults.length === 0) {
+        process.stdout.write(
+          `(no workspaces registered)
+   config: ${configPath()}
+`
+        );
+        return;
+      }
+      const width = Math.max(...vaults.map((v) => v.name.length));
+      const lines = vaults.map((v) => {
+        const tag = v.name === def ? "  (default)" : "";
+        return `${v.name.padEnd(width)}  ${v.path}${tag}`;
+      });
+      process.stdout.write(lines.join("\n") + "\n");
+    });
+    parent.command("remove <name-or-path>").description("Remove a workspace registration").action((nameOrPath) => {
+      const result = removeVault(nameOrPath);
+      const note = result.clearedDefault ? '\n   default cleared \u2014 pass --workspace until you set a new one with "oteam config workspace default --set <name>"' : "";
+      process.stdout.write(`\u2705 Removed "${result.name}"${note}
 `);
-  });
-  vault.command("default").description("Print or set the default vault").option("--set <name-or-path>", "Set the default to this name or path").action((opts) => {
-    if (opts.set) {
-      const name = setDefault(opts.set);
-      process.stdout.write(`\u2705 Default is now "${name}"
+    });
+    parent.command("default").description("Print or set the default workspace").option("--set <name-or-path>", "Set the default to this name or path").action((opts) => {
+      if (opts.set) {
+        const name = setDefault(opts.set);
+        process.stdout.write(`\u2705 Default is now "${name}"
 `);
-      return;
-    }
-    const { default: def } = listVaults();
-    if (!def) {
-      process.stdout.write(
-        "(no default \u2014 pass --vault on every command, or set one with --set)\n"
-      );
-      return;
-    }
-    process.stdout.write(`${def}
+        return;
+      }
+      const { default: def } = listVaults();
+      if (!def) {
+        process.stdout.write(
+          "(no default \u2014 pass --workspace on every command, or set one with --set)\n"
+        );
+        return;
+      }
+      process.stdout.write(`${def}
 `);
-  });
+    });
+    return parent;
+  }
+  const workspace = attachWorkspaceSubcommands(
+    new Command("workspace").description(
+      "Manage registered workspace paths and the default workspace"
+    )
+  );
+  const vaultAlias = attachWorkspaceSubcommands(
+    new Command("vault").description("Alias for workspace (back-compat)")
+  );
   const stamp = new Command("stamp").description(
     "Manage stamp-server integration (host + enforce flag)"
   );
@@ -1414,10 +1669,107 @@ enforce: ${s.enforce ? "on" : "off"}
     process.stdout.write(`${getTelemetryEnabled() ? "on" : "off"}
 `);
   });
-  config.addCommand(vault);
+  const botIdentity = new Command("bot-identity").description(
+    "Manage the GitHub login `oteam assign` claims issues under (default: empty \u2014 no claim attempted)"
+  );
+  botIdentity.command("set <login>").description("Set the bot identity (GitHub login)").action((login) => {
+    const next = setBotIdentity(login);
+    process.stdout.write(`\u2705 botIdentity = ${next}
+`);
+  });
+  botIdentity.command("clear").description("Remove the bot identity (disables claim-on-assign)").action(() => {
+    clearBotIdentity();
+    process.stdout.write("\u2705 botIdentity cleared\n");
+  });
+  botIdentity.command("show").description("Print the current bot identity").action(() => {
+    const id = getBotIdentity();
+    process.stdout.write(id.length > 0 ? `${id}
+` : "(unset)\n");
+  });
+  const repo = new Command("repo").description(
+    "Manage per-repo clone URIs (<owner>/<name> \u2192 git-url)"
+  );
+  repo.command("add <slug> <git-url>").description("Record a clone URI for a repo (e.g. OpenThinkAi/open-team git@github.com:OpenThinkAi/open-team.git)").action((slug, gitUrl) => {
+    const entry = setRepoCloneUri(slug, gitUrl);
+    process.stdout.write(`\u2705 repos.${slug} clone-uri = ${entry["clone-uri"]}
+`);
+  });
+  repo.command("set <slug>").description("Update fields for an existing repo entry").option("--clone-uri <url>", "New clone URI").action((slug, opts) => {
+    if (!opts.cloneUri) {
+      process.stderr.write("oteam config repo set: pass --clone-uri <url>\n");
+      process.exit(2);
+    }
+    const entry = setRepoCloneUri(slug, opts.cloneUri);
+    process.stdout.write(`\u2705 repos.${slug} clone-uri = ${entry["clone-uri"]}
+`);
+  });
+  repo.command("show <slug>").description("Print the recorded entry for a repo").action((slug) => {
+    const entry = getRepoEntry(slug);
+    if (!entry) {
+      process.stdout.write(`(no entry for "${slug}")
+`);
+      return;
+    }
+    process.stdout.write(`clone-uri: ${entry["clone-uri"]}
+added:     ${entry.added}
+`);
+  });
+  repo.command("list").description("List all recorded repo entries").action(() => {
+    const entries = listRepoEntries();
+    if (entries.length === 0) {
+      process.stdout.write(`(no repos registered)
+   config: ${configPath()}
+`);
+      return;
+    }
+    const slugWidth = Math.max(...entries.map((e) => e.slug.length));
+    for (const { slug, entry } of entries) {
+      process.stdout.write(`${slug.padEnd(slugWidth)}  ${entry["clone-uri"]}
+`);
+    }
+  });
+  repo.command("remove <slug>").description("Remove the clone URI entry for a repo (idempotent)").action((slug) => {
+    const removed = removeRepoEntry(slug);
+    if (removed) {
+      process.stdout.write(`\u2705 Removed "${slug}"
+`);
+    } else {
+      process.stdout.write(`\u2139\uFE0F  No entry for "${slug}" \u2014 nothing to remove
+`);
+    }
+  });
+  const push = new Command("push").description(
+    "Manage the global no-push toggle for the assign-side push step (default: on)"
+  );
+  push.command("set <on|off>").description(
+    "Turn the assign-side push step on or off (idempotent; persists to ~/.open-team/config.json)"
+  ).action((flag) => {
+    const lower = flag.toLowerCase();
+    if (lower !== "on" && lower !== "off") {
+      process.stderr.write(
+        `oteam config push set: expected on|off, got "${flag}"
+`
+      );
+      process.exit(2);
+    }
+    const next = setPush(lower);
+    process.stdout.write(`\u2705 push ${next}
+`);
+  });
+  push.command("show").description("Print the current push toggle with a one-line description").action(() => {
+    const flag = getPush();
+    const description = flag === "on" ? "push: on (default) \u2014 assigns push to origin after merge" : "push: off \u2014 assigns finish at local commit; user pushes manually";
+    process.stdout.write(`${description}
+`);
+  });
+  config.addCommand(workspace);
+  config.addCommand(vaultAlias, { hidden: true });
   config.addCommand(stamp);
+  config.addCommand(repo);
   config.addCommand(models);
   config.addCommand(telemetry);
+  config.addCommand(botIdentity);
+  config.addCommand(push);
   return config;
 }
 function expectPhase(value) {
@@ -1433,19 +1785,19 @@ function expectPhase(value) {
 
 // src/commands/init.ts
 import { Command as Command2 } from "commander";
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve3, join as join7 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve3, join as join8 } from "path";
 import readline from "readline";
 
