@team-ai/teamai-cli 0.30.3 → 0.30.5

package/dist/cli.js

@@ -61601,6 +61601,7 @@ __export(local_agent_exports, {
 import fs35 from "fs";
 import os9 from "os";
 import path76 from "path";
+import { createHash as createHash10 } from "crypto";
 import { execFile as execFile4 } from "child_process";
 import { promisify as promisify3 } from "util";
 function modelAgentKind(tool) {
@@ -61640,6 +61641,65 @@ async function acquireLocalAgentLock(waitMs = 0) {
 function getConfigPath() {
   return path76.join(getLocalAgentHome(), CONFIG_FILE);
 }
+function credentialKey(context) {
+  const agentType = normalizeAgentType(context.tool ?? "workbuddy");
+  return `${agentType}:${resolveLocalAgentId(context)}`;
+}
+function credentialEndpointDir(endpoint) {
+  const endpointDigest = createHash10("sha256").update(normalizeEndpoint(endpoint)).digest("hex").slice(0, 16);
+  return path76.join("credentials", endpointDigest);
+}
+function credentialRelativePath(endpoint, key) {
+  const digest = createHash10("sha256").update(key).digest("hex");
+  return path76.join(credentialEndpointDir(endpoint), `${digest}.token`);
+}
+async function readAgentCredential(config, context) {
+  const entry = context ? config.agentCredentials?.[credentialKey(context)] : void 0;
+  const candidate = entry ?? (!context ? Object.values(config.agentCredentials ?? {})[0] : void 0);
+  if (candidate) {
+    const credentialRoot = path76.join(getLocalAgentHome(), "credentials");
+    const credentialPath = path76.resolve(getLocalAgentHome(), candidate.file);
+    if (!credentialPath.startsWith(credentialRoot + path76.sep)) {
+      throw new Error("HTTP local agent credential path is outside its credential directory.");
+    }
+    const value = (await readFileSafe(credentialPath))?.trim();
+    if (value) return value;
+    throw new Error(`HTTP local agent credential is missing for ${candidate.agentType}. Re-run HTTP setup for that agent.`);
+  }
+  const legacy = config.token?.trim();
+  if (legacy) return legacy;
+  if (context && Object.keys(config.agentCredentials ?? {}).length > 0) {
+    throw new Error(
+      `No HTTP credential is configured for ${normalizeAgentType(context.tool ?? "workbuddy")}. Re-run HTTP setup with this agent and its token.`
+    );
+  }
+  return void 0;
+}
+async function writeAgentCredential(config, context, token) {
+  const key = credentialKey(context);
+  const tool = context.tool ?? "workbuddy";
+  const agentType = normalizeAgentType(tool);
+  const localAgentId = resolveLocalAgentId(context);
+  const file = credentialRelativePath(config.endpoint, key);
+  await ensureDir(path76.join(getLocalAgentHome(), path76.dirname(file)));
+  await writeTokenFile(path76.join(getLocalAgentHome(), file), token);
+  config.agentCredentials = {
+    ...config.agentCredentials,
+    [key]: {
+      tool,
+      agentType,
+      localAgentId,
+      file,
+      createdAt: config.agentCredentials?.[key]?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    }
+  };
+  return key;
+}
+async function promoteLegacyCredential(config, context) {
+  if (!config.token || config.agentCredentials?.[credentialKey(context)]) return;
+  await writeAgentCredential(config, context, config.token);
+  await saveLocalAgentConfig(config);
+}
 function getManifestPath() {
   return path76.join(getLocalAgentHome(), MANIFEST_FILE);
 }
@@ -61809,7 +61869,7 @@ async function canonicalizeWorkspacePath(value) {
 }
 function mergeWorkspaceBindings(existing2, incoming, canonicalKey) {
   if (!existing2) return incoming;
-  const rank2 = (binding) => (binding.projectId ?? 0) > 0 ? 2 : binding.projectId === 0 ? 1 : 0;
+  const rank2 = (binding) => binding.projectId > 0 ? 2 : binding.projectName === "__skipped__" ? 1 : 0;
   const existingRank = rank2(existing2);
   const incomingRank = rank2(incoming);
   const existingReal = existingRank === 2;
@@ -61821,6 +61881,8 @@ function mergeWorkspaceBindings(existing2, incoming, canonicalKey) {
   }
   const base = existingRank >= incomingRank ? { ...existing2 } : { ...incoming };
   base.enrolledAt ??= existing2.enrolledAt ?? incoming.enrolledAt;
+  const agentKeys = [.../* @__PURE__ */ new Set([...existing2.agentKeys ?? [], ...incoming.agentKeys ?? []])];
+  if (agentKeys.length > 0) base.agentKeys = agentKeys;
   if (!base.ideType) base.ideType = existing2.ideType ?? incoming.ideType;
   return base;
 }
@@ -61828,80 +61890,14 @@ function isWorkspaceEnrolled(config, workspacePath) {
   return config.workspaceBindings[workspacePath]?.enrolledAt !== void 0;
 }
 function hasWorkspaceBindingDecision(binding) {
-  return binding?.projectId !== void 0;
-}
-async function inferWorkspaceEnrollments(config) {
-  const inferred = {};
-  const add = async (workspacePath, enrolledAt = config.createdAt, ideType) => {
-    const canonical2 = await canonicalizeWorkspacePath(workspacePath);
-    inferred[canonical2] ??= { enrolledAt, ...ideType ? { ideType } : {} };
-  };
-  const inheritedAnchors = /* @__PURE__ */ new Set();
-  const missingBindings = /* @__PURE__ */ new Set();
-  const anchorsByPath = /* @__PURE__ */ new Map();
-  const positiveBindings = Object.entries(config.workspaceBindings).filter(([, binding]) => (binding.projectId ?? 0) > 0);
-  for (const [workspacePath] of positiveBindings) {
-    try {
-      await fs35.promises.stat(workspacePath);
-    } catch (error2) {
-      if (error2.code === "ENOENT") missingBindings.add(workspacePath);
-      continue;
-    }
-    const anchors = await resolveAnchors(workspacePath);
-    anchorsByPath.set(workspacePath, anchors);
-    if (anchors && anchors.projectAnchor !== anchors.workspaceRoot) {
-      inheritedAnchors.add(await canonicalizeWorkspacePath(anchors.projectAnchor));
-    }
-  }
-  const bindingTransactions = /* @__PURE__ */ new Map();
-  for (const [workspacePath, binding] of positiveBindings) {
-    if (!binding.boundAt) continue;
-    const key = `${binding.projectId}\0${binding.boundAt}`;
-    const paths = bindingTransactions.get(key) ?? [];
-    paths.push(workspacePath);
-    bindingTransactions.set(key, paths);
-  }
-  for (const paths of bindingTransactions.values()) {
-    if (!paths.some((workspacePath) => missingBindings.has(workspacePath))) continue;
-    for (const workspacePath of paths) {
-      if (missingBindings.has(workspacePath)) continue;
-      const anchors = anchorsByPath.get(workspacePath);
-      if (anchors && anchors.projectAnchor === anchors.workspaceRoot) inheritedAnchors.add(workspacePath);
-    }
-  }
-  for (const [workspacePath, binding] of Object.entries(config.workspaceBindings)) {
-    if ((binding.projectId ?? 0) > 0 && !missingBindings.has(workspacePath) && !inheritedAnchors.has(workspacePath)) {
-      await add(workspacePath, binding.boundAt ?? config.createdAt, binding.ideType);
-    }
-  }
-  const manifest = await readJson(getManifestPath());
-  for (const key of Object.keys(manifest?.scopes ?? {})) {
-    const parsed = parseScopeKey(key);
-    if (parsed.scope === "project" && parsed.workspacePath) await add(parsed.workspacePath);
-  }
-  const models = await readJson(getModelManifestPath());
-  for (const workspacePath of Object.keys(models?.workspaceModels ?? {})) await add(workspacePath);
-  const projectHomes = await listDirs(path76.join(getTeamaiHomePath(), "projects")).catch(() => []);
-  const mcpOwnershipFiles = [
-    path76.join(getTeamaiHomePath(), "managed-local-mcp.json"),
-    ...projectHomes.map((dir) => path76.join(getTeamaiHomePath(), "projects", dir, "managed-local-mcp.json"))
-  ];
-  for (const file of mcpOwnershipFiles) {
-    const records2 = await readJson(file);
-    for (const [key, owned] of Object.entries(records2 ?? {})) {
-      const match = /^[^:]+:local:(.+)$/.exec(key);
-      if (match?.[1] && owned.length > 0) await add(match[1]);
-    }
-  }
-  return inferred;
+  return Boolean(binding && (binding.projectId > 0 || binding.projectName === "__skipped__"));
 }
 async function loadLocalAgentConfig(options2 = {}) {
   const fileConfig = await readJson(getConfigPath());
   if (fileConfig && "disabled" in fileConfig && fileConfig.disabled === true) return null;
   if (fileConfig && "endpoint" in fileConfig && fileConfig.endpoint) {
-    const { workspaceEnrollments: legacyEnrollments, ...storedConfig } = fileConfig;
     const config = {
-      ...storedConfig,
+      ...fileConfig,
       endpoint: normalizeEndpoint(fileConfig.endpoint),
       workspaceBindings: fileConfig.workspaceBindings ?? {}
     };
@@ -61929,15 +61925,8 @@ async function loadLocalAgentConfig(options2 = {}) {
     }
     config.workspaceBindings = migrated;
     if (fileConfig.workspaceStateVersion !== 1) {
-      const enrollments = legacyEnrollments ?? await inferWorkspaceEnrollments(config);
-      for (const [wsPath, enrollment] of Object.entries(enrollments)) {
-        const canonicalKey = await canonicalizeWorkspacePath(wsPath);
-        const binding = config.workspaceBindings[canonicalKey] ?? {};
-        config.workspaceBindings[canonicalKey] = {
-          ...binding,
-          enrolledAt: binding.enrolledAt ?? enrollment.enrolledAt,
-          ideType: enrollment.ideType ?? binding.ideType
-        };
+      for (const binding of Object.values(config.workspaceBindings)) {
+        if (binding.projectId > 0) binding.enrolledAt ??= binding.boundAt;
       }
       config.workspaceStateVersion = 1;
       migrationChanged = true;
@@ -62158,12 +62147,13 @@ async function workspaceCacheGitignore(workspacePath, repoPath) {
   const file = path76.join(teamaiDir, ".gitignore");
   return await readFileSafe(file) === WORKSPACE_CACHE_GITIGNORE ? file : null;
 }
-function authHeaders5(config, json = true) {
+async function authHeaders5(config, json = true, context) {
   const headers = {};
   if (json) headers["Content-Type"] = "application/json";
