@wayai/cli 0.3.150 → 0.3.152

package/dist/index.js

@@ -447,11 +447,11 @@ function captureException2(error, context) {
     Sentry.captureException(error);
   });
 }
-function addApiBreadcrumb(method, path36) {
+function addApiBreadcrumb(method, path35) {
   if (!initialized) return;
   Sentry.addBreadcrumb({
     category: "http",
-    message: `${method} ${path36}`,
+    message: `${method} ${path35}`,
     level: "info"
   });
 }
@@ -905,8 +905,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data, path: path36, errorMaps, issueData } = params;
-      const fullPath = [...path36, ...issueData.path || []];
+      const { data, path: path35, errorMaps, issueData } = params;
+      const fullPath = [...path35, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -1217,11 +1217,11 @@ var init_types = __esm({
     init_parseUtil();
     init_util();
     ParseInputLazyPath = class {
-      constructor(parent, value, path36, key) {
+      constructor(parent, value, path35, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path36;
+        this._path = path35;
         this._key = key;
       }
       get path() {
@@ -4634,12 +4634,12 @@ function validateFollowupLinks(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path36 = ["followups", i, "after_followup_id"];
+    const path35 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -4648,7 +4648,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -4658,7 +4658,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -4670,7 +4670,7 @@ function validateFollowupLinks(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -4678,7 +4678,7 @@ function validateFollowupLinks(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -4754,12 +4754,12 @@ function typeMatches(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema(schema, path36, errors, opts = {}) {
+function validateSchema(schema, path35, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH) {
     errors.push({
-      path: path36 || "<root>",
+      path: path35 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -4767,7 +4767,7 @@ function validateSchema(schema, path36, errors, opts = {}) {
   }
   if (!isRecord(schema)) {
     errors.push({
-      path: path36,
+      path: path35,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -4775,14 +4775,14 @@ function validateSchema(schema, path36, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path36 ? `${path36}.type` : "type",
+        path: path35 ? `${path35}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches(schema.type, ALLOWED_TYPES)) {
     errors.push({
-      path: `${path36}.type`,
+      path: `${path35}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -4792,25 +4792,25 @@ function validateSchema(schema, path36, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive(e[i])) {
           errors.push({
-            path: `${path36}.enum[${i}]`,
+            path: `${path35}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -4820,7 +4820,7 @@ function validateSchema(schema, path36, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path36}.${key}`,
+        path: `${path35}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -4829,45 +4829,45 @@ function validateSchema(schema, path36, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord(schema.properties)) {
       errors.push({
-        path: `${path36}.properties`,
+        path: `${path35}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema(propSchema, `${path36}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema(propSchema, `${path35}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema(sub, `${path36}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema(sub, `${path35}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema(schema.items, `${path36}.items`, errors, { depth: depth + 1 });
+      validateSchema(schema.items, `${path35}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS) {
     if (key in schema && isRecord(schema[key])) {
-      validateSchema(schema[key], `${path36}.${key}`, errors, { depth: depth + 1 });
+      validateSchema(schema[key], `${path35}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema(sub, `${path36}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema(sub, `${path35}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS) {
     const map = schema[key];
     if (isRecord(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema(sub, `${path36}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema(sub, `${path35}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path36}.${k}`;
+    const fieldPath = `${path35}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS) {
       if (v === token) {
@@ -5012,8 +5012,8 @@ function evalInitialStateError(input) {
     const parsed = evalInitialStateEntry.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path36 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path36} is invalid: ${issue?.message ?? "malformed"}`;
+      const path35 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path35} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -5201,10 +5201,10 @@ function refineHubAsCodeEvals(config, ctx) {
 function refineHubAsCodeEvalAttachments(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path36, turn, name) => {
+  const addTurnIssue = (path35, turn, name) => {
     const error = evalTurnAttachmentsError(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path36, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path35, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes(turn)) referencedHashes.add(hash);
@@ -5350,11 +5350,11 @@ function refineHubAsCodeDelegation(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path36 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path35 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -5362,7 +5362,7 @@ function refineHubAsCodeDelegation(config, ctx) {
       if (!CONTEXT_BOUNDARIES.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES.join(", ")}`
         });
       }
@@ -8915,10 +8915,10 @@ function toDataProxyPath(v1Path) {
   }
   return `${DATA_PROXY_PREFIX}${v1Path.slice(REKOR_V1_PREFIX.length)}`;
 }
-function withOrgSelector(path36, orgId) {
-  if (!orgId) return path36;
-  const separator = path36.includes("?") ? "&" : "?";
-  return `${path36}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
+function withOrgSelector(path35, orgId) {
+  if (!orgId) return path35;
+  const separator = path35.includes("?") ? "&" : "?";
+  return `${path35}${separator}${DATA_PROXY_ORG_QUERY_PARAM}=${encodeURIComponent(orgId)}`;
 }
 function dataErrorMessage(err) {
   if (!(err instanceof ApiError)) return null;
@@ -8942,7 +8942,7 @@ var init_api_client = __esm({
     init_sentry();
     init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+    delay = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
     ApiError = class extends Error {
       status;
       body;
@@ -8952,13 +8952,13 @@ var init_api_client = __esm({
        * telling them apart by body shape misreads one for the other.
        */
       path;
-      constructor(method, path36, status, body) {
+      constructor(method, path35, status, body) {
         const safeBody = maskSecretsInMessage(body);
-        super(`API request failed: ${method} ${path36} (${status}): ${safeBody}`);
+        super(`API request failed: ${method} ${path35} (${status}): ${safeBody}`);
         this.name = "ApiError";
         this.status = status;
         this.body = safeBody;
-        this.path = path36;
+        this.path = path35;
       }
       /** True when the status code is a 4xx client error (expected user-facing condition, not a bug). */
       get isExpected() {
@@ -9060,8 +9060,8 @@ var init_api_client = __esm({
           ...opts?.check && { check: true }
         });
       }
-      async lookup(path36, opts) {
-        const params = new URLSearchParams({ path: path36 });
+      async lookup(path35, opts) {
+        const params = new URLSearchParams({ path: path35 });
         if (opts?.organizationId) params.set("organization_id", opts.organizationId);
         return this.request("GET", `/api/ci/lookup?${params.toString()}`);
       }
@@ -9504,9 +9504,9 @@ var init_api_client = __esm({
        * sandbox for this conversation, or the blob was purged).
        */
       async downloadArchiveSandboxFs(hubId, conversationId) {
-        const path36 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
-        addApiBreadcrumb("GET", path36);
-        const url = `${this.apiUrl}${path36}`;
+        const path35 = `/api/archive/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}/sandbox`;
+        addApiBreadcrumb("GET", path35);
+        const url = `${this.apiUrl}${path35}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -9520,7 +9520,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path36, response.status, await response.text());
+          throw new ApiError("GET", path35, response.status, await response.text());
         }
         return new Uint8Array(await response.arrayBuffer());
       }
@@ -9560,9 +9560,9 @@ var init_api_client = __esm({
           `/api/admin/data-explorer/debug/observability/${encodeURIComponent(hubId)}/conversations/${encodeURIComponent(conversationId)}${qs}`
         );
       }
-      async request(method, path36, body, extraHeaders, contentType) {
-        addApiBreadcrumb(method, path36);
-        const url = `${this.apiUrl}${path36}`;
+      async request(method, path35, body, extraHeaders, contentType) {
+        addApiBreadcrumb(method, path35);
+        const url = `${this.apiUrl}${path35}`;
         let refreshedOn401 = false;
         for (let retry = 0; ; retry++) {
           let response = await this.send(url, method, body, extraHeaders, contentType);
@@ -9587,7 +9587,7 @@ var init_api_client = __esm({
             await delay(RETRYABLE_BACKOFF_MS[retry]);
             continue;
           }
-          throw new ApiError(method, path36, response.status, errorBody);
+          throw new ApiError(method, path35, response.status, errorBody);
         }
       }
       /**
@@ -9607,7 +9607,7 @@ var init_api_client = __esm({
        * `dataErrorMessage` recovers the envelope's own message for display.
        *
        * `orgId` is the caller's org SELECTOR (the `--org` flag, else the repo's
-       * `.wayai.yaml`), not an authorization claim: the backend validates it against
+       * `wayai-ws/wayai.yaml`), not an authorization claim: the backend validates it against
        * the caller's grants and attests only the validated result. A multi-org user
        * needs it to pick; a single-org user can omit it.
        *
@@ -9649,9 +9649,9 @@ var init_api_client = __esm({
        * transient-retry loop — re-streaming a blob is not worth a cold-start probe.
        */
       async dataDownload(v1Path, orgId) {
-        const path36 = withOrgSelector(toDataProxyPath(v1Path), orgId);
-        addApiBreadcrumb("GET", path36);
-        const url = `${this.apiUrl}${path36}`;
+        const path35 = withOrgSelector(toDataProxyPath(v1Path), orgId);
+        addApiBreadcrumb("GET", path35);
+        const url = `${this.apiUrl}${path35}`;
         let response = await this.send(url, "GET");
         if (response.status === 401 && this.onUnauthorized) {
           let refreshed;
@@ -9665,7 +9665,7 @@ var init_api_client = __esm({
           }
         }
         if (!response.ok) {
-          throw new ApiError("GET", path36, response.status, await response.text());
+          throw new ApiError("GET", path35, response.status, await response.text());
         }
         return {
           bytes: new Uint8Array(await response.arrayBuffer()),
@@ -9817,12 +9817,12 @@ function validateFollowupLinks2(followups, label, ctx) {
   const linkTargets = /* @__PURE__ */ new Set();
   followups.forEach((followup, i) => {
     const ref = followup?.after_followup_id;
-    const path36 = ["followups", i, "after_followup_id"];
+    const path35 = ["followups", i, "after_followup_id"];
     if (followup?.type !== "inactivity_after_before_event") {
       if (ref !== void 0) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `kanban status ${label}: after_followup_id is only valid on inactivity_after_before_event followups (this one is ${followup?.type})`
         });
       }
@@ -9831,7 +9831,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (ref === void 0) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: inactivity_after_before_event requires after_followup_id naming the id of a before_event followup in the same status`
       });
       return;
@@ -9841,7 +9841,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (matches.length > 1) {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" matches ${matches.length} followups \u2014 a link must name exactly one`
       });
       return;
@@ -9853,7 +9853,7 @@ function validateFollowupLinks2(followups, label, ctx) {
       );
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: hasIdlessBeforeEvent ? `kanban status ${label}: after_followup_id "${ref}" matches no followup \u2014 a link target must declare an explicit id, and this status has before_event followups without one` : `kanban status ${label}: after_followup_id "${ref}" matches no followup in this status`
       });
       return;
@@ -9861,7 +9861,7 @@ function validateFollowupLinks2(followups, label, ctx) {
     if (target.type !== "before_event") {
       ctx.addIssue({
         code: external_exports.ZodIssueCode.custom,
-        path: path36,
+        path: path35,
         message: `kanban status ${label}: after_followup_id "${ref}" points at a ${target.type} followup \u2014 only before_event followups can anchor a chain`
       });
     }
@@ -9937,12 +9937,12 @@ function typeMatches2(typeField, allowed) {
   if (Array.isArray(typeField)) return typeField.every((t) => typeof t === "string" && allowed.has(t));
   return false;
 }
-function validateSchema2(schema, path36, errors, opts = {}) {
+function validateSchema2(schema, path35, errors, opts = {}) {
   if (typeof schema === "boolean") return;
   const depth = opts.depth ?? 0;
   if (depth > MAX_SCHEMA_DEPTH2) {
     errors.push({
-      path: path36 || "<root>",
+      path: path35 || "<root>",
       message: `schema nesting exceeds ${MAX_SCHEMA_DEPTH2} levels`,
       suggestion: "Flatten the schema; LLM providers reject deeply nested tool input_schemas."
     });
@@ -9950,7 +9950,7 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   }
   if (!isRecord2(schema)) {
     errors.push({
-      path: path36,
+      path: path35,
       message: `expected object, got ${schema === null ? "null" : typeof schema}`
     });
     return;
@@ -9958,14 +9958,14 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   if (opts.isRoot) {
     if ("type" in schema && schema.type !== "object") {
       errors.push({
-        path: path36 ? `${path36}.type` : "type",
+        path: path35 ? `${path35}.type` : "type",
         message: `root type must be 'object', got ${JSON.stringify(schema.type)}`,
         suggestion: "Tool parameters at the root must be an object: `{ type: 'object', properties: { ... } }`."
       });
     }
   } else if ("type" in schema && !typeMatches2(schema.type, ALLOWED_TYPES2)) {
     errors.push({
-      path: `${path36}.type`,
+      path: `${path35}.type`,
       message: `type must be one of ${[...ALLOWED_TYPES2].join("/")} or an array of those, got ${JSON.stringify(schema.type)}`
     });
   }
@@ -9975,25 +9975,25 @@ function validateSchema2(schema, path36, errors, opts = {}) {
       const isPlaceholder = PLACEHOLDER_TOKENS2.includes(e);
       const isOutcomePlaceholder = e === "[KANBAN_OUTCOME_VALUES]";
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got string ${JSON.stringify(e)}`,
         suggestion: isOutcomePlaceholder ? "Declare `outcomes` on the hub's terminal kanban status so the platform can render the placeholder into a valid array; with none configured the platform drops the parameter instead." : isPlaceholder ? "Set `operation: 'update_kanban_status'` on the tool and ensure at least one hub.kanban_status has `allowsAgentUpdate: true` so the platform can render the placeholder into a valid array." : 'Wrap the value in an array: `enum: ["value"]`.'
       });
     } else if (!Array.isArray(e)) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: `enum must be a non-empty array of primitives, got ${typeof e}`
       });
     } else if (e.length === 0) {
       errors.push({
-        path: `${path36}.enum`,
+        path: `${path35}.enum`,
         message: "enum must not be empty"
       });
     } else {
       for (let i = 0; i < e.length; i++) {
         if (!isPrimitive2(e[i])) {
           errors.push({
-            path: `${path36}.enum[${i}]`,
+            path: `${path35}.enum[${i}]`,
             message: `enum entry must be a primitive (string/number/boolean/null), got ${typeof e[i]}`
           });
         }
@@ -10003,7 +10003,7 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   for (const key of ["exclusiveMinimum", "exclusiveMaximum"]) {
     if (key in schema && typeof schema[key] === "boolean") {
       errors.push({
-        path: `${path36}.${key}`,
+        path: `${path35}.${key}`,
         message: `${key} as boolean is draft-04 syntax; draft 2020-12 requires a numeric value`,
         suggestion: `Replace with the numeric bound, e.g. \`${key}: 0\`.`
       });
@@ -10012,45 +10012,45 @@ function validateSchema2(schema, path36, errors, opts = {}) {
   if ("properties" in schema) {
     if (!isRecord2(schema.properties)) {
       errors.push({
-        path: `${path36}.properties`,
+        path: `${path35}.properties`,
         message: `properties must be an object, got ${Array.isArray(schema.properties) ? "array" : typeof schema.properties}`
       });
     } else {
       for (const [propName, propSchema] of Object.entries(schema.properties)) {
-        validateSchema2(propSchema, `${path36}.properties.${propName}`, errors, { depth: depth + 1 });
+        validateSchema2(propSchema, `${path35}.properties.${propName}`, errors, { depth: depth + 1 });
       }
     }
   }
   if (schemaTypeIncludes2(schema, "array") && "items" in schema) {
     if (Array.isArray(schema.items)) {
-      schema.items.forEach((sub, i) => validateSchema2(sub, `${path36}.items[${i}]`, errors, { depth: depth + 1 }));
+      schema.items.forEach((sub, i) => validateSchema2(sub, `${path35}.items[${i}]`, errors, { depth: depth + 1 }));
     } else {
-      validateSchema2(schema.items, `${path36}.items`, errors, { depth: depth + 1 });
+      validateSchema2(schema.items, `${path35}.items`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_OBJECT_KEYWORDS2) {
     if (key in schema && isRecord2(schema[key])) {
-      validateSchema2(schema[key], `${path36}.${key}`, errors, { depth: depth + 1 });
+      validateSchema2(schema[key], `${path35}.${key}`, errors, { depth: depth + 1 });
     }
   }
   for (const key of SUBSCHEMA_LIST_KEYWORDS2) {
     const list = schema[key];
     if (Array.isArray(list)) {
-      list.forEach((sub, i) => validateSchema2(sub, `${path36}.${key}[${i}]`, errors, { depth: depth + 1 }));
+      list.forEach((sub, i) => validateSchema2(sub, `${path35}.${key}[${i}]`, errors, { depth: depth + 1 }));
     }
   }
   for (const key of SUBSCHEMA_MAP_KEYWORDS2) {
     const map = schema[key];
     if (isRecord2(map)) {
       for (const [name, sub] of Object.entries(map)) {
-        validateSchema2(sub, `${path36}.${key}.${name}`, errors, { depth: depth + 1 });
+        validateSchema2(sub, `${path35}.${key}.${name}`, errors, { depth: depth + 1 });
       }
     }
   }
   const reportedPaths = new Set(errors.map((e) => e.path));
   for (const [k, v] of Object.entries(schema)) {
     if (typeof v !== "string") continue;
-    const fieldPath = `${path36}.${k}`;
+    const fieldPath = `${path35}.${k}`;
     if (reportedPaths.has(fieldPath)) continue;
     for (const token of PLACEHOLDER_TOKENS2) {
       if (v === token) {
@@ -10195,8 +10195,8 @@ function evalInitialStateError2(input) {
     const parsed = evalInitialStateEntry2.safeParse(entries[i]);
     if (!parsed.success) {
       const issue = parsed.error.issues[0];
-      const path36 = issue?.path.join(".") || "?";
-      return `initial_state[${i}].${path36} is invalid: ${issue?.message ?? "malformed"}`;
+      const path35 = issue?.path.join(".") || "?";
+      return `initial_state[${i}].${path35} is invalid: ${issue?.message ?? "malformed"}`;
     }
     if (seenSlugs.has(parsed.data.slug)) {
       return `initial_state[${i}].slug "${parsed.data.slug}" is declared more than once`;
@@ -10401,10 +10401,10 @@ function refineHubAsCodeEvals2(config, ctx) {
 function refineHubAsCodeEvalAttachments2(config, ctx) {
   const cfg = config;
   const referencedHashes = /* @__PURE__ */ new Set();
-  const addTurnIssue = (path36, turn, name) => {
+  const addTurnIssue = (path35, turn, name) => {
     const error = evalTurnAttachmentsError2(turn);
     if (error) {
-      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path36, message: `${name}: ${error}` });
+      ctx.addIssue({ code: external_exports.ZodIssueCode.custom, path: path35, message: `${name}: ${error}` });
       return;
     }
     for (const hash of collectTurnAttachmentHashes2(turn)) referencedHashes.add(hash);
@@ -10550,11 +10550,11 @@ function refineHubAsCodeDelegation2(config, ctx) {
         }
       }
       if (del.context_boundary === void 0) return;
-      const path36 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
+      const path35 = ["agents", agentIndex, "tools", "delegation", delIndex, "context_boundary"];
       if (del.type !== "hub") {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary applies only to \`type: hub\` delegations (got type "${String(del.type)}")`
         });
         return;
@@ -10562,7 +10562,7 @@ function refineHubAsCodeDelegation2(config, ctx) {
       if (!CONTEXT_BOUNDARIES2.includes(del.context_boundary)) {
         ctx.addIssue({
           code: external_exports.ZodIssueCode.custom,
-          path: path36,
+          path: path35,
           message: `context_boundary must be one of: ${CONTEXT_BOUNDARIES2.join(", ")}`
         });
       }
@@ -14516,34 +14516,15 @@ function resolveLayout(gitRoot, layout = WAYAI_LAYOUT) {
   const newWs = path.join(gitRoot, layout.wsDir);
   const legacyWs = path.join(gitRoot, layout.legacy.wsDir);
   const legacyOrg = path.join(gitRoot, layout.legacy.orgAtRoot);
-  const newExists = isDirectory(newWs);
   const legacyExists = isDirectory(legacyWs) || isDirectory(legacyOrg);
   const basesDir = path.join(newWs, layout.basesSubdir);
-  if (newExists) {
-    return {
-      hubsDir: path.join(newWs, layout.hubsSubdir),
-      orgDir: path.join(newWs, layout.orgSubdir),
-      basesDir,
-      isLegacy: false,
-      legacyAlsoPresent: legacyExists
-    };
+  const hubsDir = path.join(newWs, layout.hubsSubdir);
+  const orgDir = path.join(newWs, layout.orgSubdir);
+  const newDisplacesLegacy = () => isDirectory(hubsDir) || isDirectory(orgDir) || isDirectory(basesDir);
+  if (legacyExists && !newDisplacesLegacy()) {
+    return { hubsDir: legacyWs, orgDir: legacyOrg, basesDir, isLegacy: true, legacyAlsoPresent: false };
   }
-  if (legacyExists) {
-    return {
-      hubsDir: legacyWs,
-      orgDir: legacyOrg,
-      basesDir,
-      isLegacy: true,
-      legacyAlsoPresent: false
-    };
-  }
-  return {
-    hubsDir: path.join(newWs, layout.hubsSubdir),
-    orgDir: path.join(newWs, layout.orgSubdir),
-    basesDir,
-    isLegacy: false,
-    legacyAlsoPresent: false
-  };
+  return { hubsDir, orgDir, basesDir, isLegacy: false, legacyAlsoPresent: legacyExists };
 }
 function resolveBasesDir(gitRoot) {
   return resolveLayout(gitRoot).basesDir;
@@ -14960,111 +14941,344 @@ var init_workspace = __esm({
   }
 });
 