 // src/lib/workspace-tree.ts
 import {
-  existsSync as existsSync3,
-  mkdirSync as mkdirSync4,
-  readdirSync as readdirSync3,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync5,
+  readdirSync as readdirSync4,
   writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join6, resolve as resolve2 } from "path";
+import { join as join7, resolve as resolve2 } from "path";
 var SENTINEL_FILENAME = ".oteam-workspace";
 var WORKSPACE_SUBDIRS = [
   "tickets/triage",
@@ -1469,7 +1821,7 @@ var SENTINEL_BODY = `${JSON.stringify(
 )}
 `;
 function defaultWorkspacePath() {
-  return join6(homedir3(), "openteam");
+  return join7(homedir3(), "openteam");
 }
 var WorkspaceConflictError = class extends Error {
   path;
@@ -1490,26 +1842,26 @@ ${list}${more}`);
 function expandHome(input) {
   const home = homedir3();
   if (input === "~") return home;
-  if (input.startsWith("~/")) return join6(home, input.slice(2));
+  if (input.startsWith("~/")) return join7(home, input.slice(2));
   return input;
 }
 function bootstrapWorkspace(rawTarget) {
   const target = resolve2(expandHome(rawTarget));
-  if (existsSync3(join6(target, SENTINEL_FILENAME))) {
+  if (existsSync4(join7(target, SENTINEL_FILENAME))) {
     return { outcome: "already-initialised", path: target };
   }
-  if (existsSync3(target)) {
-    const visible = readdirSync3(target).filter((n) => !n.startsWith("."));
+  if (existsSync4(target)) {
+    const visible = readdirSync4(target).filter((n) => !n.startsWith("."));
     if (visible.length > 0) {
       throw new WorkspaceConflictError(target, visible);
     }
   }
-  mkdirSync4(target, { recursive: true });
+  mkdirSync5(target, { recursive: true });
   for (const sub of WORKSPACE_SUBDIRS) {
-    mkdirSync4(join6(target, sub), { recursive: true });
+    mkdirSync5(join7(target, sub), { recursive: true });
   }
-  writeFileSync3(join6(target, "00-meta", "README.md"), META_README_BODY);
-  writeFileSync3(join6(target, SENTINEL_FILENAME), SENTINEL_BODY);
+  writeFileSync3(join7(target, "00-meta", "README.md"), META_README_BODY);
+  writeFileSync3(join7(target, SENTINEL_FILENAME), SENTINEL_BODY);
   return { outcome: "created", path: target };
 }
 
@@ -1519,10 +1871,10 @@ var BLOCK_END = "<!-- oteam:end -->";
 var AGENTS_BODY = `## oteam \u2014 workspace-driven role pipeline for Claude agents
 
 If the user asks you to **search, find, list, filter, count, or file
-tickets**, or mentions a "workspace", an "Obsidian vault", an \`AGT-NNN\` id,
-a project, "ingesting GitHub issues or PRs", or driving tickets through a
-"role pipeline" \u2014 \`oteam\` is the right tool. The workspace is a directory
-of markdown files (typically \`~/openteam/tickets/<state>/AGT-NNN-*.md\`),
+tickets**, or mentions a "workspace", an \`AGT-NNN\` id, a project,
+"ingesting GitHub issues or PRs", or driving tickets through a "role
+pipeline" \u2014 \`oteam\` is the right tool. The workspace is a directory of
+markdown files (typically \`~/openteam/tickets/<state>/AGT-NNN-*.md\`),
 but **do not search it with \`find\` or \`grep\` directly.** The CLI knows the
 ticket schema and has structured + free-text filters; filesystem search
 does not, and you will fight false positives from incidental keyword
@@ -1540,13 +1892,13 @@ Other common verbs: \`oteam ticket new "<title>" [--project X]\` to file a
 ticket, \`oteam pull github owner/repo#NN\` to ingest a GitHub issue or PR,
 \`oteam assign <AGT-NNN>\` to drive a ticket through the role pipeline. Run
 \`oteam --help\` or \`oteam <command> --help\` for full details. If you don't
-know whether a workspace is configured, \`oteam config vault list\` tells you.
+know whether a workspace is configured, \`oteam config workspace list\` tells you.
 `;
 var CLAUDE_BODY = `## oteam
 
 If the user asks to search, find, list, or file tickets, or mentions a
-"workspace", "Obsidian vault", an \`AGT-NNN\` id, or a role pipeline, use the
-\`oteam\` CLI \u2014 **do not** \`find\`/\`grep\` the workspace directly. Start with
+"workspace", an \`AGT-NNN\` id, or a role pipeline, use the \`oteam\` CLI \u2014
+**do not** \`find\`/\`grep\` the workspace directly. Start with
 \`oteam list --grep "<term>"\` or \`oteam list --match "<term>"\`. See
 \`AGENTS.md\` next to this file for the short summary and \`oteam --help\` for
 the full surface.
@@ -1561,7 +1913,7 @@ ${BLOCK_END}
 }
 function upsertBlock(filePath, body) {
   const block = renderBlock(body);
-  if (!existsSync4(filePath)) {
+  if (!existsSync5(filePath)) {
     writeFileSync4(filePath, block, "utf8");
     return "created";
   }
@@ -1581,7 +1933,7 @@ function upsertBlock(filePath, body) {
 function expandHome2(input) {
   const home = process.env.HOME ?? "";
   if (input === "~") return home;
-  if (input.startsWith("~/")) return join7(home, input.slice(2));
+  if (input.startsWith("~/")) return join8(home, input.slice(2));
   return input;
 }
 function prompt(question, fallback) {
@@ -1636,13 +1988,13 @@ async function runInit(opts) {
   const models = seedDefaultModelsIfEmpty();
   const stamp = await runStampStep(opts);
   const docsDir = resolve3(expandHome2(opts.docsDir ?? home));
-  if (!existsSync4(docsDir)) {
+  if (!existsSync5(docsDir)) {
     process.stderr.write(`oteam init: docs directory does not exist: ${docsDir}
 `);
     process.exit(1);
   }
-  const agentsPath = join7(docsDir, "AGENTS.md");
-  const claudePath = join7(docsDir, "CLAUDE.md");
+  const agentsPath = join8(docsDir, "AGENTS.md");
+  const claudePath = join8(docsDir, "CLAUDE.md");
   const agents = upsertBlock(agentsPath, AGENTS_BODY);
   const claude = upsertBlock(claudePath, CLAUDE_BODY);
   return {
@@ -1738,7 +2090,7 @@ function workspaceLine(ws) {
   if (ws.outcome === "already-initialised") {
     return `\u2139\uFE0F  Workspace already initialised at ${ws.path} (registered as "${ws.registeredAs}")`;
   }
-  const trail = ws.promotedToDefault ? "set as default" : ws.currentDefault && ws.currentDefault !== ws.registeredAs ? `current default is "${ws.currentDefault}" \u2014 pass \`oteam config vault default --set ${ws.registeredAs}\` to switch` : "registered";
+  const trail = ws.promotedToDefault ? "set as default" : ws.currentDefault && ws.currentDefault !== ws.registeredAs ? `current default is "${ws.currentDefault}" \u2014 pass \`oteam config workspace default --set ${ws.registeredAs}\` to switch` : "registered";
   return `\u2705 Created workspace at ${ws.path} (registered as "${ws.registeredAs}"; ${trail})`;
 }
 function buildInitCommand() {
@@ -1787,27 +2139,27 @@ function buildInitCommand() {
 }
 
 // src/commands/project.ts
-import { Command as Command3 } from "commander";
-import { spawnSync } from "child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { Command as Command3, Option } from "commander";
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
 import { basename as basename3 } from "path";
 
 // src/lib/projects.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync4, statSync as statSync3 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { join as join9 } from "path";
 function projectsRoot(vaultPath) {
-  return join8(vaultPath, "projects");
+  return join9(vaultPath, "projects");
 }
 function projectDir(vaultPath, id) {
-  return join8(projectsRoot(vaultPath), id);
+  return join9(projectsRoot(vaultPath), id);
 }
 function projectReadmePath(vaultPath, id) {
-  return join8(projectDir(vaultPath, id), "README.md");
+  return join9(projectDir(vaultPath, id), "README.md");
 }
 function readProject(vaultPath, id) {
   const dir = projectDir(vaultPath, id);
   const readme = projectReadmePath(vaultPath, id);
-  if (!existsSync5(readme)) return null;
+  if (!existsSync6(readme)) return null;
   let raw;
   try {
     raw = readFileSync5(readme, "utf8");
@@ -1833,14 +2185,14 @@ function listProjects(vaultPath) {
   const root = projectsRoot(vaultPath);
   let entries = [];
   try {
-    entries = readdirSync4(root);
+    entries = readdirSync5(root);
   } catch {
     return [];
   }
   const projects = [];
   for (const name of entries) {
     if (name.startsWith(".")) continue;
-    const dir = join8(root, name);
+    const dir = join9(root, name);
     let isDir = false;
     try {
       isDir = statSync3(dir).isDirectory();
@@ -1897,7 +2249,7 @@ function bodyAfterFrontmatter(raw) {
 function listSiblings(dir) {
   let entries = [];
   try {
-    entries = readdirSync4(dir);
+    entries = readdirSync5(dir);
   } catch {
     return [];
   }
@@ -1905,7 +2257,7 @@ function listSiblings(dir) {
   for (const name of entries) {
     if (name === "README.md") continue;
     if (name.startsWith(".")) continue;
-    const full = join8(dir, name);
+    const full = join9(dir, name);
     let isFile = false;
     try {
       isFile = statSync3(full).isFile();
@@ -1930,6 +2282,16 @@ repos: []
 
