@wayai/cli 0.3.150 → 0.3.151

package/dist/index.js

@@ -447,11 +447,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path36) {
+function addApiBreadcrumb(method, path35) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path36}`,
+    message: `${method} ${path35}`,
     level: "info"
   });
 }
@@ -905,8 +905,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path36, errorMaps, issueData } = params;
-      const fullPath = [...path36, ...issueData.path || []];
+      const { data, path: path35, errorMaps, issueData } = params;
+      const fullPath = [...path35, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1217,11 +1217,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path36, key) {
+      constructor(parent, value, path35, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path36;
+        this._path = path35;
         this._key = key;
       }
       get path() {
@@ -4634,12 +4634,12 @@ function validateFollowupLinks(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path36 = ["followups", i, "after_followup_id"];
+    const path35 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -4648,7 +4648,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -4658,7 +4658,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -4670,7 +4670,7 @@ function validateFollowupLinks(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -4678,7 +4678,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -4754,12 +4754,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path36, errors, opts = {}) {
+function validateSchema(schema, path35, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path36 || "<root>",
+      path: path35 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -4767,7 +4767,7 @@ function validateSchema(schema, path36, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path36,
+      path: path35,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -4775,14 +4775,14 @@ function validateSchema(schema, path36, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path36 ? `${path36}.type` : "type",
+        path: path35 ? `${path35}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path36}.type`,
+      path: `${path35}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -4792,25 +4792,25 @@ function validateSchema(schema, path36, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path36}.enum[${i}]`,
+            path: `${path35}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -4820,7 +4820,7 @@ function validateSchema(schema, path36, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path36}.${key}`,
+        path: `${path35}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -4829,45 +4829,45 @@ function validateSchema(schema, path36, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path36}.properties`,
+        path: `${path35}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path36}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path35}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path36}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path35}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path36}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path35}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path36}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path35}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path36}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path35}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path36}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path35}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path36}.${k}`;
+    const fieldPath = `${path35}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5012,8 +5012,8 @@ function evalInitialStateError(input) {
     const parsed = evalInitialStateEntry.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path36 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path36} is invalid: ${issue?.message ?? "malformed"}`;
+      const path35 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path35} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -5201,10 +5201,10 @@ function refineHubAsCodeEvals(config, ctx) {
 function refineHubAsCodeEvalAttachments(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path36, turn, name) => {
+  const addTurnIssue = (path35, turn, name) => {
     const error = evalTurnAttachmentsError(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path36, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path35, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes(turn)) referencedHashes.add(hash);
@@ -5350,11 +5350,11 @@ function refineHubAsCodeDelegation(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path36 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path35 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -5362,7 +5362,7 @@ function refineHubAsCodeDelegation(config, ctx) {
       if (!CONTEXT_BOUNDARIES.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES.join(", ")}`
         });
       }
@@ -8915,10 +8915,10 @@ function toDataProxyPath(v1Path) {
   }
   return `${DATA_PROXY_PREFIX}${v1Path.slice(REKOR_V1_PREFIX.length)}`;
 }
-function withOrgSelector(path36, orgId) {
-  if (!orgId) return path36;
-  const separator = path36.includes("?") ? "&" : "?";
-  return `${path36}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
+function withOrgSelector(path35, orgId) {
+  if (!orgId) return path35;
+  const separator = path35.includes("?") ? "&" : "?";
+  return `${path35}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
 }
 function dataErrorMessage(err) {
   if (!(err instanceof ApiError)) return null;
@@ -8952,13 +8952,13 @@ var init_api_client = __esm({
        * telling them apart by body shape misreads one for the other.
        */
       path;
-      constructor(method, path36, status, body) {
+      constructor(method, path35, status, body) {
         const safeBody = maskSecretsInMessage(body);
-        super(`API request failed: ${method} ${path36} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path35} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
-        this.path = path36;
+        this.path = path35;
       }
       /** True when the status code is a 4xx client error (expected user-facing condition, not a bug). */
       get isExpected() {
@@ -9060,8 +9060,8 @@ var init_api_client = __esm({
           ...opts?.check && { check: true }
         });
       }
-      async lookup(path36, opts) {
-        const params = new URLSearchParams({ path: path36 });
+      async lookup(path35, opts) {
+        const params = new URLSearchParams({ path: path35 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -9504,9 +9504,9 @@ var init_api_client = __esm({
        * sandbox for this conversation, or the blob was purged).
        */
       async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path36 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path36);
-        const url = `${this.apiUrl}${path36}`;
+        const path35 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
+        addApiBreadcrumb("GET", path35);
+        const url = `${this.apiUrl}${path35}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -9520,7 +9520,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path36, response.status, await response.text());
+          throw new ApiError("GET", path35, response.status, await response.text());
         }
         return new Uint8Array(await response.arrayBuffer());
       }
@@ -9560,9 +9560,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path36, body, extraHeaders, contentType) {
-        addApiBreadcrumb(method, path36);
-        const url = `${this.apiUrl}${path36}`;
+      async request(method, path35, body, extraHeaders, contentType) {
+        addApiBreadcrumb(method, path35);
+        const url = `${this.apiUrl}${path35}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body, extraHeaders, contentType);
@@ -9587,7 +9587,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path36, response.status, errorBody);
+          throw new ApiError(method, path35, response.status, errorBody);
         }
       }
       /**
@@ -9649,9 +9649,9 @@ var init_api_client = __esm({
        * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
        */
       async dataDownload(v1Path, orgId) {
-        const path36 = withOrgSelector(toDataProxyPath(v1Path), orgId);
-        addApiBreadcrumb("GET", path36);
-        const url = `${this.apiUrl}${path36}`;
+        const path35 = withOrgSelector(toDataProxyPath(v1Path), orgId);
+        addApiBreadcrumb("GET", path35);
+        const url = `${this.apiUrl}${path35}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -9665,7 +9665,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path36, response.status, await response.text());
+          throw new ApiError("GET", path35, response.status, await response.text());
         }
         return {
           bytes: new Uint8Array(await response.arrayBuffer()),
@@ -9817,12 +9817,12 @@ function validateFollowupLinks2(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path36 = ["followups", i, "after_followup_id"];
+    const path35 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -9831,7 +9831,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -9841,7 +9841,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -9853,7 +9853,7 @@ function validateFollowupLinks2(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -9861,7 +9861,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -9937,12 +9937,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path36, errors, opts = {}) {
+function validateSchema2(schema, path35, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path36 || "<root>",
+      path: path35 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -9950,7 +9950,7 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path36,
+      path: path35,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -9958,14 +9958,14 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path36 ? `${path36}.type` : "type",
+        path: path35 ? `${path35}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path36}.type`,
+      path: `${path35}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -9975,25 +9975,25 @@ function validateSchema2(schema, path36, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path36}.enum[${i}]`,
+            path: `${path35}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -10003,7 +10003,7 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path36}.${key}`,
+        path: `${path35}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -10012,45 +10012,45 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path36}.properties`,
+        path: `${path35}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path36}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path35}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path36}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path35}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path36}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path35}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path36}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path35}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path36}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path35}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path36}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path35}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path36}.${k}`;
+    const fieldPath = `${path35}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -10195,8 +10195,8 @@ function evalInitialStateError2(input) {
     const parsed = evalInitialStateEntry2.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path36 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path36} is invalid: ${issue?.message ?? "malformed"}`;
+      const path35 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path35} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -10401,10 +10401,10 @@ function refineHubAsCodeEvals2(config, ctx) {
 function refineHubAsCodeEvalAttachments2(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path36, turn, name) => {
+  const addTurnIssue = (path35, turn, name) => {
     const error = evalTurnAttachmentsError2(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path36, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path35, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes2(turn)) referencedHashes.add(hash);
@@ -10550,11 +10550,11 @@ function refineHubAsCodeDelegation2(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path36 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path35 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -10562,7 +10562,7 @@ function refineHubAsCodeDelegation2(config, ctx) {
       if (!CONTEXT_BOUNDARIES2.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES2.join(", ")}`
         });
       }
@@ -15442,7 +15442,7 @@ var init_registry = __esm({
         surviving: "bases use",
         clause: 3,
         shipped: true,
-        reason: "WayAI's `use` binds a hub; this binds a base."
+        reason: "Deprecated since the worktree scope merged into one set-valued file: `wayai use bases/<id>` covers this. Kept as an alias for its JSON output shape."
       },
       {
         original: "unbind",
@@ -15450,7 +15450,7 @@ var init_registry = __esm({
         surviving: "bases unbind",
         clause: 3,
         shipped: true,
-        reason: "WayAI's `unbind` clears the hub binding; this clears the base binding."
+        reason: "Deprecated alongside `bases use`: `wayai unbind bases/<id>` covers this. It still clears only the bases axis of the worktree scope, never the hubs one."
       },
       {
         original: "bases promote",
@@ -15571,9 +15571,9 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path36 = getVersionCachePath(filename);
-    if (!existsSync4(path36)) return null;
-    const parsed = JSON.parse(readFileSync5(path36, "utf-8"));
+    const path35 = getVersionCachePath(filename);
+    if (!existsSync4(path35)) return null;
+    const parsed = JSON.parse(readFileSync5(path35, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -15593,10 +15593,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path36 = getVersionCachePath(filename);
-  const dir = dirname3(path36);
+  const path35 = getVersionCachePath(filename);
+  const dir = dirname3(path35);
   if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path36, JSON.stringify(cache));
+  writeFileSync2(path35, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -15635,14 +15635,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path36 = join7(projectRoot, rel);
-    if (!existsSync5(path36)) continue;
+    const path35 = join7(projectRoot, rel);
+    if (!existsSync5(path35)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path36, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path35, "utf-8"));
     } catch {
     }
-    found.push({ path: path36, version });
+    found.push({ path: path35, version });
   }
   return found;
 }
@@ -16520,10 +16520,33 @@ var init_logout = __esm({
   }
 });
 
