@rness/cli 0.6.2 → 0.8.0

package/dist/{chunk-7TOHFPW6.js → chunk-VQMX52HT.js}

@@ -735,6 +735,9 @@ async function isClean(dir, ignore = []) {
     [
       "status",
       "--porcelain",
+      // Every untracked file on its own line: a directory folded into one
+      // `?? dir/` entry would slip past a pathspec naming a file inside it.
+      "--untracked-files=all",
       ...pathspec.length > 0 ? ["--", ...pathspec] : []
     ],
     dir
@@ -794,7 +797,7 @@ function classifyProbe(url, exitCode, stderr) {
 var STDERR_FLUSH_MS = 200;
 async function probeRemote(url, timeoutMs = 6e4, credentials) {
   positional(url, "repository url");
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const auth = withCredentials(credentials);
     const child = spawn(
       "git",
@@ -813,7 +816,7 @@ async function probeRemote(url, timeoutMs = 6e4, credentials) {
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve5(probe);
+      resolve6(probe);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -824,14 +827,14 @@ async function probeRemote(url, timeoutMs = 6e4, credentials) {
     }, timeoutMs);
     child.on("error", (e) => settle(classifyProbe(url, 1, e.message)));
     child.on("exit", (code) => {
-      const finish = () => settle(classifyProbe(url, code ?? 1, chunks.join("")));
+      const finish2 = () => settle(classifyProbe(url, code ?? 1, chunks.join("")));
       const stderr = child.stderr;
       if (stderr === null || stderr.readableEnded || stderr.destroyed)
-        return finish();
-      const flush = setTimeout(finish, STDERR_FLUSH_MS);
+        return finish2();
+      const flush = setTimeout(finish2, STDERR_FLUSH_MS);
       const done = () => {
         clearTimeout(flush);
-        finish();
+        finish2();
       };
       stderr.once("end", done);
       stderr.once("error", done);
@@ -857,7 +860,7 @@ function isWorkspaceClone(name) {
 }
 var NAME_RULE = "lowercase letters, digits, '.', '_' and '-', not starting with '-'";
 var ORG_NAME = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
-var KEYS = ["contract", "org", "repos", "scopes"];
+var KEYS = ["contract", "org", "agents", "repos", "scopes"];
 function fail(message) {
   throw new Error(`rness.json: ${message}`);
 }
@@ -886,6 +889,15 @@ function readOrg(value) {
 function workspaceName(manifest, root) {
   return manifest.org ?? basename2(root);
 }
+var AGENT_NAME = /^[a-z][a-z0-9-]*$/;
+function readAgents(value) {
+  if (value === void 0) return null;
+  if (!Array.isArray(value) || !value.every((v) => typeof v === "string" && AGENT_NAME.test(v)) || new Set(value).size !== value.length)
+    fail(
+      `"agents" must be a list of unique agent names (got ${JSON.stringify(value)})`
+    );
+  return [...value];
+}
 function readRepos(value) {
   const raw = value ?? {};
   if (!isRecord(raw)) fail('"repos" must be an object');
@@ -944,6 +956,7 @@ async function loadManifest(rnessDir) {
   return {
     contract: 1,
     org: readOrg(data.org),
+    agents: readAgents(data.agents),
     repos: readRepos(data.repos),
     scopes: readScopes(data.scopes)
   };
@@ -959,6 +972,10 @@ async function writeManifest(rnessDir, manifest) {
   const lines = ["{", '  "contract": 1,'];
   if (manifest.org !== null)
     lines.push(`  "org": ${JSON.stringify(manifest.org)},`);
+  if (manifest.agents !== null)
+    lines.push(
+      `  "agents": [${manifest.agents.map((a) => JSON.stringify(a)).join(", ")}],`
+    );
   lines.push(
     '  "repos": {',
     repos.join(",\n"),
@@ -1045,13 +1062,13 @@ async function addRepository(input) {
     await clone(url, dir, input.credentialsFor?.(url) ?? null);
     action = "cloned";
   }
-  const declared = [name];
+  const declared2 = [name];
   for (const { path, base } of subs) {
     if (!await exists(join4(input.root, ...path.split("/")))) {
       if (action === "cloned") await rm3(dir, { recursive: true, force: true });
       throw new Error(`${path} does not exist`);
     }
-    declared.push(base);
+    declared2.push(base);
   }
   const manifest = {
     ...input.manifest,
@@ -1059,7 +1076,7 @@ async function addRepository(input) {
     scopes
   };
   await writeManifest(input.rnessDir, manifest);
-  return { manifest, name, url, action, declared };
+  return { manifest, name, url, action, declared: declared2 };
 }
 async function workspaceDirs(repoDir) {
   let patterns = [];
@@ -1231,7 +1248,7 @@ async function detectGithubSsh(opts) {
     ...opts.interactive ? [] : ["-o", "BatchMode=yes"],
     "git@github.com"
   ];
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const child = spawn2(opts.command ?? "ssh", args, {
       stdio: [opts.interactive ? "inherit" : "ignore", "ignore", "pipe"]
     });
@@ -1244,7 +1261,7 @@ async function detectGithubSsh(opts) {
       settled = true;
       clearTimeout(timer);
       child.stderr?.destroy();
-      resolve5(access2);
+      resolve6(access2);
     };
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
@@ -1252,7 +1269,7 @@ async function detectGithubSsh(opts) {
     }, timeoutMs);
     child.on("error", (e) => settle({ ok: false, reason: e.message }));
     child.on("exit", (code) => {
-      const finish = () => {
+      const finish2 = () => {
         const stderr2 = chunks.join("");
         const login = parseSshGreeting(stderr2);
         settle(
@@ -1264,11 +1281,11 @@ async function detectGithubSsh(opts) {
       };
       const stderr = child.stderr;
       if (stderr === null || stderr.readableEnded || stderr.destroyed)
-        return finish();
-      const flush = setTimeout(finish, STDERR_FLUSH_MS2);
+        return finish2();
+      const flush = setTimeout(finish2, STDERR_FLUSH_MS2);
       const done = () => {
         clearTimeout(flush);
-        finish();
+        finish2();
       };
       stderr.once("end", done);
       stderr.once("error", done);
@@ -1372,6 +1389,9 @@ function reportError(e) {
   return 1;
 }
 
+// src/version.ts
+var VERSION = "0.8.0";
+
 // src/core/block.ts
 import { createHash } from "crypto";
 var BEGIN = "<!-- BEGIN rness -->";
@@ -1664,7 +1684,214 @@ async function ensureClaudeMd(dir) {
 }
 