+// src/lib/workspace-manifest.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as yaml2 from "js-yaml";
+function workspaceManifestPath(gitRoot) {
+  return path3.join(gitRoot, WAYAI_LAYOUT.wsDir, WORKSPACE_MANIFEST_FILE);
+}
+function rootConfigPath(gitRoot) {
+  return path3.join(gitRoot, ROOT_CONFIG_FILE);
+}
+function loadYamlMapping(file) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(file, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "absent" };
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  let doc;
+  try {
+    doc = yaml2.load(raw);
+  } catch (err) {
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  if (doc === void 0 || doc === null) return { kind: "ok", doc: {} };
+  if (typeof doc !== "object" || Array.isArray(doc)) {
+    return { kind: "malformed", reason: "expected a YAML mapping of settings" };
+  }
+  return { kind: "ok", doc };
+}
+function loadWorkspaceManifest(gitRoot) {
+  return loadYamlMapping(workspaceManifestPath(gitRoot));
+}
+var WORKSPACE_MANIFEST_FILE, WORKSPACE_MANIFEST_LABEL, ROOT_CONFIG_FILE;
+var init_workspace_manifest = __esm({
+  "src/lib/workspace-manifest.ts"() {
+    "use strict";
+    init_layout();
+    WORKSPACE_MANIFEST_FILE = "wayai.yaml";
+    WORKSPACE_MANIFEST_LABEL = `${WAYAI_LAYOUT.wsDir}/${WORKSPACE_MANIFEST_FILE}`;
+    ROOT_CONFIG_FILE = ".wayai.yaml";
+  }
+});
+
 // src/lib/repo-config.ts
 var repo_config_exports = {};
 __export(repo_config_exports, {
+  _resetRepoConfigNotices: () => _resetRepoConfigNotices,
+  planOrgMigration: () => planOrgMigration,
   readRepoConfig: () => readRepoConfig,
+  readRepoConfigUnlessBlocked: () => readRepoConfigUnlessBlocked,
+  readRepoScopeBlocker: () => readRepoScopeBlocker,
   requireRepoConfig: () => requireRepoConfig,
+  resolveRepoConfig: () => resolveRepoConfig,
   writeRepoConfig: () => writeRepoConfig
 });
-import * as fs3 from "fs";
-import * as path3 from "path";
-import * as yaml2 from "js-yaml";
-function warnAboutLegacyFields(found) {
-  if (legacyFieldsWarned || found.length === 0) return;
-  legacyFieldsWarned = true;
-  console.warn(
-    `Note: .wayai.yaml contains deprecated field(s) ${found.join(", ")}. These are ignored \u2014 only organization_id is used now. You can remove them.`
-  );
+import * as fs4 from "fs";
+import * as path4 from "path";
+import * as yaml3 from "js-yaml";
+function noticeOnce(key, emit) {
+  if (noticed.has(key)) return;
+  noticed.add(key);
+  emit();
+}
+function _resetRepoConfigNotices() {
+  noticed.clear();
+}
+function readOrgFields(doc) {
+  const raw = doc.organization_id;
+  if (raw === void 0 || raw === null) {
+    if (typeof doc.organization === "string") {
+      return {
+        kind: "invalid",
+        detail: "it uses the old format (organization: <name>) \u2014 replace it with organization_id: <uuid>"
+      };
+    }
+    return { kind: "none" };
+  }
+  if (typeof raw !== "string" || !UUID_RE2.test(raw.trim())) {
+    return { kind: "invalid", detail: "organization_id must be a UUID" };
+  }
+  const name = typeof doc.organization_name === "string" && doc.organization_name.trim() ? doc.organization_name.trim() : void 0;
+  const config = { organization_id: raw.trim() };
+  if (name) config.organization_name = name;
+  return { kind: "declared", config };
+}
+function declarationFrom(load11) {
+  if (load11.kind === "absent") return { kind: "none" };
+  if (load11.kind === "malformed") return { kind: "invalid", detail: `it does not parse (${load11.reason})` };
+  return readOrgFields(load11.doc);
+}
+function legacyFieldsIn(load11) {
+  if (load11.kind !== "ok") return [];
+  return LEGACY_FIELDS.filter((f) => load11.doc[f] !== void 0);
+}
+function resolve2(gitRoot) {
+  const manifestFile = workspaceManifestPath(gitRoot);
+  const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
+  if (manifest.kind === "invalid") {
+    return { kind: "invalid", source: "manifest", file: manifestFile, detail: manifest.detail };
+  }
+  const rootFile = rootConfigPath(gitRoot);
+  const rootLoad = loadYamlMapping(rootFile);
+  const root = declarationFrom(rootLoad);
+  if (manifest.kind === "declared") {
+    if (root.kind === "declared" && root.config.organization_id !== manifest.config.organization_id) {
+      return {
+        kind: "conflict",
+        manifestOrg: manifest.config.organization_id,
+        rootOrg: root.config.organization_id
+      };
+    }
+    return {
+      kind: "ok",
+      resolved: { config: manifest.config, source: "manifest", path: manifestFile },
+      legacyRootFields: []
+    };
+  }
+  if (root.kind === "declared") {
+    return {
+      kind: "ok",
+      resolved: { config: root.config, source: "root", path: rootFile },
+      legacyRootFields: legacyFieldsIn(rootLoad)
+    };
+  }
+  if (root.kind === "invalid") {
+    return { kind: "invalid", source: "root", file: rootFile, detail: root.detail };
+  }
+  return { kind: "none" };
+}
+function conflictMessage(manifestOrg, rootOrg, remedy = RECONCILE_REMEDY) {
+  return [
+    "Refusing to guess the organization: two files in this repo name different ones.",
+    `  ${WORKSPACE_MANIFEST_LABEL} -> ${manifestOrg}   (the workspace manifest)`,
+    `  ${ROOT_CONFIG_FILE} -> ${rootOrg}   (deprecated fallback)`,
+    "",
+    ...remedy
+  ].join("\n");
+}
+function rebindRefusal(requestedOrg, rootOrg) {
+  return [
+    `Refusing to re-bind the organization: ${ROOT_CONFIG_FILE} still names a different one, and it is read as a fallback.`,
+    `  requested        -> ${requestedOrg}`,
+    `  ${ROOT_CONFIG_FILE}      -> ${rootOrg}   (deprecated fallback)`,
+    "",
+    `Delete ${ROOT_CONFIG_FILE} (or set its organization_id to ${requestedOrg}), then re-run.`,
+    "Nothing was written \u2014 this repo still resolves to the organization it had."
+  ].join("\n");
+}
+function invalidMessage(file, detail) {
+  return [
+    `Invalid organization binding in ${file}: ${detail}.`,
+    "",
+    "  organization_id: <your-org-uuid>",
+    "",
+    "Run `wayai init` to set up the workspace."
+  ].join("\n");
+}
+function missingMessage() {
+  return [
+    "This repository is not scoped to an organization.",
+    `Declare it in ${WORKSPACE_MANIFEST_LABEL}:`,
+    "",
+    "  organization_id: <your-org-uuid>",
+    "",
+    "Run `wayai init` to set up the workspace."
+  ].join("\n");
+}
+function report(r, posture) {
+  switch (r.kind) {
+    case "ok":
+      if (r.resolved.source !== "root") return;
+      noticeOnce(
+        "root-fallback",
+        () => console.warn(
+          `Note: this repo's organization binding is still in ${ROOT_CONFIG_FILE} at the repository root. It belongs in the workspace manifest ${WORKSPACE_MANIFEST_LABEL} \u2014 run \`wayai migrate\` to copy it there.`
+        )
+      );
+      if (r.legacyRootFields.length > 0) {
+        noticeOnce(
+          "legacy-fields",
+          () => console.warn(
+            `Note: ${ROOT_CONFIG_FILE} contains deprecated field(s) ${r.legacyRootFields.join(", ")}. These are ignored \u2014 only organization_id is used now. You can remove them.`
+          )
+        );
+      }
+      return;
+    case "invalid": {
+      const emit = () => console.error(invalidMessage(r.file, r.detail));
+      if (posture === "hard") emit();
+      else noticeOnce(`invalid:${r.source}`, emit);
+      return;
+    }
+    case "conflict":
+      console.error(conflictMessage(r.manifestOrg, r.rootOrg));
+      return;
+    case "none":
+      if (posture === "hard") console.error(missingMessage());
+      return;
+  }
+}
+function resolveRepoConfig(root) {
+  const gitRoot = root ?? findGitRoot();
+  if (!gitRoot) return null;
+  const r = resolve2(gitRoot);
+  report(r, "soft");
+  return r.kind === "ok" ? r.resolved : null;
 }
 function readRepoConfig(root) {
+  return resolveRepoConfig(root)?.config ?? null;
+}
+function readRepoConfigUnlessBlocked(root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) return null;
-  const configPath3 = path3.join(gitRoot, ".wayai.yaml");
-  if (!fs3.existsSync(configPath3)) return null;
-  try {
-    const content = fs3.readFileSync(configPath3, "utf-8");
-    const config = yaml2.load(content);
-    if (!config?.organization_id || typeof config.organization_id !== "string") {
-      if (config?.organization && typeof config.organization === "string") {
-        console.error(
-          ".wayai.yaml uses the old format (organization: name). Replace it with organization_id: <uuid>."
-        );
-      }
+  const r = resolve2(gitRoot);
+  switch (r.kind) {
+    case "ok":
+      report(r, "soft");
+      return r.resolved.config;
+    case "none":
       return null;
-    }
-    if (!UUID_RE2.test(config.organization_id)) return null;
-    const presentLegacy = LEGACY_FIELDS.filter((f) => config[f] !== void 0);
-    warnAboutLegacyFields(presentLegacy);
-    const organizationName = typeof config.organization_name === "string" && config.organization_name.trim() ? config.organization_name.trim() : void 0;
+    case "conflict":
+      throw expected(conflictMessage(r.manifestOrg, r.rootOrg));
+    case "invalid":
+      throw expected(invalidMessage(r.file, r.detail));
+  }
+}
+function requireRepoConfig(root) {
+  const gitRoot = root ?? findGitRoot();
+  const r = gitRoot ? resolve2(gitRoot) : { kind: "none" };
+  report(r, "hard");
+  if (r.kind === "ok") return r.resolved.config;
+  return process.exit(1);
+}
+function readRepoScopeBlocker(root) {
+  const gitRoot = root ?? findGitRoot();
+  if (!gitRoot) return null;
+  const r = resolve2(gitRoot);
+  if (r.kind === "conflict") {
     return {
-      organization_id: config.organization_id,
-      organization_name: organizationName
+      kind: "conflict",
+      manifest_organization_id: r.manifestOrg,
+      root_organization_id: r.rootOrg
     };
-  } catch {
-    return null;
   }
+  if (r.kind === "invalid") return { kind: "invalid", path: r.file, detail: r.detail };
+  return null;
 }
-function requireRepoConfig(root) {
-  const config = readRepoConfig(root);
-  if (!config) {
-    console.error("Missing or invalid .wayai.yaml at the repository root.");
-    console.error("The file must contain organization_id:");
-    console.error("");
-    console.error("  organization_id: <your-org-uuid>");
-    console.error("");
-    console.error("Run `wayai init` to set up the workspace.");
-    process.exit(1);
+function planOrgMigration(gitRoot) {
+  const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
+  const root = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
+  if (root.kind !== "declared") return { kind: "nothing" };
+  if (manifest.kind === "declared") {
+    if (manifest.config.organization_id === root.config.organization_id) return { kind: "nothing" };
+    return {
+      kind: "refuse",
+      message: conflictMessage(manifest.config.organization_id, root.config.organization_id, [
+        "Reconcile them by hand \u2014 migrate cannot know which one you meant."
+      ])
+    };
   }
-  return config;
+  if (manifest.kind === "invalid") {
+    return {
+      kind: "refuse",
+      message: `Cannot copy the organization binding: ${WORKSPACE_MANIFEST_LABEL} is unusable \u2014 ${manifest.detail}. Fix or delete it, then re-run \`wayai migrate\`.`
+    };
+  }
+  return { kind: "copy", config: root.config };
 }
 function writeRepoConfig(config, root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) {
     throw new Error("Not inside a git repository. Run `git init` first.");
   }
-  const configPath3 = path3.join(gitRoot, ".wayai.yaml");
+  const stale = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
+  if (stale.kind === "declared" && stale.config.organization_id !== config.organization_id) {
+    throw expected(rebindRefusal(config.organization_id, stale.config.organization_id));
+  }
+  const load11 = loadWorkspaceManifest(gitRoot);
+  if (load11.kind === "malformed") {
+    throw expected(
+      `Cannot write the organization binding: ${WORKSPACE_MANIFEST_LABEL} does not parse (${load11.reason}). Fix or delete it, then re-run.`
+    );
+  }
+  const { organization_id: _id, organization_name: _name, ...rest } = load11.kind === "ok" ? load11.doc : {};
   const doc = { organization_id: config.organization_id };
   if (config.organization_name?.trim()) doc.organization_name = config.organization_name.trim();
-  const content = yaml2.dump(doc, { quotingType: '"', forceQuotes: false });
-  fs3.writeFileSync(configPath3, content, "utf-8");
-  return configPath3;
+  Object.assign(doc, rest);
+  const file = workspaceManifestPath(gitRoot);
+  fs4.mkdirSync(path4.dirname(file), { recursive: true });
+  fs4.writeFileSync(
+    file,
+    yaml3.dump(doc, { lineWidth: -1, quotingType: '"', forceQuotes: false }),
+    "utf-8"
+  );
+  return file;
 }
-var LEGACY_FIELDS, legacyFieldsWarned;
+var LEGACY_FIELDS, noticed, RECONCILE_REMEDY;
 var init_repo_config = __esm({
   "src/lib/repo-config.ts"() {
     "use strict";
+    init_expected();
     init_workspace();
     init_utils();
+    init_workspace_manifest();
     LEGACY_FIELDS = ["project_id", "project_name", "hub_id", "hub_name"];
-    legacyFieldsWarned = false;
+    noticed = /* @__PURE__ */ new Set();
+    RECONCILE_REMEDY = [
+      "Keep the organization_id you actually work in and delete the other declaration.",
+      `\`wayai init\` rewrites ${WORKSPACE_MANIFEST_LABEL}; the root file is yours to remove.`
+    ];
   }
 });
 