-// src/lib/worktree-binding.ts
+// src/lib/base-id.ts
+function isValidBaseId(id) {
+  return id.length > 0 && id.length <= BASE_ID_MAX_LENGTH && BASE_ID_RE.test(id);
+}
+function isPathSafeId(id) {
+  return PATH_SAFE_ID_RE.test(id);
+}
+var BASE_ID_MAX_LENGTH, BASE_ID_RE, BASE_ID_RULE, PATH_SAFE_ID_RE, PATH_SAFE_ID_RULE;
+var init_base_id = __esm({
+  "src/lib/base-id.ts"() {
+    "use strict";
+    BASE_ID_MAX_LENGTH = 128;
+    BASE_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+    BASE_ID_RULE = `letters, digits, \`-\` and \`_\`, starting with a letter, digit or \`_\`, ${BASE_ID_MAX_LENGTH} characters or fewer`;
+    PATH_SAFE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
+    PATH_SAFE_ID_RULE = "letters, digits, dot, dash and underscore, with no path separators, not `.` or `..` alone, 256 characters or fewer";
+  }
+});
+
+// src/lib/worktree-scope.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import * as fs7 from "fs";
 import * as path7 from "path";
+import * as yaml4 from "js-yaml";
+function axisNoun(axis) {
+  return AXES[axis].noun;
+}
 function resolveGitDir() {
   const cwd = process.cwd();
   if (_gitDirCache && _gitDirCache.cwd === cwd) return _gitDirCache.gitDir;
@@ -16541,158 +16564,227 @@ function resolveGitDir() {
   _gitDirCache = { cwd, gitDir };
   return gitDir;
 }
-function createWorktreeBinding(descriptor) {
-  const {
-    filename,
-    legacyFilename,
-    isValidId,
-    noun,
-    idLabel,
-    unbindCommand: unbindCommand2,
-    useCommand: useCommand2
-  } = descriptor;
-  function getBindingPath2() {
-    const gitDir = resolveGitDir();
-    return gitDir ? path7.join(gitDir, filename) : null;
-  }
-  function getLegacyBindingPath() {
-    if (!legacyFilename) return null;
-    const gitDir = resolveGitDir();
-    return gitDir ? path7.join(gitDir, legacyFilename) : null;
-  }
-  function readBinding2() {
-    for (const bindingPath of [getBindingPath2(), getLegacyBindingPath()]) {
-      if (!bindingPath) continue;
-      let raw;
-      try {
-        raw = fs7.readFileSync(bindingPath, "utf-8");
-      } catch (err) {
-        if (err.code === "ENOENT") continue;
-        throw err;
-      }
-      const trimmed = raw.trim();
-      return isValidId(trimmed) ? trimmed : null;
+function getScopePath() {
+  const gitDir = resolveGitDir();
+  return gitDir ? path7.join(gitDir, SCOPE_FILE) : null;
+}
+function legacyPaths() {
+  const gitDir = resolveGitDir();
+  if (!gitDir) return [];
+  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path7.join(gitDir, f));
+}
+function emptyScope() {
+  return { hubs: [], bases: [] };
+}
+function parseAxis(raw, axis) {
+  if (!Array.isArray(raw)) return [];
+  const { isValidId } = AXES[axis];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string") continue;
+    const id = entry.trim();
+    if (!isValidId(id) || out.includes(id)) continue;
+    out.push(id);
+  }
+  return out;
+}
+function readLegacyAxis(axis) {
+  const gitDir = resolveGitDir();
+  if (!gitDir) return [];
+  const { isValidId, legacyFiles } = AXES[axis];
+  for (const filename of legacyFiles) {
+    let raw;
+    try {
+      raw = fs7.readFileSync(path7.join(gitDir, filename), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") continue;
+      throw err;
     }
-    return null;
+    const trimmed = raw.trim();
+    return isValidId(trimmed) ? [trimmed] : [];
+  }
+  return [];
+}
+function readScope() {
+  const scopePath = getScopePath();
+  if (!scopePath) return emptyScope();
+  let raw;
+  try {
+    raw = fs7.readFileSync(scopePath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { hubs: readLegacyAxis("hubs"), bases: readLegacyAxis("bases") };
+    }
+    throw err;
+  }
+  let doc;
+  try {
+    doc = yaml4.load(raw);
+  } catch {
+    return emptyScope();
   }
-  function removeLegacyBinding() {
-    const legacyPath = getLegacyBindingPath();
-    if (!legacyPath) return;
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return emptyScope();
+  const map = doc;
+  return { hubs: parseAxis(map.hubs, "hubs"), bases: parseAxis(map.bases, "bases") };
+}
+function sweepLegacyFiles() {
+  for (const legacyPath of legacyPaths()) {
     try {
       fs7.unlinkSync(legacyPath);
     } catch {
     }
   }
-  function writeBinding2(id) {
-    if (!isValidId(id)) {
-      throw new Error(`Invalid ${idLabel}: ${id}`);
-    }
-    const bindingPath = getBindingPath2();
-    if (!bindingPath) {
-      throw new Error(`Not inside a git repository \u2014 cannot write ${noun} binding.`);
+}
+function writeScope(scope) {
+  for (const axis of AXIS_ORDER) {
+    const { isValidId, idLabel } = AXES[axis];
+    for (const id of scope[axis]) {
+      if (!isValidId(id)) throw expected(`Invalid ${idLabel}: ${id}`);
     }
-    fs7.writeFileSync(bindingPath, `${id}
-`, "utf-8");
-    removeLegacyBinding();
   }
-  function clearBinding2() {
-    let removed = false;
-    for (const bindingPath of [getBindingPath2(), getLegacyBindingPath()]) {
-      if (!bindingPath) continue;
-      try {
-        fs7.unlinkSync(bindingPath);
-        removed = true;
-      } catch (err) {
-        if (err.code !== "ENOENT") throw err;
-      }
-    }
-    return removed;
+  const scopePath = getScopePath();
+  if (!scopePath) {
+    throw expected("Not inside a git repository \u2014 cannot write the worktree scope.");
   }
-  function assertMatchesBinding(resolvedId, label) {
-    const bound = readBinding2();
-    if (!bound) return;
-    if (bound === resolvedId) return;
-    const target = label ? `${label} (${resolvedId})` : resolvedId;
-    console.error(
-      [
-        `This worktree is bound to ${noun} ${bound}, but the command resolved to ${target}.`,
-        "",
-        "This usually means a prompt was routed to the wrong worktree.",
-        "Confirm with the user before unbinding. To override:",
-        `  ${unbindCommand2}             # clear the binding for this worktree`,
-        `  ${useCommand2} ${resolvedId}  # rebind this worktree to the new ${noun}`
-      ].join("\n")
-    );
-    process.exit(1);
+  const body = yaml4.dump({ hubs: scope.hubs, bases: scope.bases }, { flowLevel: 1 });
+  const tmpPath = `${scopePath}.tmp-${process.pid}`;
+  try {
+    fs7.writeFileSync(tmpPath, body, "utf-8");
+    fs7.renameSync(tmpPath, scopePath);
+  } catch (err) {
+    try {
+      fs7.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw asExpectedEnvironmentError(err);
   }
-  function assertNoBindingBlocksCreation(newName) {
-    const bound = readBinding2();
-    if (!bound) return;
-    console.error(
-      [
-        `This worktree is bound to ${noun} ${bound}, but you're about to create a new ${noun} "${newName}" here.`,
-        "",
-        "This usually means a prompt was routed to the wrong worktree.",
-        "Confirm with the user before unbinding. To override:",
-        `  ${unbindCommand2}             # clear the binding for this worktree`
-      ].join("\n")
-    );
-    process.exit(1);
+  sweepLegacyFiles();
+}
+function asExpectedEnvironmentError(err) {
+  if (err instanceof Error && typeof err.code === "string") {
+    return expected(err.message);
   }
-  function autoBindIfUnbound2(id) {
+  return err;
+}
+function setScopeAxis(axis, ids) {
+  writeScope({ ...readScope(), [axis]: ids });
+  return ids;
+}
+function addToScope(axis, id) {
+  const scope = readScope();
+  if (scope[axis].includes(id)) return null;
+  const next = [...scope[axis], id];
+  writeScope({ ...scope, [axis]: next });
+  return next;
+}
+function removeFromScope(axis, id) {
+  const scope = readScope();
+  if (!scope[axis].includes(id)) return null;
+  const next = scope[axis].filter((entry) => entry !== id);
+  writeScope({ ...scope, [axis]: next });
+  return next;
+}
+function clearScope() {
+  const scopePath = getScopePath();
+  let removed = false;
+  for (const target of [...scopePath ? [scopePath] : [], ...legacyPaths()]) {
     try {
-      if (readBinding2()) return false;
-      writeBinding2(id);
-      console.log(`Worktree bound to ${noun} ${id} (run \`${unbindCommand2}\` to clear).`);
-      return true;
+      fs7.unlinkSync(target);
+      removed = true;
     } catch (err) {
-      console.warn(
-        `  Warning: could not auto-bind worktree (${err instanceof Error ? err.message : String(err)})`
-      );
-      return false;
+      if (err.code !== "ENOENT") throw err;
     }
   }
-  return {
-    getBindingPath: getBindingPath2,
-    readBinding: readBinding2,
-    writeBinding: writeBinding2,
-    clearBinding: clearBinding2,
-    assertMatchesBinding,
-    assertNoBindingBlocksCreation,
-    autoBindIfUnbound: autoBindIfUnbound2
-  };
+  return removed;
 }
-var _gitDirCache;
-var init_worktree_binding = __esm({
-  "src/lib/worktree-binding.ts"() {
-    "use strict";
+function describeAxis(axis, ids) {
+  const { noun } = AXES[axis];
+  return ids.length === 1 ? `${noun} ${ids[0]}` : `${noun}s ${ids.join(", ")}`;
+}
+function describeScope(scope) {
+  return AXIS_ORDER.filter((axis) => scope[axis].length > 0).map((axis) => describeAxis(axis, scope[axis])).join("; ");
+}
+function assertInScope(axis, resolvedId, label) {
+  const scoped = readScope()[axis];
+  if (scoped.length === 0) return;
+  if (scoped.includes(resolvedId)) return;
+  const { noun, selectorFor } = AXES[axis];
+  const selector = selectorFor(resolvedId);
+  const target = label ? `${label} (${resolvedId})` : resolvedId;
+  console.error(
+    [
+      `This worktree is scoped to ${describeAxis(axis, scoped)}, but the command resolved to ${target}.`,
+      "",
+      "This usually means a prompt was routed to the wrong worktree.",
+      "Confirm with the user before changing this scope. To override:",
+      `  ${REPLACE_COMMAND} ${selector}   # scope this worktree to that ${noun} INSTEAD`,
+      `  ${ADD_COMMAND} ${selector}   # scope it to that ${noun} AS WELL`,
+      `  ${CLEAR_COMMAND}   # clear the whole worktree scope (both hubs and bases)`
+    ].join("\n")
+  );
+  process.exit(1);
+}
+function assertScopeAllowsCreation(axis, newName) {
+  const scoped = readScope()[axis];
+  if (scoped.length === 0) return;
+  const { noun } = AXES[axis];
+  console.error(
+    [
+      `This worktree is scoped to ${describeAxis(axis, scoped)}, but you're about to create a new ${noun} "${newName}" here.`,
+      "",
+      "This usually means a prompt was routed to the wrong worktree.",
+      "Confirm with the user before clearing this scope. To override:",
+      `  ${CLEAR_COMMAND}   # clear the whole worktree scope (both hubs and bases)`
+    ].join("\n")
+  );
+  process.exit(1);
+}
+function seedScopeIfEmpty(axis, id) {
+  try {
+    if (readScope()[axis].length > 0) return false;
+    setScopeAxis(axis, [id]);
+    console.log(
+      `Worktree bound to ${AXES[axis].noun} ${id} (run \`${CLEAR_COMMAND}\` to clear).`
+    );
+    return true;
+  } catch (err) {
+    console.warn(
+      `  Warning: could not bind worktree (${err instanceof Error ? err.message : String(err)})`
+    );
+    return false;
   }
-});
-
-// src/lib/hub-binding.ts
-var binding, getBindingPath, readBinding, writeBinding, clearBinding, autoBindIfUnbound, assertHubMatchesBinding, assertNoBindingBlocksHubCreation;
-var init_hub_binding = __esm({
-  "src/lib/hub-binding.ts"() {
+}
+var SCOPE_FILE, LEGACY_HUB_SCOPE_FILE, LEGACY_HUB_SCOPE_FILE_PRE_RENAME, LEGACY_BASE_SCOPE_FILE, AXES, AXIS_ORDER, ADD_COMMAND, REPLACE_COMMAND, CLEAR_COMMAND, _gitDirCache;
+var init_worktree_scope = __esm({
+  "src/lib/worktree-scope.ts"() {
     "use strict";
+    init_base_id();
+    init_expected();
     init_utils();
-    init_worktree_binding();
-    binding = createWorktreeBinding({
-      filename: "wayai-binding",
-      // Pre-rename filename, from when this was called a "lock".
-      legacyFilename: "wayai-lock",
-      isValidId: (id) => UUID_RE2.test(id),
-      noun: "hub",
-      idLabel: "hub_id (must be a UUID)",
-      unbindCommand: "wayai unbind",
-      useCommand: "wayai use"
-    });
-    getBindingPath = binding.getBindingPath;
-    readBinding = binding.readBinding;
-    writeBinding = binding.writeBinding;
-    clearBinding = binding.clearBinding;
-    autoBindIfUnbound = binding.autoBindIfUnbound;
-    assertHubMatchesBinding = binding.assertMatchesBinding;
-    assertNoBindingBlocksHubCreation = binding.assertNoBindingBlocksCreation;
+    SCOPE_FILE = "wayai-scope";
+    LEGACY_HUB_SCOPE_FILE = "wayai-binding";
+    LEGACY_HUB_SCOPE_FILE_PRE_RENAME = "wayai-lock";
+    LEGACY_BASE_SCOPE_FILE = "wayai-base-binding";
+    AXES = {
+      hubs: {
+        noun: "hub",
+        idLabel: "hub_id (must be a UUID)",
+        isValidId: (id) => UUID_RE2.test(id),
+        selectorFor: (id) => id,
+        legacyFiles: [LEGACY_HUB_SCOPE_FILE, LEGACY_HUB_SCOPE_FILE_PRE_RENAME]
+      },
+      bases: {
+        noun: "base",
+        idLabel: `base id (${PATH_SAFE_ID_RULE})`,
+        isValidId: isPathSafeId,
+        selectorFor: (id) => `bases/${id}`,
+        legacyFiles: [LEGACY_BASE_SCOPE_FILE]
+      }
+    };
+    AXIS_ORDER = ["hubs", "bases"];
+    ADD_COMMAND = "wayai use --add";
+    REPLACE_COMMAND = "wayai use";
+    CLEAR_COMMAND = "wayai unbind";
   }
 });
 