-  if (config.token) {
-    headers.Authorization = `Bearer ${config.token}`;
-    headers["X-API-Token"] = config.token;
+  const token = await readAgentCredential(config, context);
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+    headers["X-API-Token"] = token;
   }
   return headers;
 }
@@ -62171,7 +62161,7 @@ async function localAgentFetch(config, tag, route, init3, opts) {
   const method = init3?.method ?? "GET";
   const url = `${config.endpoint}${resolveRoute(config, route)}`;
   const headers = {
-    ...authHeaders5(config, init3?.body !== void 0),
+    ...await authHeaders5(config, init3?.body !== void 0, opts?.context),
     ...init3?.headers
   };
   logHttpRequest(tag, method, url, headers, init3?.body);
@@ -62207,12 +62197,13 @@ async function appendErrorLog(entry) {
   } catch {
   }
 }
-async function fetchUserProjects(config) {
+async function fetchUserProjects(config, context) {
   const response = await localAgentFetch(
     config,
     localAgentTag({}),
     "projects",
-    { method: "GET" }
+    { method: "GET" },
+    { context }
   );
   return response.projects ?? [];
 }
@@ -62254,8 +62245,14 @@ async function execPluginCommand(cmd, timeoutMs) {
     );
   });
 }
-async function fetchPluginConfig(config, tag) {
-  return localAgentFetch(config, tag, "getConfig", { method: "GET" }, { redactResponseLog: true });
+async function fetchPluginConfig(config, tag, context) {
+  return localAgentFetch(
+    config,
+    tag,
+    "getConfig",
+    { method: "GET" },
+    { redactResponseLog: true, context }
+  );
 }
 function getPluginPullStatePath() {
   return path76.join(getLocalAgentHome(), "plugin-pull.json");
@@ -62293,7 +62290,16 @@ async function maybeReconcilePlugins(context) {
     const child = spawn13(
       process.execPath,
       [process.argv[1], "source", "reconcile-plugins"],
-      { detached: true, windowsHide: true, stdio: "ignore", env: { ...process.env, TEAMAI_PLUGIN_LOCAL_AGENT_ID: localAgentId } }
+      {
+        detached: true,
+        windowsHide: true,
+        stdio: "ignore",
+        env: {
+          ...process.env,
+          TEAMAI_PLUGIN_LOCAL_AGENT_ID: localAgentId,
+          TEAMAI_PLUGIN_TOOL: tool
+        }
+      }
     );
     child.unref();
   } catch (e) {
@@ -62309,7 +62315,8 @@ async function runPluginReconcileWorker() {
     const tag = "[local-agent] [plugin-reconcile]";
     const statePath = getPluginPullStatePath();
     try {
-      const resp = await fetchPluginConfig(config, tag);
+      const context = { tool: process.env.TEAMAI_PLUGIN_TOOL ?? "workbuddy" };
+      const resp = await fetchPluginConfig(config, tag, context);
       const { vars, plugins } = parseGetConfig(resp);
       const declaredSlugs = plugins.length ? ` [${plugins.map((p2) => p2.slug).join(", ")}]` : "";
       log.debug(`${tag} get-config: ${plugins.length} plugin(s) declared${declaredSlugs}`);
@@ -62390,11 +62397,19 @@ async function persistWorkspaceBinding(config, cwd, resolvedPath, projectId, pro
   }
   await saveLocalAgentConfig(config);
 }
-async function enrollWorkspace(config, resolvedPath) {
-  const binding = config.workspaceBindings[resolvedPath] ?? {};
-  config.workspaceBindings[resolvedPath] = {
+async function enrollWorkspace(config, resolvedPath, agentKeys = []) {
+  const enrolledAt = (/* @__PURE__ */ new Date()).toISOString();
+  const binding = config.workspaceBindings[resolvedPath];
+  const mergedAgentKeys = [.../* @__PURE__ */ new Set([...binding?.agentKeys ?? [], ...agentKeys])];
+  config.workspaceBindings[resolvedPath] = binding ? {
     ...binding,
-    enrolledAt: binding.enrolledAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    enrolledAt: binding.enrolledAt ?? enrolledAt,
+    ...mergedAgentKeys.length > 0 ? { agentKeys: mergedAgentKeys } : {}
+  } : {
+    projectId: 0,
+    boundAt: enrolledAt,
+    enrolledAt,
+    ...mergedAgentKeys.length > 0 ? { agentKeys: mergedAgentKeys } : {}
   };
 }
 async function inheritWorktreeBinding(config, cwd, resolvedPath) {
@@ -62433,7 +62448,7 @@ async function bindWorkspaceToProject(workspacePath, projectId) {
   log.success(`\u5DF2\u5C06\u5DE5\u4F5C\u533A\u7ED1\u5B9A\u5230\u9879\u76EE\uFF1A${project.name} [id=${project.id}]`);
   return binding;
 }
-async function ensureWorkspaceBinding(config, workspacePath, sessionId, cwd) {
+async function ensureWorkspaceBinding(config, workspacePath, agentContext, sessionId, cwd) {
   if (!isWorkspaceEnrolled(config, workspacePath)) return;
   if (hasWorkspaceBindingDecision(config.workspaceBindings[workspacePath])) return;
   if (await inheritWorktreeBinding(config, cwd, workspacePath)) return;
@@ -62446,7 +62461,7 @@ async function ensureWorkspaceBinding(config, workspacePath, sessionId, cwd) {
   }
   let projects;
   try {
-    projects = await fetchUserProjects(config);
+    projects = await fetchUserProjects(config, agentContext);
   } catch (e) {
     log.debug(`local-agent: failed to load user projects: ${e.message}`);
     return;
@@ -62482,7 +62497,7 @@ function isBindPromptTool(tool) {
   const kind = modelAgentKind(tool);
   return kind === "codebuddy" || kind === "workbuddy";
 }
-async function emitBindingHint(config, workspacePath, sessionId, cwd) {
+async function emitBindingHint(config, workspacePath, agentContext, sessionId, cwd) {
   if (!isWorkspaceEnrolled(config, workspacePath)) return;
   if (hasWorkspaceBindingDecision(config.workspaceBindings[workspacePath])) return;
   if (await inheritWorktreeBinding(config, cwd, workspacePath)) return;
@@ -62495,7 +62510,7 @@ async function emitBindingHint(config, workspacePath, sessionId, cwd) {
   }
   let projects;
   try {
-    projects = await fetchUserProjects(config);
+    projects = await fetchUserProjects(config, agentContext);
   } catch {
     return;
   }
@@ -62709,16 +62724,19 @@ function stampWorkspaceTool(config, currentPath, tool) {
   const binding = config.workspaceBindings[currentPath];
   if (!binding?.enrolledAt) return false;
   const normalized = normalizeAgentType(tool);
-  if (binding.ideType !== normalized) {
-    binding.ideType = normalized;
-    return true;
-  }
-  return false;
+  const key = credentialKey({ tool });
+  const agentKeys = binding.agentKeys ?? [];
+  if (binding.ideType === normalized && agentKeys.includes(key)) return false;
+  binding.ideType = normalized;
+  binding.agentKeys = [.../* @__PURE__ */ new Set([...agentKeys, key])];
+  return true;
 }
 function selectToolWorkspaces(config, currentPath, currentTool) {
   return Object.keys(config.workspaceBindings).filter((wsPath) => {
     const b2 = config.workspaceBindings[wsPath];
     if (!b2.enrolledAt) return false;
+    const key = credentialKey({ tool: currentTool });
+    if (b2.agentKeys?.includes(key)) return true;
     const wsTool = b2.ideType ?? (wsPath === currentPath ? currentTool : void 0);
     return wsTool === currentTool;
   });
@@ -62781,7 +62799,7 @@ async function buildReportPayload(config, context) {
           name: path76.basename(wsPath),
           ide_type: currentTool
         };
-        if ((wsBinding?.projectId ?? 0) > 0) workspace.project_id = wsBinding.projectId;
+        if (wsBinding.projectId > 0) workspace.project_id = wsBinding.projectId;
         if (wsScope.skills.length > 0) workspace.skills = wsScope.skills;
         if (wsScope.rules.length > 0) workspace.rules = wsScope.rules;
         const wsMcps = await scanMcpFromManifest("project", tool, wsPath);
@@ -62810,7 +62828,7 @@ async function buildSyncPayload(config, context) {
         path: wsPath,
         name: path76.basename(wsPath),
         ide_type: currentTool,
-        ...(wsBinding?.projectId ?? 0) > 0 ? { project_id: wsBinding.projectId } : {}
+        ...wsBinding.projectId > 0 ? { project_id: wsBinding.projectId } : {}
       };
     });
   }
@@ -63476,7 +63494,7 @@ async function hookDeliveryProblem(teamConfig, localConfig2, tool, block) {
   const length = parts.filter(Boolean).join("\n\n").length;
   return length > hook.limit ? `${tool} cannot load this project's instructions: with the HTTP prompts they are ${length} characters, over the ${hook.limit}-character limit of its prompt section, so ${tool} skips them. Shorten the prompts for this project.` : null;
 }
-async function ackCommand(config, tag, command, status2, version2, error2) {
+async function ackCommand(config, tag, context, command, status2, version2, error2) {
   await localAgentFetch(config, tag, "ack", {
     method: "POST",
     body: JSON.stringify({
@@ -63486,7 +63504,7 @@ async function ackCommand(config, tag, command, status2, version2, error2) {
       error: error2 ?? "",
       version: version2
     })
-  });
+  }, { context });
 }
 function requireModelString(value, field) {
   if (typeof value !== "string" || !value.trim()) {
@@ -64463,7 +64481,7 @@ async function processCommands(config, commands, context) {
     }
     try {
       const version2 = await executeCommand(config, command, context);
-      await ackCommand(config, tag, command, "success", version2);
+      await ackCommand(config, tag, context, command, "success", version2);
       if (command.type === "apply_model_config") modelConfigApplied = true;
       log.debug(`${tag} command ${command.id} (${command.type ?? ""}) succeeded`);
       if (command.type === "uninstall_teamai") {
@@ -64474,7 +64492,7 @@ async function processCommands(config, commands, context) {
       const error2 = e.message;
       log.error(`${tag} command ${command.id} failed: ${error2}`);
       try {
-        await ackCommand(config, tag, command, "failed", void 0, error2);
+        await ackCommand(config, tag, context, command, "failed", void 0, error2);
       } catch (ackError) {
         log.debug(`${tag} failed to ack command ${command.id}: ${ackError.message}`);
       }