 // src/lib/utils.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve7(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve7(answer.trim().toLowerCase() === "y");
+      resolve8(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -15080,25 +15294,25 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve7(answer);
+      resolve8(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve7(data.trim()));
+    process.stdin.on("end", () => resolve8(data.trim()));
     process.stdin.on("error", reject);
   });
 }
 function resolveHubYamlPath(hubFolder) {
   for (const filename of ["hub.yaml", "wayai.yaml"]) {
-    const yamlPath = path4.join(hubFolder, filename);
-    if (fs4.existsSync(yamlPath)) return yamlPath;
+    const yamlPath = path5.join(hubFolder, filename);
+    if (fs5.existsSync(yamlPath)) return yamlPath;
   }
   return null;
 }
@@ -15175,8 +15389,8 @@ async function resolveOrganizationId(client, orgIdFlag) {
     }
     return { organizationId: orgIdFlag };
   }
-  const { readRepoConfig: readRepoConfig2 } = await Promise.resolve().then(() => (init_repo_config(), repo_config_exports));
-  const repoConfig = readRepoConfig2();
+  const { readRepoConfigUnlessBlocked: readRepoConfigUnlessBlocked2 } = await Promise.resolve().then(() => (init_repo_config(), repo_config_exports));
+  const repoConfig = readRepoConfigUnlessBlocked2();
   if (repoConfig) {
     return { organizationId: repoConfig.organization_id, organizationName: repoConfig.organization_name };
   }
@@ -15312,7 +15526,7 @@ var init_registry = __esm({
         surviving: null,
         clause: 1,
         shipped: true,
-        reason: "One root org binding (`.wayai.yaml`), so one `init`."
+        reason: "One org binding per repo (`wayai-ws/wayai.yaml`), so one `init`."
       },
       {
         original: "update",
@@ -15442,7 +15656,7 @@ var init_registry = __esm({
         surviving: "bases use",
         clause: 3,
         shipped: true,
-        reason: "WayAI's `use` binds a hub; this binds a base."
+        reason: "Deprecated since the worktree scope merged into one set-valued file: `wayai use bases/<id>` covers this. Kept as an alias for its JSON output shape."
       },
       {
         original: "unbind",
@@ -15450,7 +15664,7 @@ var init_registry = __esm({
         surviving: "bases unbind",
         clause: 3,
         shipped: true,
-        reason: "WayAI's `unbind` clears the hub binding; this clears the base binding."
+        reason: "Deprecated alongside `bases use`: `wayai unbind bases/<id>` covers this. It still clears only the bases axis of the worktree scope, never the hubs one."
       },
       {
         original: "bases promote",
@@ -15563,17 +15777,17 @@ var init_registry = __esm({
 });
 