 <!-- Canonical design doc for this project. Tickets reference this project via \`project: ${id}\` in their frontmatter. The role-pipeline auto-loads this README into the spawned agent's context, so anything authoritative about the project's architecture, scope, naming, or defaults belongs here. -->
 
+<!-- Conventions when editing this README:
+  - Design-doc only. Anything that would drift over time \u2014 ticket lists, status
+    tables, audit logs, per-row records \u2014 belongs to a CLI command, not inline
+    text. Before adding a new section that resembles a list of records, ask
+    whether \`oteam\` (or another CLI) already owns the content, or should, and
+    link to the command instead of hand-maintaining the list here.
+  - Architecture, scope, naming, defaults, and prior decisions are exactly the
+    things that DO belong here \u2014 those are stable design-doc content the
+    pipeline-spawned agent needs in its context. -->
+
 ## Tickets
 
 For the live ticket list, run:
@@ -1938,7 +2300,7 @@ For the live ticket list, run:
 oteam project show ${id} --tickets
 \`\`\`
 
-Tickets are not stored inside this folder \u2014 they live in \`<vault>/tickets/<state>/\` and reference this project via frontmatter \`project: ${id}\`.
+Tickets are not stored inside this folder \u2014 they live in \`<workspace>/tickets/<state>/\` and reference this project via frontmatter \`project: ${id}\`.
 
 ### Notable shipped milestones (drift expected)
 
@@ -1949,16 +2311,16 @@ Tickets are not stored inside this folder \u2014 they live in \`<vault>/tickets/
 // src/commands/project.ts
 function buildProjectCommand() {
   const project = new Command3("project").description(
-    "Manage vault projects (folders under <vault>/projects/<id>/)"
+    "Manage workspace projects (folders under <workspace>/projects/<id>/)"
   );
-  project.command("init <id>").description("Scaffold <vault>/projects/<id>/README.md and open in $EDITOR").option("--vault <name-or-path>", "Use a specific registered vault").option("--no-edit", "Skip opening the README in $EDITOR after scaffolding").action((id, opts) => {
-    runInit2(id, opts);
+  project.command("init <id>").description("Scaffold <workspace>/projects/<id>/README.md and open in $EDITOR").option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option("--vault <name-or-path>").hideHelp()).option("--no-edit", "Skip opening the README in $EDITOR after scaffolding").action((id, opts) => {
+    runInit2(id, { vault: opts.workspace ?? opts.vault, edit: opts.edit });
   });
-  project.command("list").description("List projects in the vault with derived ticket counts").option("--vault <name-or-path>", "Use a specific registered vault").action((opts) => {
-    runList2(opts);
+  project.command("list").description("List projects in the workspace with derived ticket counts").option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option("--vault <name-or-path>").hideHelp()).action((opts) => {
+    runList2({ vault: opts.workspace ?? opts.vault });
   });
-  project.command("show <id>").description("Print a project's frontmatter, body, siblings, and ticket counts").option("--vault <name-or-path>", "Use a specific registered vault").option("--tickets", "Also list every ticket tagged with this project").action((id, opts) => {
-    runShow(id, opts);
+  project.command("show <id>").description("Print a project's frontmatter, body, siblings, and ticket counts").option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option("--vault <name-or-path>").hideHelp()).option("--tickets", "Also list every ticket tagged with this project").action((id, opts) => {
+    runShow(id, { vault: opts.workspace ?? opts.vault, tickets: opts.tickets });
   });
   return project;
 }
@@ -1973,14 +2335,14 @@ function runInit2(id, opts) {
   const vaultPath = resolveVaultPath({ flagValue: opts.vault });
   const dir = projectDir(vaultPath, id);
   const readme = projectReadmePath(vaultPath, id);
-  if (existsSync6(readme)) {
+  if (existsSync7(readme)) {
     process.stderr.write(
       `oteam project init: ${readme} already exists \u2014 refusing to overwrite
 `
     );
     process.exit(1);
   }
-  mkdirSync5(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   writeFileSync5(readme, projectFrontmatterTemplate(id), "utf8");
   process.stdout.write(`\u2705 Created project ${id}
    ${readme}
@@ -1995,7 +2357,7 @@ function runList2(opts) {
   if (projects.length === 0) {
     process.stdout.write(
       `(no projects)
-   <vault>/projects/<id>/README.md is the convention; create one with: oteam project init <id>
+   <workspace>/projects/<id>/README.md is the convention; create one with: oteam project init <id>
 `
     );
     return;
@@ -2106,7 +2468,7 @@ function isValidProjectId(id) {
 function openInEditor(path) {
   const editor = process.env.EDITOR || process.env.VISUAL;
   if (!editor) return;
-  const r = spawnSync(editor, [path], { stdio: "inherit", shell: true });
+  const r = spawnSync2(editor, [path], { stdio: "inherit", shell: true });
   if (r.status !== 0 && r.status !== null) {
     process.stderr.write(
       `oteam project init: $EDITOR exited ${r.status} (file is created at ${path}; edit it manually)
@@ -2121,21 +2483,21 @@ import { Command as Command4 } from "commander";
 // src/lib/telemetry.ts
 import {
   appendFileSync,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync6,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync7,
   readFileSync as readFileSync7
 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/lib/claude-session.ts
 import { readFileSync as readFileSync6 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function encodeProjectDir(cwd) {
   return cwd.replace(/\//g, "-");
 }
 function findSessionFile(claudeConfigDir, cwd, sessionId) {
-  return join9(
+  return join10(
     claudeConfigDir,
     "projects",
     encodeProjectDir(cwd),
@@ -2151,9 +2513,34 @@ function parseSessionFile(path) {
   }
   return parseSessionJsonl(raw);
 }
+function lastAssistantText(path) {
+  let raw;
+  try {
+    raw = readFileSync6(path, "utf8");
+  } catch {
+    return null;
+  }
+  let last = "";
+  for (const line of raw.split("\n")) {
+    if (line.length === 0) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!entry || typeof entry !== "object") continue;
+    const e = entry;
+    if (e.type !== "assistant") continue;
+    const m = e.message ?? {};
+    const text = extractAssistantText(m.content);
+    if (text.length > 0) last = text;
+  }
+  return last.length > 0 ? last : null;
+}
 function parseSessionJsonl(raw) {
   const tokens = {};
-  let lastAssistantText = "";
+  let lastAssistantText2 = "";
   for (const line of raw.split("\n")) {
     if (line.length === 0) continue;
     let entry;
@@ -2176,9 +2563,9 @@ function parseSessionJsonl(raw) {
       addIfFinite(tokens, "cache-read", u.cache_read_input_tokens);
     }
     const text = extractAssistantText(m.content);
-    if (text.length > 0) lastAssistantText = text;
+    if (text.length > 0) lastAssistantText2 = text;
   }
-  return { tokens, outcome: detectOutcome(lastAssistantText) };
+  return { tokens, outcome: detectOutcome(lastAssistantText2) };
 }
 function extractAssistantText(content) {
   if (typeof content === "string") return content;
@@ -2208,10 +2595,10 @@ function addIfFinite(target, key, value) {
 function telemetryDir() {
   const override = process.env.OTEAM_TELEMETRY_DIR;
   if (override && override.length > 0) return override;
-  return join10(homedir4(), ".open-team", "telemetry");
+  return join11(homedir4(), ".open-team", "telemetry");
 }
 function runsPath(dir = telemetryDir()) {
-  return join10(dir, "runs.jsonl");
+  return join11(dir, "runs.jsonl");
 }
 function recordPhase(input) {
   try {
@@ -2225,10 +2612,21 @@ function recordPhase(input) {
     );
     let tokens = {};
     let markerOutcome = null;
-    if (existsSync7(sessionFile)) {
+    if (existsSync8(sessionFile)) {
       const parsed = parseSessionFile(sessionFile);
       tokens = parsed.tokens;
       markerOutcome = parsed.outcome;
+      if (Object.keys(tokens).length === 0) {
+        process.stderr.write(
+          `oteam: telemetry: session file found but no token data parsed \u2014 ${sessionFile}
+`
+        );
+      }
+    } else {
+      process.stderr.write(
+        `oteam: telemetry: session file not found \u2014 ${sessionFile}
+`
+      );
     }
     const outcome = input.exitCode !== 0 ? "failed" : markerOutcome ?? "unknown";
     const line = {
@@ -2242,7 +2640,7 @@ function recordPhase(input) {
       outcome
     };
     const dir = telemetryDir();
-    mkdirSync6(dir, { recursive: true });
+    mkdirSync7(dir, { recursive: true });
     appendFileSync(runsPath(dir), JSON.stringify(line) + "\n");
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -2253,7 +2651,7 @@ function recordPhase(input) {
 function resolveClaudeConfigDir() {
   const env = process.env.CLAUDE_CONFIG_DIR;
   if (env && env.length > 0) return env;
-  return join10(homedir4(), ".claude");
+  return join11(homedir4(), ".claude");
 }
 function computeWallClockMs(startedAt, endedAt) {
   const startMs = Date.parse(startedAt);
@@ -2263,7 +2661,7 @@ function computeWallClockMs(startedAt, endedAt) {
 }
 function readRuns(dir = telemetryDir()) {
   const path = runsPath(dir);
-  if (!existsSync7(path)) return [];
+  if (!existsSync8(path)) return [];
   const raw = readFileSync7(path, "utf8");
   const out = [];
   for (const line of raw.split("\n")) {
@@ -2443,17 +2841,17 @@ function formatTokenField(tokens, key) {
 }
 