@@ -64505,10 +64523,10 @@ async function syncLocalAgent(context) {
     if (workspacePath && isWorkspaceEnrolled(config, workspacePath)) {
       const sid = context.event?.sessionId;
       if (context.event?.type === "session_start") {
-        await ensureWorkspaceBinding(config, workspacePath, sid, context.cwd);
+        await ensureWorkspaceBinding(config, workspacePath, context, sid, context.cwd);
       }
       if (context.event?.type === "prompt_submit") {
-        await emitBindingHint(config, workspacePath, sid, context.cwd);
+        await emitBindingHint(config, workspacePath, context, sid, context.cwd);
       }
     }
   }
@@ -64537,7 +64555,8 @@ async function syncLocalAgent(context) {
       await localAgentFetch(config, tag, "report", {
         method: "POST",
         body: JSON.stringify(reportPayload)
-      });
+      }, { context });
+      await promoteLegacyCredential(config, context);
       log.debug(`${tag} report OK`);
     }
     const syncPayload = await buildSyncPayload(config, context);
@@ -64546,7 +64565,7 @@ async function syncLocalAgent(context) {
       tag,
       "sync",
       { method: "POST", body: JSON.stringify(syncPayload) },
-      { redactResponseLog: true }
+      { redactResponseLog: true, context }
     );
     const cmds = syncResponse.cmds;
     const commands = cmds && cmds.length > 0 ? cmds : syncResponse.commands ?? [];
@@ -64559,7 +64578,7 @@ async function syncLocalAgent(context) {
         await localAgentFetch(config, tag, "report", {
           method: "POST",
           body: JSON.stringify(reportPayload)
-        });
+        }, { context });
         log.debug(`${tag} model config report OK`);
       }
     }
@@ -64688,8 +64707,16 @@ async function reportAndSyncFromHook(stdin, tool) {
   }
 }
 async function writeTokenFile(tokenPath, token) {
-  await fs35.promises.writeFile(tokenPath, token + "\n", { mode: 384 });
-  await fs35.promises.chmod(tokenPath, 384);
+  await ensureDir(path76.dirname(tokenPath));
+  const tmp = `${tokenPath}.${process.pid}.${createHash10("sha256").update(`${tokenPath}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 12)}.tmp`;
+  try {
+    await fs35.promises.writeFile(tmp, token + "\n", { mode: 384, flag: "wx" });
+    await fs35.promises.chmod(tmp, 384);
+    await fs35.promises.rename(tmp, tokenPath);
+  } catch (error2) {
+    await fs35.promises.rm(tmp, { force: true }).catch(() => void 0);
+    throw error2;
+  }
 }
 async function initLocalAgentHttp(options2) {
   const endpoint = normalizeEndpoint(options2.endpoint);
@@ -64700,20 +64727,45 @@ async function initLocalAgentHttp(options2) {
   if (existing2 && !options2.force && normalizeEndpoint(existing2.endpoint) !== endpoint) {
     throw new Error("HTTP local agent is initialized with another endpoint. Re-run with --force to overwrite.");
   }
+  const requestedAgents = [...new Set((options2.filterAgents ?? []).map((agent) => agent.trim()).filter(Boolean))];
+  if (options2.token?.startsWith("sk-") && requestedAgents.length !== 1) {
+    throw new Error("A ClawPro instance token requires exactly one --agent.");
+  }
+  const sameEndpoint = Boolean(existing2 && normalizeEndpoint(existing2.endpoint) === endpoint);
   const config = {
     endpoint,
-    token: options2.token ?? existing2?.token,
-    createdAt: existing2?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    // A token without --agent keeps the legacy machine-wide behavior. An
+    // agent-scoped setup writes a credential file below and must not replace it.
+    token: requestedAgents.length !== 1 ? options2.token ?? (sameEndpoint ? existing2?.token : void 0) : sameEndpoint ? existing2?.token : void 0,
+    agentCredentials: sameEndpoint ? existing2?.agentCredentials : void 0,
+    createdAt: sameEndpoint ? existing2?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString() : (/* @__PURE__ */ new Date()).toISOString(),
     workspaceStateVersion: 1,
-    workspaceBindings: existing2?.workspaceBindings ?? {},
-    userGroupId: existing2?.userGroupId,
-    userGroupName: existing2?.userGroupName
-  };
+    workspaceBindings: sameEndpoint ? existing2?.workspaceBindings ?? {} : {},
+    userGroupId: sameEndpoint ? existing2?.userGroupId : void 0,
+    userGroupName: sameEndpoint ? existing2?.userGroupName : void 0,
+    routes: sameEndpoint ? existing2?.routes : void 0
+  };
+  const configuredKeys = [];
+  if (requestedAgents.length === 1 && options2.token) {
+    configuredKeys.push(await writeAgentCredential(
+      config,
+      { tool: requestedAgents[0] },
+      options2.token
+    ));
+  } else if (requestedAgents.length === 1) {
+    const key = credentialKey({ tool: requestedAgents[0] });
+    if (config.agentCredentials?.[key]) configuredKeys.push(key);
+  }
   const workspacePath = await resolveWorkspacePath(options2.workspacePath ?? process.cwd());
-  if (workspacePath) await enrollWorkspace(config, workspacePath);
+  if (workspacePath) await enrollWorkspace(config, workspacePath, configuredKeys);
   await ensureDir(getLocalAgentHome());
   await saveLocalAgentConfig(config);
-  if (options2.token) {
+  if (existing2 && !sameEndpoint) {
+    await remove(path76.join(getLocalAgentHome(), credentialEndpointDir(existing2.endpoint))).catch((error2) => {
+      log.warn(`Could not remove credentials for the previous HTTP endpoint: ${error2.message}`);
+    });
+  }
+  if (options2.token && requestedAgents.length !== 1) {
     await writeTokenFile(getTokenPath(), options2.token);
   }
   const teamConfig = createLocalAgentTeamConfig(endpoint);
@@ -64738,7 +64790,7 @@ async function pullLocalAgentForCwd(context) {
 async function describeLocalAgent(options2 = {}) {
   const config = await loadLocalAgentConfig(options2);
   if (!config) return null;
-  const boundProjects = Object.entries(config.workspaceBindings).filter(([, b2]) => (b2.projectId ?? 0) > 0).map(([workspacePath, b2]) => ({ path: workspacePath, projectName: b2.projectName, projectId: b2.projectId }));
+  const boundProjects = Object.entries(config.workspaceBindings).filter(([, b2]) => b2.projectId !== 0).map(([workspacePath, b2]) => ({ path: workspacePath, projectName: b2.projectName, projectId: b2.projectId }));
   const manifest = await loadManifest2();
   const counts = { skills: 0, rules: 0, claudemd: 0 };
   for (const scope of Object.values(manifest.scopes)) {
@@ -64957,13 +65009,7 @@ async function bindCurrentProject(options2) {
         "Current workspace is not enrolled. Run `teamai init --http <ENDPOINT> --token <API_TOKEN>` here first."
       );
     }
-    await persistWorkspaceBinding(
-      config,
-      options2?.cwd ?? process.cwd(),
-      workspacePath,
-      0,
-      "__skipped__"
-    );
+    await persistWorkspaceBinding(config, options2?.cwd ?? process.cwd(), workspacePath, 0, "__skipped__");
     log.info(`\u5DF2\u8DF3\u8FC7\u7ED1\u5B9A\uFF0C\u4EE5\u540E\u4E0D\u518D\u63D0\u793A\u6B64\u5DE5\u4F5C\u533A\u3002`);
     return;
   }
@@ -65325,7 +65371,7 @@ __export(git_exclude_delivered_exports, {
   describeUnreadableGitExcludeSetting: () => describeUnreadableGitExcludeSetting,
   reportDeliveredGitExclude: () => reportDeliveredGitExclude
 });
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import path79 from "path";
 function createDeliveryRecorder() {
   const reports = /* @__PURE__ */ new Map();
@@ -65376,7 +65422,7 @@ function deliveredOwnerElsewhere(localConfig2) {
 }
 function partitionId(localConfig2) {
   const dataHome = getDataHome(localConfig2);
-  return /-([0-9a-f]{16})$/.exec(path79.basename(dataHome))?.[1] ?? createHash10("sha256").update(path79.resolve(dataHome)).digest("hex").slice(0, 16);
+  return /-([0-9a-f]{16})$/.exec(path79.basename(dataHome))?.[1] ?? createHash11("sha256").update(path79.resolve(dataHome)).digest("hex").slice(0, 16);
 }
 function partitionOwner(localConfig2, name) {
   return {
@@ -66129,15 +66175,19 @@ async function initHttp(url, options2) {
   await reconcileHooksForInit(teamConfig, localConfig2, filterAgents2);
   const { initLocalAgentHttp: initLocalAgentHttp2 } = await Promise.resolve().then(() => (init_local_agent(), local_agent_exports));
   try {
+    const explicitLocalAgentToken = options2.token?.trim() || process.env.TEAMAI_API_TOKEN?.trim() || process.env.TEAMAI_API_KEY?.trim();
     await initLocalAgentHttp2({
       endpoint: url,
-      token: options2.token,
+      token: explicitLocalAgentToken || (filterAgents2 ? void 0 : apiKey),
       force: options2.force,
       filterAgents: filterAgents2,
       workspacePath: projectRoot ?? process.cwd()
     });
   } catch (e) {
-    log.debug(`Local agent init: ${e.message}`);
+    log.error(`Local agent init failed: ${e.message}`);
+    process.exitCode = 1;
+    closePrompt();
+    return;
   }
   await runInitScript(localConfig2, "postInit", options2.dryRun, true);
   log.success("teamai initialized (HTTP read-only)!");
@@ -67478,7 +67528,7 @@ __export(learnings_publish_exports, {
   publishLearningsMaintenance: () => publishLearningsMaintenance,
   publishQueuedLearnings: () => publishQueuedLearnings
 });
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import path83 from "path";
 import fs40 from "fs";
 function commitMessageFor(username) {
@@ -67679,7 +67729,7 @@ async function hasUncommittedChange(checkout, rel) {
 }
 async function contentDigest(file) {
   if (!fs40.existsSync(file)) return null;
-  return createHash11("sha256").update(await fs40.promises.readFile(file)).digest("hex");
+  return createHash12("sha256").update(await fs40.promises.readFile(file)).digest("hex");
 }
 async function maintenanceRecordsDir(checkout) {
   const gitPath2 = (await createGitWithBlockTimeout(checkout).raw(["rev-parse", "--git-path", "teamai-maintenance"])).trim();
@@ -71133,7 +71183,7 @@ var init_definition = __esm({
 });
 