 // src/lib/version-cache.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 import { homedir as homedir2 } from "os";
 function getVersionCachePath(filename = CLI_CACHE_FILE) {
   return join6(homedir2(), ".wayai", filename);
 }
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
-    const path36 = getVersionCachePath(filename);
-    if (!existsSync4(path36)) return null;
-    const parsed = JSON.parse(readFileSync5(path36, "utf-8"));
+    const path35 = getVersionCachePath(filename);
+    if (!existsSync3(path35)) return null;
+    const parsed = JSON.parse(readFileSync5(path35, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
     return parsed;
@@ -15593,10 +15807,10 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
   return Date.now() - cache.lastCheck > maxAgeMs;
 }
 function writeVersionCache(filename, cache) {
-  const path36 = getVersionCachePath(filename);
-  const dir = dirname3(path36);
-  if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
-  writeFileSync2(path36, JSON.stringify(cache));
+  const path35 = getVersionCachePath(filename);
+  const dir = dirname4(path35);
+  if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(path35, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
   writeVersionCache(filename, { lastCheck: Date.now(), latest: readVersionCache(filename)?.latest ?? null });
@@ -15613,9 +15827,9 @@ var init_version_cache = __esm({
 });
 
 // src/lib/skill-version.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join7 } from "path";
-import * as yaml3 from "js-yaml";
+import * as yaml4 from "js-yaml";
 function skillInstallPaths(skillName) {
   return HARNESS_SKILL_DIRS.map((dir) => `${dir}/skills/${skillName}/${SKILL_FILENAME}`);
 }
@@ -15624,7 +15838,7 @@ function parseFrontmatterVersion(content) {
   if (!match) return null;
   let parsed;
   try {
-    parsed = yaml3.load(match[1]);
+    parsed = yaml4.load(match[1]);
   } catch {
     return null;
   }
@@ -15635,14 +15849,14 @@ function parseFrontmatterVersion(content) {
 function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
-    const path36 = join7(projectRoot, rel);
-    if (!existsSync5(path36)) continue;
+    const path35 = join7(projectRoot, rel);
+    if (!existsSync4(path35)) continue;
     let version = null;
     try {
-      version = parseFrontmatterVersion(readFileSync6(path36, "utf-8"));
+      version = parseFrontmatterVersion(readFileSync6(path35, "utf-8"));
     } catch {
     }
-    found.push({ path: path36, version });
+    found.push({ path: path35, version });
   }
   return found;
 }
@@ -15673,22 +15887,22 @@ __export(config_exports, {
   readConfig: () => readConfig,
   writeConfig: () => writeConfig
 });
-import * as fs5 from "fs";
-import * as path5 from "path";
+import * as fs6 from "fs";
+import * as path6 from "path";
 import * as os from "os";
 function configDir() {
-  return path5.join(os.homedir(), ".wayai");
+  return path6.join(os.homedir(), ".wayai");
 }
 function configPath() {
-  return path5.join(configDir(), "config.json");
+  return path6.join(configDir(), "config.json");
 }
 function getConfigPath() {
   return configPath();
 }
 function readConfig() {
-  if (!fs5.existsSync(configPath())) return null;
+  if (!fs6.existsSync(configPath())) return null;
   try {
-    const content = fs5.readFileSync(configPath(), "utf-8");
+    const content = fs6.readFileSync(configPath(), "utf-8");
     const parsed = JSON.parse(content);
     if (!parsed.api_url) return null;
     return {
@@ -15701,13 +15915,13 @@ function readConfig() {
   }
 }
 function writeConfig(config) {
-  if (!fs5.existsSync(configDir())) {
-    fs5.mkdirSync(configDir(), { recursive: true });
+  if (!fs6.existsSync(configDir())) {
+    fs6.mkdirSync(configDir(), { recursive: true });
   }
   let existing = {};
-  if (fs5.existsSync(configPath())) {
+  if (fs6.existsSync(configPath())) {
     try {
-      existing = JSON.parse(fs5.readFileSync(configPath(), "utf-8"));
+      existing = JSON.parse(fs6.readFileSync(configPath(), "utf-8"));
     } catch {
     }
   }
@@ -15715,14 +15929,14 @@ function writeConfig(config) {
   delete existing.access_token;
   delete existing.refresh_token;
   Object.assign(existing, config);
-  fs5.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + "\n", {
+  fs6.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + "\n", {
     mode: 384
     // owner-only read/write
   });
 }
 function deleteConfig() {
-  if (fs5.existsSync(configPath())) {
-    fs5.unlinkSync(configPath());
+  if (fs6.existsSync(configPath())) {
+    fs6.unlinkSync(configPath());
   }
 }
 var init_config = __esm({
@@ -15732,14 +15946,14 @@ var init_config = __esm({
 });
 
 // src/lib/token-store.ts
-import * as fs6 from "fs";
-import * as path6 from "path";
+import * as fs7 from "fs";
+import * as path7 from "path";
 import * as os2 from "os";
 function configDir2() {
-  return path6.join(os2.homedir(), ".wayai");
+  return path7.join(os2.homedir(), ".wayai");
 }
 function configPath2() {
-  return path6.join(configDir2(), "config.json");
+  return path7.join(configDir2(), "config.json");
 }
 function manualCleanupCommand(account) {
   if (process.platform === "darwin") {
@@ -15791,9 +16005,9 @@ async function getKeyring() {
   return keyringCache;
 }
 function readLegacyConfigFile() {
-  if (!fs6.existsSync(configPath2())) return null;
+  if (!fs7.existsSync(configPath2())) return null;
   try {
-    return JSON.parse(fs6.readFileSync(configPath2(), "utf-8"));
+    return JSON.parse(fs7.readFileSync(configPath2(), "utf-8"));
   } catch {
     return null;
   }
@@ -15806,7 +16020,7 @@ function stripTokensFromFile() {
     if (k === "token" || k === "access_token" || k === "refresh_token") continue;
     cleaned[k] = v;
   }
-  fs6.writeFileSync(configPath2(), JSON.stringify(cleaned, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(cleaned, null, 2) + "\n", { mode: 384 });
 }
 async function migrateLegacyTokens() {
   const legacy = readLegacyConfigFile();
@@ -15957,8 +16171,8 @@ async function clearTokens() {
       }
     }
   }
-  if (fs6.existsSync(configPath2())) {
-    fs6.unlinkSync(configPath2());
+  if (fs7.existsSync(configPath2())) {
+    fs7.unlinkSync(configPath2());
   }
 }
 function readMetadataExpiresAt() {
@@ -15972,7 +16186,7 @@ function writeMetadataExpiresAt(expires_at) {
   delete existing.refresh_token;
   existing.token_expires_at = expires_at;
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 function clearMetadataExpiresAt() {
   const existing = readLegacyConfigFile();
@@ -15982,11 +16196,11 @@ function clearMetadataExpiresAt() {
   delete existing.refresh_token;
   delete existing.token_expires_at;
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 function ensureConfigDir() {
-  if (!fs6.existsSync(configDir2())) {
-    fs6.mkdirSync(configDir2(), { recursive: true });
+  if (!fs7.existsSync(configDir2())) {
+    fs7.mkdirSync(configDir2(), { recursive: true });
   }
 }
 function writeFileFallback(tokens) {
@@ -15997,7 +16211,7 @@ function writeFileFallback(tokens) {
   delete existing.token_expires_at;
   Object.assign(existing, tokens);
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 var KEYRING_SERVICE, KEY_WAY_TOKEN, KEY_OAUTH_ACCESS, KEY_OAUTH_REFRESH, keyringCache, StaleKeyringSlotError;
 var init_token_store = __esm({
@@ -16106,7 +16320,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -16132,7 +16346,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve7({ code, port });
+          resolve8({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -16239,14 +16453,14 @@ __export(skill_symlink_exports, {
   healClaudeSkillLink: () => healClaudeSkillLink,
   healSkillLinkForCommand: () => healSkillLinkForCommand
 });
-import { existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync4, rmSync, symlinkSync } from "fs";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync5, rmSync, symlinkSync } from "fs";
 import { join as join10 } from "path";
 function healClaudeSkillLink(root) {
   try {
     const source = join10(root, ".agents", "skills", SKILL_NAME);
-    if (!existsSync8(join10(source, SKILL_FILENAME))) return false;
+    if (!existsSync7(join10(source, SKILL_FILENAME))) return false;
     const link = join10(root, ".claude", "skills", SKILL_NAME);
-    if (existsSync8(join10(link, SKILL_FILENAME))) return false;
+    if (existsSync7(join10(link, SKILL_FILENAME))) return false;
     let entry = null;
     try {
       entry = lstatSync(link);
@@ -16257,7 +16471,7 @@ function healClaudeSkillLink(root) {
       if (!entry.isSymbolicLink()) return false;
       rmSync(link, { force: true });
     }
-    mkdirSync4(join10(root, ".claude", "skills"), { recursive: true });
+    mkdirSync5(join10(root, ".claude", "skills"), { recursive: true });
     symlinkSync(join10("..", "..", ".agents", "skills", SKILL_NAME), link, "dir");
     return true;
   } catch {
@@ -16344,10 +16558,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve7(answer.trim() || defaultValue || "");
+      resolve8(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -16475,8 +16689,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve7) => {
-      execFile(cmd, args2, (err) => resolve7(!err));
+    return new Promise((resolve8) => {
+      execFile(cmd, args2, (err) => resolve8(!err));
     });
   } catch {
     return false;
@@ -16520,10 +16734,33 @@ var init_logout = __esm({
   }
 });
 