 // src/commands/ticket.ts
-import { Command as Command5 } from "commander";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, writeFileSync as writeFileSync6 } from "fs";
-import { join as join11 } from "path";
+import { Command as Command5, Option as Option2 } from "commander";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync6 } from "fs";
+import { join as join12 } from "path";
 function runTicketNew(opts) {
   const title = opts.title.trim();
   if (title.length === 0) {
     throw new Error("oteam ticket new: <title> must not be empty");
   }
-  const vault = resolveVaultPath({ flagValue: opts.vault });
-  const triageDir = join11(vault, "tickets", "triage");
-  mkdirSync7(triageDir, { recursive: true });
+  const vault = resolveVaultPath({ flagValue: opts.workspace ?? opts.vault });
+  const triageDir = join12(vault, "tickets", "triage");
+  mkdirSync8(triageDir, { recursive: true });
   const id = nextTicketID(vault);
   const slug = slugify(title);
   if (slug.length === 0) {
@@ -2461,8 +2859,8 @@ function runTicketNew(opts) {
       `oteam ticket new: title "${title}" produced an empty slug \u2014 use a title with at least one alphanumeric character`
     );
   }
-  const target = join11(triageDir, `${id}-${slug}.md`);
-  if (existsSync8(target)) {
+  const target = join12(triageDir, `${id}-${slug}.md`);
+  if (existsSync9(target)) {
     throw new Error(
       `oteam ticket new: target already exists at ${target} \u2014 ID scan collision`
     );
@@ -2485,10 +2883,10 @@ function collectLabel(value, prev = []) {
 }
 function buildTicketCommand() {
   const ticket = new Command5("ticket").description(
-    "Create vault tickets directly (without an external source)"
+    "Create workspace tickets directly (without an external source)"
   );
   ticket.command("new <title>").description(
-    "File a new ticket in <vault>/tickets/triage/ \u2014 works with or without a project"
+    "File a new ticket in <workspace>/tickets/triage/ \u2014 works with or without a project"
   ).option(
     "--project <id>",
     "Tag the ticket with a project (omit for no project)"
@@ -2497,7 +2895,7 @@ function buildTicketCommand() {
     "Add a label (repeatable: --label foo --label bar)",
     collectLabel,
     []
-  ).option("--vault <name-or-path>", "Use a specific registered vault").action(
+  ).option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option2("--vault <name-or-path>").hideHelp()).action(
     (title, opts) => {
       const result = runTicketNew({
         title,
@@ -2505,7 +2903,7 @@ function buildTicketCommand() {
         team: opts.team,
         priority: opts.priority,
         labels: opts.label,
-        vault: opts.vault
+        vault: opts.workspace ?? opts.vault
       });
       process.stdout.write(`\u2705 Filed ${result.ticketID}
    ${result.path}
@@ -2516,22 +2914,89 @@ function buildTicketCommand() {
 }
 
 // src/role-pipeline/runner.ts
-import { spawnSync as spawnSync4 } from "child_process";
+import { spawn, spawnSync as spawnSync5 } from "child_process";
 import { randomUUID } from "crypto";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
-import { tmpdir } from "os";
-import { resolve as resolve4, basename as basename5, dirname as dirname2, join as join14 } from "path";
+import { readFileSync as readFileSync9, realpathSync, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir6, tmpdir } from "os";
+import { resolve as resolve4, basename as basename4, dirname as dirname2, join as join14 } from "path";
+
+// src/lib/github.ts
+import { spawnSync as spawnSync3 } from "child_process";
+function parseIssueRef(ref) {
+  const url = ref.match(
+    /^https?:\/\/github\.com\/([^/]+)\/([^/]+)\/issues\/(\d+)/
+  );
+  if (url) {
+    return { slug: `${url[1]}/${url[2]}`, number: parseInt(url[3], 10) };
+  }
+  const slug = ref.match(/^([^/]+\/[^/#]+)#(\d+)$/);
+  if (slug) {
+    return { slug: slug[1], number: parseInt(slug[2], 10) };
+  }
+  return null;
+}
+function claimGitHubIssue(slug, issueNumber, identity) {
+  const getR = ghJSON(["api", `repos/${slug}/issues/${issueNumber}`]);
+  if (!getR.ok) return { ok: false, reason: "api-error", error: getR.error };
+  const issue = getR.value;
+  if (issue.state === "closed") return { ok: false, reason: "issue-closed" };
+  const existing = collectAssignees(issue);
+  if (existing.length > 0 && !existing.includes(identity)) {
+    return { ok: false, reason: "already-claimed", assignees: existing };
+  }
+  const body = JSON.stringify({ assignees: [identity] });
+  const patchR = ghJSON(
+    [
+      "api",
+      `repos/${slug}/issues/${issueNumber}`,
+      "-X",
+      "PATCH",
+      "--input",
+      "-"
+    ],
+    body
+  );
+  if (!patchR.ok) return { ok: false, reason: "api-error", error: patchR.error };
+  const updated = patchR.value;
+  if (updated.state === "closed") return { ok: false, reason: "issue-closed" };
+  const after = collectAssignees(updated);
+  if (after.length === 0) return { ok: false, reason: "no-write-access" };
+  if (after.length !== 1 || after[0] !== identity) {
+    return { ok: false, reason: "already-claimed", assignees: after };
+  }
+  return { ok: true, assignees: after };
+}
+function collectAssignees(issue) {
+  if (!issue.assignees) return [];
+  const out = [];
+  for (const a of issue.assignees) {
+    if (typeof a?.login === "string" && a.login.length > 0) out.push(a.login);
+  }
+  return out;
+}
+function ghJSON(args, input) {
+  const r = spawnSync3("gh", args, { encoding: "utf8", input });
+  if (r.error) return { ok: false, error: r.error.message };
+  if (r.status !== 0) {
+    return { ok: false, error: r.stderr || `gh exited ${r.status}` };
+  }
+  try {
+    return { ok: true, value: JSON.parse(r.stdout) };
+  } catch (e) {
+    return { ok: false, error: `gh returned non-JSON: ${e.message}` };
+  }
+}
 