@@ -16738,12 +16830,13 @@ async function statusCommand(args2, pkg2) {
   const cachedCliLatest = readCachedLatest(CLI_CACHE_FILE);
   const cliLatest = cachedCliLatest && isNewerVersion(cachedCliLatest, pkg2.version) ? cachedCliLatest : null;
   const skill = buildSkillState();
-  let boundHubId = null;
+  let scope;
   try {
-    boundHubId = readBinding();
+    scope = readScope();
   } catch {
-    boundHubId = null;
+    scope = emptyScope();
   }
+  const boundHubId = scope.hubs[0] ?? null;
   if (!config) {
     const snapshot2 = {
       logged_in: false,
@@ -16756,6 +16849,7 @@ async function statusCommand(args2, pkg2) {
       orgs: [],
       active_org: null,
       workspace,
+      worktree_scope: scope,
       worktree_binding: { hub_id: boundHubId },
       worktree_lock: { hub_id: boundHubId }
     };
@@ -16811,6 +16905,7 @@ async function statusCommand(args2, pkg2) {
     orgs,
     active_org: activeOrg,
     workspace,
+    worktree_scope: scope,
     worktree_binding: { hub_id: boundHubId },
     worktree_lock: { hub_id: boundHubId }
   };
@@ -16842,8 +16937,10 @@ async function statusCommand(args2, pkg2) {
   } else {
     console.log("No .wayai.yaml found \u2014 run `wayai init` to scope this repo to an organization.");
   }
-  if (boundHubId) {
-    console.log(`Worktree binding: ${boundHubId} (run \`wayai unbind\` to clear)`);
+  if (scope.hubs.length > 0 || scope.bases.length > 0) {
+    console.log("Worktree scope: (run `wayai unbind` to clear)");
+    if (scope.hubs.length > 0) console.log(`  Hubs:  ${scope.hubs.join(", ")}`);
+    if (scope.bases.length > 0) console.log(`  Bases: ${scope.bases.join(", ")}`);
   }
   if (tokenValid === true && accessToken) {
     await nudgeReportActions(config.api_url, accessToken);
@@ -16856,7 +16953,7 @@ var init_status = __esm({
     init_auth();
     init_repo_config();
     init_workspace();
-    init_hub_binding();
+    init_worktree_scope();
     init_api_client();
     init_version_cache();
     init_skill_version();
@@ -17684,7 +17781,7 @@ var init_eval_attachments = __esm({
 // src/lib/parser.ts
 import * as fs12 from "fs";
 import * as path14 from "path";
-import * as yaml4 from "js-yaml";
+import * as yaml5 from "js-yaml";
 function parseHubFolder(hubFolder, opts) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) {
@@ -17693,9 +17790,9 @@ function parseHubFolder(hubFolder, opts) {
   const yamlContent = fs12.readFileSync(yamlPath, "utf-8");
   let config;
   try {
-    config = yaml4.load(yamlContent);
+    config = yaml5.load(yamlContent);
   } catch (err) {
-    if (err instanceof yaml4.YAMLException) {
+    if (err instanceof yaml5.YAMLException) {
       throw expected(`Invalid YAML in ${yamlPath}: ${err.message}`);
     }
     throw err;
@@ -17825,9 +17922,9 @@ function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
   const content = fs12.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml4.load(content);
+    raw = yaml5.load(content);
   } catch (err) {
-    if (err instanceof yaml4.YAMLException) {
+    if (err instanceof yaml5.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -17952,9 +18049,9 @@ function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
   const content = fs12.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml4.load(content);
+    raw = yaml5.load(content);
   } catch (err) {
-    if (err instanceof yaml4.YAMLException) {
+    if (err instanceof yaml5.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -18014,9 +18111,9 @@ function scanAgentYamlFiles(hubFolder) {
     const content = fs12.readFileSync(filePath, "utf-8");
     let agent;
     try {
-      agent = yaml4.load(content);
+      agent = yaml5.load(content);
     } catch (err) {
-      if (err instanceof yaml4.YAMLException) {
+      if (err instanceof yaml5.YAMLException) {
         throw expected(`Invalid YAML in agents/${file}: ${err.message}`);
       }
       throw err;
@@ -18096,7 +18193,7 @@ var init_diff_display = __esm({
 // src/lib/yaml-writer.ts
 import * as fs13 from "fs";
 import * as path15 from "path";
-import * as yaml5 from "js-yaml";
+import * as yaml6 from "js-yaml";
 function writeFileIfChanged(hubFolder, absPath, content, log) {
   const buf = Buffer.from(content, "utf-8");
   if (fileHasBytes(absPath, buf)) return;
@@ -18153,7 +18250,7 @@ function writeHubFolder(hubFolder, payload, options = {}) {
   }
   const yamlPayload = buildYamlPayload(payload);
   const agentFiles = extractAgentFiles(payload);
-  const yamlContent = yaml5.dump(yamlPayload, YAML_DUMP_OPTIONS);
+  const yamlContent = yaml6.dump(yamlPayload, YAML_DUMP_OPTIONS);
   writeFileIfChanged(hubFolder, path15.join(hubFolder, "hub.yaml"), yamlContent, log);
   if (options.seedAgentContext ?? true) {
     for (const seeded of [
@@ -18200,10 +18297,10 @@ function writeHubFolder(hubFolder, payload, options = {}) {
 function setPreviewLabelInHubYaml(hubFolder, label) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) return;
-  const obj = yaml5.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
+  const obj = yaml6.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
   if (label) obj.preview_label = label;
   else delete obj.preview_label;
-  fs13.writeFileSync(yamlPath, yaml5.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
+  fs13.writeFileSync(yamlPath, yaml6.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
 }
 function buildYamlPayload(payload) {
   const result = {
@@ -18248,7 +18345,7 @@ function writeAgentYamlFiles(hubFolder, agentsDir, agents, log) {
     slugs.add(slug);
     const entry = { ...agent };
     delete entry.instructions;
-    const yamlContent = yaml5.dump(entry, YAML_DUMP_OPTIONS);
+    const yamlContent = yaml6.dump(entry, YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.yaml`), yamlContent, log);
   }
   return slugs;
@@ -18296,7 +18393,7 @@ function writeEvalYamlFiles(hubFolder, evals, log) {
         fs13.mkdirSync(setDir, { recursive: true });
       }
     }
-    const yamlContent = yaml5.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml6.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, targetPath, yamlContent, log);
     writtenRelPaths.add(relPath);
   }
@@ -18383,7 +18480,7 @@ function writeJourneyYamlFiles(hubFolder, journeys, log) {
   for (const journeyEntry of journeys) {
     const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
     const fileName = `${slug}.yaml`;
-    const yamlContent = yaml5.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml6.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(journeysDir, fileName), yamlContent, log);
     writtenFiles.add(fileName);
   }
@@ -18501,35 +18598,16 @@ var init_terminal_output = __esm({
   }
 });
 