-// src/lib/worktree-binding.ts
+// src/lib/base-id.ts
+function isValidBaseId(id) {
+  return id.length > 0 && id.length <= BASE_ID_MAX_LENGTH && BASE_ID_RE.test(id);
+}
+function isPathSafeId(id) {
+  return PATH_SAFE_ID_RE.test(id);
+}
+var BASE_ID_MAX_LENGTH, BASE_ID_RE, BASE_ID_RULE, PATH_SAFE_ID_RE, PATH_SAFE_ID_RULE;
+var init_base_id = __esm({
+  "src/lib/base-id.ts"() {
+    "use strict";
+    BASE_ID_MAX_LENGTH = 128;
+    BASE_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+    BASE_ID_RULE = `letters, digits, \`-\` and \`_\`, starting with a letter, digit or \`_\`, ${BASE_ID_MAX_LENGTH} characters or fewer`;
+    PATH_SAFE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
+    PATH_SAFE_ID_RULE = "letters, digits, dot, dash and underscore, with no path separators, not `.` or `..` alone, 256 characters or fewer";
+  }
+});
+
+// src/lib/worktree-scope.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs7 from "fs";
-import * as path7 from "path";
+import * as fs8 from "fs";
+import * as path8 from "path";
+import * as yaml5 from "js-yaml";
+function axisNoun(axis) {
+  return AXES[axis].noun;
+}
 function resolveGitDir() {
   const cwd = process.cwd();
   if (_gitDirCache && _gitDirCache.cwd === cwd) return _gitDirCache.gitDir;
@@ -16534,165 +16771,234 @@ function resolveGitDir() {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    gitDir = raw ? path7.resolve(cwd, raw) : null;
+    gitDir = raw ? path8.resolve(cwd, raw) : null;
   } catch {
     gitDir = null;
   }
   _gitDirCache = { cwd, gitDir };
   return gitDir;
 }
-function createWorktreeBinding(descriptor) {
-  const {
-    filename,
-    legacyFilename,
-    isValidId,
-    noun,
-    idLabel,
-    unbindCommand: unbindCommand2,
-    useCommand: useCommand2
-  } = descriptor;
-  function getBindingPath2() {
-    const gitDir = resolveGitDir();
-    return gitDir ? path7.join(gitDir, filename) : null;
-  }
-  function getLegacyBindingPath() {
-    if (!legacyFilename) return null;
-    const gitDir = resolveGitDir();
-    return gitDir ? path7.join(gitDir, legacyFilename) : null;
-  }
-  function readBinding2() {
-    for (const bindingPath of [getBindingPath2(), getLegacyBindingPath()]) {
-      if (!bindingPath) continue;
-      let raw;
-      try {
-        raw = fs7.readFileSync(bindingPath, "utf-8");
-      } catch (err) {
-        if (err.code === "ENOENT") continue;
-        throw err;
-      }
-      const trimmed = raw.trim();
-      return isValidId(trimmed) ? trimmed : null;
-    }
-    return null;
+function getScopePath() {
+  const gitDir = resolveGitDir();
+  return gitDir ? path8.join(gitDir, SCOPE_FILE) : null;
+}
+function legacyPaths() {
+  const gitDir = resolveGitDir();
+  if (!gitDir) return [];
+  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path8.join(gitDir, f));
+}
+function emptyScope() {
+  return { hubs: [], bases: [] };
+}
+function parseAxis(raw, axis) {
+  if (!Array.isArray(raw)) return [];
+  const { isValidId } = AXES[axis];
+  const out = [];
+  for (const entry of raw) {
+    if (typeof entry !== "string") continue;
+    const id = entry.trim();
+    if (!isValidId(id) || out.includes(id)) continue;
+    out.push(id);
   }
-  function removeLegacyBinding() {
-    const legacyPath = getLegacyBindingPath();
-    if (!legacyPath) return;
+  return out;
+}
+function readLegacyAxis(axis) {
+  const gitDir = resolveGitDir();
+  if (!gitDir) return [];
+  const { isValidId, legacyFiles } = AXES[axis];
+  for (const filename of legacyFiles) {
+    let raw;
     try {
-      fs7.unlinkSync(legacyPath);
-    } catch {
+      raw = fs8.readFileSync(path8.join(gitDir, filename), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") continue;
+      throw err;
     }
+    const trimmed = raw.trim();
+    return isValidId(trimmed) ? [trimmed] : [];
   }
-  function writeBinding2(id) {
-    if (!isValidId(id)) {
-      throw new Error(`Invalid ${idLabel}: ${id}`);
+  return [];
+}
+function readScope() {
+  const scopePath = getScopePath();
+  if (!scopePath) return emptyScope();
+  let raw;
+  try {
+    raw = fs8.readFileSync(scopePath, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { hubs: readLegacyAxis("hubs"), bases: readLegacyAxis("bases") };
     }
-    const bindingPath = getBindingPath2();
-    if (!bindingPath) {
-      throw new Error(`Not inside a git repository \u2014 cannot write ${noun} binding.`);
+    throw err;
+  }
+  let doc;
+  try {
+    doc = yaml5.load(raw);
+  } catch {
+    return emptyScope();
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) return emptyScope();
+  const map = doc;
+  return { hubs: parseAxis(map.hubs, "hubs"), bases: parseAxis(map.bases, "bases") };
+}
+function sweepLegacyFiles() {
+  for (const legacyPath of legacyPaths()) {
+    try {
+      fs8.unlinkSync(legacyPath);
+    } catch {
     }
-    fs7.writeFileSync(bindingPath, `${id}
-`, "utf-8");
-    removeLegacyBinding();
   }
-  function clearBinding2() {
-    let removed = false;
-    for (const bindingPath of [getBindingPath2(), getLegacyBindingPath()]) {
-      if (!bindingPath) continue;
-      try {
-        fs7.unlinkSync(bindingPath);
-        removed = true;
-      } catch (err) {
-        if (err.code !== "ENOENT") throw err;
-      }
+}
+function writeScope(scope) {
+  for (const axis of AXIS_ORDER) {
+    const { isValidId, idLabel } = AXES[axis];
+    for (const id of scope[axis]) {
+      if (!isValidId(id)) throw expected(`Invalid ${idLabel}: ${id}`);
     }
-    return removed;
   }
-  function assertMatchesBinding(resolvedId, label) {
-    const bound = readBinding2();
-    if (!bound) return;
-    if (bound === resolvedId) return;
-    const target = label ? `${label} (${resolvedId})` : resolvedId;
-    console.error(
-      [
-        `This worktree is bound to ${noun} ${bound}, but the command resolved to ${target}.`,
-        "",
-        "This usually means a prompt was routed to the wrong worktree.",
-        "Confirm with the user before unbinding. To override:",
-        `  ${unbindCommand2}             # clear the binding for this worktree`,
-        `  ${useCommand2} ${resolvedId}  # rebind this worktree to the new ${noun}`
-      ].join("\n")
-    );
-    process.exit(1);
+  const scopePath = getScopePath();
+  if (!scopePath) {
+    throw expected("Not inside a git repository \u2014 cannot write the worktree scope.");
   }
-  function assertNoBindingBlocksCreation(newName) {
-    const bound = readBinding2();
-    if (!bound) return;
-    console.error(
-      [
-        `This worktree is bound to ${noun} ${bound}, but you're about to create a new ${noun} "${newName}" here.`,
-        "",
-        "This usually means a prompt was routed to the wrong worktree.",
-        "Confirm with the user before unbinding. To override:",
-        `  ${unbindCommand2}             # clear the binding for this worktree`
-      ].join("\n")
-    );
-    process.exit(1);
+  const body = yaml5.dump({ hubs: scope.hubs, bases: scope.bases }, { flowLevel: 1 });
+  const tmpPath = `${scopePath}.tmp-${process.pid}`;
+  try {
+    fs8.writeFileSync(tmpPath, body, "utf-8");
+    fs8.renameSync(tmpPath, scopePath);
+  } catch (err) {
+    try {
+      fs8.unlinkSync(tmpPath);
+    } catch {
+    }
+    throw asExpectedEnvironmentError(err);
+  }
+  sweepLegacyFiles();
+}
+function asExpectedEnvironmentError(err) {
+  if (err instanceof Error && typeof err.code === "string") {
+    return expected(err.message);
   }
-  function autoBindIfUnbound2(id) {
+  return err;
+}
+function setScopeAxis(axis, ids) {
+  writeScope({ ...readScope(), [axis]: ids });
+  return ids;
+}
+function addToScope(axis, id) {
+  const scope = readScope();
+  if (scope[axis].includes(id)) return null;
+  const next = [...scope[axis], id];
+  writeScope({ ...scope, [axis]: next });
+  return next;
+}
+function removeFromScope(axis, id) {
+  const scope = readScope();
+  if (!scope[axis].includes(id)) return null;
+  const next = scope[axis].filter((entry) => entry !== id);
+  writeScope({ ...scope, [axis]: next });
+  return next;
+}
+function clearScope() {
+  const scopePath = getScopePath();
+  let removed = false;
+  for (const target of [...scopePath ? [scopePath] : [], ...legacyPaths()]) {
     try {
-      if (readBinding2()) return false;
-      writeBinding2(id);
-      console.log(`Worktree bound to ${noun} ${id} (run \`${unbindCommand2}\` to clear).`);
-      return true;
+      fs8.unlinkSync(target);
+      removed = true;
     } catch (err) {
-      console.warn(
-        `  Warning: could not auto-bind worktree (${err instanceof Error ? err.message : String(err)})`
-      );
-      return false;
+      if (err.code !== "ENOENT") throw err;
     }
   }
-  return {
-    getBindingPath: getBindingPath2,
-    readBinding: readBinding2,
-    writeBinding: writeBinding2,
-    clearBinding: clearBinding2,
-    assertMatchesBinding,
-    assertNoBindingBlocksCreation,
-    autoBindIfUnbound: autoBindIfUnbound2
-  };
+  return removed;
 }
-var _gitDirCache;
-var init_worktree_binding = __esm({
-  "src/lib/worktree-binding.ts"() {
-    "use strict";
+function describeAxis(axis, ids) {
+  const { noun } = AXES[axis];
+  return ids.length === 1 ? `${noun} ${ids[0]}` : `${noun}s ${ids.join(", ")}`;
+}
+function describeScope(scope) {
+  return AXIS_ORDER.filter((axis) => scope[axis].length > 0).map((axis) => describeAxis(axis, scope[axis])).join("; ");
+}
+function assertInScope(axis, resolvedId, label) {
+  const scoped = readScope()[axis];
+  if (scoped.length === 0) return;
+  if (scoped.includes(resolvedId)) return;
+  const { noun, selectorFor } = AXES[axis];
+  const selector = selectorFor(resolvedId);
+  const target = label ? `${label} (${resolvedId})` : resolvedId;
+  console.error(
+    [
+      `This worktree is scoped to ${describeAxis(axis, scoped)}, but the command resolved to ${target}.`,
+      "",
+      "This usually means a prompt was routed to the wrong worktree.",
+      "Confirm with the user before changing this scope. To override:",
+      `  ${REPLACE_COMMAND} ${selector}   # scope this worktree to that ${noun} INSTEAD`,
+      `  ${ADD_COMMAND} ${selector}   # scope it to that ${noun} AS WELL`,
+      `  ${CLEAR_COMMAND}   # clear the whole worktree scope (both hubs and bases)`
+    ].join("\n")
+  );
+  process.exit(1);
+}
+function assertScopeAllowsCreation(axis, newName) {
+  const scoped = readScope()[axis];
+  if (scoped.length === 0) return;
+  const { noun } = AXES[axis];
+  console.error(
+    [
+      `This worktree is scoped to ${describeAxis(axis, scoped)}, but you're about to create a new ${noun} "${newName}" here.`,
+      "",
+      "This usually means a prompt was routed to the wrong worktree.",
+      "Confirm with the user before clearing this scope. To override:",
+      `  ${CLEAR_COMMAND}   # clear the whole worktree scope (both hubs and bases)`
+    ].join("\n")
+  );
+  process.exit(1);
+}
+function seedScopeIfEmpty(axis, id) {
+  try {
+    if (readScope()[axis].length > 0) return false;
+    setScopeAxis(axis, [id]);
+    console.log(
+      `Worktree bound to ${AXES[axis].noun} ${id} (run \`${CLEAR_COMMAND}\` to clear).`
+    );
+    return true;
+  } catch (err) {
+    console.warn(
+      `  Warning: could not bind worktree (${err instanceof Error ? err.message : String(err)})`
+    );
+    return false;
   }
-});
-
-// src/lib/hub-binding.ts
-var binding, getBindingPath, readBinding, writeBinding, clearBinding, autoBindIfUnbound, assertHubMatchesBinding, assertNoBindingBlocksHubCreation;
-var init_hub_binding = __esm({
-  "src/lib/hub-binding.ts"() {
+}
+var SCOPE_FILE, LEGACY_HUB_SCOPE_FILE, LEGACY_HUB_SCOPE_FILE_PRE_RENAME, LEGACY_BASE_SCOPE_FILE, AXES, AXIS_ORDER, ADD_COMMAND, REPLACE_COMMAND, CLEAR_COMMAND, _gitDirCache;
+var init_worktree_scope = __esm({
+  "src/lib/worktree-scope.ts"() {
     "use strict";
+    init_base_id();
+    init_expected();
     init_utils();
-    init_worktree_binding();
-    binding = createWorktreeBinding({
-      filename: "wayai-binding",
-      // Pre-rename filename, from when this was called a "lock".
-      legacyFilename: "wayai-lock",
-      isValidId: (id) => UUID_RE2.test(id),
-      noun: "hub",
-      idLabel: "hub_id (must be a UUID)",
-      unbindCommand: "wayai unbind",
-      useCommand: "wayai use"
-    });
-    getBindingPath = binding.getBindingPath;
-    readBinding = binding.readBinding;
-    writeBinding = binding.writeBinding;
-    clearBinding = binding.clearBinding;
-    autoBindIfUnbound = binding.autoBindIfUnbound;
-    assertHubMatchesBinding = binding.assertMatchesBinding;
-    assertNoBindingBlocksHubCreation = binding.assertNoBindingBlocksCreation;
+    SCOPE_FILE = "wayai-scope";
+    LEGACY_HUB_SCOPE_FILE = "wayai-binding";
+    LEGACY_HUB_SCOPE_FILE_PRE_RENAME = "wayai-lock";
+    LEGACY_BASE_SCOPE_FILE = "wayai-base-binding";
+    AXES = {
+      hubs: {
+        noun: "hub",
+        idLabel: "hub_id (must be a UUID)",
+        isValidId: (id) => UUID_RE2.test(id),
+        selectorFor: (id) => id,
+        legacyFiles: [LEGACY_HUB_SCOPE_FILE, LEGACY_HUB_SCOPE_FILE_PRE_RENAME]
+      },
+      bases: {
+        noun: "base",
+        idLabel: `base id (${PATH_SAFE_ID_RULE})`,
+        isValidId: isPathSafeId,
+        selectorFor: (id) => `bases/${id}`,
+        legacyFiles: [LEGACY_BASE_SCOPE_FILE]
+      }
+    };
+    AXIS_ORDER = ["hubs", "bases"];
+    ADD_COMMAND = "wayai use --add";
+    REPLACE_COMMAND = "wayai use";
+    CLEAR_COMMAND = "wayai unbind";
   }
 });
 
