@sailorbridge/client 0.1.1 → 0.2.0

package/dist/src/cli.js

@@ -2,10 +2,10 @@
 import { createRequire } from "node:module";
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// .dist-releases/1784772051951-3107696/src/cli.js
+// .dist-releases/1784809313131-4113078/src/cli.js
 import { hostname as hostname3 } from "node:os";
 import { writeSync } from "node:fs";
-// .dist-releases/1784772051951-3107696/src/auth/host-pairing.js
+// .dist-releases/1784809313131-4113078/src/auth/host-pairing.js
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir, hostname, platform } from "node:os";
 import path from "node:path";
@@ -220,37 +220,82 @@ function _assertObject(value) {
     throw new Error("host pairing response must be an object");
   return value;
 }
-// .dist-releases/1784772051951-3107696/src/host/repo-tip-reporter.js
+// .dist-releases/1784809313131-4113078/src/host/repo-tip-reporter.js
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
 import path2 from "node:path";
 import { spawn } from "node:child_process";
 var COMMAND_TIMEOUT_MS = 120000;
+var REPO_BACKOFF_INITIAL_MS = 60000;
+var REPO_BACKOFF_MAX_MS = 60 * 60000;
 var SHA_RE = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 function defaultRepoMirrorRoot() {
   return path2.join(homedir2(), ".sailorbridge", "repo-mirrors");
 }
-async function reportRepoTipsOnce(options, deps = {}) {
-  const logger = options.logger ?? (() => {});
+function createRepoTipReporter(deps = {}) {
+  const backoffs = new Map;
+  return async (options) => _reportRepoTipsOnce(options, deps, backoffs);
+}
+async function _reportRepoTipsOnce(options, deps, backoffs) {
   const wanted = await options.relay.getTaskRepoTipWanted(options.captainId);
   const mirrorRoot = options.mirrorRoot ?? defaultRepoMirrorRoot();
   let reported = 0;
   for (const entry of wanted.wanted) {
-    try {
-      const report = await observeRepoTips(entry, mirrorRoot, deps);
-      await options.relay.putTaskRepoTips(options.captainId, entry.session, report);
+    if (await _reportRepoTip(entry, mirrorRoot, options, deps, backoffs))
       reported += 1;
-    } catch (error) {
-      logger("host_repo_tip_report_failed", {
-        session: entry.session,
-        repo: entry.repo_path,
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
   }
+  _forgetUnwantedBackoffs(backoffs, wanted.wanted);
   return { observed: wanted.wanted.length, reported };
 }
+async function _reportRepoTip(entry, mirrorRoot, options, deps, backoffs) {
+  const backoff = backoffs.get(entry.repo_path);
+  if (backoff && _now(deps) < backoff.retryAt)
+    return false;
+  try {
+    const report = await observeRepoTips(entry, mirrorRoot, deps);
+    await options.relay.putTaskRepoTips(options.captainId, entry.session, report);
+  } catch (error) {
+    _backOffRepo(entry, error, options.logger, deps, backoffs);
+    return false;
+  }
+  if (backoff)
+    _recoverRepo(entry, backoff, options.logger, backoffs);
+  return true;
+}
+function _backOffRepo(entry, error, logger, deps, backoffs) {
+  const previous = backoffs.get(entry.repo_path);
+  const retryMs = previous ? Math.min(previous.retryMs * 2, REPO_BACKOFF_MAX_MS) : REPO_BACKOFF_INITIAL_MS;
+  const failures = (previous?.failures ?? 0) + 1;
+  backoffs.set(entry.repo_path, { failures, retryAt: _now(deps) + retryMs, retryMs });
+  if (previous)
+    return;
+  logger?.("host_repo_tip_backoff_started", {
+    session: entry.session,
+    repo: entry.repo_path,
+    error: error instanceof Error ? error.message : String(error),
+    failures,
+    retry_ms: retryMs
+  });
+}
+function _recoverRepo(entry, backoff, logger, backoffs) {
+  backoffs.delete(entry.repo_path);
+  logger?.("host_repo_tip_backoff_recovered", {
+    session: entry.session,
+    repo: entry.repo_path,
+    failures: backoff.failures
+  });
+}
+function _forgetUnwantedBackoffs(backoffs, wanted) {
+  const activeRepos = new Set(wanted.map((entry) => entry.repo_path));
+  for (const repo of backoffs.keys()) {
+    if (!activeRepos.has(repo))
+      backoffs.delete(repo);
+  }
+}
+function _now(deps) {
+  return deps.now?.() ?? Date.now();
+}
 async function observeRepoTips(entry, mirrorRoot, deps) {
   const exec = deps.execCommand ?? execArgv;
   const mirror = mirrorPathFor(mirrorRoot, entry.repo_path);
@@ -357,10 +402,10 @@ ${error.message}`));
     proc.on("close", (code) => finish(code ?? 1));
   });
 }
-// .dist-releases/1784772051951-3107696/src/host/request-consumer.js
+// .dist-releases/1784809313131-4113078/src/host/request-consumer.js
 import { hostname as hostname2 } from "node:os";
 
-// .dist-releases/1784772051951-3107696/src/driver/secrets.js
+// .dist-releases/1784809313131-4113078/src/driver/secrets.js
 function redactSensitiveText(text, env = {}, explicitSecrets = []) {
   let redacted = text;
   for (const [key, value] of Object.entries(env)) {
@@ -379,16 +424,16 @@ function isSensitiveEnvKey(key) {
   return /(TOKEN|KEY|SECRET|AUTHORIZATION|PASSWORD)/i.test(key);
 }
 
-// .dist-releases/1784772051951-3107696/src/version.js
-var CLIENT_VERSION = "0.1.1";
-var CLIENT_GIT_SHA = "ba1bf5ddf9ff";
-var CLIENT_BUILD_DIRTY = false;
+// .dist-releases/1784809313131-4113078/src/version.js
+var CLIENT_VERSION = "0.2.0";
+var CLIENT_GIT_SHA = "d1e5ed371492-dirty";
+var CLIENT_BUILD_DIRTY = true;
 var CLIENT_VERSION_LABEL = formatClientVersion(CLIENT_VERSION, CLIENT_GIT_SHA);
 function formatClientVersion(version, gitSha) {
   return `${version}+git.${gitSha}`;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/request-consumer.js
+// .dist-releases/1784809313131-4113078/src/host/request-consumer.js
 var MAX_ERROR_LENGTH = 500;
 function defaultHostIdentity(config) {
   const captainId = config.captainId?.trim();
@@ -443,7 +488,7 @@ function limitErrorMessage(error, explicitSecrets) {
   const trimmed = redactSensitiveText(message, process.env, explicitSecrets).trim() || "host request starter failed";
   return trimmed.length <= MAX_ERROR_LENGTH ? trimmed : `${trimmed.slice(0, MAX_ERROR_LENGTH - 3)}...`;
 }
-// .dist-releases/1784772051951-3107696/src/product/start-request.js
+// .dist-releases/1784809313131-4113078/src/product/start-request.js
 async function createAgentStartRequest(options) {
   const apiUrl = _required(options.apiUrl, "product API URL").replace(/\/+$/u, "");
   const accessToken = _required(options.accessToken, "product API bearer token");
@@ -503,7 +548,7 @@ function _string(value, label) {
     throw new Error(`${label} must be a non-empty string`);
   return value;
 }
-// .dist-releases/1784772051951-3107696/src/product/pair.js
+// .dist-releases/1784809313131-4113078/src/product/pair.js
 async function createPair(options) {
   const apiUrl = _required2(options.apiUrl, "product API URL").replace(/\/+$/u, "");
   const accessToken = _required2(options.accessToken, "product API bearer token");
@@ -580,7 +625,7 @@ function _string2(value, label) {
     throw new Error(`${label} must be a non-empty string`);
   return value;
 }
-// .dist-releases/1784772051951-3107696/src/product/worker.js
+// .dist-releases/1784809313131-4113078/src/product/worker.js
 async function createWorker(options) {
   const apiUrl = _required3(options.apiUrl, "product API URL").replace(/\/+$/u, "");
   const accessToken = _required3(options.accessToken, "product API bearer token");
@@ -644,7 +689,7 @@ function _string3(value, label) {
     throw new Error(`${label} must be a non-empty string`);
   return value;
 }
-// .dist-releases/1784772051951-3107696/src/driver/events.js
+// .dist-releases/1784809313131-4113078/src/driver/events.js
 class DriverEventEmitter {
   callbacks = new Map;
   on(type, callback) {
@@ -659,7 +704,7 @@ class DriverEventEmitter {
     }
   }
 }
-// .dist-releases/1784772051951-3107696/src/driver/async-queue.js
+// .dist-releases/1784809313131-4113078/src/driver/async-queue.js
 class AsyncQueue {
   values = [];
   waiters = [];
@@ -698,7 +743,7 @@ class AsyncQueue {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/types.js
+// .dist-releases/1784809313131-4113078/src/driver/types.js
 class DriverUnsupportedError extends Error {
   constructor(message) {
     super(message);
@@ -713,7 +758,7 @@ class DriverTargetNotReadyError extends Error {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/sdk-loader.js
+// .dist-releases/1784809313131-4113078/src/driver/sdk-loader.js
 async function loadSdk(loader, packageName, env = {}, installHint = `Install the optional SDK dependency ${packageName} and its peers for this transport.`) {
   try {
     return await loader();
@@ -723,7 +768,7 @@ async function loadSdk(loader, packageName, env = {}, installHint = `Install the
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/claude/driver.js
+// .dist-releases/1784809313131-4113078/src/driver/claude/driver.js
 class ClaudeAgentSdkDriver {
   options;
   capabilities = { structured: true, resume: true, attach: false };
@@ -899,7 +944,7 @@ function asRecord(value) {
 function stringValue(value) {
   return typeof value === "string" ? value : undefined;
 }
-// .dist-releases/1784772051951-3107696/src/driver/codex/driver.js
+// .dist-releases/1784809313131-4113078/src/driver/codex/driver.js
 class CodexSdkDriver {
   options;
   capabilities = { structured: true, resume: true, attach: false };
@@ -1080,7 +1125,7 @@ function asRecord2(value) {
 function stringValue2(value) {
   return typeof value === "string" ? value : undefined;
 }
-// .dist-releases/1784772051951-3107696/src/driver/liveness-heuristics.js
+// .dist-releases/1784809313131-4113078/src/driver/liveness-heuristics.js
 var BUSY_MARKERS = ["Working (", "Waiting for background", "Pasted Content", "tab to queue"];
 var ANSI_PATTERN = /\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\)|[PX^_][\s\S]*?\x1B\\)/g;
 function stripAnsi(text) {
@@ -1107,7 +1152,7 @@ function classifyInteractiveOutput(input) {
 function isOutputStable(now, lastOutputAt, idleStableMs) {
   return Boolean(lastOutputAt && now.getTime() - lastOutputAt.getTime() >= idleStableMs);
 }
-// .dist-releases/1784772051951-3107696/src/driver/pty/loader.js
+// .dist-releases/1784809313131-4113078/src/driver/pty/loader.js
 async function loadNodePty(loader = defaultNodePtyLoader) {
   try {
     return await loader();
@@ -1133,7 +1178,7 @@ async function defaultNodePtyLoader() {
   return loaded;
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/pty/driver.js
+// .dist-releases/1784809313131-4113078/src/driver/pty/driver.js
 class PtyDriver {
   options;
   capabilities = { structured: false, resume: false, attach: false };
@@ -1285,12 +1330,12 @@ function tail(text, lines) {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-// .dist-releases/1784772051951-3107696/src/driver/tmux/driver.js
+// .dist-releases/1784809313131-4113078/src/driver/tmux/driver.js
 import { mkdtemp, rm, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-// .dist-releases/1784772051951-3107696/src/driver/tmux/launch.js
+// .dist-releases/1784809313131-4113078/src/driver/tmux/launch.js
 var ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
 var PANE_BOOTSTRAP_COMMAND = 'tmux set-option -t "$TMUX_PANE" remain-on-exit on >/dev/null 2>&1 || true; tmux wait-for -S "$1"; shift; exec "$@"';
 function buildTmuxNewSessionArgs(input) {
@@ -1313,7 +1358,7 @@ function validateEnv(env) {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/tmux/paste.js
+// .dist-releases/1784809313131-4113078/src/driver/tmux/paste.js
 function buildDispatchPlan(text, useTyping) {
   return {
     mode: useTyping ? "type-literal" : "paste-buffer",
@@ -1337,7 +1382,7 @@ function arraysEqual(left, right) {
   return left.length === right.length && left.every((item, index) => item === right[index]);
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/tmux/liveness.js
+// .dist-releases/1784809313131-4113078/src/driver/tmux/liveness.js
 var SHELL_COMMANDS = new Set(["", "bash", "zsh", "sh", "fish", "pwsh", "powershell"]);
 function classifyTmuxLiveness(input) {
   if (!input.hasSession) {
@@ -1357,7 +1402,7 @@ function isTmuxProcessAlive(command, runningCommands) {
   return !SHELL_COMMANDS.has(command);
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/tmux/runner.js
+// .dist-releases/1784809313131-4113078/src/driver/tmux/runner.js
 import { spawn as spawn2 } from "node:child_process";
 var DEFAULT_TIMEOUT_MS = 15000;
 
@@ -1482,7 +1527,7 @@ class TmuxClient {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/driver/tmux/driver.js
+// .dist-releases/1784809313131-4113078/src/driver/tmux/driver.js
 var ATTACHED_STOP_GRACE_MS = 1e4;
 var DEFAULT_STOP_TIMEOUT_MS = 15000;
 var DEFAULT_READY_TIMEOUT_MS = 90000;
@@ -1877,12 +1922,12 @@ function isMissingTmuxSessionError(error) {
 ${error.result.stderr}`.toLowerCase();
   return text.includes("can't find session") || text.includes("cannot find session") || text.includes("no such session") || text.includes("session not found");
 }
-// .dist-releases/1784772051951-3107696/src/relay/client.js
+// .dist-releases/1784809313131-4113078/src/relay/client.js
 import { Buffer as Buffer2 } from "node:buffer";
 import http from "node:http";
 import https from "node:https";
 