-// src/lib/base-id.ts
-function isValidBaseId(id) {
-  return id.length > 0 && id.length <= BASE_ID_MAX_LENGTH && BASE_ID_RE.test(id);
-}
-function isPathSafeId(id) {
-  return PATH_SAFE_ID_RE.test(id);
-}
-var BASE_ID_MAX_LENGTH, BASE_ID_RE, BASE_ID_RULE, PATH_SAFE_ID_RE, PATH_SAFE_ID_RULE;
-var init_base_id = __esm({
-  "src/lib/base-id.ts"() {
-    "use strict";
-    BASE_ID_MAX_LENGTH = 128;
-    BASE_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
-    BASE_ID_RULE = `letters, digits, \`-\` and \`_\`, starting with a letter, digit or \`_\`, ${BASE_ID_MAX_LENGTH} characters or fewer`;
-    PATH_SAFE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
-    PATH_SAFE_ID_RULE = "letters, digits, dot, dash and underscore, with no path separators, not `.` or `..` alone, 256 characters or fewer";
-  }
-});
-
 // src/lib/base-workspace.ts
 import * as fs14 from "fs";
 import * as path17 from "path";
-import * as yaml6 from "js-yaml";
+import * as yaml7 from "js-yaml";
 function readBaseMeta(folder) {
   const bytes = readFileNoFollow(folder, path17.join(folder, BASE_META_FILE));
   if (bytes === null) return null;
   let doc;
   try {
-    doc = yaml6.load(bytes.toString("utf-8"));
+    doc = yaml7.load(bytes.toString("utf-8"));
   } catch {
     return null;
   }
@@ -18618,6 +18696,12 @@ function targetBaseId(target, selector) {
   if (selector && !selector.includes("/") && !selector.includes(path17.sep)) return selector;
   return target.exists ? null : path17.basename(target.folder);
 }
+function resolveBaseSelectorToId(gitRoot, selector) {
+  if (!gitRoot || selector.includes("/") || selector.includes(path17.sep)) return selector;
+  if (!isPathSafeId(selector)) return selector;
+  const id = readBaseMeta(path17.join(resolveBasesDir(gitRoot), selector))?.base_id;
+  return typeof id === "string" && isPathSafeId(id) ? id : selector;
+}
 function hasBaseMetaFile(folder) {
   try {
     return fs14.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
@@ -18640,12 +18724,12 @@ var init_base_workspace = __esm({
 // src/lib/subtree-routing.ts
 import * as fs15 from "fs";
 import * as path18 from "path";
-import * as yaml7 from "js-yaml";
+import * as yaml8 from "js-yaml";
 function readRepoDefaults(gitRoot) {
   const file = path18.join(gitRoot, WAYAI_LAYOUT.wsDir, REPO_DEFAULTS_FILE);
   let doc;
   try {
-    doc = yaml7.load(fs15.readFileSync(file, "utf-8"));
+    doc = yaml8.load(fs15.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -18690,7 +18774,7 @@ function firstSegment(p) {
   const [head] = normalized.split("/").filter(Boolean);
   return head ?? p;
 }
-function selectorSubtree(layout, selector, cwd) {
+function resolveSelectorSubtree(layout, selector, cwd) {
   const parts = selector.split(path18.sep).join("/").split("/").filter(Boolean);
   const qualified = parts[0] === WAYAI_LAYOUT.wsDir ? parts.slice(1) : parts;
   if (qualified.length > 1) {
@@ -18756,7 +18840,7 @@ function routeSubtree(options) {
   if (hubFlag !== void 0 && baseFlag !== void 0) {
     return { ok: false, refusal: mixedInvocationRefusal(verb, hubFlag, baseFlag) };
   }
-  const fromPositional = positional !== void 0 ? selectorSubtree(layout, positional, cwd) : void 0;
+  const fromPositional = positional !== void 0 ? resolveSelectorSubtree(layout, positional, cwd) : void 0;
   if (fromPositional?.kind === "both") {
     return {
       ok: false,
@@ -18861,12 +18945,12 @@ async function createDataClient(orgId) {
     return orgId2;
   }
   return {
-    async request(method, path36, body) {
-      const envelope = await api.dataRequest(method, path36, body, org);
+    async request(method, path35, body) {
+      const envelope = await api.dataRequest(method, path35, body, org);
       return envelope.data;
     },
-    async requestRaw(method, path36, body) {
-      const body_ = await api.dataRequest(method, path36, body, org);
+    async requestRaw(method, path35, body) {
+      const body_ = await api.dataRequest(method, path35, body, org);
       return body_;
     },
     async collectPages(makePath) {
@@ -18940,38 +19024,6 @@ var init_client = __esm({
   }
 });
 