@@ -16702,7 +17008,6 @@ __export(status_exports, {
   parseArgs: () => parseArgs,
   statusCommand: () => statusCommand
 });
-import * as path8 from "path";
 function parseArgs(args2) {
   return { json: args2.includes("--json") };
 }
@@ -16722,28 +17027,29 @@ function buildSkillState() {
     paths: installs.map((i) => i.path)
   };
 }
-function buildWorkspaceState(repoConfig) {
-  if (!repoConfig) return { scoped: false, path: null, hub_count: 0 };
+function buildWorkspaceState(resolved) {
+  if (!resolved) return { scoped: false, path: null, hub_count: 0 };
   const ws = detectWorkspace();
-  const gitRoot = ws?.gitRoot ?? findGitRoot();
   const hubCount = ws ? scanWorkspaceHubs(ws.workspaceDir).length : 0;
-  const yamlPath = gitRoot ? path8.join(gitRoot, ".wayai.yaml") : null;
-  return { scoped: true, path: yamlPath, hub_count: hubCount };
+  return { scoped: true, path: resolved.path, hub_count: hubCount };
 }
 async function statusCommand(args2, pkg2) {
   const { json } = parseArgs(args2);
   const config = readConfig();
-  const repoConfig = readRepoConfig();
-  const workspace = buildWorkspaceState(repoConfig);
+  const resolvedRepo = resolveRepoConfig();
+  const repoConfig = resolvedRepo?.config ?? null;
+  const workspace = buildWorkspaceState(resolvedRepo);
+  const repoScopeBlocker = resolvedRepo ? null : readRepoScopeBlocker();
   const cachedCliLatest = readCachedLatest(CLI_CACHE_FILE);
   const cliLatest = cachedCliLatest && isNewerVersion(cachedCliLatest, pkg2.version) ? cachedCliLatest : null;
   const skill = buildSkillState();
-  let boundHubId = null;
+  let scope;
   try {
-    boundHubId = readBinding();
+    scope = readScope();
   } catch {
-    boundHubId = null;
+    scope = emptyScope();
   }
+  const boundHubId = scope.hubs[0] ?? null;
   if (!config) {
     const snapshot2 = {
       logged_in: false,
@@ -16756,6 +17062,8 @@ async function statusCommand(args2, pkg2) {
       orgs: [],
       active_org: null,
       workspace,
+      repo_scope_blocker: repoScopeBlocker,
+      worktree_scope: scope,
       worktree_binding: { hub_id: boundHubId },
       worktree_lock: { hub_id: boundHubId }
     };
@@ -16811,6 +17119,8 @@ async function statusCommand(args2, pkg2) {
     orgs,
     active_org: activeOrg,
     workspace,
+    repo_scope_blocker: repoScopeBlocker,
+    worktree_scope: scope,
     worktree_binding: { hub_id: boundHubId },
     worktree_lock: { hub_id: boundHubId }
   };
@@ -16839,11 +17149,22 @@ async function statusCommand(args2, pkg2) {
     console.log(`Repository scope:`);
     console.log(`  Organization: ${orgLine}`);
     console.log(`  Hubs: ${workspace.hub_count}`);
+  } else if (repoScopeBlocker?.kind === "conflict") {
+    console.log("Repository scope: UNRESOLVED \u2014 two files name different organizations:");
+    console.log(`  ${WORKSPACE_MANIFEST_LABEL} -> ${repoScopeBlocker.manifest_organization_id}`);
+    console.log(`  ${ROOT_CONFIG_FILE} -> ${repoScopeBlocker.root_organization_id}`);
+    console.log(`  Delete or correct ${ROOT_CONFIG_FILE}; until then every command refuses.`);
+  } else if (repoScopeBlocker?.kind === "invalid") {
+    console.log(`Repository scope: UNRESOLVED \u2014 ${repoScopeBlocker.path} is unusable (${repoScopeBlocker.detail}).`);
   } else {
-    console.log("No .wayai.yaml found \u2014 run `wayai init` to scope this repo to an organization.");
+    console.log(
+      `No organization binding found in ${WORKSPACE_MANIFEST_LABEL} \u2014 run \`wayai init\` to scope this repo to an organization.`
+    );
   }
-  if (boundHubId) {
-    console.log(`Worktree binding: ${boundHubId} (run \`wayai unbind\` to clear)`);
+  if (scope.hubs.length > 0 || scope.bases.length > 0) {
+    console.log("Worktree scope: (run `wayai unbind` to clear)");
+    if (scope.hubs.length > 0) console.log(`  Hubs:  ${scope.hubs.join(", ")}`);
+    if (scope.bases.length > 0) console.log(`  Bases: ${scope.bases.join(", ")}`);
   }
   if (tokenValid === true && accessToken) {
     await nudgeReportActions(config.api_url, accessToken);
@@ -16855,8 +17176,9 @@ var init_status = __esm({
     init_config();
     init_auth();
     init_repo_config();
+    init_workspace_manifest();
     init_workspace();
-    init_hub_binding();
+    init_worktree_scope();
     init_api_client();
     init_version_cache();
     init_skill_version();
@@ -16938,7 +17260,7 @@ var init_constants = __esm({
 });
 
 // src/lib/workspace-files.ts
-import * as fs8 from "fs";
+import * as fs9 from "fs";
 import * as path9 from "path";
 function perHubAgentsMd(hubFolderName) {
   return [
@@ -16955,12 +17277,13 @@ function perHubAgentsMd(hubFolderName) {
   ].join("\n");
 }
 function isWorkspace(gitRoot) {
-  if (fs8.existsSync(path9.join(gitRoot, ".wayai.yaml"))) return true;
+  if (fs9.existsSync(workspaceManifestPath(gitRoot))) return true;
+  if (fs9.existsSync(rootConfigPath(gitRoot))) return true;
   return isDirectory(resolveLayout(gitRoot).hubsDir);
 }
 function writeIfAbsent(filePath, content) {
-  if (fs8.existsSync(filePath)) return null;
-  fs8.writeFileSync(filePath, content, "utf-8");
+  if (fs9.existsSync(filePath)) return null;
+  fs9.writeFileSync(filePath, content, "utf-8");
   return path9.basename(filePath);
 }
 function ensureWorkspaceFiles(gitRoot) {
@@ -16978,6 +17301,7 @@ var init_workspace_files = __esm({
     "use strict";
     init_constants();
     init_layout();
+    init_workspace_manifest();
     CLAUDE_MD_SHIM = "@AGENTS.md\n";
     ROOT_AGENTS_MD = [
       "# Working with WayAI",
@@ -17015,12 +17339,12 @@ __export(init_exports, {
   initCommand: () => initCommand,
   parseArgs: () => parseArgs3
 });
-import { mkdirSync as mkdirSync5 } from "fs";
+import { mkdirSync as mkdirSync6 } from "fs";
 import path10 from "path";
 function ensureHubsDir(gitRoot) {
   const hubsDir = resolveLayout(gitRoot).hubsDir;
   if (isDirectory(hubsDir)) return null;
-  mkdirSync5(hubsDir, { recursive: true });
+  mkdirSync6(hubsDir, { recursive: true });
   return `${path10.relative(gitRoot, hubsDir)}/`;
 }
 function parseArgs3(args2) {
@@ -17155,18 +17479,18 @@ var init_init = __esm({
 });
 
 // src/lib/fs-safety.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as path11 from "path";
 function fileHasBytes(abs, data) {
   let st;
   try {
-    st = fs9.lstatSync(abs);
+    st = fs10.lstatSync(abs);
   } catch {
     return false;
   }
   if (!st.isFile() || st.isSymbolicLink()) return false;
   try {
-    return fs9.readFileSync(abs).equals(data);
+    return fs10.readFileSync(abs).equals(data);
   } catch {
     return false;
   }
@@ -17175,8 +17499,8 @@ function realpathContained(root, abs) {
   let realRoot;
   let realAbs;
   try {
-    realRoot = fs9.realpathSync(root);
-    realAbs = fs9.realpathSync(abs);
+    realRoot = fs10.realpathSync(root);
+    realAbs = fs10.realpathSync(abs);
   } catch {
     return false;
   }
@@ -17184,13 +17508,13 @@ function realpathContained(root, abs) {
 }
 function mkdirTolerateRace(dir) {
   try {
-    fs9.mkdirSync(dir);
+    fs10.mkdirSync(dir);
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
     let st;
     try {
-      st = fs9.lstatSync(dir);
+      st = fs10.lstatSync(dir);
     } catch {
       st = void 0;
     }
@@ -17202,7 +17526,7 @@ function ensureRealSubdirNoSymlink(root, target, create) {
   const targetResolved = path11.resolve(target);
   if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + path11.sep)) return false;
   try {
-    if (!fs9.lstatSync(rootResolved).isDirectory()) return false;
+    if (!fs10.lstatSync(rootResolved).isDirectory()) return false;
   } catch {
     return false;
   }
@@ -17213,7 +17537,7 @@ function ensureRealSubdirNoSymlink(root, target, create) {
     cur = path11.join(cur, segment);
     let st;
     try {
-      st = fs9.lstatSync(cur);
+      st = fs10.lstatSync(cur);
     } catch {
       st = void 0;
     }
@@ -17230,8 +17554,8 @@ function ensureRealSubdirNoSymlink(root, target, create) {
 function readFileNoFollow(root, abs) {
   if (!ensureRealSubdirNoSymlink(root, path11.dirname(abs), false)) return null;
   try {
-    if (!fs9.lstatSync(abs).isFile()) return null;
-    return fs9.readFileSync(abs);
+    if (!fs10.lstatSync(abs).isFile()) return null;
+    return fs10.readFileSync(abs);
   } catch {
     return null;
   }
@@ -17241,11 +17565,11 @@ function writeFileNoFollow(root, abs, data) {
   if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
   let st;
   try {
-    st = fs9.lstatSync(abs);
+    st = fs10.lstatSync(abs);
   } catch {
   }
-  if (st?.isSymbolicLink()) fs9.rmSync(abs);
-  fs9.writeFileSync(abs, data);
+  if (st?.isSymbolicLink()) fs10.rmSync(abs);
+  fs10.writeFileSync(abs, data);
   return true;
 }
 var init_fs_safety = __esm({
@@ -17255,7 +17579,7 @@ var init_fs_safety = __esm({
 });
 