 // src/scorers/cache.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import fs48 from "fs/promises";
 import path95 from "path";
 function cacheDir(config) {
@@ -71276,7 +71326,7 @@ async function syncScorerDefinitions(config, options2 = {}) {
     }
     const { name } = parsed.definition;
     if (parsed.definition.isolation === "verified") result.verified.push(relativePath);
-    const sourceHash = createHash12("sha256").update(content).digest("hex");
+    const sourceHash = createHash13("sha256").update(content).digest("hex");
     const revision = await (reachable ??= remotelyReachableRevision(knowledgeRoot));
     const holds = await revisionHoldsSources(knowledgeRoot, revision, [{ path: relativePath, content }]);
     const previous = await withoutStaleTeamRevision(knowledgeRoot, await readCache2(config, name));
@@ -74441,7 +74491,7 @@ __export(cache_exports, {
   syncWorkflowDefinitions: () => syncWorkflowDefinitions,
   workflowsRunBy: () => workflowsRunBy
 });
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import fs49 from "fs/promises";
 import os11 from "os";
 import path97 from "path";
@@ -74646,7 +74696,7 @@ async function syncWorkflowDefinitions(config, options2 = {}) {
       checked.push({ stem, relativePath, diagnostics: resolved2.diagnostics });
       continue;
     }
-    const hash2 = createHash13("sha256").update(content);
+    const hash2 = createHash14("sha256").update(content);
     for (const source of resolved2.sources) {
       hash2.update("\0").update(source.path).update("\0").update(source.content);
     }
@@ -74783,7 +74833,7 @@ async function loadWorkflowTree(config, cached) {
   if (failed4) return { failed: failed4 };
   const teamRevision = cached.teamRevision !== void 0 && revisions.every((revision) => revision === cached.teamRevision) ? cached.teamRevision : void 0;
   if (hashes.length === 0) return { workflows, sourceHash: cached.sourceHash, ...teamRevision ? { teamRevision } : {} };
-  const hash2 = createHash13("sha256").update(cached.sourceHash);
+  const hash2 = createHash14("sha256").update(cached.sourceHash);
   for (const [name, sourceHash] of hashes.sort(([left], [right]) => left.localeCompare(right))) {
     hash2.update("\0").update(name).update("\0").update(sourceHash);
   }
@@ -77278,7 +77328,7 @@ __export(team_push_exports, {
   withDroppedRollouts: () => withDroppedRollouts
 });
 import fs55 from "fs";
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import path105 from "path";
 async function readExistingStats(statsPath) {
   try {
@@ -77447,7 +77497,7 @@ function tokenDelta(cur, prev) {
   };
 }
 function segmentKey(transcript2) {
-  return createHash14("sha256").update(transcript2).digest("hex").slice(0, 16);
+  return createHash15("sha256").update(transcript2).digest("hex").slice(0, 16);
 }
 function reportedSegments(entry) {
   const segments2 = {};
@@ -78319,7 +78369,7 @@ var init_delivery_schema = __esm({
 });
 