 // src/lib/kitty.ts
-import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync9, readdirSync as readdirSync5 } from "fs";
+import { spawnSync as spawnSync4 } from "child_process";
+import { existsSync as existsSync10, readdirSync as readdirSync6 } from "fs";
 var SOCKET_BASENAME = "kitty-claudini";
 var KNOWN_INSTANCES = ["personal", "work"];
 function isMacOS() {
   return process.platform === "darwin";
 }
 function findKittyBinary() {
-  const r = spawnSync2("/usr/bin/env", ["which", "kitty"], { encoding: "utf8" });
+  const r = spawnSync4("/usr/bin/env", ["which", "kitty"], { encoding: "utf8" });
   if (r.status !== 0) return null;
   const path = r.stdout.trim();
   return path.length > 0 ? path : null;
@@ -2556,7 +3021,7 @@ function findKittySocket(kittyPath, preferring) {
   let pidSuffixed = [];
   try {
     const prefix = `${SOCKET_BASENAME}-`;
-    pidSuffixed = readdirSync5("/tmp").filter((n) => n.startsWith(prefix)).map((n) => `/tmp/${n}`).filter((p) => !candidates.includes(p));
+    pidSuffixed = readdirSync6("/tmp").filter((n) => n.startsWith(prefix)).map((n) => `/tmp/${n}`).filter((p) => !candidates.includes(p));
   } catch {
   }
   if (preferring) {
@@ -2567,9 +3032,9 @@ function findKittySocket(kittyPath, preferring) {
     candidates.push(...pidSuffixed);
   }
   for (const path of candidates) {
-    if (!existsSync9(path)) continue;
+    if (!existsSync10(path)) continue;
     const socket = `unix:${path}`;
-    const r = spawnSync2(kittyPath, ["@", "--to", socket, "ls"], {
+    const r = spawnSync4(kittyPath, ["@", "--to", socket, "ls"], {
       encoding: "utf8"
     });
     if (r.status === 0) return socket;
@@ -2614,7 +3079,7 @@ function kittyLaunch(opts) {
     "-c",
     opts.shellCmd
   ];
-  const r = spawnSync2(opts.kittyPath, args, { encoding: "utf8" });
+  const r = spawnSync4(opts.kittyPath, args, { encoding: "utf8" });
   return { exitCode: r.status ?? -1, stderr: r.stderr ?? "" };
 }
 function augmentedPATH() {
@@ -2632,145 +3097,32 @@ function shellEscape(s) {
   return s.replace(/'/g, "'\\''");
 }
 
-// src/lib/workspace.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync8, readdirSync as readdirSync6, rmSync } from "fs";
-import { spawnSync as spawnSync3 } from "child_process";
-import { basename as basename4, join as join12 } from "path";
-function buildGithubUrl(repoSlug) {
-  return `git@github.com:${repoSlug}.git`;
-}
-var WORKSPACE_ROOT = "/tmp/open-team-issues";
-var TICKET_ID_RE = /^AGT-\d+$/;
-var ORPHAN_DIR_RE = /^agt-\d+$/;
-var StampGateError = class extends Error {
-  stampUrl;
-  cloneStderr;
-  constructor(args) {
-    const lines = [
-      `oteam assign: ${args.repoSlug} is not stamp-governed.`
-    ];
-    if (args.stampUrl) {
-      lines.push(`  Tried: git clone ${args.stampUrl}`);
-    }
-    lines.push(
-      `  Reason: ${args.reason}`,
-      `  Fix: provision the repo on the stamp server with`,
-      `    stamp provision ${basename4(args.repoSlug)}`,
-      `  Or turn enforcement off:`,
-      `    oteam config stamp set --enforce off`,
-      `  Or pass --no-stamp to bypass this gate for a single run.`
-    );
-    super(lines.join("\n"));
-    this.name = "StampGateError";
-    this.stampUrl = args.stampUrl;
-    this.cloneStderr = args.cloneStderr ?? "";
-  }
-};
-function prepareAgentWorkspace(opts) {
-  if (!TICKET_ID_RE.test(opts.ticketId)) {
-    throw new Error(
-      `prepareAgentWorkspace: refusing to operate on non-AGT ticket id "${opts.ticketId}" (expected AGT-NNN)`
-    );
-  }
-  const root = opts.rootDir ?? WORKSPACE_ROOT;
-  mkdirSync8(root, { recursive: true });
-  if (opts.activeTicketIds) gcOrphanWorkspaces(root, opts.activeTicketIds);
-  const ticketDir = join12(root, opts.ticketId.toLowerCase());
-  const repoDir = join12(ticketDir, "repo");
-  rmSync(ticketDir, { recursive: true, force: true });
-  mkdirSync8(ticketDir, { recursive: true });
-  const repoBasename = basename4(opts.repoSlug);
-  const cloneRunner = opts.cloneRunner ?? defaultCloneRunner;
-  if (opts.mode === "github") {
-    const url = buildGithubUrl(opts.repoSlug);
-    const r2 = cloneRunner(url, repoDir);
-    if (r2.status !== 0) {
-      throw new Error(
-        `oteam assign: github clone failed (git clone ${url}):
-${r2.stderr.trim() || "(no stderr)"}`
-      );
-    }
-    return { path: repoDir, originUrl: url, source: "github" };
-  }
-  if (!opts.stampHost || opts.stampHost.trim().length === 0) {
-    throw new Error(
-      "prepareAgentWorkspace: mode='stamp' requires opts.stampHost (run 'oteam config stamp set --host <url>')"
-    );
-  }
-  const stampUrl = buildStampCloneUrl(opts.stampHost, repoBasename);
-  const r = cloneRunner(stampUrl, repoDir);
-  if (r.status !== 0) {
-    throw new StampGateError({
-      repoSlug: opts.repoSlug,
-      stampUrl,
-      reason: stampGateReason(r),
-      cloneStderr: r.stderr
-    });
-  }
-  return { path: repoDir, originUrl: stampUrl, source: "stamp" };
-}
-function buildStampCloneUrl(host, repoBasename) {
-  return `${host}/srv/git/${repoBasename}.git`;
-}
-function stampGateReason(r) {
-  const stderr = r.stderr.trim();
-  if (!stderr) return `git clone exited ${r.status}`;
-  const firstLine = stderr.split(/\r?\n/).find((l) => l.trim().length > 0);
-  return `git clone exited ${r.status}: ${firstLine ?? "(no stderr)"}`;
-}
-var defaultCloneRunner = (url, dest) => {
-  const r = spawnSync3("git", ["clone", "--quiet", url, dest], {
-    encoding: "utf8",
-    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }
-  });
-  return {
-    status: r.status ?? -1,
-    stderr: r.stderr ?? ""
-  };
-};
-function gcOrphanWorkspaces(root, activeTicketIds) {
-  if (!existsSync10(root)) return [];
-  const removed = [];
-  let entries;
-  try {
-    entries = readdirSync6(root);
-  } catch {
-    return [];
-  }
-  for (const name of entries) {
-    if (!ORPHAN_DIR_RE.test(name)) continue;
-    if (activeTicketIds.has(name)) continue;
-    const target = join12(root, name);
-    try {
-      rmSync(target, { recursive: true, force: true });
-      removed.push(target);
-    } catch {
-    }
-  }
-  return removed;
-}
-
 // src/role-pipeline/install-slash-command.ts
 import { copyFileSync, existsSync as existsSync11, mkdirSync as mkdirSync9, readdirSync as readdirSync7, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
 import { homedir as homedir5 } from "os";
 import { dirname, join as join13 } from "path";
 import { fileURLToPath } from "url";
 var moduleDir = dirname(fileURLToPath(import.meta.url));
-var BUNDLED_PROMPT = join13(moduleDir, "assign-ticket.md");
+var BUNDLED_COMMANDS = [
+  { src: join13(moduleDir, "assign-ticket.md"), dest: "assign-ticket.md" },
+  { src: join13(moduleDir, "implement-project.md"), dest: "implement-project.md" }
+];
 function installRolePipelineSlashCommand() {
-  if (!existsSync11(BUNDLED_PROMPT)) return;
-  const bundled = readFileSync8(BUNDLED_PROMPT);
   const targets = resolveTargetDirs();
-  for (const dir of targets) {
-    try {
-      mkdirSync9(dir, { recursive: true });
-      const target = join13(dir, "assign-ticket.md");
-      if (existsSync11(target)) {
-        const current = readFileSync8(target);
-        if (current.equals(bundled)) continue;
+  for (const { src, dest } of BUNDLED_COMMANDS) {
+    if (!existsSync11(src)) continue;
+    const bundled = readFileSync8(src);
+    for (const dir of targets) {
+      try {
+        mkdirSync9(dir, { recursive: true });
+        const target = join13(dir, dest);
+        if (existsSync11(target)) {
+          const current = readFileSync8(target);
+          if (current.equals(bundled)) continue;
+        }
+        copyFileSync(src, target);
+      } catch {
       }
-      copyFileSync(BUNDLED_PROMPT, target);
-    } catch {
     }
   }
 }
@@ -2799,18 +3151,54 @@ function resolveTargetDirs() {
 }
 