 // src/lib/resource-files.ts
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as path12 from "path";
 import * as crypto3 from "crypto";
 function isBinaryFile(filename) {
@@ -17302,14 +17626,14 @@ function computeHash(data) {
 }
 function scanResourceFiles(dir, prefix = "") {
   const files = [];
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
       files.push(...scanResourceFiles(path12.join(dir, entry.name), relPath));
     } else if (entry.isFile()) {
       const fullPath = path12.join(dir, entry.name);
-      const stat2 = fs10.statSync(fullPath);
+      const stat2 = fs11.statSync(fullPath);
       if (stat2.size > MAX_RESOURCE_FILE_SIZE3) {
         console.warn(`  Warning: skipping ${relPath} (${(stat2.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
         continue;
@@ -17319,7 +17643,7 @@ function scanResourceFiles(dir, prefix = "") {
         mime_type: guessMimeType(entry.name),
         file_size: stat2.size
       };
-      const data = fs10.readFileSync(fullPath);
+      const data = fs11.readFileSync(fullPath);
       fileEntry.hash = computeHash(data);
       if (isBinaryFile(entry.name)) {
         fileEntry.content_base64 = data.toString("base64");
@@ -17379,7 +17703,7 @@ function writeResourceFileTree(resDir, files, root, log) {
     return;
   }
   if (files.length === 0) {
-    if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
+    if (fs11.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
     return;
   }
   const writtenPaths = /* @__PURE__ */ new Set();
@@ -17400,18 +17724,18 @@ function writeResourceFileTree(resDir, files, root, log) {
       writtenPaths.delete(file.path);
     }
   }
-  if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
+  if (fs11.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
 }
 function cleanOrphanFiles(dir, prefix, writtenPaths, root, log) {
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     const fullPath = path12.join(dir, entry.name);
     if (entry.isDirectory()) {
       cleanOrphanFiles(fullPath, relPath, writtenPaths, root, log);
-      if (fs10.readdirSync(fullPath).length === 0) fs10.rmdirSync(fullPath);
+      if (fs11.readdirSync(fullPath).length === 0) fs11.rmdirSync(fullPath);
     } else if (!writtenPaths.has(relPath)) {
-      fs10.unlinkSync(fullPath);
+      fs11.unlinkSync(fullPath);
       if (log && root) log.removed.push(path12.relative(root, fullPath));
     }
   }
@@ -17432,8 +17756,8 @@ async function downloadBinaryFiles(resDir, files, root, log) {
       }
       if (file.hash) {
         try {
-          const st = fs10.lstatSync(filePath);
-          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs10.readFileSync(filePath)) === file.hash) continue;
+          const st = fs11.lstatSync(filePath);
+          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs11.readFileSync(filePath)) === file.hash) continue;
         } catch {
         }
       }
@@ -17487,7 +17811,7 @@ var init_resource_files = __esm({
 });
 
 // src/lib/eval-attachments.ts
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as path13 from "path";
 function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
   const raw = turn.attachments;
@@ -17511,7 +17835,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
     }
     let stat2;
     try {
-      stat2 = fs11.statSync(abs);
+      stat2 = fs12.statSync(abs);
     } catch {
     }
     if (!stat2?.isFile()) {
@@ -17525,7 +17849,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
         `${label}: attachment "${entry}" is ${(stat2.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
       );
     }
-    const data = fs11.readFileSync(abs);
+    const data = fs12.readFileSync(abs);
     const hash = computeHash(data);
     const fileName = path13.basename(abs);
     const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
@@ -17633,16 +17957,16 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
     return result;
   }
-  if (!fs11.existsSync(attachDir)) return result;
+  if (!fs12.existsSync(attachDir)) return result;
   for (const dl of downloads) {
     const abs = path13.resolve(hubFolder, dl.relPath);
     if (abs !== attachDir && !abs.startsWith(attachDir + path13.sep)) continue;
     let existing;
     try {
-      existing = fs11.lstatSync(abs);
+      existing = fs12.lstatSync(abs);
     } catch {
     }
-    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs11.readFileSync(abs)) === dl.hash) {
+    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs12.readFileSync(abs)) === dl.hash) {
       continue;
     }
     try {
@@ -17660,11 +17984,11 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     }
   }
   const keep = new Set(downloads.map((d) => path13.resolve(hubFolder, d.relPath)));
-  for (const name of fs11.readdirSync(attachDir)) {
+  for (const name of fs12.readdirSync(attachDir)) {
     const abs = path13.join(attachDir, name);
-    const st = fs11.lstatSync(abs);
+    const st = fs12.lstatSync(abs);
     if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) {
-      fs11.rmSync(abs);
+      fs12.rmSync(abs);
       result.removed.push(path13.relative(hubFolder, abs));
     }
   }
@@ -17682,20 +18006,20 @@ var init_eval_attachments = __esm({
 });
 
 // src/lib/parser.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as path14 from "path";
-import * as yaml4 from "js-yaml";
+import * as yaml6 from "js-yaml";
 function parseHubFolder(hubFolder, opts) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) {
     throw expected(`hub.yaml not found in ${hubFolder}`);
   }
-  const yamlContent = fs12.readFileSync(yamlPath, "utf-8");
+  const yamlContent = fs13.readFileSync(yamlPath, "utf-8");
   let config;
   try {
-    config = yaml4.load(yamlContent);
+    config = yaml6.load(yamlContent);
   } catch (err) {
-    if (err instanceof yaml4.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${yamlPath}: ${err.message}`);
     }
     throw err;
@@ -17718,8 +18042,8 @@ function parseHubFolder(hubFolder, opts) {
     if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
       const instrValue = resolved.instructions;
       const instructionsPath = instrValue.startsWith("agents/") ? path14.join(hubFolder, instrValue) : path14.join(hubFolder, "agents", instrValue);
-      if (fs12.existsSync(instructionsPath)) {
-        resolved.instructions = fs12.readFileSync(instructionsPath, "utf-8");
+      if (fs13.existsSync(instructionsPath)) {
+        resolved.instructions = fs13.readFileSync(instructionsPath, "utf-8");
       } else {
         throw expected(
           `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
@@ -17727,8 +18051,8 @@ function parseHubFolder(hubFolder, opts) {
       }
     } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
       const conventionPath = path14.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
-      if (fs12.existsSync(conventionPath)) {
-        resolved.instructions = fs12.readFileSync(conventionPath, "utf-8");
+      if (fs13.existsSync(conventionPath)) {
+        resolved.instructions = fs13.readFileSync(conventionPath, "utf-8");
       }
     }
     return resolved;
@@ -17783,17 +18107,17 @@ function parseHubFolder(hubFolder, opts) {
 }
 function scanEvalYamlFiles(hubFolder, bytesByHash) {
   const evalsDir = path14.join(hubFolder, "evals");
-  if (!fs12.existsSync(evalsDir)) return [];
+  if (!fs13.existsSync(evalsDir)) return [];
   const evals = [];
   const seen = /* @__PURE__ */ new Set();
-  const topEntries = fs12.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const topEntries = fs13.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of topEntries) {
     if (entry.isFile() && entry.name.endsWith(".yaml")) {
       collectEval(evals, seen, path14.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
     } else if (entry.isDirectory()) {
       const setName = entry.name;
       const setDir = path14.join(evalsDir, setName);
-      const setEntries = fs12.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      const setEntries = fs13.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
       for (const sub of setEntries) {
         if (sub.isDirectory()) {
           throw expected(
@@ -17822,12 +18146,12 @@ function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesBy
   evals.push(evalEntry);
 }
 function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml4.load(content);
+    raw = yaml6.load(content);
   } catch (err) {
-    if (err instanceof yaml4.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -17925,10 +18249,10 @@ function parseFixtureField(raw, label, key) {
 }
 function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   const journeysDir = path14.join(hubFolder, "journeys");
-  if (!fs12.existsSync(journeysDir)) return [];
+  if (!fs13.existsSync(journeysDir)) return [];
   const journeys = [];
   const seen = /* @__PURE__ */ new Set();
-  const entries = fs12.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
       throw expected(
@@ -17949,12 +18273,12 @@ function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   return journeys;
 }
 function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml4.load(content);
+    raw = yaml6.load(content);
   } catch (err) {
-    if (err instanceof yaml4.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -18005,18 +18329,18 @@ function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
 }
 function scanAgentYamlFiles(hubFolder) {
   const agentsDir = path14.join(hubFolder, "agents");
-  if (!fs12.existsSync(agentsDir)) return [];
-  const yamlFiles = fs12.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
+  if (!fs13.existsSync(agentsDir)) return [];
+  const yamlFiles = fs13.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
   if (yamlFiles.length === 0) return [];
   const agents = [];
   for (const file of yamlFiles) {
     const filePath = path14.join(agentsDir, file);
-    const content = fs12.readFileSync(filePath, "utf-8");
+    const content = fs13.readFileSync(filePath, "utf-8");
     let agent;
     try {
-      agent = yaml4.load(content);
+      agent = yaml6.load(content);
     } catch (err) {
-      if (err instanceof yaml4.YAMLException) {
+      if (err instanceof yaml6.YAMLException) {
         throw expected(`Invalid YAML in agents/${file}: ${err.message}`);
       }
       throw err;
@@ -18046,7 +18370,7 @@ function parseResources(hubFolder, configResources) {
     if (res.skill_name) resource.skill_name = res.skill_name;
     const resSlug = slugify(resource.name);
     const resDir = path14.join(resourcesDir, resSlug);
-    if (fs12.existsSync(resDir)) {
+    if (fs13.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) {
         resource.files = files;
@@ -18094,9 +18418,9 @@ var init_diff_display = __esm({
 });
 