 // src/workflow/snapshot.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import fs56 from "fs";
 import path106 from "path";
 function withCommitIds(schema) {
@@ -78336,7 +78386,7 @@ function snapshotText(snapshot) {
 `;
 }
 function definitionHash(definition, workflows = {}) {
-  return createHash15("sha256").update(canonicalJson2({ definition, workflows })).digest("hex");
+  return createHash16("sha256").update(canonicalJson2({ definition, workflows })).digest("hex");
 }
 function snapshotBody(snapshot) {
   const { snapshot: _format, run: _run, owner: _owner, ownedAt: _ownedAt, stateRevision: _revision, write: _write, ...body } = snapshot;
@@ -79299,7 +79349,7 @@ var init_records = __esm({
 });
 
 // src/scorers/label.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 function sumUsage(first2, second) {
   if (!first2 || !second) return first2 ?? second;
   const tokens = (left, right) => left === void 0 && right === void 0 ? void 0 : (left ?? 0) + (right ?? 0);
@@ -79327,10 +79377,10 @@ function labelKey(label) {
   return canonicalJson2({ scorer: label.scorer, sourceHash: label.rubric.sourceHash, subject: label.subject, judge: label.judge.kind });
 }
 function labelId(label) {
-  return createHash16("sha256").update(labelKey(label)).digest("hex");
+  return createHash17("sha256").update(labelKey(label)).digest("hex");
 }
 function labelVersion(label) {
-  return createHash16("sha256").update(canonicalJson2(label)).digest("hex");
+  return createHash17("sha256").update(canonicalJson2(label)).digest("hex");
 }
 function newestLabels(labels) {
   const newest = /* @__PURE__ */ new Map();
@@ -89062,7 +89112,7 @@ var init_scrub = __esm({
 });
 