-// .dist-releases/1784772051951-3107696/src/relay/errors.js
+// .dist-releases/1784809313131-4113078/src/relay/errors.js
 class RelayError extends Error {
   method;
   path;
@@ -1919,7 +1964,7 @@ class RelayProtocolError extends RelayError {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/relay/client.js
+// .dist-releases/1784809313131-4113078/src/relay/client.js
 var JSON_CONTENT_TYPE = "application/json";
 var MAX_MAILBOX_LIMIT = 16;
 var MAX_WAIT_TIMEOUT_SEC = 120;
@@ -2206,29 +2251,6 @@ class RelayClient {
     const response = await this.requestJson("POST", path3, body);
     return _parseTeamAgentSlot(response.agent_slot, "POST", path3);
   }
-  async getTeamRepository(captainId, session) {
-    const path3 = `/api/v1/captains/${segment(captainId)}/sessions`;
-    const response = await this.requestJson("GET", path3);
-    if (!Array.isArray(response.sessions))
-      throw new RelayProtocolError("GET", path3, "sessions must be an array");
-    const rows = response.sessions.map((row) => _parseTeamRepository(row, "GET", path3));
-    const repository = rows.find((row) => row.team_id === session);
-    if (!repository)
-      throw new RelayProtocolError("GET", path3, `team ${session} is missing`);
-    return repository;
-  }
-  async setTeamRepositoryState(captainId, session, body) {
-    const path3 = `${_captainSessionPath(captainId, session)}/repo-verification-state`;
-    const response = await this.requestJson("PATCH", path3, body);
-    return _parseTeamRepository(response.session, "PATCH", path3);
-  }
-  async createRepoVerificationRequest(captainId, session, hostId, gitRepoUrl) {
-    const path3 = `${_captainSessionPath(captainId, session)}/repo-verification-requests`;
-    const response = await this.requestJson("POST", path3, { host_id: hostId, git_repo_url: gitRepoUrl });
-    const request = parseAgentStartRequest(response.request, "POST", path3);
-    _requireRepoVerificationRequest(request, "POST", path3, session, hostId);
-    return request;
-  }
   async getAgentStartRequest(captainId, session, requestId, timeoutMs) {
     const path3 = `${_captainSessionPath(captainId, session)}/agent-start-requests/${segment(requestId)}`;
     const response = await this.requestJson("GET", path3, undefined, timeoutMs);
@@ -2403,6 +2425,12 @@ class RelayClient {
     const path3 = `/api/v1/rag/captains/${segment(captainId)}/teams/${segment(teamId)}/index`;
     return parseRagMemoryIndex(await this.requestJson("GET", path3), "GET", path3);
   }
+  async getRagEntitlement(captainId, teamId) {
+    requireCaptainId(captainId);
+    requireSegment(teamId, "teamId");
+    const path3 = `/api/v1/rag/captains/${segment(captainId)}/teams/${segment(teamId)}/entitlement`;
+    return parseRagEntitlement(await this.requestJson("GET", path3), "GET", path3);
+  }
   async setRagCardPin(captainId, teamId, key, pinned) {
     requireCaptainId(captainId);
     requireSegment(teamId, "teamId");
@@ -2966,34 +2994,6 @@ function _parseTeamAgentSlot(value, method, path3) {
     template_id: slot.template_id ?? null
   };
 }
-function _parseTeamRepository(value, method, path3) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    throw new RelayProtocolError(method, path3, "session must be an object");
-  const session = value;
-  if (typeof session.id !== "string" || !session.id)
-    throw new RelayProtocolError(method, path3, "session.id must be a non-empty string");
-  if (session.git_repo_url !== null && typeof session.git_repo_url !== "string")
-    throw new RelayProtocolError(method, path3, "session.git_repo_url must be a string or null");
-  if (!_isTeamRepositoryStatus(session.git_repo_verification_status))
-    throw new RelayProtocolError(method, path3, "session.git_repo_verification_status is invalid");
-  if (session.git_repo_verification_reason !== null && typeof session.git_repo_verification_reason !== "string")
-    throw new RelayProtocolError(method, path3, "session.git_repo_verification_reason must be a string or null");
-  return {
-    team_id: session.id,
-    git_repo_url: session.git_repo_url,
-    git_repo_verification_status: session.git_repo_verification_status,
-    git_repo_verification_reason: session.git_repo_verification_reason
-  };
-}
-function _isTeamRepositoryStatus(value) {
-  return value === "unverified" || value === "pending" || value === "verified" || value === "failed";
-}
-function _requireRepoVerificationRequest(request, method, path3, session, hostId) {
-  if (request.request_kind !== "repo_verification")
-    throw new RelayProtocolError(method, path3, "request_kind must be repo_verification");
-  if (request.session !== session || request.host_id !== hostId)
-    throw new RelayProtocolError(method, path3, "request identity does not match repository verification target");
-}
 function _parseSessionArtifact(value, method, path3) {
   for (const field of ["id", "name", "sha256", "content_url"]) {
     if (typeof value[field] !== "string" || !value[field])
@@ -3357,7 +3357,7 @@ function parseAgentStartRequest(value, method, path3) {
   }
   if (request.request_kind === undefined)
     request.request_kind = "agent_start";
-  if (request.request_kind !== "agent_start" && request.request_kind !== "repo_verification" && request.request_kind !== "worker_start") {
+  if (request.request_kind !== "agent_start" && request.request_kind !== "worker_start") {
     throw new RelayProtocolError(method, path3, "request.request_kind is invalid");
   }
   if (request.result !== undefined && (!request.result || typeof request.result !== "object" || Array.isArray(request.result))) {
@@ -3520,6 +3520,11 @@ function parseRagMemoryIndex(value, method, path3) {
   }));
   return { enabled: value.enabled, degraded: value.degraded, text: value.text, budget_tokens: value.budget_tokens, total_cards: value.total_cards, omitted_cards: value.omitted_cards, sections };
 }
+function parseRagEntitlement(value, method, path3) {
+  if (typeof value.enabled !== "boolean")
+    throw new RelayProtocolError(method, path3, "entitlement.enabled must be a boolean");
+  return { enabled: value.enabled };
+}
 function parseManagedMaterializationResponse(value, method, path3, cursor) {
   if (value === "not_modified_304") {
     if (!cursor?.trim())
@@ -3849,12 +3854,12 @@ function redact(value, token) {
 function bytesToBase64(bytes) {
   return Buffer2.from(bytes).toString("base64");
 }
-// .dist-releases/1784772051951-3107696/src/relay/config.js
+// .dist-releases/1784809313131-4113078/src/relay/config.js
 import { existsSync as existsSync2, readFileSync } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import path3 from "node:path";
 
-// .dist-releases/1784772051951-3107696/src/worker/protocol.js
+// .dist-releases/1784809313131-4113078/src/worker/protocol.js
 var DEFAULT_RELAY_URL = DEFAULT_PRODUCT_API_URL;
 var DEFAULT_WORKER = "host";
 var DEFAULT_WORKDIR = "~/sailorbridge-workdir";
@@ -3883,7 +3888,7 @@ function effectiveJobKind(kind, spec) {
   return kind === "stream" || spec.stream === true ? "stream" : kind;
 }
 
-// .dist-releases/1784772051951-3107696/src/relay/config.js
+// .dist-releases/1784809313131-4113078/src/relay/config.js
 function loadRelayConfig(env = process.env) {
   const envRelayUrl = nonEmpty(env.SAILORBRIDGE_RELAY_URL);
   const envBearerToken = nonEmpty(env.SAILORBRIDGE_TOKEN);
@@ -3955,7 +3960,7 @@ function storedCaptainId(value) {
   }
   return;
 }
-// .dist-releases/1784772051951-3107696/src/supervisor/retirement.js
+// .dist-releases/1784809313131-4113078/src/supervisor/retirement.js
 var DEFAULT_THRESHOLD = 3;
 var DEFAULT_WINDOW_MS = 30000;
 var DEFAULT_COOLDOWN_MS = 1000;
@@ -4030,7 +4035,7 @@ function isAuthoritativeRetirementReason(reason) {
   return reason === "monitor_fetch" || reason === "agent_session_patch";
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/wait.js
+// .dist-releases/1784809313131-4113078/src/supervisor/wait.js
 async function waitForWakeableTimeout(ms, setWake, sleep3) {
   if (sleep3) {
     await Promise.race([
@@ -4061,7 +4066,7 @@ async function waitForWakeableTimeout(ms, setWake, sleep3) {
   setWake(null);
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/mailbox.js
+// .dist-releases/1784809313131-4113078/src/supervisor/mailbox.js
 var CLEAR_TAG = "CLEAR";
 var REFRESH_TAG = "WORKFLOW-REFRESH";
 var SYNC_TAG = "SYNC";
@@ -4597,38 +4602,79 @@ function ordinaryDeliveryAttempt(error) {
 function _isMissingModerator(error) {
   return error instanceof RelayHttpError && error.status === 400 && error.body.includes("no agents match");
 }
-// .dist-releases/1784772051951-3107696/src/supervisor/runtime.js
+// .dist-releases/1784809313131-4113078/src/supervisor/runtime.js
 import path9 from "node:path";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 
-// .dist-releases/1784772051951-3107696/src/host/managed-materialization.js
+// .dist-releases/1784809313131-4113078/src/host/managed-materialization.js
 import { createHash as createHash2, randomBytes } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 import { lstat, mkdir as mkdir3, open, readdir, rename, rm as rm2 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import path5 from "node:path";
 
-// .dist-releases/1784772051951-3107696/src/host/memory-stub.js
-import { mkdir as mkdir2, writeFile as writeFile3 } from "node:fs/promises";
+// .dist-releases/1784809313131-4113078/src/host/memory-stub.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
 import path4 from "node:path";
-var RAG_MEMORY_STUB_BEGIN = "<!-- sailorbridge-rag-memory-stub:begin -->";
-var RAG_MEMORY_STUB_END = "<!-- sailorbridge-rag-memory-stub:end -->";
-var RAG_MEMORY_STUB = [
-  "# SailorBridge RAG Memory Protocol",
+var TEAM_MEMORY_STUB_BEGIN = "<!-- sailorbridge-team-memory-stub:begin -->";
+var TEAM_MEMORY_STUB_END = "<!-- sailorbridge-team-memory-stub:end -->";
+var LEGACY_STUB_BEGIN = "<!-- sailorbridge-rag-memory-stub:begin -->";
+var LEGACY_STUB_END = "<!-- sailorbridge-rag-memory-stub:end -->";
+var STUB_LOCAL_MEMORY = [
+  "- Your local memory files are yours: the product never collects, rewrites, or deletes them.",
+  "  Keep working notes and everything tied to your own role in local memory.",
+  "- Role-bound and personal content must stay local. Never publish it to shared team stores:",
+  "  another member recalling your role's private memory is an identity mix-up."
+];
+var TEAM_MEMORY_STUB_ENTITLED = [
+  "# SailorBridge Team Memory Protocol",
   "",
-  "- Memory is service-only with zero synchronization: store durable facts only in the relay RAG card store, never in local memory files.",
-  "- Run `sail rag search` before recall; treat returned RAG cards as authoritative and never override them from local memory.",
-  "- Write learned durable facts back with `sail rag set <key> --stdin --source <source>` or `sail rag set <key> --file <path> --source <source>`.",
-  "- Keep only this protocol stub in local memory files: query RAG first, trust the cards, and write learned facts back to RAG.",
-  "- Never write durable facts to CLAUDE.md, AGENTS.md, MEMORY.md, or engine-native local memory directories; RAG is the only write channel.",
-  "- Fail fast when the service is unavailable; never present stale local content as a successful result.",
-  "- Optional read-only snapshots must be clearly marked as disaster recovery.",
+  ...STUB_LOCAL_MEMORY,
+  "- Team memory is the team's shared knowledge and experience. Before a non-trivial",
+  "  question, run `sail memory search <query>` — someone may already know.",
+  "- When you learn something the whole team benefits from, save it with",
+  "  `sail memory set <key> --stdin --source <source>` (or `--file <path>`).",
+  "- Prefer team memory over rules when saving: rules are behavior norms; knowledge",
+  "  and experience belong in team memory.",
+  "- If the memory service is unavailable, fail fast and say so; never present stale",
+  "  local content as the team's shared truth.",
   ""
 ].join(`
 `);
-var RAG_MEMORY_STUB_MARKED = _markedStub(RAG_MEMORY_STUB);
+var TEAM_MEMORY_STUB_UNENTITLED = [
+  "# SailorBridge Team Memory Protocol",
+  "",
+  ...STUB_LOCAL_MEMORY,
+  "- Share lessons and working norms through team rules: propose a rule to your",
+  "  captain or moderator so the whole team inherits it.",
+  "- The Team Memory add-on adds shared cross-member memory with corrections",
+  "  (`sail memory` commands); the captain can enable it from the console.",
+  ""
+].join(`
+`);
+function teamMemoryStub(entitled) {
+  return entitled ? TEAM_MEMORY_STUB_ENTITLED : TEAM_MEMORY_STUB_UNENTITLED;
+}
+function teamMemoryStubMarked(entitled) {
+  return `${TEAM_MEMORY_STUB_BEGIN}
+${teamMemoryStub(entitled)}${TEAM_MEMORY_STUB_END}
+`;
+}
+async function resolveTeamMemoryEntitlement(relay, captainId, teamId) {
+  const captain = captainId?.trim();
+  const team = teamId?.trim();
+  if (!captain || !team)
+    throw new Error("team memory entitlement requires captain_id and session");
+  try {
+    return (await relay.getRagEntitlement(captain, team)).enabled;
+  } catch (error) {
+    if (error instanceof RelayHttpError && error.status === 402)
+      return false;
+    throw error;
+  }
+}
 async function materializeAgentMemoryStub(options) {
   const engine = _memoryStubEngine(options.engine);
   const homeDir = options.homeDir ? path4.resolve(_expandHome(options.homeDir)) : agentSandboxHome(options.agentName, engine, options.env ?? process.env);
@@ -4637,7 +4683,10 @@ async function materializeAgentMemoryStub(options) {
   const mkdirFn = options.mkdir ?? mkdir2;
   const writeFileFn = options.writeFile ?? writeFile3;
   await mkdirFn(homeDir, { recursive: true });
-  await writeFileFn(filePath, RAG_MEMORY_STUB_MARKED, { mode: 384 });
+  const existing = await _readIfPresent(filePath, options.readFile ?? readFile2);
+  const next = _spliceStubBlock(existing, teamMemoryStubMarked(options.teamMemoryEntitled));
+  if (next !== existing)
+    await writeFileFn(filePath, next, { mode: 384 });
   return {
     engine,
     homeDir,
@@ -4652,6 +4701,38 @@ function agentSandboxHome(agentName, engine, env = process.env) {
 function memoryStubFileName(engine) {
   return engine === "claude" ? "CLAUDE.md" : "AGENTS.md";
 }
+function _spliceStubBlock(existing, block) {
+  if (existing === null || !existing.trim())
+    return block;
+  const current = _replaceMarkedBlock(existing, TEAM_MEMORY_STUB_BEGIN, TEAM_MEMORY_STUB_END, block) ?? _replaceMarkedBlock(existing, LEGACY_STUB_BEGIN, LEGACY_STUB_END, block);
+  if (current !== undefined)
+    return current;
+  const cleaned = _dropStrayMarkers(existing);
+  if (!cleaned.trim())
+    return block;
+  return `${block}
+${cleaned.replace(/^\n+/u, "")}`;
+}
+function _replaceMarkedBlock(content, begin, end, block) {
+  const start = content.indexOf(begin);
+  const stop = content.indexOf(end);
+  if (start < 0 || stop < start)
+    return;
+  const after = content.slice(stop + end.length).replace(/^\n/u, "");
+  return `${content.slice(0, start)}${block}${after}`;
+}
+function _dropStrayMarkers(content) {
+  return [TEAM_MEMORY_STUB_BEGIN, TEAM_MEMORY_STUB_END, LEGACY_STUB_BEGIN, LEGACY_STUB_END].reduce((text, marker) => text.split(marker).join(""), content);
+}
+async function _readIfPresent(filePath, readFileFn) {
+  try {
+    return await readFileFn(filePath, "utf8");
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+      return null;
+    throw error;
+  }
+}
 function _memoryStubEngine(value) {
   if (value !== "claude" && value !== "codex") {
     throw new Error("memory stub engine must be claude or codex");
@@ -4679,13 +4760,8 @@ function _safePathLabel(value, field) {
   }
   return trimmed;
 }
-function _markedStub(body) {
-  return `${RAG_MEMORY_STUB_BEGIN}
-${body}${RAG_MEMORY_STUB_END}
-`;
-}
 