 // src/commands/sync.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
+
+// src/core/agent-targets.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import { dirname as dirname4, join as join9 } from "path";
+
+// src/core/agents.ts
+var TARGETS = {
+  claude: {
+    name: "claude",
+    label: "Claude Code",
+    file: ".claude/settings.json",
+    // Read the context repository from a repository without a prompt. The
+    // path is resolved against the project directory, and only once Claude
+    // Code has trusted it (verified on 2.1.284, spec 0011 §7).
+    guarantees: [
+      {
+        path: ["permissions", "additionalDirectories"],
+        contains: "../../.rness"
+      }
+    ]
+  }
+};
+var SUPPORTED_AGENTS = Object.keys(TARGETS);
+function unsupportedAgents(names) {
+  return names.filter((n) => !Object.hasOwn(TARGETS, n));
+}
+function unsupportedMessage(name) {
+  return `rness.json: agent "${name}" is not supported by @rness/cli ${VERSION} (supported: ${SUPPORTED_AGENTS.join(", ")})`;
+}
+
+// src/core/json-guarantees.ts
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function parse3(text) {
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    return { ok: false, reason: "not valid JSON" };
+  }
+  return isObject(data) ? { ok: true, data } : { ok: false, reason: "not a JSON object" };
+}
+function listAt(root, g, create) {
+  let node = root;
+  for (const [i, key] of g.path.slice(0, -1).entries()) {
+    const next = node[key];
+    if (next === void 0) {
+      if (!create) return { kind: "absent" };
+      node[key] = {};
+    } else if (!isObject(next))
+      return {
+        kind: "invalid",
+        reason: `${g.path.slice(0, i + 1).join(".")} is not an object`
+      };
+    node = node[key];
+  }
+  const last = g.path[g.path.length - 1] ?? "";
+  const value = node[last];
+  if (value === void 0) {
+    if (!create) return { kind: "absent" };
+    const list = [];
+    node[last] = list;
+    return { kind: "list", list };
+  }
+  if (!Array.isArray(value))
+    return { kind: "invalid", reason: `${g.path.join(".")} is not a list` };
+  return { kind: "list", list: value };
+}
+function styleOf(text) {
+  const indent = text.split(/\r?\n/).slice(1).map((l) => /^[ \t]+/.exec(l)?.[0]).find((w) => w !== void 0);
+  return {
+    indent: indent ?? "  ",
+    eol: text.includes("\r\n") ? "\r\n" : "\n",
+    final: text.endsWith("\n")
+  };
+}
+function ensureGuarantees(existing, guarantees) {
+  const parsed = existing === null ? { ok: true, data: {} } : parse3(existing);
+  if (!parsed.ok) return { kind: "invalid", reason: parsed.reason };
+  let changed = false;
+  for (const g of guarantees) {
+    const found = listAt(parsed.data, g, true);
+    if (found.kind === "invalid")
+      return { kind: "invalid", reason: found.reason };
+    if (found.kind === "list" && !found.list.includes(g.contains)) {
+      found.list.push(g.contains);
+      changed = true;
+    }
+  }
+  if (existing === null)
+    return {
+      kind: "created",
+      text: `${JSON.stringify(parsed.data, null, 2)}
+`
+    };
+  if (!changed) return { kind: "unchanged", text: existing };
+  const { indent, eol, final } = styleOf(existing);
+  const body = JSON.stringify(parsed.data, null, indent).split("\n").join(eol);
+  return { kind: "updated", text: final ? `${body}${eol}` : body };
+}
+function missingGuarantees(existing, guarantees) {
+  if (existing === null) return [...guarantees];
+  const parsed = parse3(existing);
+  if (!parsed.ok) return { invalid: parsed.reason };
+  const missing = [];
+  for (const g of guarantees) {
+    const found = listAt(parsed.data, g, false);
+    if (found.kind === "invalid") return { invalid: found.reason };
+    if (found.kind === "absent" || !found.list.includes(g.contains))
+      missing.push(g);
+  }
+  return missing;
+}
+function describeGuarantee(g) {
+  return `${g.path.join(".")} lacks ${g.contains}`;
+}
+
+// src/core/agent-targets.ts
+async function filesOf(root, manifest, targets) {
+  const files = [];
+  for (const repo of Object.keys(manifest.repos)) {
+    if (!await exists(join9(root, "org", repo))) continue;
+    for (const target of targets)
+      files.push({
+        target,
+        file: join9(root, "org", repo, ...target.file.split("/")),
+        label: `org/${repo}/${target.file}`
+      });
+  }
+  return files;
+}
+function declared(manifest) {
+  return (manifest.agents ?? []).flatMap(
+    (name) => Object.hasOwn(TARGETS, name) ? [TARGETS[name]] : []
+  );
+}
+async function agentTargets(root, manifest, opts) {
+  const outcomes = [];
+  for (const { target, file, label } of await filesOf(
+    root,
+    manifest,
+    declared(manifest)
+  )) {
+    const existing = await readOrNull(file);
+    if (opts.check) {
+      const missing = missingGuarantees(existing, target.guarantees);
+      if ("invalid" in missing)
+        outcomes.push({ label, status: "invalid", detail: missing.invalid });
+      else if (missing.length > 0)
+        outcomes.push({
+          label,
+          status: "stale",
+          detail: missing.map(describeGuarantee).join("; ")
+        });
+      else outcomes.push({ label, status: "unchanged", detail: null });
+      continue;
+    }
+    const ensured = ensureGuarantees(existing, target.guarantees);
+    if (ensured.kind === "invalid") {
+      outcomes.push({ label, status: "invalid", detail: ensured.reason });
+      continue;
+    }
+    if (ensured.kind === "unchanged") {
+      outcomes.push({ label, status: "unchanged", detail: null });
+      continue;
+    }
+    await mkdir2(dirname4(file), { recursive: true });
+    await writeFileAtomic(file, ensured.text);
+    outcomes.push({ label, status: "updated", detail: null });
+  }
+  return outcomes;
+}
+async function leftoverTargets(root, manifest) {
+  if (manifest.agents === null) return [];
+  const agents = manifest.agents;
+  const undeclared = Object.values(TARGETS).filter(
+    (t) => !agents.includes(t.name)
+  );
+  const leftovers = [];
+  for (const { target, file, label } of await filesOf(
+    root,
+    manifest,
+    undeclared
+  )) {
+    const existing = await readOrNull(file);
+    if (existing === null) continue;
+    const missing = missingGuarantees(existing, target.guarantees);
+    if (!("invalid" in missing) && missing.length === 0) leftovers.push(label);
+  }
+  return leftovers;
+}
+
+// src/core/ask-agents.ts
+var AGENTS_QUESTION = "Which agents does your team use?";
+async function askAgents(p) {
+  const answer = await p.multiselect({
+    message: AGENTS_QUESTION,
+    options: Object.values(TARGETS).map((t) => ({
+      value: t.name,
+      label: t.label
+    })),
+    required: false
+  });
+  if (p.isCancel(answer)) return null;
+  return Array.isArray(answer) ? answer : [];
+}
 