-// src/lib/base-binding.ts
-var binding2, getBaseBindingPath, readBaseBinding, writeBaseBinding, clearBaseBinding, autoBindBaseIfUnbound, assertBaseMatchesBinding, assertNoBindingBlocksBaseCreation;
-var init_base_binding = __esm({
-  "src/lib/base-binding.ts"() {
-    "use strict";
-    init_base_id();
-    init_worktree_binding();
-    binding2 = createWorktreeBinding({
-      filename: "wayai-base-binding",
-      // `isPathSafeId`, not the API's base-id rule. The tripwire's duty is that a
-      // garbled or multi-line file read as unbound, which this grammar delivers;
-      // applying the mint rule instead would refuse to bind a base whose stored id
-      // predates it — a base the API still serves — and so lock the CLI out of the
-      // one workflow that could migrate off it.
-      isValidId: isPathSafeId,
-      noun: "base",
-      // States what is actually checked. "must be a slug" described no rule the
-      // reader could act on, and naming the API's rule here would name the wrong one.
-      idLabel: `base id (${PATH_SAFE_ID_RULE})`,
-      unbindCommand: "wayai bases unbind",
-      useCommand: "wayai bases use"
-    });
-    getBaseBindingPath = binding2.getBindingPath;
-    readBaseBinding = binding2.readBinding;
-    writeBaseBinding = binding2.writeBinding;
-    clearBaseBinding = binding2.clearBinding;
-    autoBindBaseIfUnbound = binding2.autoBindIfUnbound;
-    assertBaseMatchesBinding = binding2.assertMatchesBinding;
-    assertNoBindingBlocksBaseCreation = binding2.assertNoBindingBlocksCreation;
-  }
-});
-
 // src/data/helpers.ts
 import { readFileSync as readFileSync16 } from "fs";
 function pathSegment(id, label = "id") {
@@ -19128,9 +19180,9 @@ var init_types2 = __esm({
 // src/data/config-as-code/config-writer.ts
 import * as fs16 from "fs";
 import * as path19 from "path";
-import * as yaml8 from "js-yaml";
-function dump4(value) {
-  return yaml8.dump(value, YAML_DUMP_OPTIONS);
+import * as yaml9 from "js-yaml";
+function dump5(value) {
+  return yaml9.dump(value, YAML_DUMP_OPTIONS);
 }
 function omitUndefined(obj) {
   const out = {};
@@ -19188,7 +19240,7 @@ function writeBaseFolder(folder, meta, config) {
       `Refusing to write ${folder}: the path crosses a symlink. Remove it and pull again.`
     );
   }
-  writeFileIfChanged(folder, path19.join(folder, BASE_META_FILE), dump4(metaFileObject(meta)), delta);
+  writeFileIfChanged(folder, path19.join(folder, BASE_META_FILE), dump5(metaFileObject(meta)), delta);
   for (const kind of ENTITY_KINDS) {
     const dir = path19.join(folder, ENTITY_DIRS[kind]);
     const entities = config[kind] ?? [];
@@ -19202,7 +19254,7 @@ function writeBaseFolder(folder, meta, config) {
       }
       const file = `${id}.yaml`;
       keep.add(file);
-      writeFileIfChanged(folder, path19.join(dir, file), dump4(toFileObject(kind, entity)), delta);
+      writeFileIfChanged(folder, path19.join(dir, file), dump5(toFileObject(kind, entity)), delta);
     }
     pruneOrphans(folder, dir, keep, delta);
   }
@@ -19363,7 +19415,7 @@ var init_api = __esm({
 // src/data/config-as-code/config-parser.ts
 import * as fs17 from "fs";
 import * as path20 from "path";
-import * as yaml9 from "js-yaml";
+import * as yaml10 from "js-yaml";
 function readEntityDir(folder, dir) {
   if (!ensureRealSubdirNoSymlink(folder, dir, false)) {
     throw expected(`Refusing to read ${dir}: it is a symlink, not a config directory.`);
@@ -19379,7 +19431,7 @@ function readEntityDir(folder, dir) {
     }
     let parsed;
     try {
-      parsed = yaml9.load(bytes.toString("utf-8"));
+      parsed = yaml10.load(bytes.toString("utf-8"));
     } catch (err) {
       throw expected(`Failed to parse ${abs}: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -19561,7 +19613,7 @@ async function pullBase(gitRootOrNull, selector, args2) {
     console.log(`Production base mirrored (read-only) \u2192 ${folder}`);
     return;
   }
-  assertBaseMatchesBinding(baseId);
+  assertInScope("bases", baseId);
   if (target.exists && !autoConfirm) {
     const ok = await confirm(
       `Overwrite local files in ${path21.relative(gitRoot, target.folder)} with the server config for "${sanitizeTerminalText(baseId)}"?`
@@ -19580,7 +19632,7 @@ async function pullBase(gitRootOrNull, selector, args2) {
   );
   if (!isFirstPull) printLocalFileChanges(delta);
   console.log("  Credential values are not written. Manage them with `wayai bases credentials`.");
-  autoBindBaseIfUnbound(baseId);
+  seedScopeIfEmpty("bases", baseId);
   if (record.origin_base_id) {
     await mirrorLinkedProduction(client, basesDir, record.origin_base_id);
   }
@@ -19605,7 +19657,7 @@ async function createDeclaredPreview(client, target, parsed, autoConfirm) {
     );
   }
   const name = meta.name ?? path21.basename(target.folder);
-  assertNoBindingBlocksBaseCreation(name);
+  assertScopeAllowsCreation("bases", name);
   if (!autoConfirm) {
     const ok = await confirm(
       `Create a new preview "${sanitizeTerminalText(name)}" from "${sanitizeTerminalText(meta.origin_base_id)}"?`
@@ -19624,7 +19676,7 @@ async function createDeclaredPreview(client, target, parsed, autoConfirm) {
   writeBaseFolder(target.folder, { ...meta, ...metaFromRecord(record, id) }, config);
   console.log(`Created preview "${sanitizeTerminalText(id)}".`);
   printWarnings((record.warnings ?? []).map((w) => sanitizeTerminalText(w.message)));
-  autoBindBaseIfUnbound(id);
+  seedScopeIfEmpty("bases", id);
   return id;
 }
 async function pushBase(gitRootOrNull, selector, args2) {
@@ -19662,13 +19714,13 @@ async function pushBase(gitRootOrNull, selector, args2) {
         `"${sanitizeTerminalText(baseId)}" is a ${sanitizeTerminalText(record.environment)} base. Push operates on previews \u2014 promote with \`wayai bases promote\`.`
       );
     }
-    assertBaseMatchesBinding(baseId);
+    assertInScope("bases", baseId);
   }
   const diff = await diffConfig(client, baseId, config);
   printLintWarnings(diff.warnings);
   if (isDiffEmpty(diff)) {
     console.log(`No changes \u2014 preview "${sanitizeTerminalText(baseId)}" already matches your files.`);
-    if (!dryRun) autoBindBaseIfUnbound(baseId);
+    if (!dryRun) seedScopeIfEmpty("bases", baseId);
     return;
   }
   console.log(renderDiff(diff));
@@ -19720,7 +19772,7 @@ Delete ${removals.length} server ${word} not in your files? Record types cascade
   }
   console.log(`
 Pushed to preview "${sanitizeTerminalText(baseId)}".`);
-  autoBindBaseIfUnbound(baseId);
+  seedScopeIfEmpty("bases", baseId);
 }
 var init_sync = __esm({
   "src/data/config-as-code/sync.ts"() {
@@ -19732,7 +19784,7 @@ var init_sync = __esm({
     init_terminal_output();
     init_base_id();
     init_push();
-    init_base_binding();
+    init_worktree_scope();
     init_api();
     init_config_parser();
     init_config_writer();
@@ -19759,7 +19811,7 @@ __export(push_exports, {
 });
 import * as fs18 from "fs";
 import * as path22 from "path";
-import * as yaml10 from "js-yaml";
+import * as yaml11 from "js-yaml";
 function parseArgs5(args2) {
   let autoConfirm = false;
   let label;
@@ -19873,7 +19925,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     for (const file of yamlFiles) {
       try {
         const content = fs18.readFileSync(path22.join(agentsDir, file), "utf-8");
-        const agent = yaml10.load(content);
+        const agent = yaml11.load(content);
         if (agent?.id && agent.name) {
           agentsWithIds.push({ id: agent.id, name: agent.name });
         }
@@ -19886,7 +19938,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     const yamlPath = resolveHubYamlPath(hubFolder);
     if (!yamlPath) return;
     const yamlContent = fs18.readFileSync(yamlPath, "utf-8");
-    const config = yaml10.load(yamlContent);
+    const config = yaml11.load(yamlContent);
     agentsWithIds = (config.agents || []).filter((a) => !!a.id && !!a.name);
   }
   if (agentsWithIds.length === 0) return;
@@ -20036,7 +20088,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
     } else {
       console.log("No changes to push; folder renamed.");
     }
-    autoBindIfUnbound(hubId);
+    seedScopeIfEmpty("hubs", hubId);
     return true;
   }
   console.log("\nChanges to push:");
@@ -20052,7 +20104,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
   const result = await client.push(hubId, wireConfig, organizationId);
   printSyncResult(result);
   await syncAfterPush(client, hubId, hubFolder, organizationId);
-  autoBindIfUnbound(hubId);
+  seedScopeIfEmpty("hubs", hubId);
   return true;
 }
 function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
@@ -20118,7 +20170,7 @@ hub_environment: preview
 ${content}`;
   }
   fs18.writeFileSync(hubYamlPath, updated, "utf-8");
-  autoBindIfUnbound(hubId);
+  seedScopeIfEmpty("hubs", hubId);
   await pushSingleHub(client, hubId, newHub.hubFolder, opts.autoConfirm, opts.organizationId, { skipAgentRename: true });
 }
 function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsLabel) {
@@ -20188,11 +20240,11 @@ async function pushCommand(args2) {
       console.warn("Note: --label is only used when creating a new hub. To change an existing hub's label, use `wayai relabel`.");
     }
     console.log(`Target hub: ${path22.basename(existing.hubFolder)} (${existing.hubId})`);
-    assertHubMatchesBinding(existing.hubId, path22.basename(existing.hubFolder));
+    assertInScope("hubs", existing.hubId, path22.basename(existing.hubFolder));
     await pushSingleHub(client, existing.hubId, existing.hubFolder, autoConfirm, organizationId);
     return;
   }
-  assertNoBindingBlocksHubCreation(resolution.target.hub.hubName);
+  assertScopeAllowsCreation("hubs", resolution.target.hub.hubName);
   await createAndPushNewHub(client, resolution.target.hub, { autoConfirm, label, organizationId });
 }
 var LOCAL_CHANGE_LIST_CAP;
@@ -20211,7 +20263,7 @@ var init_push = __esm({
     init_layout();
     init_workspace_files();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_subtree_routing();
     LOCAL_CHANGE_LIST_CAP = 20;
   }
@@ -20285,7 +20337,7 @@ async function pullCommand(args2) {
     console.log(`Production hub mirrored (read-only) \u2192 ${folder}`);
     return;
   }
-  assertHubMatchesBinding(hubId);
+  assertInScope("hubs", hubId);
   let hubFolder = existingFolder;
   let wroteFiles = false;
   if (!hubFolder) {
@@ -20344,7 +20396,7 @@ async function pullCommand(args2) {
       printLocalFileChanges(delta);
     }
   }
-  if (wroteFiles) autoBindIfUnbound(hubId);
+  if (wroteFiles) seedScopeIfEmpty("hubs", hubId);
   if (payload.production_hub_id) {
     await mirrorLinkedProduction2(client, workspaceDir, payload.production_hub_id, organizationId);
   }
@@ -20406,7 +20458,7 @@ var init_pull = __esm({
     init_layout();
     init_workspace_files();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_subtree_routing();
     MIRROR_MARKER_PREFIX2 = "# Read-only mirror of production hub";
   }
@@ -20472,7 +20524,7 @@ async function createCommand(args2) {
     }
     process.exit(1);
   }
-  assertNoBindingBlocksHubCreation(resolution.hub.hubName);
+  assertScopeAllowsCreation("hubs", resolution.hub.hubName);
   await createAndPushNewHub(client, resolution.hub, { autoConfirm, label, organizationId });
 }
 var init_create = __esm({
@@ -20484,7 +20536,7 @@ var init_create = __esm({
     init_workspace();
     init_layout();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
   }
 });
 