-// .dist-releases/1784772051951-3107696/src/host/managed-materialization.js
+// .dist-releases/1784809313131-4113078/src/host/managed-materialization.js
 var MANIFEST_FILE = ".sailorbridge-managed-manifest.json";
 var BANNER_PREFIX = "# SailorBridge managed file";
 var HASH_RE = /^sha256:[a-f0-9]{64}$/u;
@@ -5211,14 +5287,14 @@ function _expandHome2(value) {
   return value;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/credential-guardian.js
-import { lstat as lstat2, readFile as readFile2, rename as rename2, symlink, unlink, writeFile as writeFile4 } from "node:fs/promises";
+// .dist-releases/1784809313131-4113078/src/host/credential-guardian.js
+import { lstat as lstat2, readFile as readFile3, rename as rename2, symlink, unlink, writeFile as writeFile4 } from "node:fs/promises";
 import path6 from "node:path";
 var DEFAULT_CREDENTIAL_SWEEP_INTERVAL_MS = 60000;
 var DEFAULT_FAILURE_ALERT_THRESHOLD = 3;
 var defaultFs = {
   lstat: lstat2,
-  readFile: (filePath) => readFile2(filePath),
+  readFile: (filePath) => readFile3(filePath),
   writeFile: (filePath, data, options) => writeFile4(filePath, data, options),
   rename: rename2,
   symlink: (target, linkPath) => symlink(target, linkPath),
@@ -5357,7 +5433,7 @@ function _tmpSibling(filePath) {
   return path6.join(path6.dirname(filePath), `.${path6.basename(filePath)}.sb-guardian.${process.pid}.${tmpSequence}.tmp`);
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/resolve.js
+// .dist-releases/1784809313131-4113078/src/supervisor/resolve.js
 var DEFAULT_CAPTURE_LINES = 200;
 var MAX_CAPTURE_LINES = 1000;
 
@@ -5563,7 +5639,7 @@ function defaultSleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/transcript-backfill.js
+// .dist-releases/1784809313131-4113078/src/supervisor/transcript-backfill.js
 import { createHash as createHash3 } from "node:crypto";
 import {
   closeSync,
@@ -6220,7 +6296,7 @@ function errorMessage4(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/usage-collector.js
+// .dist-releases/1784809313131-4113078/src/supervisor/usage-collector.js
 import { statSync as statSync2 } from "node:fs";
 import path8 from "node:path";
 var SUPPORTED_USAGE_ENGINES = new Set(["claude", "codex"]);
@@ -6629,7 +6705,7 @@ function sourceUnreadableReason(source) {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/runtime.js
+// .dist-releases/1784809313131-4113078/src/supervisor/runtime.js
 var RESOLVE_CAPTURE_LINES = 200;
 var SHORT_LIVED_EXIT_MS = 5000;
 var STARTUP_OBSERVATION_MS = 1e4;
@@ -7299,7 +7375,7 @@ function errorMessage5(error) {
 function formatRestartCommand(command) {
   return command.map((part) => /^[A-Za-z0-9_./:=@%+-]+$/.test(part) ? part : `'${part.replaceAll("'", "'\\''")}'`).join(" ");
 }
-// .dist-releases/1784772051951-3107696/src/supervisor/transport.js
+// .dist-releases/1784809313131-4113078/src/supervisor/transport.js
 var SUPPORTED_PHASE1_CLI_KINDS = ["claude", "codex"];
 var PHASE1_ENGINE_GATE_MESSAGE = "Only claude and codex engines are available in this release; opencode and custom CLI engines will open in the next release.";
 var PHASE1_TRANSPORT_GATE_MESSAGE = "Only tmux transport is available in this release; sdk, headless, and pty transports will open in the next release.";
@@ -7507,7 +7583,7 @@ function hasCodexSafetyDriverOptions(options) {
   return options?.codex?.sandboxMode !== undefined || options?.codex?.approvalPolicy !== undefined || options?.codex?.yolo !== undefined;
 }
 
-// .dist-releases/1784772051951-3107696/src/supervisor/cli-options.js
+// .dist-releases/1784809313131-4113078/src/supervisor/cli-options.js
 function parseSuperviseArgs(argv) {
   const split = argv.indexOf("--");
   const flagArgs = split >= 0 ? argv.slice(0, split) : argv;
@@ -7659,7 +7735,7 @@ function optionalBoolean(value, label) {
     return false;
   throw new Error(`${label} must be true or false`);
 }
-// .dist-releases/1784772051951-3107696/src/supervisor/tmux-availability.js
+// .dist-releases/1784809313131-4113078/src/supervisor/tmux-availability.js
 import { spawn as spawn3 } from "node:child_process";
 import { createInterface } from "node:readline";
 function isTmuxAvailable(spawnFn = spawn3) {
@@ -7776,7 +7852,7 @@ function _tmuxMissingMessage(platform2) {
   const how = platform2 === "darwin" ? "brew install tmux" : platform2 === "linux" ? "install tmux via your package manager (e.g. sudo apt-get install -y tmux)" : "install tmux";
   return `tmux is required in this release but was not found. Install tmux (${how}) and re-run.`;
 }
-// .dist-releases/1784772051951-3107696/src/output-format.js
+// .dist-releases/1784809313131-4113078/src/output-format.js
 function parseOutputArgs(argv) {
   const cleaned = [];
   let format = "plain";
@@ -7866,7 +7942,7 @@ ${normalized.split(`
 `)}`;
 }
 
-// .dist-releases/1784772051951-3107696/src/plain-output-fields.js
+// .dist-releases/1784809313131-4113078/src/plain-output-fields.js
 var PREVIEW_LIMIT = 20;
 var UNSAFE_DISPLAY_CODE_POINT = /[\u007f-\u009f\u2028-\u202e\u2066-\u2069]/gu;
 function renderTaskPlain(command, value) {
@@ -8274,7 +8350,7 @@ function _omissionLine(total) {
   return total > PREVIEW_LIMIT ? `Omitted ${total - PREVIEW_LIMIT}; rerun with --format json for the complete response.` : undefined;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/cli.js
+// .dist-releases/1784809313131-4113078/src/host/cli.js
 var HOST_RELAY_SUBCOMMANDS = new Set(["consume", "heartbeat", "list", "register"]);
 async function runHostCommandFromCli(client, argv, config, io) {
   const sub = argv[0] ?? "list";
@@ -8512,11 +8588,11 @@ function optionalDisplayName(value) {
   const trimmed = value?.trim();
   return trimmed || undefined;
 }
-// .dist-releases/1784772051951-3107696/src/host/service.js
+// .dist-releases/1784809313131-4113078/src/host/service.js
 import { execFile as execFileCb } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
-import { access, chmod as chmod2, lstat as lstat3, mkdir as mkdir4, readFile as readFile3, rename as rename3, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
+import { access, chmod as chmod2, lstat as lstat3, mkdir as mkdir4, readFile as readFile4, rename as rename3, rm as rm3, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir7, platform as platform2, userInfo } from "node:os";
 import path10 from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -8736,7 +8812,7 @@ function serviceRuntime(deps) {
     username: deps.username ?? info.username,
     execFile: deps.execFile ?? execFileDefault,
     writeFile: deps.writeFile ?? writeFile5,
-    readFile: deps.readFile ?? readFile3,
+    readFile: deps.readFile ?? readFile4,
     mkdir: deps.mkdir ?? mkdir4,
     rm: deps.rm ?? rm3,
     access: deps.access ?? access,
@@ -8995,7 +9071,7 @@ function writeServiceLog(io, event, fields) {
   io.stderr.write(`${JSON.stringify({ ts: new Date().toISOString(), event, ...fields ?? {} })}
 `);
 }
-// .dist-releases/1784772051951-3107696/src/host/git-remote.js
+// .dist-releases/1784809313131-4113078/src/host/git-remote.js
 var GIT_SECRET_PATH_MARKERS = [
   "token",
   "credential",
@@ -9047,16 +9123,6 @@ function sanitizeGitOrigin(value) {
   }
   return hasCredentialPath(origin) ? null : origin;
 }
-function gitRemoteRequiresGitHubAuth(value) {
-  const remote = value.trim();
-  if (remote.startsWith("git@"))
-    return /^git@github\.com:/iu.test(remote);
-  try {
-    return new URL(remote).hostname.toLowerCase() === "github.com";
-  } catch {
-    return false;
-  }
-}
 function isAcceptedRemote(value, allowLocalPath) {
   const remote = value.trim();
   if (!remote || remote.length > 2048 || GIT_REMOTE_UNSAFE_RE.test(remote))
@@ -9097,7 +9163,7 @@ function looksLikeCredential(segment2) {
   return value.length >= 32 && /^[A-Za-z0-9_-]+$/u.test(value);
 }
 
-// .dist-releases/1784772051951-3107696/src/host/start-spec.js
+// .dist-releases/1784809313131-4113078/src/host/start-spec.js
 var TRANSPORTS = ["auto", "sdk", "pty", "tmux", "headless"];
 var SUPPORTED_PHASE1_ENGINES = ["claude", "codex"];
 var ENGINE_PATTERN = /^[a-z][a-z0-9._-]{0,63}$/u;
@@ -9347,7 +9413,7 @@ function _trimmed(value, label) {
     throw new Error(`${label} must not be empty`);
   return trimmed;
 }
-// .dist-releases/1784772051951-3107696/src/host/workspace.js
+// .dist-releases/1784809313131-4113078/src/host/workspace.js
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync4 } from "node:fs";
 import { mkdir as mkdir5, readdir as readdir2, rename as rename4, stat } from "node:fs/promises";
@@ -9578,7 +9644,7 @@ function _safeSegment(value) {
     throw new Error("workspace path segment is empty after sanitizing");
   return segment2;
 }
-// .dist-releases/1784772051951-3107696/src/host/workspace-inventory.js
+// .dist-releases/1784809313131-4113078/src/host/workspace-inventory.js
 import { access as access2 } from "node:fs/promises";
 import { constants } from "node:fs";
 import { execFile as execFile2 } from "node:child_process";
@@ -9670,8 +9736,8 @@ async function canAccess(path12, mode, deps) {
     return false;
   }
 }
-// .dist-releases/1784772051951-3107696/src/host/host-config.js
-import { chmod as chmod3, mkdir as mkdir6, readFile as readFile4, writeFile as writeFile6 } from "node:fs/promises";
+// .dist-releases/1784809313131-4113078/src/host/host-config.js
+import { chmod as chmod3, mkdir as mkdir6, readFile as readFile5, writeFile as writeFile6 } from "node:fs/promises";
 import { homedir as homedir10 } from "node:os";
 import path12 from "node:path";
 var HOST_CONFIG_KIND = "sailorbridge-host-config";
@@ -9688,7 +9754,7 @@ function normalizeWorkspacePath(entry) {
 async function loadHostConfig(configPath = defaultHostConfigPath()) {
   let text;
   try {
-    text = await readFile4(configPath, "utf8");
+    text = await readFile5(configPath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return { kind: HOST_CONFIG_KIND, workspaces: [] };
@@ -9755,7 +9821,7 @@ function _parseHostConfig(text, configPath) {
   });
   return { kind: HOST_CONFIG_KIND, workspaces };
 }
-// .dist-releases/1784772051951-3107696/src/host/host-workspace-cli.js
+// .dist-releases/1784809313131-4113078/src/host/host-workspace-cli.js
 async function runHostWorkspaceCommandFromCli(argv, io, deps = {}) {
   const configPath = deps.configPath ?? defaultHostConfigPath();
   const sub = argv[0] ?? "list";
@@ -9799,7 +9865,7 @@ function _renderAddPlain(result) {
   return result.note ? `${status} ${result.path}
 ${result.note}` : `${status} ${result.path}`;
 }
-// .dist-releases/1784772051951-3107696/src/host/agent-env.js
+// .dist-releases/1784809313131-4113078/src/host/agent-env.js
 var RUNTIME_NATIVE_HOME_ENV = new Set(["CLAUDE_CONFIG_DIR", "CODEX_HOME"]);
 function buildAgentEnv(options) {
   const env = {};
@@ -9828,16 +9894,16 @@ function buildAgentEnv(options) {
   }
   return env;
 }
-// .dist-releases/1784772051951-3107696/src/host/runtime-env.js
+// .dist-releases/1784809313131-4113078/src/host/runtime-env.js
 import path16 from "node:path";
 
-// .dist-releases/1784772051951-3107696/src/host/agent-defaults.js
-import { chmod as chmod4, mkdir as mkdir7, readFile as readFile6, stat as stat2, writeFile as writeFile7 } from "node:fs/promises";
+// .dist-releases/1784809313131-4113078/src/host/agent-defaults.js
+import { chmod as chmod4, mkdir as mkdir7, readFile as readFile7, stat as stat2, writeFile as writeFile7 } from "node:fs/promises";
 import { homedir as homedir11 } from "node:os";
 import path14 from "node:path";
 