 // src/core/progress.ts
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -1803,12 +2030,12 @@ function sessionUi(p) {
     },
     async step(options, work, done) {
       const label = options.sentence ?? tidy(options.doing);
-      const finish = (result) => done?.(result) ?? null;
+      const finish2 = (result) => done?.(result) ?? null;
       const label_ = (line) => `${line[1]} ${line[0]}`;
       if (options.git === true && !this.gitIsSilent) {
         p.log.message(paint("idle", `${label}\u2026`));
         const result = await work();
-        const line = finish(result);
+        const line = finish2(result);
         if (line !== null) say(line[0], label_(line));
         return result;
       }
@@ -1816,7 +2043,7 @@ function sessionUi(p) {
       spin.start(label);
       try {
         const result = await work();
-        const line = finish(result);
+        const line = finish2(result);
         spin.stop(line === null ? label : label_(line));
         return result;
       } catch (e) {
@@ -1853,7 +2080,7 @@ function targetsOf(manifest, root, only) {
     const segments = entry.path.split("/");
     targets.push({
       scope: name,
-      dir: join9(root, ...segments),
+      dir: join10(root, ...segments),
       depth: segments.length,
       label: `${entry.path}/AGENTS.md`
     });
@@ -1917,16 +2144,60 @@ async function syncCommand(opts, deps = {}) {
   const check = opts.check === true;
   const ownUi = deps.ui === void 0;
   const ui = deps.ui ?? (opts.yes !== true && !check ? await makeUi(terminal) : { ...plainUi });
+  const agentFlags = opts.agent ?? [];
+  if (agentFlags.length > 0 && check) {
+    process.stderr.write(
+      "--agent cannot be combined with --check: it declares agents in rness.json\n"
+    );
+    return 2;
+  }
+  const unknown = unsupportedAgents(agentFlags)[0];
+  if (unknown !== void 0) {
+    process.stderr.write(
+      `unknown agent "${unknown}" (supported: ${SUPPORTED_AGENTS.join(", ")})
+`
+    );
+    return 2;
+  }
   try {
     const ws = await findWorkspace(cwd);
     const manifest = await loadManifest(ws.rnessDir);
     const org = workspaceName(manifest, ws.root);
+    const unsupported = unsupportedAgents(manifest.agents ?? [])[0];
+    if (unsupported !== void 0) {
+      process.stderr.write(`${unsupportedMessage(unsupported)}
+`);
+      return 1;
+    }
     if (ownUi) ui.intro(`Sync workspace ${org}`);
     if (opts.scope !== void 0 && !Object.hasOwn(manifest.scopes, opts.scope)) {
       process.stderr.write(`unknown scope: ${opts.scope}
 `);
       return 1;
     }
+    let declare = null;
+    if (agentFlags.length > 0) {
+      const current = manifest.agents ?? [];
+      const added = agentFlags.filter((a) => !current.includes(a));
+      if (added.length > 0) declare = [...current, ...new Set(added)];
+    } else if (manifest.agents === null && !check && opts.yes !== true && opts.scope === void 0 && terminal.isTty()) {
+      const answer = await askAgents(await terminal.prompts());
+      if (answer === null) {
+        ui.cancelled();
+        return 1;
+      }
+      declare = answer;
+    }
+    if (declare !== null) {
+      const before = manifest.agents ?? [];
+      manifest.agents = declare;
+      await writeManifest(ws.rnessDir, manifest);
+      for (const name of declare.filter((a) => !before.includes(a)))
+        ui.line("declared", `agent ${name} in .rness/rness.json`);
+      if (declare.length === 0)
+        ui.line("declared", "no agent in .rness/rness.json");
+      ui.hint("rness.json changed: commit it in .rness, for the whole team");
+    }
     const clones = await clonesIn(ws.root);
     const missing = Object.keys(manifest.repos).filter((n) => !clones.has(n));
     let toClone = new Set(opts.all === true && !check ? missing : []);
@@ -1968,7 +2239,7 @@ async function syncCommand(opts, deps = {}) {
     try {
       const notCloned = /* @__PURE__ */ new Set();
       for (const [name, repo] of Object.entries(manifest.repos)) {
-        const dir = join9(ws.root, "org", name);
+        const dir = join10(ws.root, "org", name);
         const label = `org/${name}`;
         if (!await exists(dir)) {
           if (!toClone.has(name)) {
@@ -1989,7 +2260,13 @@ async function syncCommand(opts, deps = {}) {
           }
         } else if (opts.pull === true && !check) {
           try {
-            if (!await isClean(dir, MANAGED_FILES)) {
+            const written = [
+              ...MANAGED_FILES,
+              ...(manifest.agents ?? []).flatMap(
+                (a) => Object.hasOwn(TARGETS, a) ? [TARGETS[a].file] : []
+              )
+            ];
+            if (!await isClean(dir, written)) {
               lines.push(["skipped", `${label} (working tree not clean)`]);
               continue;
             }
@@ -2020,7 +2297,7 @@ async function syncCommand(opts, deps = {}) {
         lines.push(
           `not in rness.json: ${undeclared.join(", ")} (${rnessCommand()} add <name> declares it)`
         );
-      if (!await exists(join9(ws.root, "org"))) {
+      if (!await exists(join10(ws.root, "org"))) {
         lines.push(["skipped", "blocks (no org/ directory here)"]);
       } else {
         let differences = 0;
@@ -2032,7 +2309,7 @@ async function syncCommand(opts, deps = {}) {
             continue;
           }
           const [agentsLinked, claudeLinked] = await Promise.all(
-            MANAGED_FILES.map((f) => isSymlink(join9(t.dir, f)))
+            MANAGED_FILES.map((f) => isSymlink(join10(t.dir, f)))
           );
           const atRoot = t.scope === null;
           if (!atRoot && (agentsLinked === true || claudeLinked === true)) {
@@ -2055,7 +2332,7 @@ async function syncCommand(opts, deps = {}) {
               `${t.label}: block is ${Math.round(block.bytes / 1024)} KB (over 32 KB)`
             );
           }
-          const agents = agentsLinked === true ? "skipped" : await syncBlockFile(join9(t.dir, "AGENTS.md"), block, check);
+          const agents = agentsLinked === true ? "skipped" : await syncBlockFile(join10(t.dir, "AGENTS.md"), block, check);
           if (typeof agents === "object") {
             problems.push(`${t.label}: ${agents.error}`);
             continue;
@@ -2070,7 +2347,7 @@ async function syncCommand(opts, deps = {}) {
           }
           if (claudeLinked === true) continue;
           const claude = await syncBlockFile(
-            join9(t.dir, "CLAUDE.md"),
+            join10(t.dir, "CLAUDE.md"),
             block,
             check,
             true
@@ -2086,6 +2363,28 @@ async function syncCommand(opts, deps = {}) {
           problems.push(
             `${differences} block(s) out of date \u2014 run ${rnessCommand()} sync`
           );
+        if (opts.scope === void 0) {
+          let stale = 0;
+          for (const o of await agentTargets(ws.root, manifest, { check })) {
+            if (o.status === "invalid")
+              problems.push(
+                `${o.label}: ${o.detail ?? "unreadable"}; fix it, then ${rnessCommand()} sync`
+              );
+            else if (o.status === "stale") {
+              stale += 1;
+              lines.push(["stale", `${o.label} (${o.detail ?? ""})`]);
+            } else lines.push([o.status, o.label]);
+          }
+          if (stale > 0)
+            problems.push(
+              `${stale} agent file(s) out of date \u2014 run ${rnessCommand()} sync`
+            );
+          if (!check)
+            for (const label of await leftoverTargets(ws.root, manifest))
+              lines.push(
+                `${label} still carries the values of an agent no longer in rness.json (left as is)`
+              );
+        }
       }
       return problems.length > 0 ? 1 : 0;
     } finally {
@@ -2105,7 +2404,7 @@ async function syncCommand(opts, deps = {}) {
 }
 
 // src/commands/add.ts
-import { basename as basename3, join as join10 } from "path";
+import { basename as basename3, join as join11 } from "path";
 function printDeclared(ui, result, already) {
   for (const name of result.declared) {
     if (already.has(name)) continue;
@@ -2198,7 +2497,7 @@ async function addCommand(spec, opts, deps = {}) {
     }
     parsed = parseRepoSpec(spec, org, host);
     const scopes = (opts.scopes ?? "").split(",").map((s) => s.trim()).filter((s) => s !== "");
-    const dir = join10(ws.root, "org", parsed.name);
+    const dir = join11(ws.root, "org", parsed.name);
     const present = await exists(dir);
     if (interactive) {
       const { confirm, isCancel } = await terminal.prompts();
@@ -2324,26 +2623,23 @@ async function contextCommand(opts) {
   }
 }
 
-// src/version.ts
-var VERSION = "0.6.2";
-
 // src/core/delegate.ts
 import { readFile as readFile6 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var DEFAULT_BIN = "dist/bin/rness.js";
 async function readPinnedCli(rnessDir) {
-  const dir = join11(rnessDir, "node_modules", "@rness", "cli");
+  const dir = join12(rnessDir, "node_modules", "@rness", "cli");
   let pkg;
   try {
-    pkg = JSON.parse(await readFile6(join11(dir, "package.json"), "utf8"));
+    pkg = JSON.parse(await readFile6(join12(dir, "package.json"), "utf8"));
   } catch {
     return null;
   }
-  const declared = pkg.bin;
+  const declared2 = pkg.bin;
   let bin = DEFAULT_BIN;
-  if (typeof declared === "string") bin = declared;
-  else if (declared !== null && typeof declared === "object") {
-    const named = declared["rness"];
+  if (typeof declared2 === "string") bin = declared2;
+  else if (declared2 !== null && typeof declared2 === "object") {
+    const named = declared2["rness"];
     if (typeof named === "string") bin = named;
   }
   return {
@@ -2355,7 +2651,7 @@ async function readPinnedCli(rnessDir) {
 async function pinnedBinPath(rnessDir) {
   const pinned = await readPinnedCli(rnessDir);
   if (pinned === null) return null;
-  return join11(pinned.dir, ...pinned.bin.split("/"));
+  return join12(pinned.dir, ...pinned.bin.split("/"));
 }
 async function findDelegate(cwd, ownVersion) {
   let root;
@@ -2371,12 +2667,12 @@ async function findDelegate(cwd, ownVersion) {
   if (pinned === null) return null;
   const { version } = pinned;
   if (version === null || version === ownVersion) return null;
-  return { entry: join11(pinned.dir, "dist", "index.js"), version, root };
+  return { entry: join12(pinned.dir, "dist", "index.js"), version, root };
 }
 
 // src/core/scaffold.ts
 import { statSync } from "fs";
-import { dirname as dirname4, join as join12 } from "path";
+import { dirname as dirname5, join as join13 } from "path";
 import { fileURLToPath } from "url";
 var SCAFFOLD_FILES = [
   "AGENTS.md",
@@ -2398,37 +2694,45 @@ var SCAFFOLD_FILES = [
   "docs/.gitkeep"
 ];
 function scaffoldDir() {
-  let dir = dirname4(fileURLToPath(import.meta.url));
+  let dir = dirname5(fileURLToPath(import.meta.url));
   for (let i = 0; i < 4; i += 1) {
-    const candidate = join12(dir, "scaffold");
+    const candidate = join13(dir, "scaffold");
     try {
-      if (statSync(join12(candidate, "rness.json")).isFile()) return candidate;
+      if (statSync(join13(candidate, "rness.json")).isFile()) return candidate;
     } catch {
     }
-    dir = dirname4(dir);
+    dir = dirname5(dir);
   }
   throw new Error("scaffold directory not found next to the @rness/cli package");
 }
 