@@ -20637,7 +20689,7 @@ async function replicateCommand(args2) {
     payload.preview_label,
     payload.branch_name
   );
-  autoBindIfUnbound(previewHubId);
+  seedScopeIfEmpty("hubs", previewHubId);
   if (folderPreExisted) printLocalFileChanges(delta);
   console.log(`Preview written to ${path25.basename(hubFolder)}`);
   console.log(`  Switch to it with: wayai use ${path25.basename(hubFolder)}`);
@@ -20653,7 +20705,7 @@ var init_replicate = __esm({
     init_workspace();
     init_layout();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_contracts();
   }
 });
@@ -20716,7 +20768,7 @@ async function relabelCommand(args2) {
     console.log("This is a read-only production mirror \u2014 production hubs have no preview label. Relabel the linked preview hub instead.");
     return;
   }
-  assertHubMatchesBinding(target.hubId, path26.basename(target.hubFolder));
+  assertInScope("hubs", target.hubId, path26.basename(target.hubFolder));
   console.log(normalizedLabel ? `Setting preview label to "${normalizedLabel}"...` : "Clearing preview label...");
   const { data } = await client.relabelPreview(target.hubId, normalizedLabel);
   const row = data[0];
@@ -20745,7 +20797,7 @@ var init_relabel = __esm({
     init_workspace();
     init_layout();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_contracts();
   }
 });
@@ -20872,7 +20924,7 @@ async function publishCommand(args2) {
       return;
     }
   }
-  assertHubMatchesBinding(hubId, hubFolder ? path27.basename(hubFolder) : void 0);
+  assertInScope("hubs", hubId, hubFolder ? path27.basename(hubFolder) : void 0);
   await runPublish(client, { hubId, localConfig, organizationId, autoConfirm });
 }
 var STATUS_STYLE;
@@ -20888,7 +20940,7 @@ var init_publish = __esm({
     init_layout();
     init_resource_files();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     STATUS_STYLE = {
       added: { sym: "+", color: 32 },
       // green
@@ -20900,77 +20952,151 @@ var init_publish = __esm({
   }
 });
 
+// src/lib/scope-selector.ts
+import * as path28 from "path";
+function findAddFlag(args2) {
+  return args2.find((arg) => arg === "--add" || arg.startsWith("--add="));
+}
+function isValuedFlag(token) {
+  return token.includes("=");
+}
+function resolveScopeSelector(verb, args2) {
+  const { hubFlag, baseFlag, positional } = parseRoutingTokens(args2);
+  if (hubFlag !== void 0 && baseFlag !== void 0) {
+    throw expected(mixedInvocationRefusal(verb, hubFlag, baseFlag));
+  }
+  assertValueIsNotAFlag(verb, "--hub", hubFlag);
+  assertValueIsNotAFlag(verb, "--base", baseFlag);
+  assertFlagWasGivenAValue(verb, "--hub", args2, hubFlag);
+  assertFlagWasGivenAValue(verb, "--base", args2, baseFlag);
+  if (hubFlag !== void 0) return { axis: "hubs", target: hubFlag, gitRoot: findGitRoot() };
+  if (baseFlag !== void 0) return { axis: "bases", target: baseFlag, gitRoot: findGitRoot() };
+  if (positional === void 0) return null;
+  const gitRoot = findGitRoot();
+  const layout = gitRoot ? resolveLayout(gitRoot) : null;
+  const resolved = resolveSelectorSubtree(layout, positional, process.cwd());
+  if (resolved.kind === "both") {
+    throw expected(mixedInvocationRefusal(verb, resolved.target, resolved.target));
+  }
+  if (resolved.kind === "hubs" || resolved.kind === "bases") {
+    return { axis: resolved.kind, target: resolved.target, gitRoot };
+  }
+  return { axis: "hubs", target: positional, gitRoot };
+}
+function assertValueIsNotAFlag(verb, flag, captured) {
+  if (captured === void 0 || !captured.startsWith("-")) return;
+  throw refusal(verb, flag, `but got ${JSON.stringify(captured)} \u2014 which is a flag, not a hub or base`);
+}
+function assertFlagWasGivenAValue(verb, flag, args2, captured) {
+  if (captured !== void 0 && captured !== "") return;
+  if (!args2.some((arg) => arg === flag || arg.startsWith(`${flag}=`))) return;
+  throw refusal(verb, flag, "but no target followed it");
+}
+function refusal(verb, flag, problem) {
+  return expected(
+    `\`wayai ${verb} ${flag}\` needs a target, ${problem}.
+  wayai ${verb} ${flag} <hub-or-base>`
+  );
+}
+function resolveHubSelectorToId(gitRoot, selector) {
+  if (UUID_RE2.test(selector)) return selector;
+  const workspaceDir = detectWorkspace()?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
+  if (!workspaceDir) {
+    throw expected("Not inside a git repository, and no UUID provided.");
+  }
+  const match = findHubByFolderName(workspaceDir, selector);
+  if (match) return match.hubId;
+  const newHubs = scanNewHubs(workspaceDir);
+  const pending = newHubs.find((h) => path28.basename(h.hubFolder) === selector);
+  if (pending) {
+    throw expected(
+      `"${selector}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
+Create it first \u2014 the worktree scope picks it up automatically afterward:
+  wayai create ${selector}`
+    );
+  }
+  throw expected(
+    [
+      `No hub matching "${selector}" found in ${hubsDirLabel(gitRoot)}/. Pass a UUID or a folder name from:`,
+      ...scanWorkspaceHubs(workspaceDir).map((h) => `  ${path28.basename(h.hubFolder)} (${h.hubId})`),
+      ...newHubs.map(
+        (h) => `  ${path28.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path28.basename(h.hubFolder)}\`)`
+      )
+    ].join("\n")
+  );
+}
+function resolveScopeTarget(selector) {
+  const { axis, target, gitRoot } = selector;
+  if (axis === "hubs") {
+    return { axis, id: resolveHubSelectorToId(gitRoot, target) };
+  }
+  const id = resolveBaseSelectorToId(gitRoot, target);
+  assertValidBaseSelector(id, "base id");
+  return { axis, id };
+}
+var init_scope_selector = __esm({
+  "src/lib/scope-selector.ts"() {
+    "use strict";
+    init_expected();
+    init_base_workspace();
+    init_layout();
+    init_subtree_routing();
+    init_utils();
+    init_workspace();
+  }
+});
+
 // src/commands/use.ts
 var use_exports = {};
 __export(use_exports, {
   useCommand: () => useCommand
 });
-import * as path28 from "path";
 async function useCommand(args2) {
-  const target = args2[0];
-  if (!target || target.startsWith("-")) {
-    console.error("Usage: wayai use <hub_uuid|folder-name>");
-    process.exit(1);
-  }
-  let hubId;
-  if (UUID_RE2.test(target)) {
-    hubId = target;
-  } else {
-    const workspace = detectWorkspace();
-    const gitRoot = findGitRoot();
-    const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
-    if (!workspaceDir) {
-      console.error("Not inside a git repository, and no UUID provided.");
-      process.exit(1);
-    }
-    const wsLabel = hubsDirLabel(gitRoot);
-    const match = findHubByFolderName(workspaceDir, target);
-    if (!match) {
-      const newHubs = scanNewHubs(workspaceDir);
-      const pending = newHubs.find((h) => path28.basename(h.hubFolder) === target);
-      if (pending) {
-        console.error(
-          `"${target}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
-Create it first \u2014 the worktree binds automatically afterward:
-  wayai create ${target}`
-        );
-        process.exit(1);
-      }
-      console.error(`No hub matching "${target}" found in ${wsLabel}/. Pass a UUID or a folder name from:`);
-      for (const h of scanWorkspaceHubs(workspaceDir)) {
-        console.error(`  ${path28.basename(h.hubFolder)} (${h.hubId})`);
-      }
-      for (const h of newHubs) {
-        console.error(`  ${path28.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path28.basename(h.hubFolder)}\`)`);
-      }
-      process.exit(1);
-    }
-    hubId = match.hubId;
+  const addFlag = findAddFlag(args2);
+  if (addFlag !== void 0 && isValuedFlag(addFlag)) {
+    throw expected(
+      [
+        `\`--add\` is a boolean flag \u2014 write it bare, not ${JSON.stringify(addFlag)}.`,
+        "  wayai use --add <selector>   # widen the worktree scope",
+        "  wayai use <selector>         # replace that axis instead"
+      ].join("\n")
+    );
   }
-  const previous = readBinding();
-  if (previous === hubId) {
-    console.log(`Worktree already bound to ${hubId}.`);
+  const add = addFlag !== void 0;
+  const selector = resolveScopeSelector("use", args2);
+  if (!selector) throw expected(USAGE);
+  const { axis, id } = resolveScopeTarget(selector);
+  const noun = axisNoun(axis);
+  if (add) {
+    const widened = addToScope(axis, id);
+    console.log(
+      widened ? `Worktree scope widened \u2014 now ${describeAxis(axis, widened)}.` : `Worktree scope already includes ${noun} ${id}.`
+    );
     return;
   }
-  try {
-    writeBinding(hubId);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-  }
-  if (previous) {
-    console.log(`Worktree rebound: ${previous} \u2192 ${hubId}`);
-  } else {
-    console.log(`Worktree bound to hub ${hubId}.`);
+  const previous = readScope()[axis];
+  if (previous.length === 1 && previous[0] === id) {
+    console.log(`Worktree already bound to ${noun} ${id}.`);
+    return;
   }
+  setScopeAxis(axis, [id]);
+  console.log(
+    previous.length > 0 ? `Worktree rebound: ${previous.join(", ")} \u2192 ${id}.` : `Worktree bound to ${noun} ${id}.`
+  );
 }
+var USAGE;
 var init_use = __esm({
   "src/commands/use.ts"() {
     "use strict";
-    init_hub_binding();
-    init_workspace();
-    init_layout();
-    init_utils();
+    init_expected();
+    init_scope_selector();
+    init_worktree_scope();
+    USAGE = [
+      "Usage: wayai use [--add] <hub_uuid|folder-name|hubs/<name>|bases/<name>>",
+      "       wayai use [--add] --hub <hub> | --base <base>",
+      "",
+      "  --add   widen the worktree scope instead of replacing that axis"
+    ].join("\n");
   }
 });
 