-// .dist-releases/1784772051951-3107696/src/host/claude-settings.js
-import { readFile as readFile5 } from "node:fs/promises";
+// .dist-releases/1784809313131-4113078/src/host/claude-settings.js
+import { readFile as readFile6 } from "node:fs/promises";
 import path13 from "node:path";
 async function readHostClaudeSettings(claudeConfigDir) {
   const settings = await _readSettingsObject(path13.join(claudeConfigDir, "settings.json"));
@@ -9846,7 +9912,7 @@ async function readHostClaudeSettings(claudeConfigDir) {
 async function _readSettingsObject(filePath) {
   let text;
   try {
-    text = await readFile5(filePath, "utf8");
+    text = await readFile6(filePath, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return {};
@@ -9877,7 +9943,7 @@ function _nonEmptyString(value) {
   return typeof value === "string" && value.trim() ? value : null;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/agent-defaults.js
+// .dist-releases/1784809313131-4113078/src/host/agent-defaults.js
 var CODEX_BLOCK_BEGIN = "# sailorbridge-terse-defaults:begin";
 var CODEX_BLOCK_END = "# sailorbridge-terse-defaults:end";
 var CODEX_MODEL_BLOCK_BEGIN = "# sailorbridge-host-model-settings:begin";
@@ -10600,7 +10666,7 @@ async function _claudeTrustRoots(projectPath) {
   }
   if (!stats.isFile())
     return [projectPath];
-  const gitdir = /^gitdir:\s*(.+)\s*$/m.exec(await readFile6(pointer, "utf8"))?.[1];
+  const gitdir = /^gitdir:\s*(.+)\s*$/m.exec(await readFile7(pointer, "utf8"))?.[1];
   if (!gitdir) {
     throw new Error(`workspace ${projectPath} has an unreadable .git pointer — cannot pre-trust its main repository for claude`);
   }
@@ -10986,7 +11052,7 @@ async function _readTextIfExists2(filePath) {
       return "";
     throw error;
   }
-  return readFile6(filePath, "utf8");
+  return readFile7(filePath, "utf8");
 }
 function _expandHome3(value) {
   if (value === "~")
@@ -11007,7 +11073,7 @@ function _escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
 
-// .dist-releases/1784772051951-3107696/src/host/engine-auth.js
+// .dist-releases/1784809313131-4113078/src/host/engine-auth.js
 import { lstat as lstat4, mkdir as mkdir8, readlink, realpath, stat as stat3, symlink as symlink2, unlink as unlink2 } from "node:fs/promises";
 import { homedir as homedir12 } from "node:os";
 import path15 from "node:path";
@@ -11097,7 +11163,7 @@ async function _ensureSymlink(linkPath, targetPath, sharedTargetPath) {
   await symlink2(targetPath, linkPath);
 }
 
-// .dist-releases/1784772051951-3107696/src/host/runtime-env.js
+// .dist-releases/1784809313131-4113078/src/host/runtime-env.js
 async function materializeAgentRuntimeEnv(options) {
   const env = buildAgentEnv({
     hostEnv: options.hostEnv,
@@ -11108,6 +11174,7 @@ async function materializeAgentRuntimeEnv(options) {
   const memoryStub = await materializeAgentMemoryStub({
     agentName: options.agentName,
     engine: options.engine,
+    teamMemoryEntitled: options.teamMemoryEntitled,
     env: options.hostEnv,
     homeDir
   });
@@ -11136,7 +11203,7 @@ function _ensureRootSandboxEscape(env, engine, uid) {
 function _currentUid() {
   return typeof process.getuid === "function" ? process.getuid() : null;
 }
-// .dist-releases/1784772051951-3107696/src/host/context-statusline.js
+// .dist-releases/1784809313131-4113078/src/host/context-statusline.js
 function renderClaudeContextStatusLine(payload) {
   const percent = _usedPercentage(payload);
   if (percent === null)
@@ -11174,179 +11241,10 @@ function _bar(percent) {
   const filled = Math.min(10, Math.max(0, Math.trunc(percent / 10)));
   return "█".repeat(filled) + "░".repeat(10 - filled);
 }
-// .dist-releases/1784772051951-3107696/src/host/memory-sweeper.js
-import { createHash as createHash5 } from "node:crypto";
-import { readdir as readdir3, readFile as readFile7, stat as stat4, writeFile as writeFile8 } from "node:fs/promises";
-import path17 from "node:path";
-function createMemorySweepState() {
-  return { completedFingerprints: new Map };
-}
-async function sweepAgentMemory(options) {
-  const captainId = _captainId2(options.captainId);
-  const engine = _memoryEngine(options.engine);
-  const sandbox = agentSandboxHome(options.agentName, engine, options.env ?? process.env);
-  const candidates = await _memoryCandidates(sandbox, engine, options);
-  let ingested = 0;
-  let skipped = 0;
-  for (const candidate of candidates) {
-    const changed = await _sweepCandidate(candidate, { ...options, captainId, engine });
-    if (changed)
-      ingested += 1;
-    else
-      skipped += 1;
-  }
-  return { scanned: candidates.length, ingested, skipped };
-}
-async function _sweepCandidate(candidate, options) {
-  const content = await (options.readFile ?? readFile7)(candidate.filePath, "utf8");
-  const spill = _spillContent(content);
-  if (spill.malformedStub) {
-    options.logger?.("host_memory_spill_malformed_marker", {
-      agent_name: options.agentName,
-      engine: options.engine,
-      mode: options.mode ?? "runtime",
-      path: candidate.relativePath
-    });
-    return false;
-  }
-  if (!spill.text.trim())
-    return false;
-  const fingerprint = _fingerprint(candidate.filePath, spill.text, await (options.stat ?? stat4)(candidate.filePath));
-  if (options.state?.completedFingerprints.get(candidate.filePath) === fingerprint)
-    return false;
-  const response = await options.relay.ingestRagDocument(options.captainId, options.teamId, _ingestBody(candidate, options, spill.text));
-  await _verifyCards(options.relay, options.captainId, options.teamId, response);
-  const latestContent = await (options.readFile ?? readFile7)(candidate.filePath, "utf8");
-  if (latestContent !== content) {
-    options.logger?.("host_memory_spill_changed_before_slim", {
-      agent_name: options.agentName,
-      engine: options.engine,
-      mode: options.mode ?? "runtime",
-      path: candidate.relativePath,
-      cards: response.cards
-    });
-    return true;
-  }
-  await (options.writeFile ?? writeFile8)(candidate.filePath, RAG_MEMORY_STUB_MARKED, { mode: 384 });
-  options.state?.completedFingerprints.set(candidate.filePath, fingerprint);
-  options.logger?.("host_memory_spill_ingested", {
-    agent_name: options.agentName,
-    engine: options.engine,
-    mode: options.mode ?? "runtime",
-    path: candidate.relativePath,
-    cards: response.cards
-  });
-  return true;
-}
-async function _memoryCandidates(sandbox, engine, deps) {
-  const canonical = path17.join(sandbox, memoryStubFileName(engine));
-  const candidates = await _fileExists(canonical, deps) ? [_candidate(sandbox, canonical)] : [];
-  const projectRoot = path17.join(sandbox, "projects");
-  for (const filePath of await _walkMemoryFiles(projectRoot, deps)) {
-    if (filePath !== canonical)
-      candidates.push(_candidate(sandbox, filePath));
-  }
-  return candidates;
-}
-async function _walkMemoryFiles(root, deps) {
-  if (!await _dirExists(root, deps))
-    return [];
-  const out = [];
-  for (const entry of await (deps.readdir ?? readdir3)(root, { withFileTypes: true })) {
-    const filePath = path17.join(root, entry.name);
-    if (entry.isDirectory())
-      out.push(...await _walkMemoryFiles(filePath, deps));
-    if (entry.isFile() && path17.basename(filePath) === "MEMORY.md" && path17.basename(path17.dirname(filePath)) === "memory") {
-      out.push(filePath);
-    }
-  }
-  return out;
-}
-function _spillContent(content) {
-  const start = content.indexOf(RAG_MEMORY_STUB_BEGIN);
-  const stop = content.indexOf(RAG_MEMORY_STUB_END);
-  if (start < 0 && stop < 0)
-    return { text: content, malformedStub: false };
-  if (start < 0 || stop < start)
-    return { text: "", malformedStub: true };
-  return {
-    text: _joinSpillParts(content.slice(0, start), content.slice(stop + RAG_MEMORY_STUB_END.length)),
-    malformedStub: false
-  };
-}
-function _joinSpillParts(beforeStub, afterStub) {
-  const before = beforeStub.trim();
-  const after = afterStub.trim();
-  if (!before)
-    return after ? `${after}
-` : "";
-  if (!after)
-    return `${before}
-`;
-  return `${before}
-${after}
-`;
-}
-function _ingestBody(candidate, options, text) {
-  return {
-    name: `agent-memory/${options.agentName}/${options.engine}/${candidate.relativePath}`,
-    text,
-    type: "memory",
-    max_chars: 800,
-    citation: { agent: options.agentName, engine: options.engine, file: candidate.relativePath }
-  };
-}
-async function _verifyCards(relay, captainId, teamId, response) {
-  if (response.cards < 1)
-    throw new Error("RAG ingest returned no cards for non-empty memory spill");
-  const cards = [];
-  for (let index = 0;index < response.cards; index += 1) {
-    cards.push(await relay.getRagCurrentCard(captainId, teamId, `${response.doc_id}#${String(index).padStart(2, "0")}`));
-  }
-  return cards;
-}
-function _candidate(sandbox, filePath) {
-  return { filePath, relativePath: path17.relative(sandbox, filePath).split(path17.sep).join("/") };
-}
-function _fingerprint(filePath, content, stats) {
-  const digest = createHash5("sha256").update(content).digest("hex");
-  return `${filePath}:${stats.size}:${stats.mtimeMs}:${digest}`;
-}
-async function _fileExists(filePath, deps) {
-  try {
-    return (await (deps.stat ?? stat4)(filePath)).isFile();
-  } catch (error) {
-    if (_notFound(error))
-      return false;
-    throw error;
-  }
-}
-async function _dirExists(filePath, deps) {
-  try {
-    return (await (deps.stat ?? stat4)(filePath)).isDirectory();
-  } catch (error) {
-    if (_notFound(error))
-      return false;
-    throw error;
-  }
-}
-function _captainId2(value) {
-  if (value?.trim())
-    return value.trim();
-  throw new Error("memory sweep requires descriptor captain_id");
-}
-function _memoryEngine(value) {
-  if (value === "claude" || value === "codex")
-    return value;
-  throw new Error("memory sweep engine must be claude or codex");
-}
-function _notFound(error) {
-  return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
-}
-// .dist-releases/1784772051951-3107696/src/host/scratch-sweeper.js
+// .dist-releases/1784809313131-4113078/src/host/scratch-sweeper.js
 import { execFile as execFile3 } from "node:child_process";
-import { lstat as lstat5, readdir as readdir4, realpath as realpath2, unlink as unlink3 } from "node:fs/promises";
-import path18 from "node:path";
+import { lstat as lstat5, readdir as readdir3, realpath as realpath2, unlink as unlink3 } from "node:fs/promises";
+import path17 from "node:path";
 import { promisify as promisify4 } from "node:util";
 var execFileAsync3 = promisify4(execFile3);
 var SCRATCH_SUBDIR = ".agent/tmp";
@@ -11360,8 +11258,8 @@ function scratchSweepEnabled(env) {
   return raw !== "0" && raw !== "false" && raw !== "no" && raw !== "off";
 }
 async function sweepWorkspaceScratch(options) {
-  const root = path18.resolve(options.workspaceRoot);
-  const tmpDir = path18.join(root, SCRATCH_SUBDIR);
+  const root = path17.resolve(options.workspaceRoot);
+  const tmpDir = path17.join(root, SCRATCH_SUBDIR);
   const state = await _tmpDirState(root, tmpDir);
   if (state === "missing")
     return EMPTY;
@@ -11399,7 +11297,7 @@ async function _trackedScratchFiles(root, options) {
     const tracked = new Set;
     for (const rel of stdout.split("\x00"))
       if (rel)
-        tracked.add(path18.join(root, rel));
+        tracked.add(path17.join(root, rel));
     return tracked;
   } catch (error) {
     options.logger?.("host_scratch_sweep_git_failed", { workspace: root, error: _errno(error) });
@@ -11408,8 +11306,8 @@ async function _trackedScratchFiles(root, options) {
 }
 async function _collectScratchFiles(dir, root, logger) {
   const out = [];
-  for (const entry of await readdir4(dir, { withFileTypes: true })) {
-    const abs = path18.join(dir, entry.name);
+  for (const entry of await readdir3(dir, { withFileTypes: true })) {
+    const abs = path17.join(dir, entry.name);
     if (!_within(root, abs)) {
       logger?.("host_scratch_sweep_out_of_bounds", { workspace: root, path: abs });
       continue;
@@ -11475,8 +11373,8 @@ async function _runGit2(root, args) {
   return String(stdout);
 }
 function _within(root, target) {
-  const rel = path18.relative(root, target);
-  return rel === "" || !rel.startsWith("..") && !path18.isAbsolute(rel);
+  const rel = path17.relative(root, target);
+  return rel === "" || !rel.startsWith("..") && !path17.isAbsolute(rel);
 }
 function _isEnoent(error) {
   return Boolean(error && typeof error === "object" && "code" in error && error.code === "ENOENT");
@@ -11486,16 +11384,22 @@ function _errno(error) {
     return String(error.code);
   return error instanceof Error ? error.message : String(error);
 }
-// .dist-releases/1784772051951-3107696/src/host/launcher.js
+// .dist-releases/1784809313131-4113078/src/host/launcher.js
 var MAX_TMUX_SESSION_SUFFIX = 100;
 async function launchSupervisedAgent(input, deps = {}) {
   const spec = parseAgentStartSpec(input.spec);
   const logger = input.logger ?? (() => {});
+  const relay = new RelayClient({
+    relayUrl: input.descriptor.relay_url,
+    bearerToken: input.descriptor.token,
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+  });
   const { env, credentialGuard } = await materializeAgentRuntimeEnv({
     agentName: input.descriptor.agent_name,
     engine: spec.engine,
     hostEnv: input.hostEnv ?? process.env,
     descriptor: input.descriptor,
+    teamMemoryEntitled: await (deps.resolveTeamMemoryEntitlementFn ?? resolveTeamMemoryEntitlement)(relay, input.captainId, input.descriptor.session),
     specEnv: spec.env
   });
   const cwd = await (deps.prepareWorkspaceFn ?? prepareWorkspace)({
@@ -11508,11 +11412,6 @@ async function launchSupervisedAgent(input, deps = {}) {
   });
   await _trustPreparedWorkspace(input.descriptor.agent_name, spec.engine, env, cwd);
   const resolved = await _resolveTransport(spec, input.descriptor, cwd, logger, deps.ensureTmuxTransportFn, deps.tmuxSessionExistsFn, input.recoveryTmuxSession);
-  const relay = new RelayClient({
-    relayUrl: input.descriptor.relay_url,
-    bearerToken: input.descriptor.token,
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-  });
   const runtime = (deps.createRuntime ?? ((options) => new AgentSupervisorRuntime(options)))({
     agentName: input.descriptor.agent_name,
     displayName: input.descriptor.agent_name,
@@ -11636,90 +11535,10 @@ async function _tmuxSessionExists(session) {
     throw error;
   }
 }
-// .dist-releases/1784772051951-3107696/src/host/repo-verification.js
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir as tmpdir2 } from "node:os";
-import path19 from "node:path";
-import { spawn as spawn5 } from "node:child_process";
-var COMMAND_TIMEOUT_MS2 = 30000;
-async function verifyTeamRepository(gitRepoUrl, hostId, deps = {}) {
-  const command = deps.runCommand ?? runCommand;
-  const commandOutput = deps.runCommandOutput ?? runCommandOutput;
-  const trimmed = gitRepoUrl.trim();
-  if (!isAcceptedTeamGitRemote(trimmed))
-    throw new Error("git repository URL is not accepted by SailorBridge hardening rules");
-  if (gitRemoteRequiresGitHubAuth(trimmed)) {
-    await command(["gh", "auth", "status"], process.cwd(), "gh auth status failed; install and authenticate GitHub CLI on the Moderator host");
-  }
-  const readProbe = await commandOutput(["git", "ls-remote", "--symref", trimmed, "HEAD"], process.cwd(), "git read probe failed");
-  const mainRef = _defaultBranchFromSymrefProbe(readProbe);
-  const temp = mkdtempSync(path19.join(tmpdir2(), "sailorbridge-repo-verify-"));
-  try {
-    await command(["git", "init"], temp, "git init failed for write probe");
-    await command(["git", "config", "user.email", "sailorbridge-verify@example.invalid"], temp, "git config failed for write probe");
-    await command(["git", "config", "user.name", "SailorBridge Verify"], temp, "git config failed for write probe");
-    await command(["git", "commit", "--allow-empty", "-m", "sailorbridge verify"], temp, "git commit failed for write probe");
-    await command(["git", "push", "--dry-run", trimmed, "HEAD:refs/heads/sailorbridge-verify"], temp, "git write probe failed");
-  } finally {
-    rmSync(temp, { recursive: true, force: true });
-  }
-  return {
-    verified: true,
-    reason: "git read and dry-run write probes succeeded",
-    verified_at: (deps.now ?? (() => new Date))().toISOString(),
-    verification_host_id: hostId,
-    ...mainRef ? { main_ref: mainRef } : {}
-  };
-}
-function _defaultBranchFromSymrefProbe(output) {
-  const match = /^ref:\s+refs\/heads\/(\S+)\s+HEAD$/mu.exec(output);
-  return match ? match[1] : null;
-}
-async function runCommand(argv, cwd, failurePrefix) {
-  await runCommandOutput(argv, cwd, failurePrefix);
-}
-async function runCommandOutput(argv, cwd, failurePrefix) {
-  const result = await execArgv2(argv, cwd);
-  if (result.exitCode === 0)
-    return result.stdout;
-  const detail = [result.stderr.trim(), result.stdout.trim()].filter(Boolean).join(`
-`).slice(0, 500);
-  throw new Error(detail ? `${failurePrefix}: ${detail}` : failurePrefix);
-}
-function execArgv2(argv, cwd) {
-  return new Promise((resolve2) => {
-    const proc = spawn5(argv[0], argv.slice(1), { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    const stdout = [];
-    const stderr = [];
-    let settled = false;
-    const finish = (exitCode, extraStderr = "") => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      resolve2({
-        exitCode,
-        stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: `${Buffer.concat(stderr).toString("utf8")}${extraStderr}`
-      });
-    };
-    const timer = setTimeout(() => {
-      proc.kill("SIGTERM");
-      finish(124, `
-timeout expired`);
-    }, COMMAND_TIMEOUT_MS2);
-    proc.stdout.on("data", (chunk) => stdout.push(chunk));
-    proc.stderr.on("data", (chunk) => stderr.push(chunk));
-    proc.on("error", (error) => finish(127, `
-${error.message}`));
-    proc.on("close", (code) => finish(code ?? 1));
-  });
-}
-
-// .dist-releases/1784772051951-3107696/src/worker/capability.js
-import { accessSync, constants as constants2, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+// .dist-releases/1784809313131-4113078/src/worker/capability.js
+import { accessSync, constants as constants2, mkdirSync as mkdirSync3, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
 import os from "node:os";
-import path20 from "node:path";
+import path18 from "node:path";
 import { spawnSync } from "node:child_process";
 var TOOLS = ["podman", "git", "kubectl", "perf", "bpftrace"];
 var GPU_TAGS = new Set(["intel-b60", "nvidia-h100", "none"]);
@@ -11819,11 +11638,11 @@ function parseOsReleaseLine(line) {
 }
 function isReadonly(dir) {
   try {
-    const root = path20.resolve(dir);
+    const root = path18.resolve(dir);
     mkdirSync3(root, { recursive: true });
-    const temp = mkdtempSync2(path20.join(root, ".sailorbridge-write-test-"));
-    writeFileSync2(path20.join(temp, "probe"), "");
-    rmSync2(temp, { recursive: true, force: true });
+    const temp = mkdtempSync(path18.join(root, ".sailorbridge-write-test-"));
+    writeFileSync2(path18.join(temp, "probe"), "");
+    rmSync(temp, { recursive: true, force: true });
     return false;
   } catch {
     return true;
@@ -11847,10 +11666,10 @@ function commandExists(command) {
   return commandPath(command) !== null;
 }
 function commandPath(command) {
-  if (command.includes(path20.sep))
+  if (command.includes(path18.sep))
     return command;
-  for (const entry of (process.env.PATH ?? "").split(path20.delimiter)) {
-    const candidate = path20.join(entry, command);
+  for (const entry of (process.env.PATH ?? "").split(path18.delimiter)) {
+    const candidate = path18.join(entry, command);
     try {
       accessSync(candidate, constants2.X_OK);
       return candidate;
@@ -11859,7 +11678,7 @@ function commandPath(command) {
   return null;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/worker-start-spec.js
+// .dist-releases/1784809313131-4113078/src/host/worker-start-spec.js
 var MAX_TAGS = 32;
 var TAG_PATTERN = /^[a-z0-9][a-z0-9=._:/-]{0,63}$/iu;
 var RESERVED_TAG_KEYS = new Set(["os", "kernel", "arch", "gpu", "mode", "role", "tool"]);
@@ -11919,16 +11738,16 @@ function _trimmed2(value, label) {
   return trimmed;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/worker-launcher.js
+// .dist-releases/1784809313131-4113078/src/host/worker-launcher.js
 import { statSync as statSync3 } from "node:fs";
 import os4 from "node:os";
-import path23 from "node:path";
-// .dist-releases/1784772051951-3107696/src/worker/client.js
+import path21 from "node:path";
+// .dist-releases/1784809313131-4113078/src/worker/client.js
 import { readFileSync as readFileSync5 } from "node:fs";
 import os3 from "node:os";
-import path22 from "node:path";
+import path20 from "node:path";
 