 // src/core/scaffold-copy.ts
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile7, stat as stat2, writeFile as writeFile2 } from "fs/promises";
-import { dirname as dirname5, join as join13 } from "path";
+import { chmod as chmod2, mkdir as mkdir3, readFile as readFile7, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname6, join as join14 } from "path";
 var TOKENISED = /* @__PURE__ */ new Set(["package.json"]);
-async function copyScaffold(dest, tokens) {
-  const source = scaffoldDir();
+async function renderScaffold(source, tokens) {
+  const files = [];
   for (const rel of SCAFFOLD_FILES) {
     if (rel === "rness.json") continue;
-    const from = join13(source, ...rel.split("/"));
-    const targetRel = rel === "_gitignore" ? ".gitignore" : rel;
-    const to = join13(dest, ...targetRel.split("/"));
-    await mkdir2(dirname5(to), { recursive: true });
+    const from = join14(source, ...rel.split("/"));
     let content = await readFile7(from, "utf8");
     if (TOKENISED.has(rel)) {
       content = content.replaceAll("__RNESS_VERSION__", tokens.version).replaceAll("__RNESS_PM__", tokens.packageManager);
     }
-    await writeFile2(to, content, "utf8");
-    const mode = (await stat2(from)).mode & 511;
-    if (mode & 73) await chmod2(to, mode);
+    files.push({
+      path: rel === "_gitignore" ? ".gitignore" : rel,
+      content,
+      executable: ((await stat2(from)).mode & 73) !== 0
+    });
+  }
+  return files;
+}
+async function copyScaffold(dest, tokens) {
+  for (const file of await renderScaffold(scaffoldDir(), tokens)) {
+    const to = join14(dest, ...file.path.split("/"));
+    await mkdir3(dirname6(to), { recursive: true });
+    await writeFile2(to, file.content, "utf8");
+    if (file.executable) await chmod2(to, 493);
   }
 }
 
@@ -2582,18 +2886,18 @@ function revokeUrl() {
 }
 
 // src/commands/create.ts
-import { mkdir as mkdir5, mkdtemp, rename as rename2, rm as rm5 } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join17, relative as relative4, resolve as resolve4 } from "path";
+import { mkdir as mkdir6, mkdtemp as mkdtemp2, rename as rename2, rm as rm6 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join19, relative as relative4, resolve as resolve5 } from "path";
 
 // src/core/new-workspace.ts
-import { mkdir as mkdir3, readdir as readdir2, rm as rm4, stat as stat3 } from "fs/promises";
-import { dirname as dirname6, join as join15, relative as relative2 } from "path";
+import { mkdir as mkdir4, readdir as readdir2, rm as rm5, stat as stat3 } from "fs/promises";
+import { dirname as dirname8, join as join17, relative as relative2 } from "path";
 
 // src/core/pinned.ts
 import { execFile as execFile4 } from "child_process";
 import { readFile as readFile8 } from "fs/promises";
-import { basename as basename4, join as join14 } from "path";
+import { basename as basename4, join as join15 } from "path";
 import { promisify as promisify4 } from "util";
 var execFileP4 = promisify4(execFile4);
 var PACKAGE = "@rness/cli";
@@ -2618,7 +2922,7 @@ function compareVersions(a, b) {
 async function readPackageJson(rnessDir) {
   try {
     const parsed = JSON.parse(
-      await readFile8(join14(rnessDir, "package.json"), "utf8")
+      await readFile8(join15(rnessDir, "package.json"), "utf8")
     );
     return parsed !== null && typeof parsed === "object" ? parsed : null;
   } catch {
@@ -2637,7 +2941,7 @@ async function readPin(rnessDir) {
   return null;
 }
 async function writePin(rnessDir, from, to) {
-  const file = join14(rnessDir, "package.json");
+  const file = join15(rnessDir, "package.json");
   const text = await readFile8(file, "utf8");
   const entry = new RegExp(
     `("${PACKAGE}"\\s*:\\s*")${from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(")`
@@ -2654,18 +2958,18 @@ var LOCKFILES = [
   ["package-lock.json", "npm"]
 ];
 async function workspacePackageManager(rnessDir) {
-  const declared = (await readPackageJson(rnessDir))?.["packageManager"];
-  if (typeof declared === "string") {
-    const name = declared.split("@")[0] ?? "";
+  const declared2 = (await readPackageJson(rnessDir))?.["packageManager"];
+  if (typeof declared2 === "string") {
+    const name = declared2.split("@")[0] ?? "";
     if (isPackageManager(name)) return name;
   }
   for (const [lockfile, pm] of LOCKFILES)
-    if (await exists(join14(rnessDir, lockfile))) return pm;
+    if (await exists(join15(rnessDir, lockfile))) return pm;
   return "npm";
 }
 async function hasLockfile(rnessDir, pm) {
   for (const [lockfile, owner] of LOCKFILES)
-    if (owner === pm && await exists(join14(rnessDir, lockfile))) return true;
+    if (owner === pm && await exists(join15(rnessDir, lockfile))) return true;
   return false;
 }
 async function pinDrift(rnessDir) {
@@ -2721,9 +3025,9 @@ async function ensureInstalled(rnessDir, opts = {}) {
   }
 }
 async function runPinnedSync(root) {
-  const installed = await readPinnedCli(join14(root, ".rness"));
+  const installed = await readPinnedCli(join15(root, ".rness"));
   if (installed === null) return null;
-  const pinned = join14(installed.dir, ...installed.bin.split("/"));
+  const pinned = join15(installed.dir, ...installed.bin.split("/"));
   if (!await exists(pinned))
     return {
       code: 1,
@@ -2785,7 +3089,7 @@ function syncOutcome(result, opts = {}) {
   };
 }
 async function syncPinned(root, shown, fallback) {
-  const rnessDir = join14(root, ".rness");
+  const rnessDir = join15(root, ".rness");
   const installed = await readPinnedCli(rnessDir);
   if (installed === null) {
     if (fallback !== void 0) return fallback();
@@ -2795,7 +3099,7 @@ async function syncPinned(root, shown, fallback) {
     );
     return 1;
   }
-  const pinned = join14(installed.dir, ...installed.bin.split("/"));
+  const pinned = join15(installed.dir, ...installed.bin.split("/"));
   if (!await exists(pinned)) {
     process.stderr.write(
       `@rness/cli in ${shown}/.rness is not installed correctly (missing ${installed.bin}); reinstall in .rness/
@@ -2828,6 +3132,166 @@ async function syncPinned(root, shown, fallback) {
   }
 }
 