 // src/session-flow/agent-session.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import fs77 from "fs";
 import path129 from "path";
 function noAdapter(platform3, use, os25 = process.platform) {
@@ -89144,7 +89194,7 @@ async function writeCopyOnce(target, { session, sourcePlatform, cwd }) {
   } catch (e) {
     return { status: "failed", failure: { code: "invalid_workspace", cwd, message: messageOf(e) } };
   }
-  const key = createHash19("sha256").update(`${targetPlatform}\0${targetId}`).digest("hex").slice(0, 16);
+  const key = createHash20("sha256").update(`${targetPlatform}\0${targetId}`).digest("hex").slice(0, 16);
   const lockPath = path129.join(getTeamaiHomeDir(), "locks", `session-copy-${key}.lock`);
   for (let attempt = 1; !await acquireLock(lockPath); attempt++) {
     if (attempt === COPY_LOCK_ATTEMPTS) {
@@ -90352,12 +90402,12 @@ var init_settings = __esm({
 });
 
 // src/scorers/entry.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 function entryIdOf(scorer, subject) {
-  return `s${createHash20("sha256").update(canonicalJson2({ scorer, subject })).digest("hex").slice(0, 13)}`;
+  return `s${createHash21("sha256").update(canonicalJson2({ scorer, subject })).digest("hex").slice(0, 13)}`;
 }
 function sessionEntryIdOf(scorer, sourceHash, subject) {
-  return `s${createHash20("sha256").update(canonicalJson2({ scorer, sourceHash, subject })).digest("hex").slice(0, 13)}`;
+  return `s${createHash21("sha256").update(canonicalJson2({ scorer, sourceHash, subject })).digest("hex").slice(0, 13)}`;
 }
 function isLeaseRef(value) {
   return LEASE_REF.test(value);
@@ -90509,11 +90559,11 @@ var init_evidence = __esm({
 });
 
 // src/scorers/sampling.ts
-import { createHash as createHash21 } from "crypto";
+import { createHash as createHash22 } from "crypto";
 function isSampled(scorer, subject, samplingRate) {
   if (samplingRate <= 0) return false;
   if (samplingRate >= 100) return true;
-  const digest = createHash21("sha256").update(canonicalJson2({ scorer, ...subject })).digest();
+  const digest = createHash22("sha256").update(canonicalJson2({ scorer, ...subject })).digest();
   return digest.readUInt32BE(0) % 1e4 < samplingRate * 100;
 }
 var init_sampling = __esm({
@@ -91177,7 +91227,7 @@ var init_workspace = __esm({
 });
 
 // src/workflow/worktree.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 import { execFile as execFile6, spawn as spawn6 } from "child_process";
 import fs83 from "fs/promises";
 import path137 from "path";
@@ -91238,7 +91288,7 @@ function git(cwd, args, options2) {
 }
 function worktreePath2(main2, branch) {
   const safe = branch.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "") || "step";
-  const hash2 = createHash22("sha256").update(branch).digest("hex").slice(0, 12);
+  const hash2 = createHash23("sha256").update(branch).digest("hex").slice(0, 12);
   return path137.join(main2, ".teamai", "workflow-worktrees", `${safe}-${hash2}`);
 }
 function stepCheckout(active, branch) {
@@ -92103,7 +92153,7 @@ var init_scoring_evidence = __esm({
 import * as fs85 from "fs";
 import * as path139 from "path";
 import { execFileSync as execFileSync7 } from "child_process";
-import { createHash as createHash23, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash24, randomUUID as randomUUID13 } from "crypto";
 function utcNow() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -92235,7 +92285,7 @@ function assertNoSymlinkedAncestors(target, root) {
 }
 async function withSessionPublicationLock(repoRoot, fn) {
   const real = await fs85.promises.realpath(repoRoot).catch(() => path139.resolve(repoRoot));
-  const key = createHash23("sha256").update(real).digest("hex").slice(0, 16);
+  const key = createHash24("sha256").update(real).digest("hex").slice(0, 16);
   const lockPath = path139.join(getTeamaiHomeDir(), "locks", `session-publish-${key}.lock`);
   for (let attempt = 1; !await acquireLock(lockPath); attempt++) {
     if (attempt === INDEX_LOCK_ATTEMPTS) return { status: "busy", lockPath };
@@ -92249,7 +92299,7 @@ async function withSessionPublicationLock(repoRoot, fn) {
 }
 async function withSessionIndexLock(repoRoot, fn) {
   const real = await fs85.promises.realpath(repoRoot).catch(() => path139.resolve(repoRoot));
-  const key = createHash23("sha256").update(path139.join(real, "sessions")).digest("hex").slice(0, 16);
+  const key = createHash24("sha256").update(path139.join(real, "sessions")).digest("hex").slice(0, 16);
   const lockPath = path139.join(getTeamaiHomeDir(), "locks", `sessions-${key}.lock`);
   for (let attempt = 1; !await acquireLock(lockPath); attempt++) {
     if (attempt === INDEX_LOCK_ATTEMPTS) return { status: "busy", lockPath };
@@ -106388,7 +106438,7 @@ __export(source_exports, {
   sourceSyncWarnings: () => sourceSyncWarnings
 });
 import path158 from "path";
-import { createHash as createHash24 } from "crypto";
+import { createHash as createHash25 } from "crypto";
 function sourceLockPath() {
   return path158.join(getUserHome(), ".teamai", ".source-lifecycle-lock");
 }
@@ -106428,7 +106478,7 @@ async function listSourceNames() {
   }
 }
 function getSourceRepoId(source) {
-  return createHash24("sha256").update(source.repo.trim()).digest("hex");
+  return createHash25("sha256").update(source.repo.trim()).digest("hex");
 }
 function getSourceRepoCacheDir(source) {
   return path158.join(getUserHome(), ".teamai", "source-repos", getSourceRepoId(source));
@@ -106450,7 +106500,7 @@ async function listInstallationRecords() {
   return records2;
 }
 function getSourceManifestPath(sourceName, localConfig2) {
-  const installationId = createHash24("sha256").update(JSON.stringify([
+  const installationId = createHash25("sha256").update(JSON.stringify([
     path158.resolve(resolveBaseDir(localConfig2)),
     path158.resolve(localConfig2.repo.localPath)
   ])).digest("hex");
@@ -106838,6 +106888,7 @@ async function sourceAddHttp(endpoint, options2) {
     endpoint: trimmed2,
     token: options2.token,
     force: true,
+    filterAgents: normalizeAgentList(options2.agent),
     workspacePath: mainConfig?.projectRoot ?? process.cwd()
   });
   log.success(`HTTP source added (${trimmed2}).`);
@@ -107566,6 +107617,7 @@ var init_source2 = __esm({
     init_builtin_skills();
     init_home();
     init_update();
+    init_known_agents();
     init_path_safety();
     init_types5();
   }
@@ -108077,13 +108129,13 @@ __export(builtin_skills_exports, {
   skillsGuardBase: () => skillsGuardBase
 });
 import fs95 from "fs";
-import { createHash as createHash25 } from "crypto";
+import { createHash as createHash26 } from "crypto";
 import path161 from "path";
 function isCliOwnedSkillName(name) {
   return BUILTIN_SKILL_NAMES.has(name) || LEGACY_BUILTIN_SKILL_NAMES.has(name);
 }
 function packagedSkillDigest(content) {
-  return createHash25("sha256").update(content).digest("hex");
+  return createHash26("sha256").update(content).digest("hex");
 }
 async function ownedSkillFiles(skillName, paths) {
   const owned = /* @__PURE__ */ new Map();
@@ -108209,7 +108261,7 @@ async function removeOwnedFiles(dir, owned, baseDir, backupDir) {
 }
 function skillBackupDir(baseDir, tool, skillRoot, skillName) {
   const rootSlug = skillRoot.replace(/[\\/:]+/g, "-").replace(/^-+/, "");
-  const baseSlug = `${path161.basename(baseDir) || "root"}-${createHash25("sha256").update(baseDir).digest("hex").slice(0, 8)}`;
+  const baseSlug = `${path161.basename(baseDir) || "root"}-${createHash26("sha256").update(baseDir).digest("hex").slice(0, 8)}`;
   return path161.join(getUserHome(), ".teamai", "removed-skills", PRUNE_RUN_ID, baseSlug, tool, rootSlug, skillName);
 }
 async function skillsGuardBase(scopeRoot, skillsDir) {
@@ -113355,7 +113407,7 @@ __export(types_exports, {
   usesBranchWorktree: () => usesBranchWorktree
 });
 import path171 from "path";
-import { createHash as createHash26 } from "crypto";
+import { createHash as createHash27 } from "crypto";
 function parseInstallScope(value) {
   const parsed = InstallScopeSchema.safeParse(value);
   if (!parsed.success) throw new Error(`Invalid scope "${value}". Use "workspace" or "user".`);
@@ -113423,7 +113475,7 @@ function managedMcpManifestKey(tool, projectScope) {
   return projectScope ? `${owner}:project` : owner;
 }
 function managedMcpWorkspaceId(workspaceRoot) {
-  return createHash26("sha1").update(workspaceRoot).digest("hex").slice(0, 12);
+  return createHash27("sha1").update(workspaceRoot).digest("hex").slice(0, 12);
 }
 function managedMcpManifestPath(dataHome, workspaceRoot) {
   if (workspaceRoot) {
@@ -114884,7 +114936,7 @@ var init_types5 = __esm({
 