 // src/role-pipeline/runner.ts
-function resolveWorkspaceMode(config, noStamp) {
-  if (noStamp) return "github";
+async function resolveCloneUriForAssign(config, slug, resolver) {
+  if (resolver) return resolver(slug);
+  const existing = getRepoEntry(slug, config);
+  let uri;
+  if (existing) {
+    uri = existing["clone-uri"];
+  } else {
+    const defaultUri = `https://github.com/${slug}.git`;
+    const result = await promptCloneUri(
+      slug,
+      defaultUri,
+      { isTTY: process.stdin.isTTY === true },
+      "refuse"
+    );
+    uri = result.uri;
+    setRepoCloneUri(slug, uri);
+  }
   if (config.stamp?.enforce) {
     if (!config.stamp.host || config.stamp.host.length === 0) {
       throw new Error(
         "oteam assign: stamp.enforce is on but stamp.host is empty \u2014 run 'oteam config stamp set --host <url>' or 'oteam config stamp set --enforce off'"
       );
     }
-    return "stamp";
+    if (!uri.startsWith(config.stamp.host)) {
+      throw new StampEnforceError({ slug, uri, stampHost: config.stamp.host });
+    }
   }
-  return "github";
+  return uri;
 }
+var StampEnforceError = class extends Error {
+  slug;
+  uri;
+  constructor(args) {
+    const lines = [
+      `oteam assign: ${args.slug} clone URI is not stamp-governed.`,
+      `  Recorded URI: ${args.uri}`,
+      `  Expected URI starting with: ${args.stampHost}`,
+      `  Fix: update the recorded URI:`,
+      `    oteam config repo set ${args.slug} --clone-uri <stamp-url>`,
+      `  Or turn enforcement off:`,
+      `    oteam config stamp set --enforce off`
+    ];
+    super(lines.join("\n"));
+    this.name = "StampEnforceError";
+    this.slug = args.slug;
+    this.uri = args.uri;
+  }
+};
 async function assignTicket(opts) {
   const config = readConfig();
   let resolvedVault = resolveVault({ flagValue: opts.vault, config });
@@ -2830,6 +3218,7 @@ async function assignTicket(opts) {
       `assign: could not parse ticket at ${ticketPath} (frontmatter unreadable)`
     );
   }
+  enforceClaimOrExit(ticket.source, config);
   installRolePipelineSlashCommand();
   const claudePath = findToolOnPath("claude");
   if (!claudePath) {
@@ -2839,28 +3228,32 @@ async function assignTicket(opts) {
   }
   let workspace = null;
   if (ticket.repo) {
-    const mode = resolveWorkspaceMode(config, opts.noStamp ?? false);
+    let cloneUri;
     try {
-      workspace = prepareAgentWorkspace({
-        ticketId: ticket.id,
-        repoSlug: ticket.repo,
-        mode,
-        stampHost: mode === "stamp" ? config.stamp?.host : void 0,
-        activeTicketIds: collectActiveTicketIds(resolvedVault.path)
-      });
+      cloneUri = await resolveCloneUriForAssign(
+        config,
+        ticket.repo,
+        opts.cloneUriResolver
+      );
     } catch (err) {
-      if (err instanceof StampGateError) {
+      if (err instanceof NoTTYError || err instanceof StampEnforceError) {
         process.stderr.write(`${err.message}
 `);
         process.exit(1);
       }
       throw err;
     }
-    if (opts.noStamp && config.stamp?.enforce) {
-      process.stderr.write(
-        `oteam assign: --no-stamp set; cloned from ${workspace.originUrl}. The stamp gate is bypassed \u2014 verify any push manually.
-`
-      );
+    try {
+      workspace = prepareAgentWorkspace({
+        ticketId: ticket.id,
+        repoSlug: ticket.repo,
+        cloneUri,
+        activeTicketIds: collectActiveTicketIds(resolvedVault.path)
+      });
+    } catch (err) {
+      process.stderr.write(`${err.message}
+`);
+      process.exit(1);
     }
   }
   const projectContext = loadProjectContext(resolvedVault.path, ticket.project);
@@ -2873,7 +3266,13 @@ async function assignTicket(opts) {
     models: config.models
   });
   const haikuDownshift = model === HAIKU_PRODUCT_MODEL && ticket.state === "triage";
-  const systemPrompt = composeSystemPrompt(ticket.id, projectContext, haikuDownshift);
+  const pushDisabled = config.push === "off";
+  const systemPrompt = composeSystemPrompt(
+    ticket.id,
+    projectContext,
+    haikuDownshift,
+    pushDisabled
+  );
   const phase = phaseForState(ticket.state);
   const telemetry = phase !== null && getTelemetryEnabled() ? {
     ticketId: ticket.id,
@@ -2884,7 +3283,7 @@ async function assignTicket(opts) {
   const wantsKitty = !opts.workInline && isMacOS();
   if (!wantsKitty) {
     process.stdout.write(inlineStartLine(ticket.id) + "\n");
-    runInline(
+    await runInline(
       claudePath,
       ticketPath,
       resolvedVault.path,
@@ -2913,7 +3312,7 @@ async function assignTicket(opts) {
     process.exit(1);
   }
   const cwd = workspace?.path ?? dirname2(ticketPath);
-  const title = `Vault \xB7 ${basename5(ticketPath)}`;
+  const title = `Vault \xB7 ${basename4(ticketPath)}`;
   const repoBasename = ticket.repo?.split("/").pop() ?? null;
   const repoSlug = ticket.repo ? ticket.repo.replace(/\//g, "-").toLowerCase() : null;
   const envPrefix = envSourcingPrefix(preferring, repoBasename, repoSlug, {
@@ -2926,15 +3325,23 @@ async function assignTicket(opts) {
   const projectFlag = systemPrompt ? ` --append-system-prompt "$(cat '${shellEscape(systemPrompt.tmpFile)}')"` : "";
   const sessionFlag = telemetry ? ` --session-id '${shellEscape(telemetry.sessionId)}'` : "";
   const claudeCmd = `'${escapedClaude}' --dangerously-skip-permissions --model ${shellEscape(model)}${sessionFlag}${projectFlag} '${escapedPrompt}'`;
-  const telemetryTail = telemetry ? buildTelemetryTail({
-    oteamPath: findToolOnPath("oteam") ?? "oteam",
-    ticketId: telemetry.ticketId,
-    phase: telemetry.phase,
-    model,
-    sessionId: telemetry.sessionId,
-    startedAt: telemetry.startedAt
-  }) : "";
-  const shellCmd = `${envPrefix}${claudeCmd}${telemetryTail}`;
+  const sentinelPath = sentinelPathForTicket(ticket.id);
+  try {
+    unlinkSync(sentinelPath);
+  } catch {
+  }
+  const tail2 = buildKittySpawnTail({
+    sentinelPath,
+    telemetry: telemetry ? {
+      oteamPath: findToolOnPath("oteam") ?? "oteam",
+      ticketId: telemetry.ticketId,
+      phase: telemetry.phase,
+      model,
+      sessionId: telemetry.sessionId,
+      startedAt: telemetry.startedAt
+    } : null
+  });
+  const shellCmd = `${envPrefix}${claudeCmd}${tail2}`;
   const result = kittyLaunch({
     socket,
     title,
@@ -2947,50 +3354,88 @@ async function assignTicket(opts) {
       `kitty @ launch exited ${result.exitCode}: ${result.stderr || "(no stderr)"}`
     );
   }
-  process.stdout.write(kittySpawnLine(ticket.id, workspace?.path ?? null) + "\n");
+  process.stdout.write(
+    kittySpawnLine(ticket.id, workspace?.path ?? null, sentinelPath) + "\n"
+  );
+}
+function sentinelPathForTicket(ticketId) {
+  return `/tmp/oteam-sentinel-${ticketId.toLowerCase()}.exit`;
 }
-function kittySpawnLine(ticketId, workspacePath) {
-  const suffix = workspacePath ? ` (worktree at ${workspacePath})` : "";
-  return `oteam assign: spawned kitty window for ${ticketId}${suffix}`;
+function kittySpawnLine(ticketId, workspacePath, sentinelPath = null) {
+  const worktree = workspacePath ? ` (worktree at ${workspacePath})` : "";
+  const sentinel = sentinelPath ? ` (sentinel ${sentinelPath})` : "";
+  return `oteam assign: spawned kitty window for ${ticketId}${worktree}${sentinel}`;
 }
 function inlineStartLine(ticketId) {
   return `oteam assign: running inline for ${ticketId}; agent starting\u2026`;
 }
-function buildTelemetryTail(input) {
-  const oteam = `'${shellEscape(input.oteamPath)}'`;
-  const args = [
-    `--ticket '${shellEscape(input.ticketId)}'`,
-    `--phase '${shellEscape(input.phase)}'`,
-    `--model '${shellEscape(input.model)}'`,
-    `--session '${shellEscape(input.sessionId)}'`,
-    `--started-at '${shellEscape(input.startedAt)}'`,
-    `--exit-code "$EC"`
-  ].join(" ");
-  return `; EC=$?; ${oteam} telemetry record ${args} >/dev/null 2>&1 || true; exit "$EC"`;
-}
-function runInline(claudePath, ticketPath, vaultPath, systemPrompt, workspace, model, telemetry) {
+function buildKittySpawnTail(input) {
+  const sentinelWrite = `printf '%s\\n' "$EC" > '${shellEscape(input.sentinelPath)}' || true`;
+  const parts = [`EC=$?`, sentinelWrite];
+  if (input.telemetry) {
+    const oteam = `'${shellEscape(input.telemetry.oteamPath)}'`;
+    const args = [
+      `--ticket '${shellEscape(input.telemetry.ticketId)}'`,
+      `--phase '${shellEscape(input.telemetry.phase)}'`,
+      `--model '${shellEscape(input.telemetry.model)}'`,