@@ -21072,19 +21198,71 @@ var unbind_exports = {};
 __export(unbind_exports, {
   unbindCommand: () => unbindCommand
 });
-async function unbindCommand(_args) {
-  const previous = readBinding();
-  if (!previous) {
-    console.log("No worktree binding to clear.");
+async function unbindCommand(args2) {
+  const addFlag = findAddFlag(args2);
+  if (addFlag !== void 0) {
+    throw expected(
+      [
+        `\`wayai unbind\` does not take ${JSON.stringify(addFlag)}.`,
+        "  wayai unbind <selector>      # remove one entry from the worktree scope",
+        "  wayai unbind                 # clear the whole scope (both hubs and bases)",
+        "  wayai use --add <selector>   # WIDEN the scope instead (the opposite change)"
+      ].join("\n")
+    );
+  }
+  const selector = resolveScopeSelector("unbind", args2);
+  if (!selector) {
+    if (args2.length > 0) {
+      throw expected(
+        [
+          `\`wayai unbind ${args2.join(" ")}\` does not name anything to remove.`,
+          "",
+          "Refusing rather than clearing the whole scope \u2014 that is what a BARE",
+          "`wayai unbind` does, and it is not what this invocation asked for.",
+          "  wayai unbind <selector>   # remove one entry",
+          "  wayai unbind              # clear the whole scope (both hubs and bases)"
+        ].join("\n")
+      );
+    }
+    const described = describeScope(readScope());
+    clearScope();
+    console.log(
+      described ? `Worktree scope cleared (was ${described}).` : "No worktree scope to clear."
+    );
     return;
   }
-  clearBinding();
-  console.log(`Worktree unbound (was: ${previous}).`);
+  const scope = readScope();
+  const literal = AXIS_ORDER.filter((axis2) => scope[axis2].includes(selector.target));
+  const literalAxis = literal.includes(selector.axis) ? selector.axis : literal.length === 1 ? literal[0] : null;
+  if (literalAxis) {
+    announce(literalAxis, selector.target, removeFromScope(literalAxis, selector.target) ?? []);
+    return;
+  }
+  const { axis, id } = resolveScopeTarget(selector);
+  const remaining = removeFromScope(axis, id);
+  if (!remaining) {
+    const described = describeScope(scope);
+    throw expected(
+      [
+        `${axisNoun(axis)} ${id} is not in this worktree's scope.`,
+        described ? `This worktree is scoped to ${described}.` : "This worktree has no scope."
+      ].join("\n")
+    );
+  }
+  announce(axis, id, remaining);
+}
+function announce(axis, id, remaining) {
+  const noun = axisNoun(axis);
+  console.log(
+    remaining.length > 0 ? `Removed ${noun} ${id} from the worktree scope (${axis}: ${remaining.join(", ")}).` : `Removed ${noun} ${id} \u2014 this worktree is no longer scoped to any ${noun}.`
+  );
 }
 var init_unbind = __esm({
   "src/commands/unbind.ts"() {
     "use strict";
-    init_hub_binding();
+    init_expected();
+    init_scope_selector();
+    init_worktree_scope();
   }
 });
 
@@ -23028,7 +23206,7 @@ __export(eval_capture_exports, {
 });
 import * as fs24 from "fs";
 import * as path31 from "path";
-import * as yaml11 from "js-yaml";
+import * as yaml12 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
   if (name.startsWith(".")) return false;
@@ -23134,7 +23312,7 @@ async function evalCaptureCommand(args2) {
   };
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
   fs24.mkdirSync(targetDir, { recursive: true });
-  fs24.writeFileSync(targetPath, yaml11.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
+  fs24.writeFileSync(targetPath, yaml12.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
   const relPath = path31.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
@@ -24507,7 +24685,7 @@ var init_set_connection_credential = __esm({
 // src/lib/org-workspace.ts
 import * as fs25 from "fs";
 import * as path32 from "path";
-import * as yaml12 from "js-yaml";
+import * as yaml13 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
@@ -24518,7 +24696,7 @@ function parseOrgResources(orgDir) {
   const manifestPath = path32.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
   if (fs25.existsSync(manifestPath)) {
-    manifest = yaml12.load(fs25.readFileSync(manifestPath, "utf-8")) ?? {};
+    manifest = yaml13.load(fs25.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
   const resourcesDir = path32.join(orgDir, "resources");
@@ -24551,7 +24729,7 @@ function writeOrgResources(orgDir, payload) {
   });
   fs25.writeFileSync(
     path32.join(orgDir, ORG_MANIFEST_NAME),
-    yaml12.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
+    yaml13.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
   const resourcesDir = path32.join(orgDir, "resources");
@@ -25373,7 +25551,7 @@ async function runSkillInstall(positional) {
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
 }
 async function runSandboxExec(positional, flagArgs) {
-  const USAGE = 'wayai admin sandbox exec [--cmd "<command>" | <command>] --hub <hub_id> --connection <connection_id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]';
+  const USAGE2 = 'wayai admin sandbox exec [--cmd "<command>" | <command>] --hub <hub_id> --connection <connection_id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]';
   let hubId;
   let connectionId;
   let egress;
@@ -25427,7 +25605,7 @@ async function runSandboxExec(positional, flagArgs) {
   const positionalCmd = positional[0];
   if (positional.length > 1) {
     console.error("Provide the command as a single quoted argument (or use --cmd).");
-    console.error(USAGE);
+    console.error(USAGE2);
     process.exit(1);
   }
   if (positionalCmd && cmdFlag) {
@@ -25436,7 +25614,7 @@ async function runSandboxExec(positional, flagArgs) {
   }
   const cmd = cmdFlag ?? positionalCmd;
   if (!cmd || !hubId || !connectionId) {
-    console.error(USAGE);
+    console.error(USAGE2);
     process.exit(1);
   }
   const body = {
@@ -25533,8 +25711,8 @@ function parseScopedTargetFlags(flagArgs, usage3, opts = {}) {
   return { body: { scope: "hub", hub_id: hubId, dry_run: dryRun }, targetLabel: `hub ${hubId}`, dryRun, yes, jsonOutput };
 }
 async function runRepairTeamOrphans(flagArgs) {
-  const USAGE = "wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
-  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE2);
   if (!dryRun && !yes && !jsonOutput) {
     console.log(`About to PURGE dangling team references in: ${targetLabel}.`);
     console.log("Memberships pointing at a deleted team are removed (HubDO + UserDO mirror); conversations pinned to one are unassigned.");
@@ -25580,8 +25758,8 @@ async function runRepairTeamOrphans(flagArgs) {
   }
 }
 async function runRepairLegacyOrgGrants(flagArgs) {
-  const USAGE = "wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]";
-  const scoped = parseScopedTargetFlags(flagArgs, USAGE, {
+  const USAGE2 = "wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]";
+  const scoped = parseScopedTargetFlags(flagArgs, USAGE2, {
     scopes: ["all", "org"],
     allLabel: "ALL organizations (platform-wide)"
   });
@@ -25633,8 +25811,8 @@ async function runRepairLegacyOrgGrants(flagArgs) {
   }
 }
 async function runHarnessMassDestroy(flagArgs) {
-  const USAGE = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
-  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE2);
   if (!dryRun && !yes && !jsonOutput) {
     console.log(`About to REAP every live harness sandbox / token / slot in: ${targetLabel}.`);
     console.log("This destroys running sandboxes and revokes their tokens. Run with --dry-run first to see the blast radius.");
@@ -25688,8 +25866,8 @@ function rejectHarnessFlags(flagArgs, usage3) {
   process.exit(1);
 }
 async function runHarnessToggle(enable, flagArgs) {
-  const USAGE = "wayai admin harness enable|disable";
-  rejectHarnessFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin harness enable|disable";
+  rejectHarnessFlags(flagArgs, USAGE2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   let value;
@@ -25710,8 +25888,8 @@ async function runHarnessToggle(enable, flagArgs) {
   }
 }
 async function runHarnessStatus(flagArgs) {
-  const USAGE = "wayai admin harness status";
-  rejectHarnessFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin harness status";
+  rejectHarnessFlags(flagArgs, USAGE2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   let value = 0;
@@ -27950,16 +28128,16 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
   ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
     const client = await createDataClient();
     const id = pathSegment(tokenId, "token id");
-    const path36 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
+    const path35 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
     const format = outputFormat(this);
     const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
     if (opts.force) {
-      await client.request("DELETE", path36(true));
+      await client.request("DELETE", path35(true));
       revoked(true);
       return;
     }
     try {
-      await client.request("DELETE", path36(false));
+      await client.request("DELETE", path35(false));
       revoked(false);
     } catch (err) {
       if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
@@ -27974,7 +28152,7 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
         console.error("Aborted.");
         return process.exit(1);
       }
-      await client.request("DELETE", path36(true));
+      await client.request("DELETE", path35(true));
       revoked(true);
     }
   });
@@ -28122,10 +28300,9 @@ var init_base_tags = __esm({
 