 // src/claude-hook-host.ts
 import fs99 from "fs";
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import path172 from "path";
 function copilotRunsEntries(data) {
   const file = data;
@@ -114892,7 +114944,7 @@ function copilotRunsEntries(data) {
   return Object.entries(file.hooks).flatMap(([event, entries2]) => !Array.isArray(entries2) ? [] : entries2.filter((entry) => entry?.type === "command").flatMap((entry) => [entry.bash, entry.powershell, entry.command].filter((command) => typeof command === "string").map((command) => [event, entry.matcher, command])));
 }
 function copilotCopyKey(event, matcher, command) {
-  return createHash27("sha256").update(JSON.stringify([event, matcher && matcher !== "*" ? matcher : "", command])).digest("hex");
+  return createHash28("sha256").update(JSON.stringify([event, matcher && matcher !== "*" ? matcher : "", command])).digest("hex");
 }
 function claudeHookOtherHostSkip(copilotEvent, copilotMatcher, command) {
   if (!copilotEvent) return CURSOR_HOOK_SKIP;
@@ -114974,7 +115026,7 @@ var init_claude_hook_host = __esm({
 });
 
 // src/copilot-hook-claim.ts
-import { createHash as createHash28 } from "crypto";
+import { createHash as createHash29 } from "crypto";
 import fs100 from "fs";
 import path173 from "path";
 function claimDay(raw) {
@@ -115002,7 +115054,7 @@ function claimCopilotHookEvent(event, matcher, raw, env3 = process.env) {
   if (!day) return true;
   const root = path173.join(getTeamaiHomeDir(), CLAIMS_DIR);
   removeOldClaims(root, day);
-  const key = createHash28("sha256").update(JSON.stringify([env3.COPILOT_AGENT_SESSION_ID ?? "", event, matcher, raw])).digest("hex");
+  const key = createHash29("sha256").update(JSON.stringify([env3.COPILOT_AGENT_SESSION_ID ?? "", event, matcher, raw])).digest("hex");
   try {
     fs100.mkdirSync(path173.join(root, day), { recursive: true });
     fs100.writeFileSync(path173.join(root, day, key), "", { flag: "wx" });
@@ -115641,7 +115693,7 @@ __export(hooks_exports2, {
   unregisterCheckoutFromSharedManifest: () => unregisterCheckoutFromSharedManifest
 });
 import path176 from "path";
-import { createHash as createHash29 } from "crypto";
+import { createHash as createHash30 } from "crypto";
 import { isDeepStrictEqual as isDeepStrictEqual10 } from "util";
 import { realpathSync as realpathSync6 } from "fs";
 import { lstat as lstat2, readdir as readdir2, rm as rm2 } from "fs/promises";
@@ -116386,7 +116438,7 @@ function copilotPowershellCommand(command) {
   return match[1] === "bash" ? `${match[2]} 2>$null; exit 0` : `& ${match[1]} -lc "${match[2]} 2>/dev/null"; exit 0`;
 }
 function copilotGlobalSource(file) {
-  return createHash29("sha256").update(path176.resolve(file)).digest("hex");
+  return createHash30("sha256").update(path176.resolve(file)).digest("hex");
 }
 function toCopilotEntry(def, globalSource) {
   const command = globalSource && def.source === "builtin" ? def.command.replace("--tool copilot", `--tool copilot --copilot-global ${copilotGlobalSource(globalSource)}`) : def.command;
@@ -117704,7 +117756,7 @@ async function codexTrustTargets(teamConfig, localConfig2, selectedAgents) {
   };
 }
 async function codexTrustFingerprint(targets) {
-  const hash2 = createHash29("sha256").update(JSON.stringify({ ...targets, inputs: void 0 }));
+  const hash2 = createHash30("sha256").update(JSON.stringify({ ...targets, inputs: void 0 }));
   for (const file of targets.inputs) hash2.update(`\0${file}\0${await readFileSafe(file) ?? ""}`);
   hash2.update(`\0${codexBuildsIdentity()}`);
   return hash2.digest("hex");
@@ -124183,7 +124235,7 @@ var init_overlay = __esm({
 });
 
 // src/workflow/place/worktree-snapshot.ts
-import { createHash as createHash30 } from "crypto";
+import { createHash as createHash31 } from "crypto";
 import { execFile as execFile9 } from "child_process";
 import fs106 from "fs/promises";
 import path185 from "path";
@@ -124211,7 +124263,7 @@ async function hashPath(workspace, relative3) {
   try {
     const stats = await fs106.lstat(full);
     const bytes = stats.isSymbolicLink() ? await fs106.readlink(full) : await fs106.readFile(full);
-    return createHash30("sha256").update(bytes).digest("hex");
+    return createHash31("sha256").update(bytes).digest("hex");
   } catch {
     return "missing";
   }
@@ -124541,7 +124593,7 @@ var init_setup = __esm({
 });
 