+// src/core/scaffold-git.ts
+import { execFile as execFile5 } from "child_process";
+import { mkdtemp, realpath as realpath2, rm as rm4, writeFile as writeFile3 } from "fs/promises";
+import { tmpdir } from "os";
+import { dirname as dirname7, join as join16, resolve as resolve3 } from "path";
+import { promisify as promisify5 } from "util";
+var execFileP5 = promisify5(execFile5);
+var CREATE_SUBJECT = "chore: rness workspace context";
+var SCAFFOLD_SUBJECT = /^chore: rness scaffold (\S+)$/;
+var SCAFFOLD_TRAILER = "Rness-Scaffold";
+async function run(dir, args, env = {}) {
+  try {
+    const { stdout, stderr } = await execFileP5("git", [...args], {
+      cwd: dir,
+      env: {
+        ...process.env,
+        ...env,
+        GIT_TERMINAL_PROMPT: "0",
+        GIT_CEILING_DIRECTORIES: dirname7(resolve3(dir))
+      },
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return { code: 0, stdout, stderr };
+  } catch (e) {
+    const err = e;
+    return {
+      code: typeof err.code === "number" ? err.code : 1,
+      stdout: err.stdout ?? "",
+      stderr: err.stderr ?? String(e)
+    };
+  }
+}
+async function must(dir, args, env = {}) {
+  const r = await run(dir, args, env);
+  if (r.code !== 0) {
+    const first = r.stderr.split("\n").find((l) => l.trim() !== "") ?? "unknown error";
+    throw new Error(`git ${args[0] ?? ""} failed: ${first.trim()}`);
+  }
+  return r.stdout.trim();
+}
+function scaffoldMessage(subject, version) {
+  return `${subject}
+
+${SCAFFOLD_TRAILER}: ${version}`;
+}
+async function findScaffoldBase(rnessDir) {
+  const log = await run(rnessDir, [
+    "log",
+    "--topo-order",
+    `--format=%H%x1f%P%x1f%s%x1f%(trailers:key=${SCAFFOLD_TRAILER},valueonly,separator=%x2C)%x1e`,
+    "HEAD"
+  ]);
+  if (log.code !== 0) return null;
+  const commits = log.stdout.split("").map((r) => r.trim()).filter((r) => r !== "").map((r) => {
+    const [hash = "", parents = "", subject = "", trailer = ""] = r.split("");
+    return { hash, parents: parents.trim(), subject, trailer: trailer.trim() };
+  });
+  for (const c of commits) {
+    const m = SCAFFOLD_SUBJECT.exec(c.subject);
+    if (m !== null) return { commit: c.hash, version: m[1] ?? null };
+  }
+  const root = commits.find(
+    (c) => c.parents === "" && c.subject === CREATE_SUBJECT
+  );
+  if (root === void 0) return null;
+  return {
+    commit: root.hash,
+    version: root.trailer === "" ? null : root.trailer
+  };
+}
+async function buildScaffoldCommit(rnessDir, base, files, version) {
+  const scratch = await mkdtemp(join16(tmpdir(), "rness-scaffold-"));
+  const env = { GIT_INDEX_FILE: join16(scratch, "index") };
+  try {
+    await must(
+      rnessDir,
+      ["read-tree", ...base === null ? ["--empty"] : [base]],
+      env
+    );
+    for (const [i, file] of files.entries()) {
+      const tmp = join16(scratch, `blob-${i}`);
+      await writeFile3(tmp, file.content, "utf8");
+      const blob = await must(rnessDir, [
+        "hash-object",
+        "-w",
+        "--no-filters",
+        "--",
+        tmp
+      ]);
+      await must(
+        rnessDir,
+        [
+          "update-index",
+          "--add",
+          "--cacheinfo",
+          `${file.executable ? "100755" : "100644"},${blob},${file.path}`
+        ],
+        env
+      );
+    }
+    const tree = await must(rnessDir, ["write-tree"], env);
+    return await must(rnessDir, [
+      "commit-tree",
+      tree,
+      ...base === null ? [] : ["-p", base],
+      "-m",
+      scaffoldMessage(`chore: rness scaffold ${version}`, version)
+    ]);
+  } finally {
+    await rm4(scratch, { recursive: true, force: true });
+  }
+}
+async function blobAt(rnessDir, rev, path) {
+  const r = await run(rnessDir, [
+    "rev-parse",
+    "--verify",
+    "--quiet",
+    `${rev}:${path}`
+  ]);
+  return r.code === 0 ? r.stdout.trim() : null;
+}
+async function mergeScaffold(rnessDir, commit, base) {
+  await run(rnessDir, [
+    "merge",
+    "--no-commit",
+    "--no-ff",
+    ...base === null ? ["--allow-unrelated-histories"] : [],
+    commit
+  ]);
+  const conflicts = (await must(rnessDir, ["diff", "--name-only", "--diff-filter=U"])).split("\n").filter((l) => l !== "");
+  const changes = [];
+  const status2 = await must(rnessDir, [
+    "diff",
+    "--cached",
+    "--name-status",
+    "HEAD"
+  ]);
+  for (const line of status2.split("\n")) {
+    const [letter = "", path = ""] = line.split("	");
+    if (path === "" || conflicts.includes(path)) continue;
+    if (letter === "A") changes.push(["added", path]);
+    else if (letter === "D") changes.push(["removed", path]);
+    else if (letter === "M") {
+      const untouched = base !== null && await blobAt(rnessDir, "HEAD", path) === await blobAt(rnessDir, base, path);
+      changes.push([untouched ? "updated" : "merged", path]);
+    }
+  }
+  return { conflicts, changes };
+}
+async function isShallow(rnessDir) {
+  const r = await run(rnessDir, ["rev-parse", "--is-shallow-repository"]);
+  return r.code === 0 && r.stdout.trim() === "true";
+}
+async function isRepository2(rnessDir) {
+  const r = await run(rnessDir, ["rev-parse", "--show-toplevel"]);
+  if (r.code !== 0) return false;
+  const real = (p) => realpath2(p).catch(() => resolve3(p));
+  return await real(r.stdout.trim()) === await real(rnessDir);
+}
+
 // src/core/new-workspace.ts
 async function isEmptyDir(dir) {
   return (await readdir2(dir)).length === 0;
@@ -2842,11 +3306,11 @@ async function insideWorkspace(dir) {
 }
 async function targetProblem(cwd, root, pm) {
   const shown = relative2(cwd, root) || ".";
-  if (await insideWorkspace(cwd) || await insideWorkspace(dirname6(root)))
+  if (await insideWorkspace(cwd) || await insideWorkspace(dirname8(root)))
     return "already inside an rness workspace; create runs from outside one";
   if (!await exists(root)) return null;
-  if (await exists(join15(root, ".rness", "rness.json"))) {
-    if (!await exists(join15(root, ".rness", "node_modules")))
+  if (await exists(join17(root, ".rness", "rness.json"))) {
+    if (!await exists(join17(root, ".rness", "node_modules")))
       return `${shown} holds an rness workspace whose dependencies are not installed; cd ${shown}/.rness && ${pm} install, then ${rnessCommand()} sync`;
     return `${shown} already holds an rness workspace (.rness/); run ${rnessCommand()} add inside it to add repositories`;
   }
@@ -2869,9 +3333,9 @@ async function installContext(input) {
 }
 async function buildContext(input) {
   const { ui, root, shown, pm } = input;
-  const rnessDir = join15(root, ".rness");
+  const rnessDir = join17(root, ".rness");
   const pmVersion = await packageManagerVersion(pm);
-  await mkdir3(root, { recursive: true });
+  await mkdir4(root, { recursive: true });
   try {
     await copyScaffold(rnessDir, {
       version: VERSION,
@@ -2883,9 +3347,9 @@ async function buildContext(input) {
     return true;
   } catch (e) {
     reportError(e);
-    await rm4(rnessDir, { recursive: true, force: true }).catch(() => void 0);
+    await rm5(rnessDir, { recursive: true, force: true }).catch(() => void 0);
     if (await isEmptyDir(root).catch(() => false))
-      await rm4(root, { recursive: true, force: true }).catch(() => void 0);
+      await rm5(root, { recursive: true, force: true }).catch(() => void 0);
     process.stderr.write(
       `removed ${shown}/.rness after the failure; fix it and retry
 `
@@ -2897,7 +3361,7 @@ async function commitContext(input) {
   const { ui, rnessDir, shown } = input;
   await init(rnessDir);
   try {
-    await commitAll(rnessDir, "chore: rness workspace context");
+    await commitAll(rnessDir, scaffoldMessage(CREATE_SUBJECT, VERSION));
     ui.line("committed", `${shown}/.rness`);
   } catch (e) {
     ui.warn(
@@ -2937,8 +3401,8 @@ async function syncBlocks(ui, root, shown, inPlace, sshWorks) {
 }
 