-// .dist-releases/1784772051951-3107696/src/worker/errors.js
+// .dist-releases/1784809313131-4113078/src/worker/errors.js
 class LeaseFencingRejected extends Error {
   status;
   constructor(status, message) {
@@ -11942,10 +11761,10 @@ class WorkerHttpError extends Error {
   method;
   path;
   status;
-  constructor(method, path21, status, message) {
+  constructor(method, path19, status, message) {
     super(message || `HTTP ${status}`);
     this.method = method;
-    this.path = path21;
+    this.path = path19;
     this.status = status;
     this.name = "WorkerHttpError";
   }
@@ -11954,10 +11773,10 @@ class WorkerHttpError extends Error {
 class WorkerNetworkError extends Error {
   method;
   path;
-  constructor(method, path21, message) {
+  constructor(method, path19, message) {
     super(message);
     this.method = method;
-    this.path = path21;
+    this.path = path19;
     this.name = "WorkerNetworkError";
   }
 }
@@ -11965,14 +11784,14 @@ var LEASE_FENCING_BAD_REQUEST_MESSAGES = [
   "lease_token is required",
   "lease_token must be a non-empty string"
 ];
-function raiseForLeaseFencingOrStatus(method, path21, status, body) {
+function raiseForLeaseFencingOrStatus(method, path19, status, body) {
   if (status === 409)
     throw new LeaseFencingRejected(status, body);
   if (status === 400 && LEASE_FENCING_BAD_REQUEST_MESSAGES.some((message) => body.includes(message))) {
     throw new LeaseFencingRejected(status, body);
   }
   if (status >= 300)
-    throw new WorkerHttpError(method, path21, status, body);
+    throw new WorkerHttpError(method, path19, status, body);
 }
 function isNetworkError(error) {
   if (error instanceof WorkerNetworkError)
@@ -11984,23 +11803,23 @@ function isNetworkError(error) {
   const code = error.code;
   return code === "ECONNRESET" || code === "ECONNREFUSED" || code === "ETIMEDOUT" || code === "EPIPE" || error.name === "AbortError";
 }
-function countsTowardWorkerSessionRebuild(path21) {
-  if (path21 === "/api/v1/workers/register")
+function countsTowardWorkerSessionRebuild(path19) {
+  if (path19 === "/api/v1/workers/register")
     return false;
-  if (/^\/api\/v1\/workers\/[^/]+\/heartbeat$/u.test(path21))
+  if (/^\/api\/v1\/workers\/[^/]+\/heartbeat$/u.test(path19))
     return false;
   return true;
 }
 
-// .dist-releases/1784772051951-3107696/src/worker/executor.js
-import { spawn as spawn6 } from "node:child_process";
-import { mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync3, readFileSync as readFileSync4, realpathSync, rmSync as rmSync3, statfsSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { tmpdir as tmpdir3, loadavg } from "node:os";
+// .dist-releases/1784809313131-4113078/src/worker/executor.js
+import { spawn as spawn5 } from "node:child_process";
+import { mkdirSync as mkdirSync4, mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, realpathSync, rmSync as rmSync2, statfsSync, writeFileSync as writeFileSync3 } from "node:fs";
+import { tmpdir as tmpdir2, loadavg } from "node:os";
 import os2 from "node:os";
-import path21 from "node:path";
+import path19 from "node:path";
 import { TextDecoder } from "node:util";
 
-// .dist-releases/1784772051951-3107696/src/worker/async-queue.js
+// .dist-releases/1784809313131-4113078/src/worker/async-queue.js
 class AsyncByteQueue {
   maxSize;
   values = [];
@@ -12060,7 +11879,7 @@ class AsyncByteQueue {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/worker/http.js
+// .dist-releases/1784809313131-4113078/src/worker/http.js
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { URLSearchParams as URLSearchParams2 } from "node:url";
@@ -12090,27 +11909,27 @@ class WorkerHttpClient {
       throw new Error("token is required");
     this.relayUrl = relayUrl.replace(/\/+$/u, "");
   }
-  async getJson(path21, query, timeouts, options = {}) {
+  async getJson(path19, query, timeouts, options = {}) {
     const suffix = new URLSearchParams2(query).toString();
-    return this.requestJson("GET", suffix ? `${path21}?${suffix}` : path21, undefined, timeouts, options);
+    return this.requestJson("GET", suffix ? `${path19}?${suffix}` : path19, undefined, timeouts, options);
   }
-  async postJson(path21, value, timeouts) {
-    return this.requestJson("POST", path21, { type: "json", value }, timeouts, {});
+  async postJson(path19, value, timeouts) {
+    return this.requestJson("POST", path19, { type: "json", value }, timeouts, {});
   }
-  async postBytes(path21, body, headers, timeouts) {
-    const response = await this.request("POST", path21, { type: "bytes", value: body }, timeouts, headers);
-    raiseForLeaseFencingOrStatus("POST", path21, response.status, response.text);
+  async postBytes(path19, body, headers, timeouts) {
+    const response = await this.request("POST", path19, { type: "bytes", value: body }, timeouts, headers);
+    raiseForLeaseFencingOrStatus("POST", path19, response.status, response.text);
   }
-  async requestJson(method, path21, body, timeouts, options) {
-    const response = await this.request(method, path21, body, timeouts, {});
-    const errorPath = pathOnly(path21);
+  async requestJson(method, path19, body, timeouts, options) {
+    const response = await this.request(method, path19, body, timeouts, {});
+    const errorPath = pathOnly(path19);
     if (options.leaseFencing === false && response.status >= 300)
       throw new WorkerHttpError(method, errorPath, response.status, response.text);
     raiseForLeaseFencingOrStatus(method, errorPath, response.status, response.text);
     return parseJson(method, errorPath, response.text);
   }
-  async request(method, path21, body, timeouts, extraHeaders) {
-    const url = new URL(`${this.relayUrl}${path21}`);
+  async request(method, path19, body, timeouts, extraHeaders) {
+    const url = new URL(`${this.relayUrl}${path19}`);
     const headers = this.headers(body, extraHeaders);
     return sendRequest(method, url, body, headers, timeouts, this.signal);
   }
@@ -12237,7 +12056,7 @@ function waitForRequestDrain(req) {
     req.once("close", onClose);
   });
 }
-function parseJson(method, path21, text) {
+function parseJson(method, path19, text) {
   try {
     const parsed = JSON.parse(text);
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -12246,15 +12065,15 @@ function parseJson(method, path21, text) {
     return parsed;
   } catch (error) {
     if (error instanceof SyntaxError)
-      throw new WorkerNetworkError(method, path21, "response JSON is invalid");
+      throw new WorkerNetworkError(method, path19, "response JSON is invalid");
     throw error;
   }
 }
-function pathOnly(path21) {
-  return path21.split("?", 1)[0] || path21;
+function pathOnly(path19) {
+  return path19.split("?", 1)[0] || path19;
 }
 
-// .dist-releases/1784772051951-3107696/src/worker/stream-upload.js
+// .dist-releases/1784809313131-4113078/src/worker/stream-upload.js
 async function uploadStream(session, jobId, stream, leaseToken, chunks, workerId) {
   if (!leaseToken.trim())
     throw new Error("lease_token is required");
@@ -12264,7 +12083,7 @@ async function uploadStream(session, jobId, stream, leaseToken, chunks, workerId
   await session.http.postBytes(`/api/v1/jobs/${encodeURIComponent(jobId)}/stream-upload?${query.toString()}`, chunks, { "X-Lease-Token": leaseToken }, UPLOAD_TIMEOUTS);
 }
 