 // src/data/commands/bases.ts
 import { Command as Command10 } from "commander";
-import * as path35 from "path";
-function pageOf(path36, cursor) {
-  if (!cursor) return path36;
-  return `${path36}${path36.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
+function pageOf(path35, cursor) {
+  if (!cursor) return path35;
+  return `${path35}${path35.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
 }
 function parseEnum(flag, value, allowed) {
   if (value === void 0) return void 0;
@@ -28282,9 +28459,9 @@ function buildBasesCommand() {
   });
   bases.command("list-previews <origin-id>").description("List preview bases cloned from a base (production or preview)").action(async function(originId) {
     const client = await createDataClient();
-    const path36 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
+    const path35 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path36, cursor)),
+      await client.collectPages((cursor) => pageOf(path35, cursor)),
       outputFormat(this)
     );
   });
@@ -28331,45 +28508,52 @@ function buildBasesCommand() {
   });
   bases.command("promotions <production-id>").description("List promotion history for a production base").action(async function(productionId) {
     const client = await createDataClient();
-    const path36 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
+    const path35 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path36, cursor)),
+      await client.collectPages((cursor) => pageOf(path35, cursor)),
       outputFormat(this)
     );
   });
   bases.command("use <base>").description(
-    "Bind this worktree to a base so push/pull refuse to run against a different one"
+    "Deprecated alias of `wayai use bases/<id>` \u2014 scope this worktree to a base"
   ).action(async function(selector) {
-    const baseId = resolveSelectorToBaseId(selector);
-    const previous = readBaseBinding();
-    if (previous !== baseId) {
+    const baseId = resolveBaseSelectorToId(findGitRoot(), selector);
+    const previous = readScope().bases;
+    const changed = previous.length !== 1 || previous[0] !== baseId;
+    if (changed) {
       try {
-        writeBaseBinding(baseId);
+        setScopeAxis("bases", [baseId]);
       } catch (err) {
         throw expected(err instanceof Error ? err.message : String(err));
       }
     }
     if (outputFormat(this) === "json") {
-      printOutput({ base_id: baseId, previous_base_id: previous, changed: previous !== baseId }, "json");
+      printOutput(
+        { base_id: baseId, previous_base_id: previous[0] ?? null, changed },
+        "json"
+      );
       return;
     }
-    if (previous === baseId) {
+    if (!changed) {
       console.log(`Worktree already bound to base ${baseId}.`);
     } else {
       console.log(
-        previous ? `Worktree rebound: ${previous} -> ${baseId}.` : `Worktree bound to base ${baseId}.`
+        previous.length > 0 ? `Worktree rebound: ${previous.join(", ")} -> ${baseId}.` : `Worktree bound to base ${baseId}.`
       );
     }
   });
-  bases.command("unbind").description("Clear the base binding for this worktree").action(async function() {
-    const previous = readBaseBinding();
-    if (previous) clearBaseBinding();
+  bases.command("unbind").description("Deprecated alias of `wayai unbind bases/<id>` \u2014 clear the base scope").action(async function() {
+    const previous = readScope().bases;
+    if (previous.length > 0) setScopeAxis("bases", []);
     if (outputFormat(this) === "json") {
-      printOutput({ previous_base_id: previous, cleared: previous !== null }, "json");
+      printOutput(
+        { previous_base_id: previous[0] ?? null, cleared: previous.length > 0 },
+        "json"
+      );
       return;
     }
     console.log(
-      previous ? `Worktree unbound from base (was: ${previous}).` : "No base binding to clear."
+      previous.length > 0 ? `Worktree unbound from base (was: ${previous.join(", ")}).` : "No base binding to clear."
     );
   });
   bases.addCommand(buildBasesTokensCommand());
@@ -28381,13 +28565,6 @@ function buildBasesCommand() {
   bases.addCommand(buildBasesReportCommand());
   return bases;
 }
-function resolveSelectorToBaseId(selector) {
-  const gitRoot = findGitRoot();
-  if (!gitRoot || selector.includes("/") || selector.includes(path35.sep)) return selector;
-  if (!isPathSafeId(selector)) return selector;
-  const id = readBaseMeta(path35.join(resolveBasesDir(gitRoot), selector))?.base_id;
-  return typeof id === "string" && isPathSafeId(id) ? id : selector;
-}
 var init_bases = __esm({
   "src/data/commands/bases.ts"() {
     "use strict";
@@ -28405,10 +28582,8 @@ var init_bases = __esm({
     init_utils();
     init_terminal_output();
     init_workspace();
-    init_layout();
     init_base_workspace();
-    init_base_binding();
-    init_base_id();
+    init_worktree_scope();
     init_expected();
   }
 });
@@ -28882,8 +29057,8 @@ function buildRecordsCommand() {
     const body = { data: parseData(opts.data) };
     if (opts.externalId) body.external_id = opts.externalId;
     if (opts.externalSource) body.external_source = opts.externalSource;
-    const path36 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
-    printOutput(await client.request("PUT", path36, body), outputFormat(this));
+    const path35 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
+    printOutput(await client.request("PUT", path35, body), outputFormat(this));
   });
   records.command("query <record_type>").description("List/search records: exact filters + fuzzy `search`, sorting, pagination").option(
     "--external-source <source>",
@@ -28918,9 +29093,9 @@ function buildRecordsCommand() {
   ).action(async function(recordType2, id, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path36 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
-    if (opts.externalSource) path36 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
-    printOutput(await client.request("GET", path36), outputFormat(this));
+    let path35 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    if (opts.externalSource) path35 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
+    printOutput(await client.request("GET", path35), outputFormat(this));
   });
   records.command("delete <record_type> <id>").description(
     "Delete a record by internal ID, or by external_id (pass --external-source to scope it)"
@@ -28934,11 +29109,11 @@ function buildRecordsCommand() {
     }
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path36 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    let path35 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
     if (opts.externalSource) {
-      path36 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
+      path35 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
     }
-    await client.request("DELETE", path36);
+    await client.request("DELETE", path35);
     console.log("Deleted");
   });
   records.command("history <id>").description(
@@ -29103,8 +29278,8 @@ function buildRelationshipsCommand() {
     if (opts.data) body.data = parseData(opts.data);
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path36 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
-    printOutput(await client.request("PUT", path36, body), outputFormat(this));
+    const path35 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
+    printOutput(await client.request("PUT", path35, body), outputFormat(this));
   });
   relationships.command("get <id>").description(
     "Get a relationship by ID (or by its external key: pass the external_id with --rel-type)"
@@ -29337,8 +29512,8 @@ function buildToolsetsCommand() {
   toolsets.command("get <slug>").description("Get a toolset").option("--resolved", "Include resolved record_type schemas").action(async function(slug, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path36 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
-    printOutput(await client.request("GET", path36), outputFormat(this));
+    const path35 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
+    printOutput(await client.request("GET", path35), outputFormat(this));
   });
   toolsets.command("list").description("List all toolsets").action(async function() {
     const base = pathSegment(requireBase(this), "--base");
@@ -29573,7 +29748,7 @@ init_utils();
 init_registry();
 import { readFileSync as readFileSync26 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname12, join as join34 } from "path";
+import { dirname as dirname12, join as join33 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -29729,7 +29904,7 @@ Run \`wayai admin skill install\` to update.`);
 
 // src/index.ts
 var __dirname = dirname12(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join34(__dirname, "..", "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync26(join33(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -29978,9 +30153,9 @@ Commands:
   sync               Alias of \`publish\` (not to be confused with sync-skills / sync-mcp)
   org create         Create a new organization (you become its owner)
   org <pull|push|diff>  Sync org-scoped resources as code (wayai-ws/org/)
-  use <hub>          Bind this worktree to a specific hub (UUID or folder name)
+  use [--add] <sel>  Scope this worktree to a hub or base (UUID, folder name, hubs/<n>, bases/<n>; --add widens)
   migrate            Move a legacy repo to the wayai-ws/{hubs,org} layout
-  unbind             Clear the worktree hub binding
+  unbind [<sel>]     Drop one entry from the worktree scope, or clear the whole scope
   send-message       Send a test message to a hub (preview or production; -f <path> to attach a file)
   conversations      List or inspect conversations
   alerts             Show a hub's active connection/credential alerts (run this FIRST when a hub misbehaves)
@@ -30002,8 +30177,8 @@ Commands:
 Data \u2014 one namespace per entity. Run \`wayai <namespace> --help\` for its tree.
 ${await dataHelpBlock()}
   bases promote      Promote a preview base to production (distinct from \`publish\`, which promotes a hub)
-  bases use <base>   Bind this worktree to a base (\`wayai use\` binds a hub)
-  bases unbind       Clear this worktree's base binding
+  bases use <base>   Deprecated alias of \`wayai use bases/<id>\`
+  bases unbind       Deprecated alias of \`wayai unbind bases/<id>\` (clears the base axis)
 
 Flags:
   --yes, -y              Skip confirmation prompts (useful for CI and scripting)
@@ -30055,12 +30230,15 @@ Org-scoped mode:
   pull/push operate on the single hub in the workspace, or pass
   \`--hub <uuid|name>\` to disambiguate when multiple hubs exist.
 
-Worktree hub binding:
-  Each git checkout (main or linked worktree) can be bound to a single hub.
-  push/pull refuse to run against a different hub once bound. The binding is
-  auto-set on first successful pull (or new-hub creation) into an unbound
-  checkout. Use \`wayai use <hub>\` to bind manually and \`wayai unbind\` to clear.
-  The binding lives at \`<git-dir>/wayai-binding\` and is naturally per-checkout.
+Worktree scope:
+  Each git checkout (main or linked worktree) carries a scope: a set of hubs and
+  a set of bases, at \`<git-dir>/wayai-scope\` \u2014 per-checkout, never tracked.
+  push/pull/publish refuse to run against anything outside a non-empty set. Each
+  axis is seeded by the first successful pull/push/create into a checkout that
+  has none, and only widens on purpose: \`wayai use --add <sel>\` adds one,
+  \`wayai use <sel>\` replaces that axis, \`wayai unbind <sel>\` drops one entry and
+  bare \`wayai unbind\` clears everything. It is a routing tripwire, not a lock
+  and not authorization.
 
 Examples:
   wayai login