 // src/commands/create-blank.ts
-import { mkdir as mkdir4 } from "fs/promises";
-import { join as join16, relative as relative3, resolve as resolve3 } from "path";
+import { mkdir as mkdir5 } from "fs/promises";
+import { join as join18, relative as relative3, resolve as resolve4 } from "path";
 var WORKSPACE_NAME = /^(?!\.{1,2}$)[A-Za-z0-9._][A-Za-z0-9._-]*$/;
 function workspaceNameError(name) {
   return `workspace name "${name}" may only contain letters, digits, '.', '_' and '-', not starting with '-'`;
@@ -2970,7 +3434,7 @@ async function createBlank(input) {
     name = answer.trim();
     prompted = true;
   }
-  const root = resolve3(cwd, name);
+  const root = resolve4(cwd, name);
   const shown = relative3(cwd, root) || ".";
   const problem = await targetProblem(cwd, root, pm);
   if (problem !== null) {
@@ -2984,6 +3448,14 @@ async function createBlank(input) {
     );
     return 2;
   }
+  let agents = input.agents.length > 0 ? [...input.agents] : null;
+  if (agents === null && input.interactive) {
+    agents = await askAgents(await input.prompts());
+    if (agents === null) {
+      ui.cancelled();
+      return 0;
+    }
+  }
   if (input.interactive && !prompted) {
     const p = await input.prompts();
     const ok = await p.confirm({
@@ -2998,14 +3470,14 @@ async function createBlank(input) {
     ui,
     root,
     shown,
-    manifest: { contract: 1, org: null, repos: {}, scopes: {} },
+    manifest: { contract: 1, org: null, agents, repos: {}, scopes: {} },
     pm,
     skipInstall: input.skipInstall,
     kind: "blank workspace"
   });
   if (!built) return 1;
-  await mkdir4(join16(root, "org"), { recursive: true });
-  await commitContext({ ui, rnessDir: join16(root, ".rness"), shown });
+  await mkdir5(join18(root, "org"), { recursive: true });
+  await commitContext({ ui, rnessDir: join18(root, ".rness"), shown });
   const code = await syncBlocks(
     ui,
     root,
@@ -3165,7 +3637,7 @@ async function cloneSelection(input) {
           { doing: `cloning  org/${repo}`, git: true },
           () => clone(
             entry.url,
-            join17(input.root, "org", repo),
+            join19(input.root, "org", repo),
             input.provider.credentialsFor(entry.url)
           ),
           () => ["cloned", `org/${repo}`]
@@ -3296,6 +3768,15 @@ async function createCommand(opts, deps = {}) {
 `);
     return 2;
   }
+  const agentFlags = [...new Set(opts.agent ?? [])];
+  const unknownAgent = unsupportedAgents(agentFlags)[0];
+  if (unknownAgent !== void 0) {
+    process.stderr.write(
+      `unknown agent "${unknownAgent}" (supported: ${SUPPORTED_AGENTS.join(", ")})
+`
+    );
+    return 2;
+  }
   if (opts.ssh === true && opts.https === true) {
     process.stderr.write("--ssh and --https cannot be combined\n");
     return 2;
@@ -3369,6 +3850,7 @@ async function createCommand(opts, deps = {}) {
     if (blank)
       return await createBlank({
         name: opts.name,
+        agents: agentFlags,
         cwd,
         pm,
         interactive,
@@ -3424,7 +3906,7 @@ async function createCommand(opts, deps = {}) {
       org = answer.trim();
       prompted = true;
     }
-    const root = resolve4(cwd, org);
+    const root = resolve5(cwd, org);
     const shown = relative4(cwd, root) || ".";
     const problem = await targetProblem(cwd, root, pm);
     if (problem !== null) {
@@ -3452,6 +3934,13 @@ async function createCommand(opts, deps = {}) {
       return 1;
     }
     const joining = probe.kind === "found";
+    if (joining && agentFlags.length > 0) {
+      process.stderr.write(
+        `${org}/.rness exists: --agent only applies to a new workspace; after joining, run ${rnessCommand()} sync${agentFlags.map((a) => ` --agent ${a}`).join("")}
+`
+      );
+      return 2;
+    }
     if (joining)
       ui.line(
         "found",
@@ -3464,10 +3953,16 @@ async function createCommand(opts, deps = {}) {
         `${org}/.rness (or not visible to you) \u2014 starting a new workspace`,
         `${org} has no workspace yet (or none you can see) \u2014 starting one`
       );
-    let catalogue = { contract: 1, org, repos: {}, scopes: {} };
+    let catalogue = {
+      contract: 1,
+      org,
+      agents: null,
+      repos: {},
+      scopes: {}
+    };
     const staged = async () => {
-      staging ??= await mkdtemp(join17(tmpdir(), "rness-join-"));
-      return join17(staging, ".rness");
+      staging ??= await mkdtemp2(join19(tmpdir2(), "rness-join-"));
+      return join19(staging, ".rness");
     };
     if (joining) {
       const stagedDir = await staged();
@@ -3510,6 +4005,14 @@ async function createCommand(opts, deps = {}) {
     } else {
       specs = Object.keys(catalogue.repos);
     }
+    if (!joining) {
+      if (agentFlags.length > 0) catalogue.agents = agentFlags;
+      else if (interactive) {
+        const answer = await askAgents(await prompts());
+        if (answer === null) return cancelled(ui);
+        catalogue.agents = answer;
+      }
+    }
     if (interactive && !prompted) {
       const p = await prompts();
       const ok = await p.confirm({
@@ -3517,10 +4020,10 @@ async function createCommand(opts, deps = {}) {
       });
       if (p.isCancel(ok) || ok !== true) return cancelled(ui);
     }
-    const rnessDir = join17(root, ".rness");
+    const rnessDir = join19(root, ".rness");
     const install = () => installContext({ ui, pm, rnessDir, skip: opts.skipInstall === true });
     if (joining) {
-      await mkdir5(root, { recursive: true });
+      await mkdir6(root, { recursive: true });
       await placeContext(
         await staged(),
         rnessDir,
@@ -3530,7 +4033,7 @@ async function createCommand(opts, deps = {}) {
       ui.line("cloned", `${shown}/.rness (joined ${org})`);
       if (opts.pm === void 0) pm = await workspacePackageManager(rnessDir);
       await install();
-      await mkdir5(join17(root, "org"), { recursive: true });
+      await mkdir6(join19(root, "org"), { recursive: true });
       const failures2 = await cloneSelection({
         root,
         rnessDir,
@@ -3583,7 +4086,7 @@ ${next2.map((l) => `  ${l}`).join("\n")}
       kind: "new workspace"
     });
     if (!built) return 1;
-    await mkdir5(join17(root, "org"), { recursive: true });
+    await mkdir6(join19(root, "org"), { recursive: true });
     const failures = await cloneSelection({
       root,
       rnessDir,
@@ -3650,7 +4153,7 @@ ${next2.map((l) => `  ${l}`).join("\n")}
     return reportError(e);
   } finally {
     if (staging !== void 0)
-      await rm5(staging, { recursive: true, force: true }).catch(() => void 0);
+      await rm6(staging, { recursive: true, force: true }).catch(() => void 0);
   }
 }
 