-// .dist-releases/1784772051951-3107696/src/worker/executor.js
+// .dist-releases/1784809313131-4113078/src/worker/executor.js
 class StreamingProcessFailure extends Error {
   exitCode;
   stdout;
@@ -12336,8 +12155,8 @@ function sandboxPath(workdir, requested) {
   if (requested.startsWith("/") || parts.length === 0 || parts.includes("..")) {
     throw new Error("path must be a relative path inside the worker sandbox");
   }
-  const root = realpathSync(path21.resolve(workdir));
-  const target = path21.resolve(root, ...parts);
+  const root = realpathSync(path19.resolve(workdir));
+  const target = path19.resolve(root, ...parts);
   if (!isPathInside(root, target)) {
     throw new Error("path escapes worker sandbox");
   }
@@ -12477,7 +12296,7 @@ async function collectAndUpload(session, jobId, stream, pipe, leaseToken, worker
   return collected.join("");
 }
 function spawnProcess(argv, cwd) {
-  return spawn6(argv[0], argv.slice(1), { cwd, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
+  return spawn5(argv[0], argv.slice(1), { cwd, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
 }
 async function terminateProcess(proc) {
   if (proc.pid === undefined)
@@ -12513,9 +12332,9 @@ function writeFileJob(workdir, spec, startedAt, started) {
   if (typeof spec.content !== "string")
     throw new Error("write_file spec.content must be a string");
   const target = sandboxPath(workdir, String(spec.path ?? ""));
-  mkdirSync4(path21.dirname(target), { recursive: true });
+  mkdirSync4(path19.dirname(target), { recursive: true });
   writeFileSync3(target, spec.content, "utf8");
-  return output(0, path21.relative(realpathSync(path21.resolve(workdir)), target), "", startedAt, started);
+  return output(0, path19.relative(realpathSync(path19.resolve(workdir)), target), "", startedAt, started);
 }
 function readUtf8File(target) {
   return decodeUtf8(readFileSync4(target));
@@ -12523,13 +12342,13 @@ function readUtf8File(target) {
 async function applyDiff(workdir, spec, signal) {
   if (typeof spec.diff_unified_text !== "string")
     throw new Error("apply_diff spec.diff_unified_text must be a string");
-  const dir = mkdtempSync3(path21.join(tmpdir3(), "sailorbridge-patch-"));
-  const patch = path21.join(dir, "change.patch");
+  const dir = mkdtempSync2(path19.join(tmpdir2(), "sailorbridge-patch-"));
+  const patch = path19.join(dir, "change.patch");
   writeFileSync3(patch, spec.diff_unified_text, "utf8");
   try {
     return await runArgv(["patch", "-p1", "-i", patch], workdir, coerceJobTimeoutSeconds(spec) * 1000, signal);
   } finally {
-    rmSync3(dir, { recursive: true, force: true });
+    rmSync2(dir, { recursive: true, force: true });
   }
 }
 async function executeCompose(spec, workdir, startedAt, started, signal) {
@@ -12764,24 +12583,24 @@ function resolveExistingTarget(target) {
   let current = target;
   while (true) {
     try {
-      return path21.resolve(realpathSync(current), ...missingParts.reverse());
+      return path19.resolve(realpathSync(current), ...missingParts.reverse());
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
-      const parent = path21.dirname(current);
+      const parent = path19.dirname(current);
       if (parent === current)
         throw error;
-      missingParts.push(path21.basename(current));
+      missingParts.push(path19.basename(current));
       current = parent;
     }
   }
 }
 function isPathInside(root, target) {
-  const relative = path21.relative(root, target);
-  return relative === "" || !relative.startsWith("..") && !path21.isAbsolute(relative);
+  const relative = path19.relative(root, target);
+  return relative === "" || !relative.startsWith("..") && !path19.isAbsolute(relative);
 }
 function prepareWorkdir(workdir) {
-  const resolved = path21.resolve(workdir);
+  const resolved = path19.resolve(workdir);
   mkdirSync4(resolved, { recursive: true });
   return resolved;
 }
@@ -12796,7 +12615,7 @@ function errorMessage6(error) {
   return error instanceof Error ? error.message : String(error);
 }
 
-// .dist-releases/1784772051951-3107696/src/worker/client.js
+// .dist-releases/1784809313131-4113078/src/worker/client.js
 var TOKEN_FILES = [
   "~/.config/sailorbridge/token",
   "/etc/sailorbridge/token"
@@ -13135,7 +12954,7 @@ ${JSON.stringify(result)}\r
 `);
   for (const file of attachments) {
     yield Buffer.from(`--${multipartBoundary}\r
-Content-Disposition: form-data; name="files"; filename="${path22.basename(file)}"\r
+Content-Disposition: form-data; name="files"; filename="${path20.basename(file)}"\r
 \r
 `);
     yield readFileSync5(file);
@@ -13169,7 +12988,7 @@ function parseFlags2(argv) {
   return values;
 }
 function expandHome2(value) {
-  return value === "~" || value.startsWith("~/") ? path22.join(os3.homedir(), value.slice(2)) : value;
+  return value === "~" || value.startsWith("~/") ? path20.join(os3.homedir(), value.slice(2)) : value;
 }
 function _sleep(ms, signal) {
   if (signal?.aborted)
@@ -13193,7 +13012,7 @@ function errorName2(error) {
 function errorMessage7(error) {
   return error instanceof Error ? error.message : String(error);
 }
-// .dist-releases/1784772051951-3107696/src/host/worker-launcher.js
+// .dist-releases/1784809313131-4113078/src/host/worker-launcher.js
 var DEFAULT_WORKER_READY_TIMEOUT_MS = 60000;
 async function launchSupervisedWorker(input, deps = {}) {
   const logger = input.logger ?? (() => {});
@@ -13276,21 +13095,21 @@ function _requireWorkerName(descriptor) {
   return worker;
 }
 function _resolveWorkdir(workdir, homeDir) {
-  return workdir === "~" || workdir.startsWith("~/") ? path23.join(homeDir, workdir.slice(2)) : workdir;
+  return workdir === "~" || workdir.startsWith("~/") ? path21.join(homeDir, workdir.slice(2)) : workdir;
 }
 function _assertWorkdir(workdir) {
-  let stat5;
+  let stat4;
   try {
-    stat5 = statSync3(workdir);
+    stat4 = statSync3(workdir);
   } catch {
     throw new Error(`worker workdir does not exist: ${workdir}`);
   }
-  if (!stat5.isDirectory())
+  if (!stat4.isDirectory())
     throw new Error(`worker workdir is not a directory: ${workdir}`);
   return workdir;
 }
 
-// .dist-releases/1784772051951-3107696/src/host/daemon.js
+// .dist-releases/1784809313131-4113078/src/host/daemon.js
 async function runHostDaemon(options) {
   const logger = options.logger ?? (() => {});
   const sleep3 = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
@@ -13299,7 +13118,6 @@ async function runHostDaemon(options) {
   const workerRuntimes = new Map;
   const cleanupLocks = new Map;
   const startLocks = new Map;
-  const memorySweepTargets = new Map;
   const managedTargets = new Map;
   const launch = options.launch ?? launchSupervisedAgent;
   const launchWorker = options.launchWorker ?? launchSupervisedWorker;
@@ -13307,15 +13125,14 @@ async function runHostDaemon(options) {
   const reclaim = options.reclaimOrphanWorkspaces ?? reclaimOrphanWorkspaces;
   const identity = { captainId: options.captainId, hostId: options.hostId, displayName: options.displayName };
   const redactSecrets = [...options.redactSecrets ?? []];
-  const sweep = options.sweepAgentMemory ?? sweepAgentMemory;
   const materializeManaged = options.materializeManagedFiles ?? materializeManagedFiles;
   const now = options.now ?? (() => Date.now());
-  const memorySweepIntervalMs = options.memorySweepIntervalMs ?? 6 * 60 * 60 * 1000;
-  let lastRuntimeMemorySweepAt = now();
+  const managedSyncIntervalMs = options.managedSyncIntervalMs ?? 6 * 60 * 60 * 1000;
+  let lastManagedSyncAt = now();
   const scratchSweep = options.sweepWorkspaceScratch ?? sweepWorkspaceScratch;
   const scratchSweepIntervalMs = options.scratchSweepIntervalMs ?? 6 * 60 * 60 * 1000;
   let lastScratchSweepAt = now();
-  const reportRepoTips = options.reportRepoTips ?? reportRepoTipsOnce;
+  const reportRepoTips = options.reportRepoTips ?? createRepoTipReporter();
   const repoTipReportIntervalMs = options.repoTipReportIntervalMs ?? 60 * 1000;
   let lastRepoTipReportAt = now() - repoTipReportIntervalMs;
   const reconcileIntervalMs = options.reconcileIntervalMs ?? 5 * 60 * 1000;
@@ -13360,9 +13177,7 @@ async function runHostDaemon(options) {
     await waitForAgentCleanup(cleanupLocks, request.agent_name);
     const spec = parseAgentStartSpec(request.spec);
     const agentRelay = agentRelayClient(descriptor, options);
-    const memoryTarget = memorySweepTarget(descriptor, spec.engine, options, agentRelay);
     const managedTarget = managedMaterializationTarget(descriptor, spec.engine, options, agentRelay);
-    await runMemorySweep(sweep, memoryTarget, "pre-start", logger, true);
     await runManagedMaterialization(materializeManaged, managedTarget, "pre-start", logger, true);
     await waitForAgentCleanup(cleanupLocks, request.agent_name);
     let runtime = null;
@@ -13379,10 +13194,8 @@ async function runHostDaemon(options) {
         return;
       }
       const cleanupTask = Promise.resolve().then(async () => {
-        await runMemorySweep(sweep, memoryTarget, "runtime", logger, false);
         await runManagedMaterialization(materializeManaged, managedTarget, "runtime", logger, false);
         runtimes.delete(request.agent_name);
-        memorySweepTargets.delete(request.agent_name);
         managedTargets.delete(request.agent_name);
         try {
           await cleanup({
@@ -13426,7 +13239,6 @@ async function runHostDaemon(options) {
       }, options.launchDeps);
       previous = runtimes.get(request.agent_name);
       runtimes.set(request.agent_name, runtime);
-      memorySweepTargets.set(request.agent_name, memoryTarget);
       managedTargets.set(request.agent_name, managedTarget);
     } finally {
       finishStart();
@@ -13438,14 +13250,6 @@ async function runHostDaemon(options) {
       await previous.stop().catch(() => {});
   };
   const starter = async (request) => {
-    if (request.request_kind === "repo_verification") {
-      const gitRepoUrl = request.spec.git_repo_url;
-      if (typeof gitRepoUrl !== "string" || !gitRepoUrl.trim()) {
-        throw new Error("repo verification request requires spec.git_repo_url");
-      }
-      const verifyRepository = options.verifyRepository ?? verifyTeamRepository;
-      return { ...await verifyRepository(gitRepoUrl, options.hostId) };
-    }
     if (request.request_kind === "worker_start")
       return _startWorker(request);
     await startAgent(request, await options.resolveCredential(request));
@@ -13462,7 +13266,9 @@ async function runHostDaemon(options) {
   const _recoverDurableRuntimes = async () => {
     if (!options.recoverRuntimes)
       return;
-    for (const recovery of await options.recoverRuntimes()) {
+    const recoveries = await options.recoverRuntimes();
+    const workers = recoveries.filter(({ request }) => request.request_kind === "worker_start").length;
+    for (const recovery of recoveries) {
       if (options.signal?.aborted)
         return;
       try {
@@ -13475,6 +13281,7 @@ async function runHostDaemon(options) {
         });
       }
     }
+    logger("host_runtime_recovery_completed", { agents: recoveries.length - workers, workers });
   };
   logger("host_daemon_start", { host_id: options.hostId, captain_id: options.captainId });
   try {
@@ -13500,9 +13307,8 @@ async function runHostDaemon(options) {
           logger("host_workspace_reconcile_failed", { error: errorMessage8(error) });
         }
       }
-      if (now() - lastRuntimeMemorySweepAt >= memorySweepIntervalMs) {
-        lastRuntimeMemorySweepAt = now();
-        await sweepRuntimeMemory(sweep, memorySweepTargets, logger);
+      if (now() - lastManagedSyncAt >= managedSyncIntervalMs) {
+        lastManagedSyncAt = now();
         await syncRuntimeManagedMaterialization(materializeManaged, managedTargets, logger);
       }
       if (now() - lastScratchSweepAt >= scratchSweepIntervalMs) {
@@ -13530,7 +13336,6 @@ async function runHostDaemon(options) {
   } finally {
     logger("host_daemon_stopping", { agents: runtimes.size, workers: workerRuntimes.size });
     try {
-      await sweepRuntimeMemory(sweep, memorySweepTargets, logger);
       await syncRuntimeManagedMaterialization(materializeManaged, managedTargets, logger);
     } finally {
       await Promise.allSettled([
@@ -13540,17 +13345,6 @@ async function runHostDaemon(options) {
     }
   }
 }
-function memorySweepTarget(descriptor, engine, options, relay) {
-  return {
-    agentName: descriptor.agent_name,
-    engine,
-    captainId: descriptor.captain_id,
-    teamId: descriptor.session,
-    env: options.hostEnv ?? process.env,
-    relay,
-    state: createMemorySweepState()
-  };
-}
 function managedMaterializationTarget(descriptor, engine, options, relay) {
   return {
     agentName: descriptor.agent_name,
@@ -13569,11 +13363,6 @@ function agentRelayClient(descriptor, options) {
     ...options.launchDeps?.fetchImpl ? { fetchImpl: options.launchDeps.fetchImpl } : {}
   });
 }
-async function sweepRuntimeMemory(sweep, targets, logger) {
-  for (const target of targets.values()) {
-    await runMemorySweep(sweep, target, "runtime", logger, false);
-  }
-}
 async function sweepWorkspaceScratchRoots(scratchSweep, env, logger) {
   if (!scratchSweepEnabled(env))
     return;
@@ -13590,15 +13379,6 @@ async function syncRuntimeManagedMaterialization(materialize, targets, logger) {
     await runManagedMaterialization(materialize, target, "runtime", logger, false);
   }
 }
-async function runMemorySweep(sweep, target, mode, logger, failFast) {
-  try {
-    await sweep({ ...target, mode, logger });
-  } catch (error) {
-    logger("host_memory_sweep_failed", { agent_name: target.agentName, mode, error: errorMessage8(error) });
-    if (failFast)
-      throw error;
-  }
-}
 async function runManagedMaterialization(materialize, target, mode, logger, failFast) {
   try {
     await materialize({ ...target, logger });
@@ -13678,7 +13458,7 @@ async function _drainOnce(options, identity, starter, logger, redactSecrets) {
     return false;
   }
 }
-// .dist-releases/1784772051951-3107696/src/host/enrollment-redeem.js
+// .dist-releases/1784809313131-4113078/src/host/enrollment-redeem.js
 var DEFAULT_NOT_FOUND_RETRIES = 3;
 var NOT_FOUND_RETRY_DELAY_MS = 500;
 function createEnrollmentRedeemer(options) {
@@ -13815,7 +13595,7 @@ function _role2(enrollment) {
   }
   return _string4(enrollment.roles[0], "roles[0]").trim();
 }
-// .dist-releases/1784772051951-3107696/src/host/tutorial.js
+// .dist-releases/1784809313131-4113078/src/host/tutorial.js
 function buildTutorialSteps(state) {
   const paired = state.hasCredential;
   return [
@@ -13886,7 +13666,7 @@ async function runTutorial(options) {
   }
   return steps;
 }
-// .dist-releases/1784772051951-3107696/src/events.js
+// .dist-releases/1784809313131-4113078/src/events.js
 var EVENT_COMMANDS = new Set(["add", "list", "enable", "disable", "rm"]);
 var EVENT_FLAGS = new Set(["at", "days", "message", "run-date", "session", "tag", "tz"]);
 var PRODUCT_DAYS_MODES = new Set(["once", "daily", "weekday"]);
@@ -13976,7 +13756,7 @@ function _assertListArgs(args) {
   }
 }
 