 // src/workflow/place/writer.ts
-import { createHash as createHash31 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 import fs109 from "fs/promises";
 import path188 from "path";
 async function mergeBranches({ dir, run: run3, step, executor, merge }) {
@@ -124574,7 +124626,7 @@ async function conflictsPath(dir) {
   return path188.resolve(dir, printed);
 }
 function hashText(text2) {
-  return createHash31("sha256").update(text2).digest("hex");
+  return createHash32("sha256").update(text2).digest("hex");
 }
 async function rememberConflicts(dir) {
   const current = await conflictContents(dir);
@@ -131242,7 +131294,7 @@ var init_session_cmd = __esm({
 // src/dashboard/workspaces.ts
 import fs119 from "fs/promises";
 import path206 from "path";
-import { createHash as createHash32 } from "crypto";
+import { createHash as createHash33 } from "crypto";
 async function configAt(home) {
   try {
     return LocalConfigSchema.parse(import_yaml42.default.parse(await fs119.readFile(path206.join(home, "config.yaml"), "utf8")));
@@ -131277,7 +131329,7 @@ async function dashboardWorkspaces(events) {
     if (!config) return;
     seen.add(anchor);
     result.push({
-      id: createHash32("sha256").update(anchor).digest("hex").slice(0, 24),
+      id: createHash33("sha256").update(anchor).digest("hex").slice(0, 24),
       label: path206.basename(root),
       scope: "project",
       root,
@@ -132342,7 +132394,7 @@ __export(distribution_exports, {
   saveProjects: () => saveProjects,
   saveRoles: () => saveRoles
 });
-import { createHash as createHash33 } from "crypto";
+import { createHash as createHash34 } from "crypto";
 function assertRolesEditable(ownConfig) {
   if (!ownConfig.roleAssignment) return;
   throw new HttpError(409, `Roles are assigned in ${ROLE_ASSIGNMENTS_FILE} in the team repo and cannot be changed here. Open a merge request against that file, or ask a code owner of manifest/ to.`);
@@ -132356,7 +132408,7 @@ function selectionOf2(config) {
 }
 function revisionOf(config) {
   const identity2 = { scope: config.scope, dataHome: config.dataHome ?? null, projectRoot: config.projectRoot ?? null };
-  return createHash33("sha256").update(JSON.stringify({ identity: identity2, selection: selectionOf2(config) })).digest("hex").slice(0, 16);
+  return createHash34("sha256").update(JSON.stringify({ identity: identity2, selection: selectionOf2(config) })).digest("hex").slice(0, 16);
 }
 async function readManifest3(kind, load2, repoPath) {
   try {
@@ -135264,7 +135316,7 @@ var init_graph_index_schema = __esm({
 });
 
 // src/wiki-engine/code-knowledge/code-collector.ts
-import { createHash as createHash34 } from "crypto";
+import { createHash as createHash35 } from "crypto";
 import { execFile as execFile10 } from "child_process";
 import { readFile as readFile7, readdir as readdir4, stat as stat5 } from "fs/promises";
 import path215 from "path";
@@ -135308,7 +135360,7 @@ async function collectCode(options2) {
       path: filePath,
       relativePath,
       language,
-      sha256: createHash34("sha256").update(content).digest("hex"),
+      sha256: createHash35("sha256").update(content).digest("hex"),
       content,
       isKeyFile: isKeyFile(relativePath, language)
     });
@@ -142868,7 +142920,7 @@ var init_code_knowledge_recall = __esm({
 });
 
 // src/codebase-freshness.ts
-import { createHash as createHash35 } from "crypto";
+import { createHash as createHash36 } from "crypto";
 import { lstat as lstat5, readFile as readFile16, readdir as readdir10, realpath as realpath10, stat as stat11 } from "fs/promises";
 import path235 from "path";
 function errorCode(error2) {
@@ -143054,7 +143106,7 @@ async function checkOneSource(source, manifest, checkout) {
   if (!fileStat.isFile()) return unknown();
   try {
     const content = await readFile16(actualPath, "utf8");
-    const actualHash = createHash35("sha256").update(content).digest("hex");
+    const actualHash = createHash36("sha256").update(content).digest("hex");
     return {
       ...source,
       freshness: actualHash === expectedHash ? "current" : "stale",
@@ -153491,7 +153543,7 @@ sourceCmd.command("remove <name>").description("Remove a source and clean up its
   const { sourceRemove: sourceRemove2 } = await Promise.resolve().then(() => (init_source2(), source_exports));
   await sourceRemove2(name, globalOpts);
 });
-sourceCmd.command("add-http <endpoint>").description("Add an HTTP source (report/sync/ack) alongside a git main repo").option("--token <key>", "API token for the HTTP endpoint (stored 0600, never committed)").option("--force", "Overwrite an existing HTTP source config").action(async (endpoint, cmdOpts) => {
+sourceCmd.command("add-http <endpoint>").description("Add an HTTP source (report/sync/ack) alongside a git main repo").option("--token <key>", "API token for the HTTP endpoint (stored 0600, never committed)").option("--agent <name>", "Agent instance that owns this token (repeat setup for each agent)", (val, acc) => acc.concat(val), []).option("--force", "Overwrite an existing HTTP source config").action(async (endpoint, cmdOpts) => {
   const globalOpts = program2.opts();
   const { sourceAddHttp: sourceAddHttp2 } = await Promise.resolve().then(() => (init_source2(), source_exports));
   await sourceAddHttp2(endpoint, { ...globalOpts, ...cmdOpts });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-ai/teamai-cli",
-  "version": "0.30.3",
+  "version": "0.30.5",
   "description": "TeamAI — Make Every Team AI Native (skill sync + shared knowledge base, powered by Git)",
   "type": "module",
   "bin": {

package/skill-data/core/references/commands.md

@@ -175,6 +175,7 @@ Generated: do not edit by hand. Regenerate with
   - `teamai source remove <name>` — Remove a source and clean up its skills
   - `teamai source add-http <endpoint>` — Add an HTTP source (report/sync/ack) alongside a git main repo
     - `--token <key>` — API token for the HTTP endpoint (stored 0600, never committed)
+    - `--agent <name>` — Agent instance that owns this token (repeat setup for each agent)
     - `--force` — Overwrite an existing HTTP source config
   - `teamai source remove-http` — Remove the HTTP source and clean up its resources
   - `teamai source list` — List all configured sources

package/skill-data/setup/references/join-member.md

@@ -104,11 +104,19 @@ was skipped and why.
 cannot use Git. If the admin provides an HTTP endpoint + API key instead, use:
 
 ```bash
-teamai init --http https://your-team-host/api --token <api-key>
+teamai init --http https://your-team-host/api --token <api-key> --agent <tool>
 ```
 
 This is a read-only consumer mode — `push` / `contribute` are not available, but
-skills and rules still sync.
+skills and rules still sync. Run it from each workspace that should be managed:
+the user-level hooks are shared by the machine, but an unrelated workspace is
+not reported or allowed to receive workspace resources. ClawPro project binding
+is optional; skipping it keeps general workspace sync enabled while declining
+resources tied to a specific project. Treat each linked Git worktree as a
+separate workspace and run HTTP setup in each one that should be managed.
+ClawPro instance tokens are Agent-specific. On a machine with multiple AI tools,
+run setup once per tool with its own `--agent` and token; TeamAI keeps those
+credentials separate while allowing them to manage the same workspace.
 
 **Claude Code or Codex kept in a different directory (`CLAUDE_CONFIG_DIR`,
 `CODEX_HOME`):** `init` records that directory (as `toolRoots.claude` /