@@ -3683,17 +4186,16 @@ async function logoutCommand() {
 }
 
 // src/commands/upgrade.ts
-import { execFile as execFile5 } from "child_process";
-import { mkdir as mkdir6, readFile as readFile9, readdir as readdir3 } from "fs/promises";
-import { basename as basename5, dirname as dirname7, join as join18, relative as relative5 } from "path";
-import { promisify as promisify5 } from "util";
-var execFileP5 = promisify5(execFile5);
+import { execFile as execFile6 } from "child_process";
+import { mkdtemp as mkdtemp3, readFile as readFile9, rm as rm7 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { basename as basename5, join as join20, relative as relative5 } from "path";
+import { promisify as promisify6 } from "util";
+var execFileP6 = promisify6(execFile6);
 var NOTES = "https://github.com/rness-dev/rness/tree/main/packages/cli#readme";
-var OLD_WORKFLOW_RUN = /npx --yes @rness\/cli@(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?) validate/;
-var WORKFLOW_RUN = `npx --yes "@rness/cli@$(node -p "require('./package.json').devDependencies['@rness/cli']")" validate`;
 async function latestVersion() {
   try {
-    const { stdout } = await execFileP5(
+    const { stdout } = await execFileP6(
       "npm",
       ["view", "@rness/cli@latest", "version"],
       { timeout: 3e4 }
@@ -3704,7 +4206,70 @@ async function latestVersion() {
     return null;
   }
 }
-async function upgradeCommand(version, opts, terminal = defaultTerminal) {
+async function scaffoldFor(version, rnessDir) {
+  if (version === VERSION) return { dir: scaffoldDir() };
+  const installed = await readPinnedCli(rnessDir);
+  const inside = installed === null ? null : join20(installed.dir, "scaffold");
+  if (installed?.version === version && inside !== null && await exists(join20(inside, "package.json")))
+    return { dir: inside };
+  const scratch = await mkdtemp3(join20(tmpdir3(), "rness-pack-"));
+  const cleanup = () => rm7(scratch, { recursive: true, force: true });
+  try {
+    const { stdout } = await execFileP6(
+      "npm",
+      [
+        "pack",
+        `@rness/cli@${version}`,
+        "--pack-destination",
+        scratch,
+        "--silent"
+      ],
+      { timeout: 6e4 }
+    );
+    const tarball = stdout.trim().split("\n").at(-1) ?? "";
+    await execFileP6("tar", ["-xzf", join20(scratch, tarball), "-C", scratch]);
+    return { dir: join20(scratch, "package", "scaffold"), cleanup };
+  } catch (e) {
+    await cleanup();
+    throw new Error(
+      `cannot get the @rness/cli ${version} scaffold (npm pack): ${e instanceof Error ? e.message.split("\n")[0] : String(e)}`,
+      { cause: e }
+    );
+  }
+}
+async function declaredManager(rnessDir, pm) {
+  try {
+    const pkg = JSON.parse(
+      await readFile9(join20(rnessDir, "package.json"), "utf8")
+    );
+    if (typeof pkg.packageManager === "string") return pkg.packageManager;
+  } catch {
+  }
+  return `${pm}@${await packageManagerVersion(pm)}`;
+}
+function finish(ui, cwd, rnessDir, label, target) {
+  const rel = relative5(cwd, rnessDir) || ".";
+  const next = [
+    `git -C ${rel} add -A && git -C ${rel} commit -m "chore: rness ${target}"`,
+    "# teammates: git pull \u2014 the next rness command installs it"
+  ];
+  if (ui.session) {
+    ui.note("Next steps", next);
+    ui.outro(`${label} runs @rness/cli ${target}`);
+  } else
+    process.stdout.write(
+      [
+        "",
+        status("upgraded", `${label} to @rness/cli ${target}`),
+        "",
+        "Next:",
+        ...next.map((line) => `  ${line}`),
+        ""
+      ].join("\n")
+    );
+  return 0;
+}
+async function upgradeCommand(version, opts, terminal = defaultTerminal, deps = {}) {
   const cwd = opts.cwd ?? process.cwd();
   if (version !== void 0 && !EXACT_VERSION.test(version)) {
     process.stderr.write(
@@ -3746,7 +4311,21 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
       return 1;
     }
     const installed = (await readPinnedCli(ws.rnessDir))?.version ?? null;
-    if (pin.spec === target && installed === target) {
+    if (!await isRepository2(ws.rnessDir)) {
+      process.stderr.write(`${label} is not a git repository
+`);
+      return 1;
+    }
+    if (!await isClean(ws.rnessDir)) {
+      process.stderr.write(
+        `${label} has uncommitted changes; commit or stash them, then ${rnessCommand()} upgrade
+`
+      );
+      return 1;
+    }
+    const base = await findScaffoldBase(ws.rnessDir);
+    const scaffoldCurrent = base !== null && base.version === target;
+    if (pin.spec === target && installed === target && scaffoldCurrent) {
       if (ui.session) ui.outro(`Already at ${target}`);
       else process.stdout.write(`already at ${target}
 `);
@@ -3761,7 +4340,9 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
       return 1;
     }
     const pm = await workspacePackageManager(ws.rnessDir);
-    if (pin.spec === target)
+    if (pin.spec === target && installed === target)
+      ui.line("scaffold", `@rness/cli ${target} \u2014 merging it into ${label}`);
+    else if (pin.spec === target)
       ui.line(
         "install",
         `@rness/cli ${target} in ${label} (${pm}) \u2014 ${installed ?? "nothing"} is installed`
@@ -3783,46 +4364,58 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
         return 1;
       }
     }
-    const packageFile = join18(ws.rnessDir, "package.json");
-    const restore = /* @__PURE__ */ new Map([
-      [packageFile, await readFile9(packageFile, "utf8")]
-    ]);
-    if (pin.spec !== target) await writePin(ws.rnessDir, pin.spec, target);
-    const workflows = join18(ws.rnessDir, ".github", "workflows");
-    for (const name of await readdir3(workflows).catch(() => [])) {
-      if (!/\.ya?ml$/.test(name)) continue;
-      const file = join18(workflows, name);
-      const text = await readOrNull(file);
-      if (text === null) continue;
-      const shown = `.github/workflows/${name}`;
-      if (name === "validate.yml" && OLD_WORKFLOW_RUN.test(text)) {
-        restore.set(file, text);
-        await writeFileAtomic(
-          file,
-          text.replace(OLD_WORKFLOW_RUN, () => WORKFLOW_RUN)
+    let merged = false;
+    if (!scaffoldCurrent) {
+      const source = await (deps.scaffoldFor ?? scaffoldFor)(
+        target,
+        ws.rnessDir
+      );
+      try {
+        const files = await renderScaffold(source.dir, {
+          version: target,
+          packageManager: await declaredManager(ws.rnessDir, pm)
+        });
+        if (base === null)
+          ui.line(
+            "adopting",
+            `the @rness/cli ${target} scaffold (no scaffold commit in ${label} yet)`
+          );
+        else ui.line("merging", `the @rness/cli ${target} scaffold`);
+        const commit = await buildScaffoldCommit(
+          ws.rnessDir,
+          base?.commit ?? null,
+          files,
+          target
         );
-        ui.line(
-          "updated",
-          `${shown} (it now reads the version from package.json)`
+        const result = await mergeScaffold(
+          ws.rnessDir,
+          commit,
+          base?.commit ?? null
         );
-      } else if (pin.spec !== target && text.includes(`@rness/cli@${pin.spec}`)) {
-        ui.warn(`${shown} names @rness/cli@${pin.spec}; update it by hand`);
+        for (const [change, path] of result.changes) ui.line(change, path);
+        if (result.conflicts.length > 0) {
+          for (const path of result.conflicts) ui.error(`conflict ${path}`);
+          const rel = relative5(cwd, ws.rnessDir) || ".";
+          ui.hint(
+            `resolve them in ${rel} (git checkout --ours <file> keeps yours, --theirs takes the scaffold's, or edit), git add, git commit, then ${rnessCommand()} upgrade again`,
+            "stderr"
+          );
+          return 1;
+        }
+        merged = true;
+      } finally {
+        await source.cleanup?.();
       }
     }
-    const dependabot = join18(ws.rnessDir, ".github", "dependabot.yml");
-    if (await exists(dependabot)) {
-      ui.hint(".github/dependabot.yml is already there \u2014 left as it is");
-    } else {
-      await mkdir6(dirname7(dependabot), { recursive: true });
-      await writeFileAtomic(
-        dependabot,
-        await readFile9(join18(scaffoldDir(), ".github", "dependabot.yml"), "utf8")
-      );
-      ui.line(
-        "wrote",
-        ".rness/.github/dependabot.yml (@rness/cli now moves by pull request)"
-      );
-    }
+    const packageFile = join20(ws.rnessDir, "package.json");
+    const restore = /* @__PURE__ */ new Map([
+      [packageFile, await readFile9(packageFile, "utf8")]
+    ]);
+    const moved = await readPin(ws.rnessDir);
+    if (moved !== null && moved.spec !== target)
+      await writePin(ws.rnessDir, moved.spec, target);
+    if (pin.spec === target && installed === target)
+      return finish(ui, cwd, ws.rnessDir, label, target);
     try {
       await ui.step(
         { doing: `installing dependencies with ${pm}` },
@@ -3830,10 +4423,20 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
         () => ["installed", `dependencies with ${pm}`]
       );
     } catch (e) {
-      for (const [file, text] of restore) await writeFileAtomic(file, text);
       const message = e instanceof Error ? e.message : String(e);
       ui.error(message);
-      ui.hint(`restored ${relative5(cwd, packageFile) || packageFile}`, "stderr");
+      if (!merged) {
+        for (const [file, text] of restore) await writeFileAtomic(file, text);
+        ui.hint(
+          `restored ${relative5(cwd, packageFile) || packageFile}`,
+          "stderr"
+        );
+      }
+      if (merged)
+        ui.hint(
+          `the scaffold merge is still staged; undo it with: git -C ${relative5(cwd, ws.rnessDir) || "."} merge --abort`,
+          "stderr"
+        );
       if (/minimum.?release.?age|NO_MATURE/i.test(message))
         ui.hint(
           "pnpm refuses versions published less than 24 h ago: add '@rness/cli' under minimumReleaseAgeExclude in .rness/pnpm-workspace.yaml",
@@ -3852,33 +4455,14 @@ async function upgradeCommand(version, opts, terminal = defaultTerminal) {
     ui.gitIsSilent = true;
     const code = await syncBlocks(ui, ws.root, basename5(ws.root));
     if (code !== 0) return code;
-    const rel = relative5(cwd, ws.rnessDir) || ".";
-    const next = [
-      `git -C ${rel} add -A && git -C ${rel} commit -m "chore: rness ${target}"`,
-      "# teammates: git pull \u2014 the next rness command installs it"
-    ];
-    if (ui.session) {
-      ui.note("Next steps", next);
-      ui.outro(`${label} runs @rness/cli ${target}`);
-    } else
-      process.stdout.write(
-        [
-          "",
-          status("upgraded", `${label} to @rness/cli ${target}`),
-          "",
-          "Next:",
-          ...next.map((line) => `  ${line}`),
-          ""
-        ].join("\n")
-      );
-    return 0;
+    return finish(ui, cwd, ws.rnessDir, label, target);
   } catch (e) {
     return reportError(e);
   }
 }
 