-// .dist-releases/1784772051951-3107696/src/text-input.js
+// .dist-releases/1784809313131-4113078/src/text-input.js
 import { readFile as readFile8 } from "node:fs/promises";
 var _readUtf8File = async (file) => await readFile8(file, "utf8");
 async function readTextInput(input) {
@@ -14010,17 +13790,17 @@ async function rejectUnusedTextInput(input, message) {
     input.unref?.();
   }
 }
-async function readTextFile(path24, readUtf8File2 = _readUtf8File) {
-  return await readUtf8File2(path24);
+async function readTextFile(path22, readUtf8File2 = _readUtf8File) {
+  return await readUtf8File2(path22);
 }
-async function readTextFileOrStdin(path24, input, unusedInputMessage, readUtf8File2 = _readUtf8File) {
-  if (path24 === "-")
+async function readTextFileOrStdin(path22, input, unusedInputMessage, readUtf8File2 = _readUtf8File) {
+  if (path22 === "-")
     return await readTextInput(input);
   await rejectUnusedTextInput(input, unusedInputMessage);
-  return await readTextFile(path24, readUtf8File2);
+  return await readTextFile(path22, readUtf8File2);
 }
 
-// .dist-releases/1784772051951-3107696/src/ask.js
+// .dist-releases/1784809313131-4113078/src/ask.js
 var ASK_FLAGS = new Set(["body-file", "option", "reason", "recommend", "session", "title"]);
 async function runAskFromCli(client2, argv, config, input) {
   const args = _parseAskArgs(argv);
@@ -14135,7 +13915,7 @@ function _singleAskValue(values, name) {
   return entries[0];
 }
 
-// .dist-releases/1784772051951-3107696/src/task.js
+// .dist-releases/1784809313131-4113078/src/task.js
 import { readFile as readFile9 } from "node:fs/promises";
 import { basename } from "node:path";
 var TASK_FLAGS = new Set(["after", "all", "artifact-id", "before", "body-file", "commit", "depends", "description", "description-file", "draft", "findings", "image", "level", "limit", "owner-of-resume", "pair", "priority", "query", "reason", "resume-condition", "resume-dependency", "session", "status", "type", "version"]);
@@ -14625,13 +14405,9 @@ function _taskListFooter(shown, returned, total, hasMore, cursor) {
   return `Shown ${shown} of ${total}${local}${next}`;
 }
 
-// .dist-releases/1784772051951-3107696/src/team.js
-import { setTimeout as sleep3 } from "node:timers/promises";
+// .dist-releases/1784809313131-4113078/src/team.js
 var TEAM_BOOTSTRAP_ENGINES = new Set(["claude", "codex"]);
 var SLOT_SPEC_RE = /^([^=\s]+)=([^:@\s]+):([^:@\s]+)$/;
-var REPO_WAIT_DEFAULT_SECONDS = 60;
-var REPO_WAIT_MAX_SECONDS = 300;
-var REPO_POLL_INTERVAL_MS = 250;
 var TEAM_PLAIN_LIMIT = 20;
 
 class TeamBootstrapError extends Error {
@@ -14642,20 +14418,9 @@ class TeamBootstrapError extends Error {
     this.kind = kind;
   }
 }
-
-class TeamRepoError extends Error {
-  kind;
-  constructor(kind, message) {
-    super(message);
-    this.name = "TeamRepoError";
-    this.kind = kind;
-  }
-}
 async function runTeamFromCli(client2, argv, config, format) {
-  if (argv[0] === "repo")
-    return await _runTeamRepoFromCli(client2, argv.slice(1), config, format);
   if (argv[0] !== "bootstrap")
-    throw new TeamBootstrapError("usage", "team command must be bootstrap or repo");
+    throw new TeamBootstrapError("usage", "team command must be bootstrap");
   const captainId = config.captainId;
   if (!captainId)
     throw new TeamBootstrapError("usage", "team bootstrap requires SAILORBRIDGE_CAPTAIN_ID");
@@ -14668,173 +14433,6 @@ async function runTeamFromCli(client2, argv, config, format) {
   const finalSlots = (await client2.getTeamAgentSlots(captainId, args.session)).agent_slots;
   return format === "json" ? { agent_slots: finalSlots } : _auditFinalState(finalSlots);
 }
-async function _runTeamRepoFromCli(client2, argv, config, format) {
-  const captainId = config.captainId;
-  if (!captainId)
-    throw new TeamRepoError("usage", "team repo requires SAILORBRIDGE_CAPTAIN_ID");
-  if (argv[0] === "status") {
-    const repository = await client2.getTeamRepository(captainId, _parseRepoStatusArgs(argv.slice(1), config));
-    return format === "json" ? repository : _formatRepository(repository);
-  }
-  if (argv[0] !== "set")
-    throw new TeamRepoError("usage", "team repo command must be set or status");
-  return await _setTeamRepository(client2, captainId, _parseRepoSetArgs(argv.slice(1), config), format);
-}
-function _parseRepoStatusArgs(tokens, config) {
-  if (!tokens.length)
-    return _requiredRepoSession(undefined, config);
-  if (tokens.length !== 2 || tokens[0] !== "--session")
-    throw new TeamRepoError("usage", "team repo status accepts only --session TEAM");
-  return _requiredRepoSession(tokens[1], config);
-}
-function _parseRepoSetArgs(tokens, config) {
-  const gitRepoUrl = tokens[0]?.trim();
-  if (!gitRepoUrl || gitRepoUrl.startsWith("--"))
-    throw new TeamRepoError("usage", "team repo set requires GIT_URL");
-  if (!isAcceptedTeamGitRemote(gitRepoUrl))
-    throw new TeamRepoError("usage", "GIT_URL must be an accepted git remote without embedded credentials");
-  const flags = _parseRepoSetFlags(tokens.slice(1));
-  return {
-    gitRepoUrl,
-    session: _requiredRepoSession(flags.session, config),
-    wait: flags.wait,
-    timeoutSeconds: flags.timeoutSeconds
-  };
-}
-function _parseRepoSetFlags(tokens) {
-  const flags = { wait: false, timeoutSet: false, timeoutSeconds: REPO_WAIT_DEFAULT_SECONDS };
-  for (let index = 0;index < tokens.length; index += 1) {
-    index += _applyRepoSetFlag(tokens, index, flags);
-  }
-  if (flags.timeoutSet && !flags.wait)
-    throw new TeamRepoError("usage", "--timeout-sec requires --wait");
-  return flags;
-}
-function _applyRepoSetFlag(tokens, index, flags) {
-  const token = tokens[index];
-  if (token === "--wait") {
-    if (flags.wait)
-      throw new TeamRepoError("usage", "--wait may only be provided once");
-    flags.wait = true;
-    return 0;
-  }
-  if (token === "--session") {
-    flags.session = _singleRepoFlagValue(tokens, index + 1, token, flags.session);
-    return 1;
-  }
-  if (token !== "--timeout-sec")
-    throw new TeamRepoError("usage", `unknown team repo set flag: ${token}`);
-  if (flags.timeoutSet)
-    throw new TeamRepoError("usage", "--timeout-sec may only be provided once");
-  flags.timeoutSet = true;
-  flags.timeoutSeconds = _repoTimeoutSeconds(_singleRepoFlagValue(tokens, index + 1, token));
-  return 1;
-}
-function _singleRepoFlagValue(tokens, index, flag, previous) {
-  if (previous !== undefined)
-    throw new TeamRepoError("usage", `${flag} may only be provided once`);
-  const value = tokens[index]?.trim();
-  if (!value || value.startsWith("--"))
-    throw new TeamRepoError("usage", `${flag} requires a value`);
-  return value;
-}
-function _repoTimeoutSeconds(value) {
-  const seconds = Number(value);
-  if (!Number.isInteger(seconds) || seconds < 1 || seconds > REPO_WAIT_MAX_SECONDS) {
-    throw new TeamRepoError("usage", `--timeout-sec must be an integer from 1 to ${REPO_WAIT_MAX_SECONDS}`);
-  }
-  return seconds;
-}
-function _requiredRepoSession(value, config) {
-  const session = (value ?? config.session)?.trim();
-  if (!session)
-    throw new TeamRepoError("usage", "team repo requires --session or SAILORBRIDGE_SESSION");
-  return session;
-}
-async function _setTeamRepository(client2, captainId, args, format) {
-  const hostId = _moderatorHostId((await client2.getTeamAgentSlots(captainId, args.session)).agent_slots);
-  const pending = await client2.setTeamRepositoryState(captainId, args.session, _repoState(args.gitRepoUrl, "pending", null));
-  const request = await _queueRepoVerification(client2, captainId, args, hostId);
-  if (!args.wait) {
-    if (format === "json")
-      return { repository: pending, verification_request: request };
-    return `${_formatRepository(pending)}
-Verification request: ${request.id}`;
-  }
-  const terminal = await _waitForRepoVerification(client2, captainId, args, request.id);
-  const repository = await _persistRepoTerminal(client2, captainId, args, terminal);
-  return format === "json" ? { repository, verification_request: terminal } : _formatRepository(repository);
-}
-function _moderatorHostId(slots) {
-  const moderator = slots.find((slot) => slot.slot_id === "moderator" && slot.status === "materialized");
-  if (!moderator?.host_id) {
-    throw new TeamRepoError("moderator-unavailable", "team repo verification requires a materialized Moderator slot with a host");
-  }
-  return moderator.host_id;
-}
-async function _queueRepoVerification(client2, captainId, args, hostId) {
-  try {
-    return await client2.createRepoVerificationRequest(captainId, args.session, hostId, args.gitRepoUrl);
-  } catch (error) {
-    await client2.setTeamRepositoryState(captainId, args.session, _repoState(args.gitRepoUrl, "failed", "Repository verification could not be queued on the Moderator host"));
-    throw error;
-  }
-}
-async function _waitForRepoVerification(client2, captainId, args, requestId) {
-  const deadline = Date.now() + args.timeoutSeconds * 1000;
-  while (Date.now() < deadline) {
-    let request;
-    try {
-      request = await client2.getAgentStartRequest(captainId, args.session, requestId, Math.max(1, deadline - Date.now()));
-    } catch (error) {
-      if (Date.now() < deadline)
-        throw error;
-      break;
-    }
-    if (request.status !== "queued" && request.status !== "claimed")
-      return request;
-    await sleep3(Math.min(REPO_POLL_INTERVAL_MS, Math.max(1, deadline - Date.now())));
-  }
-  throw new TeamRepoError("verification-timeout", `repository verification timed out after ${args.timeoutSeconds} second${args.timeoutSeconds === 1 ? "" : "s"}`);
-}
-async function _persistRepoTerminal(client2, captainId, args, request) {
-  if (request.status === "started") {
-    try {
-      const reason2 = _verifiedRepoReason(request);
-      return await client2.setTeamRepositoryState(captainId, args.session, _repoState(args.gitRepoUrl, "verified", reason2));
-    } catch (error) {
-      const reason2 = error instanceof Error ? error.message : "Moderator host returned an invalid repository verification result";
-      await client2.setTeamRepositoryState(captainId, args.session, _repoState(args.gitRepoUrl, "failed", reason2));
-      throw error;
-    }
-  }
-  const reason = request.error?.trim() || `Repository verification request ended as ${request.status}`;
-  await client2.setTeamRepositoryState(captainId, args.session, _repoState(args.gitRepoUrl, "failed", reason));
-  throw new TeamRepoError("verification-failed", reason);
-}
-function _verifiedRepoReason(request) {
-  const result = request.result;
-  if (result?.verified !== true || typeof result.reason !== "string" || !result.reason.trim()) {
-    throw new TeamRepoError("verification-failed", "Moderator host returned an invalid repository verification result");
-  }
-  if (typeof result.verified_at !== "string" || !result.verified_at || typeof result.verification_host_id !== "string" || !result.verification_host_id) {
-    throw new TeamRepoError("verification-failed", "Moderator host returned an incomplete repository verification result");
-  }
-  if (!Number.isFinite(Date.parse(result.verified_at)) || result.verification_host_id !== request.host_id) {
-    throw new TeamRepoError("verification-failed", "Moderator host returned an inconsistent repository verification result");
-  }
-  return result.reason.trim();
-}
-function _repoState(gitRepoUrl, status, reason) {
-  return { git_repo_url: gitRepoUrl, git_repo_verification_status: status, git_repo_verification_reason: reason };
-}
-function _formatRepository(repository) {
-  const url = repository.git_repo_url ?? "not configured";
-  const reason = repository.git_repo_verification_reason ?? "-";
-  return `Repository: ${url}
-Status: ${repository.git_repo_verification_status}
-Reason: ${reason}`;
-}
 function _parseBootstrapArgs(tokens, config) {
   const values = {};
   for (let index = 0;index < tokens.length; index += 1) {
@@ -14962,11 +14560,11 @@ function _slotTable(slots) {
 Shown ${shown.length} of ${slots.length}${omitted ? `; ${omitted} omitted (use --format json)` : ""}`;
 }
 