+      `--session '${shellEscape(input.telemetry.sessionId)}'`,
+      `--started-at '${shellEscape(input.telemetry.startedAt)}'`,
+      `--exit-code "$EC"`
+    ].join(" ");
+    parts.push(`${oteam} telemetry record ${args} >/dev/null 2>&1 || true`);
+  }
+  parts.push(`exit "$EC"`);
+  return `; ${parts.join("; ")}`;
+}
+async function runInline(claudePath, ticketPath, vaultPath, systemPrompt, workspace, model, telemetry) {
+  const sessionId = telemetry?.sessionId ?? randomUUID();
   const args = [
     "--dangerously-skip-permissions",
     "--model",
-    model
+    model,
+    "--session-id",
+    sessionId
   ];
-  if (telemetry) {
-    args.push("--session-id", telemetry.sessionId);
-  }
   if (systemPrompt) {
     args.push("--append-system-prompt", systemPrompt.content);
   }
   args.push(`/assign-ticket ${ticketPath}`);
-  const cwd = workspace?.path ?? process.cwd();
-  const r = spawnSync4(
-    claudePath,
-    args,
-    {
-      stdio: "inherit",
-      cwd: workspace?.path,
-      env: { ...process.env, PRODUCT_VAULT_PATH: vaultPath }
+  const rawCwd = workspace?.path ?? process.cwd();
+  const cwd = (() => {
+    try {
+      return realpathSync(rawCwd);
+    } catch {
+      return rawCwd;
     }
-  );
+  })();
+  const child = spawn(claudePath, args, {
+    stdio: "inherit",
+    cwd: workspace?.path,
+    env: { ...process.env, PRODUCT_VAULT_PATH: vaultPath },
+    detached: true
+  });
+  if (child.pid == null) {
+    throw new Error(`oteam assign: failed to spawn claude \u2014 pid is null`);
+  }
+  const pgid = child.pid;
+  const exitCode = await new Promise((resolve5) => {
+    child.on("exit", (code) => resolve5(code ?? 0));
+  });
+  const killed = await killGroupAfterGrace(pgid, 3e4);
+  if (killed.length > 0) {
+    process.stderr.write(
+      `oteam assign: killed ${killed.length} subprocess(es) that outlived the agent turn: PIDs ${killed.join(", ")}
+`
+    );
+    const claudeConfigDir = (process.env["CLAUDE_CONFIG_DIR"] ?? "").length > 0 ? process.env["CLAUDE_CONFIG_DIR"] : join14(homedir6(), ".claude");
+    const sessionPath = findSessionFile(claudeConfigDir, cwd, sessionId);
+    const summary = lastAssistantText(sessionPath);
+    if (summary) {
+      process.stdout.write(
+        "\n--- Last agent output (recovered from session JSONL) ---\n" + summary + "\n--- end recovered output ---\n"
+      );
+    }
+  }
   if (telemetry) {
     recordPhase({
       ticket: telemetry.ticketId,
@@ -2998,17 +3443,45 @@ function runInline(claudePath, ticketPath, vaultPath, systemPrompt, workspace, m
       model,
       sessionId: telemetry.sessionId,
       startedAt: telemetry.startedAt,
-      exitCode: r.status ?? -1,
+      exitCode,
       cwd
     });
   }
-  if (r.status != null && r.status !== 0) process.exit(r.status);
+  if (exitCode !== 0) process.exit(exitCode);
 }
+async function killGroupAfterGrace(pgid, graceMs, opts = {}) {
+  const listFn = opts.listFn ?? listProcessGroup;
+  const killFn = opts.killFn ?? ((pid) => {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  });
+  const pollMs = opts.pollMs ?? 500;
+  const deadline = Date.now() + graceMs;
+  while (Date.now() < deadline) {
+    const pids = listFn(pgid);
+    if (pids.length === 0) return [];
+    await new Promise((r) => setTimeout(r, pollMs));
+  }
+  const survivors = listFn(pgid);
+  for (const pid of survivors) killFn(pid);
+  return survivors;
+}
+function listProcessGroup(pgid) {
+  let r = spawnSync5("pgrep", ["-g", String(pgid)], { encoding: "utf8" });
+  if (r.status !== 0 || !r.stdout?.trim()) {
+    r = spawnSync5("ps", ["-o", "pid=", "-g", String(pgid)], { encoding: "utf8" });
+  }
+  if (r.status !== 0 || !r.stdout) return [];
+  return r.stdout.trim().split("\n").map((s) => parseInt(s.trim(), 10)).filter((n) => Number.isFinite(n) && n > 0);
+}
+var TERMINAL_STATES = /* @__PURE__ */ new Set(["done", "blocked"]);
 function collectActiveTicketIds(vaultPath) {
   const ids = /* @__PURE__ */ new Set();
   try {
     for (const t of readAllTickets(vaultPath)) {
-      ids.add(t.id.toLowerCase());
+      if (!TERMINAL_STATES.has(t.state)) ids.add(t.id.toLowerCase());
     }
   } catch {
   }
@@ -3026,10 +3499,11 @@ function loadProjectContext(vaultPath, projectId) {
   }
   return formatProjectContextForPrompt(project);
 }
-function composeSystemPrompt(ticketId, projectContext, haikuDownshift) {
+function composeSystemPrompt(ticketId, projectContext, haikuDownshift, pushDisabled) {
   const parts = [];
   if (projectContext) parts.push(projectContext);
   if (haikuDownshift) parts.push(haikuDownshiftPromptHint());
+  if (pushDisabled) parts.push(pushDisabledPromptHint());
   if (parts.length === 0) return null;
   const content = parts.join("\n\n");
   const safeId = ticketId.replace(/[^a-zA-Z0-9._-]/g, "_");
@@ -3050,6 +3524,21 @@ function haikuDownshiftPromptHint() {
     "instead of the standard `### YYYY-MM-DD \u2014 Product agent`. That makes the heuristic visible in the ticket's audit trail."
   ].join("\n");
 }
+function pushDisabledPromptHint() {
+  return [
+    "# Push step: disabled by oteam config",
+    "",
+    "AGT-099: the operator has set `push: off` in `~/.open-team/config.json`. When you reach Phase 4b's outbound push (Step 5a `stamp push`, Step 5b `git push -u origin <feature>`, or Step 5c `git push -u origin <feature>` after the local stamp-merge), do NOT run it. Run every step before the push as normal \u2014 review, status gate, stamp-merge \u2014 but stop short of the push command itself.",
+    "",
+    "Instead of pushing, print this status line verbatim (substituting `<sha>` with the SHA of the most recent commit on the branch about to be pushed \u2014 `git rev-parse HEAD` after the merge in 5a/5c, or after the last feature commit in 5b):",
+    "",
+    "    push disabled by oteam config; merge commit is local at <sha>; run 'git push origin' manually when ready",
+    "",
+    "Then continue with the rest of Phase 4b (PR creation in 5b/5c is also skipped, since there is nothing pushed for `gh pr create` to reference; record `linked-pr:` as empty and note in the wrap-up comment that the push was held). Step 6 (stamp retro routing) still runs because it does not depend on any push.",
+    "",
+    "This gate covers only the assign-side push step. Ingest commands (`oteam pull github`) are unaffected."
+  ].join("\n");
+}
 function readTicketBody(path) {
   try {
     return readFileSync9(path, "utf8");
@@ -3058,7 +3547,7 @@ function readTicketBody(path) {
   }
 }
 function findToolOnPath(name) {
-  const r = spawnSync4("/usr/bin/env", ["which", name], { encoding: "utf8" });
+  const r = spawnSync5("/usr/bin/env", ["which", name], { encoding: "utf8" });
   if (r.status !== 0) return null;
   const path = (r.stdout || "").trim();
   return path.length > 0 ? path : null;
@@ -3068,11 +3557,52 @@ function readMonitoredOrgsFromEnv() {
   if (!raw) return [];
   return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
+function enforceClaimOrExit(source, config) {
+  if (source.type !== "github" || !source.url) return;
+  const identity = resolveBotIdentity(config);
+  if (identity.length === 0) return;
+  const ref = parseIssueRef(source.url);
+  if (!ref) {
+    process.stderr.write(
+      `oteam assign: ticket source.url "${source.url}" is not a parseable github issue ref \u2014 skipping claim
+`
+    );
+    return;
+  }
+  const claim = claimGitHubIssue(ref.slug, ref.number, identity);
+  if (claim.ok) return;
+  switch (claim.reason) {
+    case "issue-closed":
+      process.stderr.write(
+        `oteam assign: refusing to drive role pipeline \u2014 ${ref.slug}#${ref.number} is closed
+`
+      );
+      process.exit(1);
+    case "already-claimed":
+      process.stderr.write(
+        `oteam assign: refusing to drive role pipeline \u2014 ${ref.slug}#${ref.number} is assigned to ${claim.assignees.join(", ")} (not "${identity}")
+`
+      );
+      process.exit(1);
+    case "no-write-access":
+      process.stderr.write(
+        `oteam assign: cannot claim ${ref.slug}#${ref.number} as "${identity}" \u2014 gh token has no push access on the repo (assignee changes are silently dropped). Add the operator as a collaborator, or unset botIdentity if claims aren't wanted on this repo.
+`
+      );
+      process.exit(1);
+    case "api-error":
+      process.stderr.write(
+        `oteam assign: claim failed for ${ref.slug}#${ref.number} \u2014 ${claim.error}
+`
+      );
+      process.exit(1);
+  }
+}
 