 // src/core/blocks.ts
-import { join as join19 } from "path";
+import { join as join21 } from "path";
 var PROBLEM = /* @__PURE__ */ new Set(["stale", "malformed"]);
 async function checkBlocks({
   root,
@@ -3895,7 +4479,7 @@ async function checkBlocks({
     warnings: checks.filter((c) => !PROBLEM.has(c.status) && c.message !== null).map((c) => c.message),
     checks
   });
-  if (!await exists(join19(root, "org"))) return derive();
+  if (!await exists(join21(root, "org"))) return derive();
   const targets = [
     { scope: null, dir: root, depth: 0, file: "AGENTS.md", label: "AGENTS.md" },
     { scope: null, dir: root, depth: 0, file: "CLAUDE.md", label: "CLAUDE.md" }
@@ -3904,7 +4488,7 @@ async function checkBlocks({
     const segments = entry.path.split("/");
     targets.push({
       scope: name,
-      dir: join19(root, ...segments),
+      dir: join21(root, ...segments),
       depth: segments.length,
       file: "AGENTS.md",
       label: `${entry.path}/AGENTS.md`
@@ -3919,7 +4503,7 @@ async function checkBlocks({
       );
       continue;
     }
-    const text = await readOrNull(join19(t.dir, t.file));
+    const text = await readOrNull(join21(t.dir, t.file));
     const lines = text === null ? [] : text.split(/\r?\n/);
     const found = findBlock(lines);
     if (found.kind === "none") {
@@ -3959,7 +4543,7 @@ async function checkBlocks({
 }
 
 // src/core/contract.ts
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 var STATUSES = {
   adr: ["Proposed", "Accepted", "Rejected", "Superseded"],
   specs: [
@@ -3978,7 +4562,7 @@ async function checkContract(rnessDir) {
   const problems = [];
   for (const name of COLLECTIONS) {
     const allowed = STATUSES[name];
-    const items = await collectMarkdown(join20(rnessDir, name));
+    const items = await collectMarkdown(join22(rnessDir, name));
     for (const item of items) {
       const where = `${name}/${item.rel}`;
       if (SKIP.has(where)) continue;
@@ -4030,11 +4614,35 @@ async function validateCommand(opts, deps = {}) {
       org
     });
     problems.push(...blocks.problems);
+    for (const name of unsupportedAgents(manifest.agents ?? []))
+      problems.push(unsupportedMessage(name));
+    const targets = await agentTargets(ws.root, manifest, { check: true });
+    for (const o of targets)
+      if (o.status === "stale")
+        problems.push(
+          `${o.label}: ${o.detail ?? ""} (run ${rnessCommand()} sync)`
+        );
+      else if (o.status === "invalid")
+        problems.push(`${o.label}: ${o.detail ?? "unreadable"}`);
+    const scaffoldWarnings = [];
+    if (await isRepository2(ws.rnessDir) && !await isShallow(ws.rnessDir)) {
+      const pin = await readPin(ws.rnessDir);
+      const base = await findScaffoldBase(ws.rnessDir);
+      if (base === null || base.version === null)
+        scaffoldWarnings.push(
+          `the scaffold is not tracked in .rness yet: run ${rnessCommand()} upgrade`
+        );
+      else if (pin !== null && EXACT_VERSION.test(pin.spec) && pin.spec !== base.version)
+        scaffoldWarnings.push(
+          `the @rness/cli ${pin.spec} scaffold is not merged here: run ${rnessCommand()} upgrade`
+        );
+    }
     const ui = await makeUi(deps.terminal ?? defaultTerminal);
     if (!ui.session) {
       for (const p of problems) process.stderr.write(`${p}
 `);
-      for (const w of blocks.warnings) process.stderr.write(`${warn(w)}
+      for (const w of [...blocks.warnings, ...scaffoldWarnings])
+        process.stderr.write(`${warn(w)}
 `);
       if (problems.length > 0) return 1;
       process.stdout.write("context ok\n");
@@ -4052,7 +4660,10 @@ async function validateCommand(opts, deps = {}) {
       else if (c.status === "stale" || c.status === "malformed")
         ui.error(c.message);
       else ui.warn(c.message);
+    for (const o of targets)
+      if (o.status === "unchanged") ui.line("current", o.label);
     for (const p of problems) if (!blocks.problems.includes(p)) ui.error(p);
+    for (const w of scaffoldWarnings) ui.warn(w);
     ui.outro(
       problems.length > 0 ? "Context mismatch" : "Context OK",
       problems.length > 0 ? "error" : "done"
@@ -4126,7 +4737,11 @@ function buildProgram(state) {
   ).option("--scope <name>", "only this scope (the root block is skipped)").option(
     "--check",
     "render and compare only; exit 1 when a block is out of date"
-  ).option("--pull", "git pull --ff-only in every clean clone").option("--all", "clone every rness.json repository missing from org/").option("-y, --yes", "do not ask for confirmation").addOption(new Option("--cwd <dir>").hideHelp()).action(async (opts) => {
+  ).option("--pull", "git pull --ff-only in every clean clone").option("--all", "clone every rness.json repository missing from org/").option(
+    "--agent <name>",
+    "declare an agent in rness.json, then write its files (repeatable; supported: claude)",
+    (value, previous = []) => [...previous, value]
+  ).option("-y, --yes", "do not ask for confirmation").addOption(new Option("--cwd <dir>").hideHelp()).action(async (opts) => {
     state.code = await syncCommand(opts);
   });
   program.command("add").description(
@@ -4174,6 +4789,10 @@ function buildProgram(state) {
   ).option("--https", "force https://github.com/").option(
     "--blank",
     "a local workspace with no GitHub organization: .rness/, an empty org/, the root files"
+  ).option(
+    "--agent <name>",
+    "a new workspace's agent, declared in rness.json (repeatable; supported: claude)",
+    (value, previous = []) => [...previous, value]
   ).option("--skip-install", "do not install .rness/ dependencies").option("-y, --yes", "do not ask for confirmation").option("--template <name>", "reserved").addOption(new Option("--host <base>").hideHelp()).addOption(new Option("--github-api <base>").hideHelp()).addOption(new Option("--cwd <dir>").hideHelp()).action(async (orgArg, opts) => {
     if (opts.blank === true) {
       state.code = await createCommand(
@@ -4196,7 +4815,7 @@ function buildProgram(state) {
   });
   return program;
 }
-async function run(argv) {
+async function run2(argv) {
   const state = { code: 0 };
   const program = buildProgram(state);
   if (argv.length === 0) {
@@ -4289,6 +4908,7 @@ export {
   defaultTransport,
   findWorkspace,
   reportError,
+  VERSION,
   BEGIN,
   END,
   BLOCK_SIZE_WARNING,
@@ -4310,7 +4930,6 @@ export {
   addCommand,
   renderMarkdown,
   contextCommand,
-  VERSION,
   findDelegate,
   SCAFFOLD_FILES,
   scaffoldDir,
@@ -4323,8 +4942,8 @@ export {
   STATUSES,
   checkContract,
   validateCommand,
-  run,
+  run2 as run,
   OWN_COMMANDS,
   catchUp
 };
-//# sourceMappingURL=chunk-7TOHFPW6.js.map
+//# sourceMappingURL=chunk-VQMX52HT.js.map