-// .dist-releases/1784772051951-3107696/src/rag.js
+// .dist-releases/1784809313131-4113078/src/memory.js
 var VALUE_FLAGS = new Set(["file", "source"]);
-var RAG_SEARCH_PLAIN_LIMIT = 20;
-async function runRagFromCli(client2, argv, config, input, format) {
-  const args = _parseRagArgs(argv);
+var MEMORY_SEARCH_PLAIN_LIMIT = 20;
+async function runMemoryFromCli(client2, argv, config, input, format) {
+  const args = _parseMemoryCliArgs(argv);
   const captainId = _requireConfig(config.captainId, "SAILORBRIDGE_CAPTAIN_ID");
   const teamId = _requireConfig(config.session, "SAILORBRIDGE_SESSION");
   if (args.command === "set")
@@ -14977,14 +14575,14 @@ async function runRagFromCli(client2, argv, config, input, format) {
     return await _currentMemory(client2, captainId, teamId, args, format);
   if (args.command === "pin" || args.command === "unpin")
     return await _pinMemory(client2, captainId, teamId, args, format);
-  _assertRagShape(args, "rag index", 0, []);
+  _assertMemoryShape(args, "memory index", 0, []);
   const result = await client2.getRagMemoryIndex(captainId, teamId);
   return format === "json" ? result : result.text;
 }
-function _parseRagArgs(argv) {
+function _parseMemoryCliArgs(argv) {
   const command = argv[0];
   if (command !== "set" && command !== "search" && command !== "current" && command !== "index" && command !== "pin" && command !== "unpin") {
-    throw new Error("rag command must be set, search, current, index, pin, or unpin");
+    throw new Error("memory command must be set, search, current, index, pin, or unpin");
   }
   const positionals = [];
   const flags = {};
@@ -14993,14 +14591,14 @@ function _parseRagArgs(argv) {
     if (!token.startsWith("--"))
       positionals.push(token);
     else
-      _addRagFlag(flags, token, VALUE_FLAGS.has(token.slice(2)) ? argv[++index] : undefined);
+      _addMemoryFlag(flags, token, VALUE_FLAGS.has(token.slice(2)) ? argv[++index] : undefined);
   }
   return { command, positionals, flags };
 }
-function _addRagFlag(flags, token, value) {
+function _addMemoryFlag(flags, token, value) {
   const name = token.slice(2);
   if (name !== "stdin" && !VALUE_FLAGS.has(name))
-    throw new Error(`unknown rag flag: ${token}`);
+    throw new Error(`unknown memory flag: ${token}`);
   if (flags[name] !== undefined)
     throw new Error(`${token} may only be provided once`);
   if (name === "stdin")
@@ -15011,7 +14609,7 @@ function _addRagFlag(flags, token, value) {
     flags[name] = value;
 }
 async function _setMemory(client2, captainId, teamId, args, input, format) {
-  _assertRagShape(args, "rag set", 1, ["stdin", "file", "source"]);
+  _assertMemoryShape(args, "memory set", 1, ["stdin", "file", "source"]);
   const key = args.positionals[0];
   const source = _requiredFlag(args, "source");
   const value = await _payload(args, input);
@@ -15024,26 +14622,26 @@ async function _setMemory(client2, captainId, teamId, args, input, format) {
   return `${result.card.key} v${result.card.version ?? 1} ${result.card.status ?? "active"}${suffix}`;
 }
 async function _searchMemory(client2, captainId, teamId, args, input, format) {
-  _assertRagShape(args, "rag search", 1, []);
+  _assertMemoryShape(args, "memory search", 1, []);
   if (args.positionals[0] !== undefined)
-    await rejectUnusedTextInput(input, "rag search received stdin that its query argument does not consume; omit the query argument to read stdin");
+    await rejectUnusedTextInput(input, "memory search received stdin that its query argument does not consume; omit the query argument to read stdin");
   const text = args.positionals[0] ?? await readTextInput(input);
   if (!text.trim())
-    throw new Error("rag search requires a query argument or stdin");
+    throw new Error("memory search requires a query argument or stdin");
   const result = await client2.searchRag(captainId, teamId, text);
   if (format === "json")
     return result;
   const { cards } = result;
   if (!cards.length)
     return "No matching memory cards.";
-  const shown = cards.slice(0, RAG_SEARCH_PLAIN_LIMIT);
+  const shown = cards.slice(0, MEMORY_SEARCH_PLAIN_LIMIT);
   const lines = shown.map((card) => `${card.key}	${card.score}	${_summary(card.value)}`);
   const omitted = cards.length - shown.length;
   return [...lines, `Shown ${shown.length} of ${cards.length}${omitted ? `; ${omitted} omitted (use --format json)` : ""}`].join(`
 `);
 }
 async function _currentMemory(client2, captainId, teamId, args, format) {
-  _assertRagShape(args, "rag current", 1, []);
+  _assertMemoryShape(args, "memory current", 1, []);
   const card = await client2.getRagCurrentCard(captainId, teamId, args.positionals[0]);
   if (format === "json")
     return card;
@@ -15053,14 +14651,14 @@ ${card.value}`;
 }
 async function _pinMemory(client2, captainId, teamId, args, format) {
   const pinned = args.command === "pin";
-  _assertRagShape(args, `rag ${args.command}`, 1, []);
+  _assertMemoryShape(args, `memory ${args.command}`, 1, []);
   const card = await client2.setRagCardPin(captainId, teamId, args.positionals[0], pinned);
   if (format === "json")
     return card;
   return `${card.key} v${card.version ?? 1} ${pinned ? "pinned" : "unpinned"}`;
 }
-function _assertRagShape(args, name, maxPositionals, allowedFlags) {
-  const requiresKey = name !== "rag search" && name !== "rag index";
+function _assertMemoryShape(args, name, maxPositionals, allowedFlags) {
+  const requiresKey = name !== "memory search" && name !== "memory index";
   if (args.positionals.length > maxPositionals) {
     const requirement = maxPositionals ? requiresKey ? "requires one key" : "accepts at most one positional argument" : "requires no positional arguments";
     throw new Error(`${name} ${requirement}`);
@@ -15074,12 +14672,12 @@ async function _payload(args, input) {
   const fromStdin = args.flags.stdin === true;
   const file = args.flags.file;
   if (fromStdin === (typeof file === "string"))
-    throw new Error("rag set requires exactly one of --stdin or --file");
+    throw new Error("memory set requires exactly one of --stdin or --file");
   if (!fromStdin)
-    await rejectUnusedTextInput(input, "rag set received stdin that --file does not consume; use --stdin");
+    await rejectUnusedTextInput(input, "memory set received stdin that --file does not consume; use --stdin");
   const value = fromStdin ? await readTextInput(input) : await readTextFile(file);
   if (!value.trim())
-    throw new Error("rag set payload must not be empty");
+    throw new Error("memory set payload must not be empty");
   return value;
 }
 function _requiredFlag(args, name) {
@@ -15090,14 +14688,14 @@ function _requiredFlag(args, name) {
 }
 function _requireConfig(value, name) {
   if (!value?.trim())
-    throw new Error(`rag requires ${name}`);
+    throw new Error(`memory requires ${name}`);
   return value;
 }
 function _summary(value) {
   return value.replace(/\s+/gu, " ").trim().slice(0, 180);
 }
 
-// .dist-releases/1784772051951-3107696/src/mailbox-send.js
+// .dist-releases/1784809313131-4113078/src/mailbox-send.js
 var SEND_FLAGS = new Set(["body-file", "commit", "session", "tag", "task-id", "task-version", "to-agents", "to-roles", "to-host"]);
 function parseMailboxSendArgs(argv) {
   const parsed = argsFromValues(parseFlagValues(argv));
@@ -15196,7 +14794,7 @@ function splitList(value) {
   return list?.length ? list : undefined;
 }
 
-// .dist-releases/1784772051951-3107696/src/reply.js
+// .dist-releases/1784809313131-4113078/src/reply.js
 var REPLY_FLAGS = new Set(["agent", "body-file", "in-reply-to", "session"]);
 async function sendReplyFromCli(client2, argv, config, io) {
   const args = _parseReplyArgs(argv);
@@ -15253,7 +14851,7 @@ function _requiredReplyValue(values, name) {
   return value;
 }
 
-// .dist-releases/1784772051951-3107696/src/create.js
+// .dist-releases/1784809313131-4113078/src/create.js
 var CREATE_ENGINES = new Set(["claude", "codex"]);
 var DEFAULT_ENGINE = "claude";
 var WORKSPACE_PLAIN_LIMIT = 20;
@@ -15305,9 +14903,9 @@ async function _startTeamSlots(deps, ctx, team, hostId, workspaceRoot, engine, s
   }
   return requests;
 }
-async function _postConsoleJson(deps, ctx, path24, body) {
+async function _postConsoleJson(deps, ctx, path22, body) {
   const fetchImpl = deps.fetchImpl ?? fetch;
-  const response = await fetchImpl(`${ctx.apiUrl.replace(/\/$/, "")}${path24}`, {
+  const response = await fetchImpl(`${ctx.apiUrl.replace(/\/$/, "")}${path22}`, {
     method: "POST",
     headers: { Authorization: `Bearer ${ctx.token}`, "Content-Type": "application/json" },
     body: JSON.stringify(body)
@@ -15545,7 +15143,7 @@ function _workerPlain(hostId, workdir, result) {
 `);
 }
 
-// .dist-releases/1784772051951-3107696/src/cli.js
+// .dist-releases/1784809313131-4113078/src/cli.js
 var FORMATTED_COMMANDS = new Set([
   "ask",
   "create",
@@ -15554,7 +15152,7 @@ var FORMATTED_COMMANDS = new Set([
   "host",
   "login",
   "mailbox",
-  "rag",
+  "memory",
   "reply",
   "task",
   "team",
@@ -15664,8 +15262,8 @@ async function main(argv) {
     writeOutput(process.stdout, await runTeamFromCli(client2, argv.slice(1), config, output2.format), output2.format);
     return;
   }
-  if (command === "rag") {
-    writeOutput(process.stdout, await runRagFromCli(client2, argv.slice(1), config, process.stdin, output2.format), output2.format);
+  if (command === "memory") {
+    writeOutput(process.stdout, await runMemoryFromCli(client2, argv.slice(1), config, process.stdin, output2.format), output2.format);
     return;
   }
   if (command === "enrollment") {
@@ -15690,7 +15288,7 @@ var KNOWN_COMMANDS = new Set([
   "host",
   "login",
   "mailbox",
-  "rag",
+  "memory",
   "refresh",
   "reply",
   "supervise",
@@ -15707,7 +15305,7 @@ var SUBCOMMANDS = {
   event: new Set(["add", "disable", "enable", "list", "rm"]),
   host: new Set([...HOST_RELAY_SUBCOMMANDS, "run", "service", "start-request", "statusline", "workspace"]),
   mailbox: new Set(["ack", "claim", "peek", "send"]),
-  rag: new Set(["current", "index", "pin", "search", "set", "unpin"]),
+  memory: new Set(["current", "index", "pin", "search", "set", "unpin"]),
   supervise: new Set,
   task: new Set([
     "activate",
@@ -15723,7 +15321,7 @@ var SUBCOMMANDS = {
     "ready",
     "unpark"
   ]),
-  team: new Set(["bootstrap", "repo"]),
+  team: new Set(["bootstrap"]),
   worker: new Set(["serve"])
 };
 function _assertKnownCommand(command, subcommand) {
@@ -15740,7 +15338,7 @@ function _assertKnownCommand(command, subcommand) {
 }
 async function _rejectUnsupportedCliInput(command, args, input) {
   const subcommand = args[0];
-  const acceptsInput = command === "reply" || command === "host" && subcommand === "statusline" || command === "mailbox" && subcommand === "send" || command === "task" && subcommand === "create" || command === "ask" && subcommand !== "list" && subcommand !== "get" && subcommand !== "status" || command === "rag" && (subcommand === "set" || subcommand === "search");
+  const acceptsInput = command === "reply" || command === "host" && subcommand === "statusline" || command === "mailbox" && subcommand === "send" || command === "task" && subcommand === "create" || command === "ask" && subcommand !== "list" && subcommand !== "get" && subcommand !== "status" || command === "memory" && (subcommand === "set" || subcommand === "search");
   if (!acceptsInput)
     await rejectUnusedTextInput(input, `${command}${subcommand ? ` ${subcommand}` : ""} does not accept stdin`);
 }
@@ -15986,6 +15584,7 @@ async function supervise(client2, argv, config) {
     agentName: parsed.agentName,
     engine: parsed.cli,
     hostEnv: process.env,
+    teamMemoryEntitled: await resolveTeamMemoryEntitlement(client2, config.captainId, config.session),
     descriptor: {
       key_id: "direct-supervise",
       relay_url: config.relayUrl,
@@ -16211,14 +15810,12 @@ function _usageText() {
   sailorbridge create worker --name N --concurrency N [--host H] [--workspace PATH] [--session S]
     starts a worker on a paired online host. All create commands: [--api-url URL] [--credentials-path PATH] [--format plain|json]
   sailorbridge team bootstrap --template classic3 --slot SLOT=HOST:claude|codex [--slot ...] [--session S]
-  sailorbridge team repo set GIT_URL [--wait] [--timeout-sec 1..300] [--session S]
-  sailorbridge team repo status [--session S]
-  sail rag set KEY (--stdin | --file PATH) --source SOURCE
-  sail rag search [QUERY]
-  sail rag current KEY
-  sail rag pin KEY                        (moderator/captain only)
-  sail rag unpin KEY                      (moderator/captain only)
-  sail rag index
+  sail memory set KEY (--stdin | --file PATH) --source SOURCE
+  sail memory search [QUERY]
+  sail memory current KEY
+  sail memory pin KEY                        (moderator/captain only)
+  sail memory unpin KEY                      (moderator/captain only)
+  sail memory index
   sailorbridge enrollment --session S --agent A --roles operator [--host H] [--name N]
   sailorbridge host list|register|heartbeat [--host-id H] [--display-name N]
   sailorbridge host consume --once --dry-run-start [--host-id H] [--display-name N]
@@ -16272,5 +15869,5 @@ function _looksLikeNetworkFailure(message) {
   return /fetch failed|network|ECONN(?:REFUSED|RESET)|ENOTFOUND|ETIMEDOUT/iu.test(message);
 }
 
-//# debugId=97C757320E29169264756E2164756E21
+//# debugId=D1FAA8446085164F64756E2164756E21
 //# sourceMappingURL=cli.js.map