 // package.json
 var package_default = {
   name: "@openthink/team",
-  version: "0.0.11",
+  version: "0.0.13",
   type: "module",
   description: "Source-agnostic vault-driven role pipeline for spawning Claude agents against tickets",
   bin: {
@@ -3082,7 +3612,7 @@ var package_default = {
     "dist"
   ],
   scripts: {
-    build: "tsup && cp src/role-pipeline/assign-ticket.md dist/assign-ticket.md",
+    build: "tsup && cp src/role-pipeline/assign-ticket.md dist/assign-ticket.md && cp src/role-pipeline/implement-project.md dist/implement-project.md",
     dev: "tsx src/index.ts",
     typecheck: "tsc --noEmit",
     test: "node --test --import tsx 'tests/**/*.test.ts'",
@@ -3120,14 +3650,15 @@ var package_default = {
 // src/index.ts
 var program = new Command6();
 program.name("oteam").description(
-  "Source-agnostic vault-driven role pipeline for spawning Claude agents against tickets"
+  "Source-agnostic workspace-driven role pipeline for spawning Claude agents against tickets"
 ).version(package_default.version);
 async function handlePull(source, ref, opts) {
   const result = await runPull({
     source,
     ref,
-    vault: opts.vault,
-    project: opts.project
+    vault: opts.workspace ?? opts.vault,
+    project: opts.project,
+    cloneUri: opts.cloneUri
   });
   const verb = result.reused ? "Reused existing" : "Filed";
   process.stdout.write(`\u2705 ${verb} ${result.ticketID}
@@ -3135,34 +3666,36 @@ async function handlePull(source, ref, opts) {
 `);
 }
 program.command("pull <source> <ref>").description(
-  "Ingest an external item into the vault as a triage ticket (sources: github)"
-).option("--vault <name-or-path>", "Use a specific registered vault").option(
+  "Ingest an external item into the workspace as a triage ticket (sources: github)"
+).option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option3("--vault <name-or-path>").hideHelp()).option(
   "--project <name>",
   "Tag the ticket with a project name (defaults to the source repo's bare name)"
+).option(
+  "--clone-uri <url>",
+  "Record this clone URI for the repo instead of prompting (daemon-friendly)"
 ).action(handlePull);
-program.command("ingest <source> <ref>", { hidden: true }).description("Hidden alias for `pull`.").option("--vault <name-or-path>", "Use a specific registered vault").option(
+program.command("ingest <source> <ref>", { hidden: true }).description("Hidden alias for `pull`.").option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option3("--vault <name-or-path>").hideHelp()).option(
   "--project <name>",
   "Tag the ticket with a project name (defaults to the source repo's bare name)"
+).option(
+  "--clone-uri <url>",
+  "Record this clone URI for the repo instead of prompting (daemon-friendly)"
 ).action(handlePull);
 program.command("assign <ticket-or-id>").description(
   "Drive the role pipeline against a ticket (full path or AGT-NNN id)"
 ).option(
   "--inline",
   "Run the role pipeline in the current terminal instead of spawning kitty"
-).option("--vault <name-or-path>", "Use a specific registered vault").option(
-  "--no-stamp",
-  "Force a github clone for this run, overriding stamp.enforce in oteam config. The durable knob is 'oteam config stamp set --enforce off'."
-).action(
+).option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option3("--vault <name-or-path>").hideHelp()).action(
   async (ticketPath, opts) => {
     await assignTicket({
       ticketPath,
       workInline: opts.inline,
-      vault: opts.vault,
-      noStamp: opts.stamp === false
+      vault: opts.workspace ?? opts.vault
     });
   }
 );
-program.command("list").description("List tickets in the vault (filter by structured frontmatter or grep)").option("--state <state>", "Filter by ticket state (triage|refined|...)").option("--project <name>", "Filter by project name (case-insensitive)").option("--repo <slug>", "Filter by repo frontmatter (case-insensitive)").option("--team <team>", "Filter by team (case-insensitive)").option("--priority <priority>", "Filter by priority (case-insensitive)").option("--source <type>", "Filter by source.type (github|manual|...)").option(
+program.command("list").description("List tickets in the workspace (filter by structured frontmatter or grep)").option("--state <state>", "Filter by ticket state (triage|refined|...)").option("--project <name>", "Filter by project name (case-insensitive)").option("--repo <slug>", "Filter by repo frontmatter (case-insensitive)").option("--team <team>", "Filter by team (case-insensitive)").option("--priority <priority>", "Filter by priority (case-insensitive)").option("--source <type>", "Filter by source.type (github|manual|...)").option(
   "--label <label>",
   "Filter by label (case-insensitive; repeatable, all must match)",
   (value, prev = []) => [...prev, value],
@@ -3175,8 +3708,8 @@ program.command("list").description("List tickets in the vault (filter by struct
   "Case-insensitive substring match against the ticket body (reads files)"
 ).option(
   "--include-archived",
-  "Also search <vault>/archive/ (excluded by default)"
-).option("--vault <name-or-path>", "Use a specific registered vault").action(
+  "Also search <workspace>/archive/ (excluded by default)"
+).option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option3("--vault <name-or-path>").hideHelp()).action(
   (opts) => {
     if (opts.state && !TICKET_STATES.includes(opts.state)) {
       process.stderr.write(
@@ -3185,11 +3718,11 @@ program.command("list").description("List tickets in the vault (filter by struct
       );
       process.exit(2);
     }
-    process.stdout.write(runList(opts) + "\n");
+    process.stdout.write(runList({ ...opts, vault: opts.workspace ?? opts.vault }) + "\n");
   }
 );
-program.command("archive <ticket-id>").description("Move a done ticket to archive/YYYY-MM/").option("--vault <name-or-path>", "Use a specific registered vault").action((ticketID, opts) => {
-  const path = runArchive({ ticketID, vault: opts.vault });
+program.command("archive <ticket-id>").description("Move a done ticket to archive/YYYY-MM/").option("-w, --workspace <name-or-path>", "Use a specific registered workspace").addOption(new Option3("--vault <name-or-path>").hideHelp()).action((ticketID, opts) => {
+  const path = runArchive({ ticketID, vault: opts.workspace ?? opts.vault });
   process.stdout.write(`\u2705 Archived
    ${path}
 `);