 // src/lib/yaml-writer.ts
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as path15 from "path";
-import * as yaml5 from "js-yaml";
+import * as yaml7 from "js-yaml";
 function writeFileIfChanged(hubFolder, absPath, content, log) {
   const buf = Buffer.from(content, "utf-8");
   if (fileHasBytes(absPath, buf)) return;
@@ -18145,15 +18469,15 @@ function buildEvalYamlObject(evalEntry, slug) {
 function writeHubFolder(hubFolder, payload, options = {}) {
   const log = { changed: [], removed: [] };
   const agentsDir = path15.join(hubFolder, "agents");
-  if (!fs13.existsSync(hubFolder)) {
-    fs13.mkdirSync(hubFolder, { recursive: true });
+  if (!fs14.existsSync(hubFolder)) {
+    fs14.mkdirSync(hubFolder, { recursive: true });
   }
-  if (!fs13.existsSync(agentsDir)) {
-    fs13.mkdirSync(agentsDir, { recursive: true });
+  if (!fs14.existsSync(agentsDir)) {
+    fs14.mkdirSync(agentsDir, { recursive: true });
   }
   const yamlPayload = buildYamlPayload(payload);
   const agentFiles = extractAgentFiles(payload);
-  const yamlContent = yaml5.dump(yamlPayload, YAML_DUMP_OPTIONS);
+  const yamlContent = yaml7.dump(yamlPayload, YAML_DUMP_OPTIONS);
   writeFileIfChanged(hubFolder, path15.join(hubFolder, "hub.yaml"), yamlContent, log);
   if (options.seedAgentContext ?? true) {
     for (const seeded of [
@@ -18164,8 +18488,8 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     }
   }
   const oldYamlPath = path15.join(hubFolder, "wayai.yaml");
-  if (fs13.existsSync(oldYamlPath)) {
-    fs13.unlinkSync(oldYamlPath);
+  if (fs14.existsSync(oldYamlPath)) {
+    fs14.unlinkSync(oldYamlPath);
     log.removed.push(path15.relative(hubFolder, oldYamlPath));
   }
   const yamlSlugs = writeAgentYamlFiles(hubFolder, agentsDir, payload.agents || [], log);
@@ -18174,20 +18498,20 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     mdSlugs.add(slug);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.md`), content, log);
   }
-  const existingFiles = fs13.readdirSync(agentsDir);
+  const existingFiles = fs14.readdirSync(agentsDir);
   for (const file of existingFiles) {
     if (file.endsWith(".yaml")) {
       const slug = file.slice(0, -5);
       if (!yamlSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs14.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     } else if (file.endsWith(".md")) {
       const slug = file.slice(0, -3);
       if (!mdSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs14.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     }
@@ -18200,10 +18524,10 @@ function writeHubFolder(hubFolder, payload, options = {}) {
 function setPreviewLabelInHubYaml(hubFolder, label) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) return;
-  const obj = yaml5.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
+  const obj = yaml7.load(fs14.readFileSync(yamlPath, "utf-8")) ?? {};
   if (label) obj.preview_label = label;
   else delete obj.preview_label;
-  fs13.writeFileSync(yamlPath, yaml5.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
+  fs14.writeFileSync(yamlPath, yaml7.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
 }
 function buildYamlPayload(payload) {
   const result = {
@@ -18248,7 +18572,7 @@ function writeAgentYamlFiles(hubFolder, agentsDir, agents, log) {
     slugs.add(slug);
     const entry = { ...agent };
     delete entry.instructions;
-    const yamlContent = yaml5.dump(entry, YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(entry, YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.yaml`), yamlContent, log);
   }
   return slugs;
@@ -18268,17 +18592,17 @@ function extractAgentFiles(payload) {
 function writeEvalYamlFiles(hubFolder, evals, log) {
   const evalsDir = path15.join(hubFolder, "evals");
   if (evals.length === 0) {
-    if (fs13.existsSync(evalsDir)) {
+    if (fs14.existsSync(evalsDir)) {
       cleanEvalOrphans(hubFolder, evalsDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(evalsDir).length === 0) fs13.rmdirSync(evalsDir);
+        if (fs14.readdirSync(evalsDir).length === 0) fs14.rmdirSync(evalsDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(evalsDir)) {
-    fs13.mkdirSync(evalsDir, { recursive: true });
+  if (!fs14.existsSync(evalsDir)) {
+    fs14.mkdirSync(evalsDir, { recursive: true });
   }
   const writtenRelPaths = /* @__PURE__ */ new Set();
   for (const evalEntry of evals) {
@@ -18292,42 +18616,42 @@ function writeEvalYamlFiles(hubFolder, evals, log) {
     }
     if (setName) {
       const setDir = path15.join(evalsDir, setName);
-      if (!fs13.existsSync(setDir)) {
-        fs13.mkdirSync(setDir, { recursive: true });
+      if (!fs14.existsSync(setDir)) {
+        fs14.mkdirSync(setDir, { recursive: true });
       }
     }
-    const yamlContent = yaml5.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, targetPath, yamlContent, log);
     writtenRelPaths.add(relPath);
   }
   cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log);
 }
 function cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log) {
-  const entries = fs13.readdirSync(evalsDir, { withFileTypes: true });
+  const entries = fs14.readdirSync(evalsDir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path15.join(evalsDir, entry.name);
     if (entry.isFile()) {
       if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
-        fs13.unlinkSync(fullPath);
+        fs14.unlinkSync(fullPath);
         log.removed.push(path15.relative(hubFolder, fullPath));
       }
       continue;
     }
     if (entry.isDirectory()) {
       const setName = entry.name;
-      const subEntries = fs13.readdirSync(fullPath, { withFileTypes: true });
+      const subEntries = fs14.readdirSync(fullPath, { withFileTypes: true });
       for (const sub of subEntries) {
         if (sub.isFile() && sub.name.endsWith(".yaml")) {
           const relPath = `${setName}/${sub.name}`;
           if (!writtenRelPaths.has(relPath)) {
             const orphan = path15.join(fullPath, sub.name);
-            fs13.unlinkSync(orphan);
+            fs14.unlinkSync(orphan);
             log.removed.push(path15.relative(hubFolder, orphan));
           }
         }
       }
       try {
-        if (fs13.readdirSync(fullPath).length === 0) fs13.rmdirSync(fullPath);
+        if (fs14.readdirSync(fullPath).length === 0) fs14.rmdirSync(fullPath);
       } catch {
       }
     }
@@ -18366,35 +18690,35 @@ function buildJourneyYamlObject(journeyEntry, slug) {
 function writeJourneyYamlFiles(hubFolder, journeys, log) {
   const journeysDir = path15.join(hubFolder, "journeys");
   if (journeys.length === 0) {
-    if (fs13.existsSync(journeysDir)) {
+    if (fs14.existsSync(journeysDir)) {
       cleanJourneyOrphans(hubFolder, journeysDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(journeysDir).length === 0) fs13.rmdirSync(journeysDir);
+        if (fs14.readdirSync(journeysDir).length === 0) fs14.rmdirSync(journeysDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(journeysDir)) {
-    fs13.mkdirSync(journeysDir, { recursive: true });
+  if (!fs14.existsSync(journeysDir)) {
+    fs14.mkdirSync(journeysDir, { recursive: true });
   }
   const writtenFiles = /* @__PURE__ */ new Set();
   const usedSlugs = /* @__PURE__ */ new Set();
   for (const journeyEntry of journeys) {
     const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
     const fileName = `${slug}.yaml`;
-    const yamlContent = yaml5.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(journeysDir, fileName), yamlContent, log);
     writtenFiles.add(fileName);
   }
   cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log);
 }
 function cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log) {
-  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true });
+  const entries = fs14.readdirSync(journeysDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
       const orphan = path15.join(journeysDir, entry.name);
-      fs13.unlinkSync(orphan);
+      fs14.unlinkSync(orphan);
       log.removed.push(path15.relative(hubFolder, orphan));
     }
   }
@@ -18408,12 +18732,12 @@ function writeResourceFiles(hubFolder, resources, log) {
     const resDir = path15.join(resourcesDir, resSlug);
     writeResourceFileTree(resDir, resource.files || [], hubFolder, log);
   }
-  if (fs13.existsSync(resourcesDir)) {
-    const existingDirs = fs13.readdirSync(resourcesDir, { withFileTypes: true });
+  if (fs14.existsSync(resourcesDir)) {
+    const existingDirs = fs14.readdirSync(resourcesDir, { withFileTypes: true });
     for (const entry of existingDirs) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
         const orphanDir = path15.join(resourcesDir, entry.name);
-        fs13.rmSync(orphanDir, { recursive: true, force: true });
+        fs14.rmSync(orphanDir, { recursive: true, force: true });
         log.removed.push(`${path15.relative(hubFolder, orphanDir)}/`);
       }
     }
@@ -18501,35 +18825,16 @@ var init_terminal_output = __esm({
   }
 });
 
-// src/lib/base-id.ts
-function isValidBaseId(id) {
-  return id.length > 0 && id.length <= BASE_ID_MAX_LENGTH && BASE_ID_RE.test(id);
-}
-function isPathSafeId(id) {
-  return PATH_SAFE_ID_RE.test(id);
-}
-var BASE_ID_MAX_LENGTH, BASE_ID_RE, BASE_ID_RULE, PATH_SAFE_ID_RE, PATH_SAFE_ID_RULE;
-var init_base_id = __esm({
-  "src/lib/base-id.ts"() {
-    "use strict";
-    BASE_ID_MAX_LENGTH = 128;
-    BASE_ID_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
-    BASE_ID_RULE = `letters, digits, \`-\` and \`_\`, starting with a letter, digit or \`_\`, ${BASE_ID_MAX_LENGTH} characters or fewer`;
-    PATH_SAFE_ID_RE = /^(?!\.\.?$)[A-Za-z0-9._-]{1,256}$/;
-    PATH_SAFE_ID_RULE = "letters, digits, dot, dash and underscore, with no path separators, not `.` or `..` alone, 256 characters or fewer";
-  }
-});
-
 // src/lib/base-workspace.ts
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import * as path17 from "path";
-import * as yaml6 from "js-yaml";
+import * as yaml8 from "js-yaml";
 function readBaseMeta(folder) {
   const bytes = readFileNoFollow(folder, path17.join(folder, BASE_META_FILE));
   if (bytes === null) return null;
   let doc;
   try {
-    doc = yaml6.load(bytes.toString("utf-8"));
+    doc = yaml8.load(bytes.toString("utf-8"));
   } catch {
     return null;
   }
@@ -18539,7 +18844,7 @@ function readBaseMeta(folder) {
 function listBaseFolders(basesDir) {
   let entries;
   try {
-    entries = fs14.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
+    entries = fs15.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
   } catch {
     return [];
   }
@@ -18618,9 +18923,15 @@ function targetBaseId(target, selector) {
   if (selector && !selector.includes("/") && !selector.includes(path17.sep)) return selector;
   return target.exists ? null : path17.basename(target.folder);
 }
+function resolveBaseSelectorToId(gitRoot, selector) {
+  if (!gitRoot || selector.includes("/") || selector.includes(path17.sep)) return selector;
+  if (!isPathSafeId(selector)) return selector;
+  const id = readBaseMeta(path17.join(resolveBasesDir(gitRoot), selector))?.base_id;
+  return typeof id === "string" && isPathSafeId(id) ? id : selector;
+}
 function hasBaseMetaFile(folder) {
   try {
-    return fs14.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
+    return fs15.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
   } catch {
     return false;
   }
@@ -18638,25 +18949,17 @@ var init_base_workspace = __esm({
 });
 
 // src/lib/subtree-routing.ts
-import * as fs15 from "fs";
 import * as path18 from "path";
-import * as yaml7 from "js-yaml";
 function readRepoDefaults(gitRoot) {
-  const file = path18.join(gitRoot, WAYAI_LAYOUT.wsDir, REPO_DEFAULTS_FILE);
-  let doc;
-  try {
-    doc = yaml7.load(fs15.readFileSync(file, "utf-8"));
-  } catch {
-    return {};
-  }
-  if (!doc || typeof doc !== "object") return {};
-  const raw = doc;
+  const load11 = loadWorkspaceManifest(gitRoot);
+  if (load11.kind !== "ok") return {};
+  const raw = load11.doc;
   const str = (v) => {
     if (typeof v !== "string" || !v.trim()) return void 0;
     const value = v.trim();
     if (value.includes("/") || value.includes(path18.sep) || value === "." || value === "..") {
       console.warn(
-        `Warning: ignoring ${JSON.stringify(value)} in ${WAYAI_LAYOUT.wsDir}/${REPO_DEFAULTS_FILE} \u2014 a default names a hub or base, not a path.`
+        `Warning: ignoring ${JSON.stringify(value)} in ${WORKSPACE_MANIFEST_LABEL} \u2014 a default names a hub or base, not a path.`
       );
       return void 0;
     }
@@ -18690,7 +18993,7 @@ function firstSegment(p) {
   const [head] = normalized.split("/").filter(Boolean);
   return head ?? p;
 }
-function selectorSubtree(layout, selector, cwd) {
+function resolveSelectorSubtree(layout, selector, cwd) {
   const parts = selector.split(path18.sep).join("/").split("/").filter(Boolean);
   const qualified = parts[0] === WAYAI_LAYOUT.wsDir ? parts.slice(1) : parts;
   if (qualified.length > 1) {
@@ -18744,11 +19047,11 @@ function routeSubtree(options) {
     return {
       ok: false,
       refusal: [
-        `\`wayai ${verb}\` does not take --org: it operates on the organization named by .wayai.yaml at the repo root.`,
+        `\`wayai ${verb}\` does not take --org: it operates on the organization named by ${WORKSPACE_MANIFEST_LABEL}.`,
         "",
         "To act on another organization:",
         "  wayai bases <command> --org <uuid>   # the Data surface honors it",
-        "  # or run from a checkout whose .wayai.yaml names that organization"
+        "  # or run from a checkout whose workspace manifest names that organization"
       ].join("\n")
     };
   }
@@ -18756,7 +19059,7 @@ function routeSubtree(options) {
   if (hubFlag !== void 0 && baseFlag !== void 0) {
     return { ok: false, refusal: mixedInvocationRefusal(verb, hubFlag, baseFlag) };
   }
-  const fromPositional = positional !== void 0 ? selectorSubtree(layout, positional, cwd) : void 0;
+  const fromPositional = positional !== void 0 ? resolveSelectorSubtree(layout, positional, cwd) : void 0;
   if (fromPositional?.kind === "both") {
     return {
       ok: false,
@@ -18815,15 +19118,15 @@ function requireSubtree(verb, args2, gitRoot) {
   }
   return { subtree: result.subtree, selector: result.selector };
 }
-var REPO_DEFAULTS_FILE, VALUE_FLAGS;
+var VALUE_FLAGS;
 var init_subtree_routing = __esm({
   "src/lib/subtree-routing.ts"() {
     "use strict";
     init_layout();
     init_terminal_output();
+    init_workspace_manifest();
     init_workspace();
     init_base_workspace();
-    REPO_DEFAULTS_FILE = "wayai.yaml";
     VALUE_FLAGS = /* @__PURE__ */ new Set(["--hub", "--base", "--label", "--org"]);
   }
 });
@@ -18850,23 +19153,23 @@ async function createDataClient(orgId) {
   if (selected !== void 0 && !UUID_RE2.test(selected)) {
     throw expected(`Invalid --org: ${JSON.stringify(selected)}. Expected an organization UUID.`);
   }
-  const org = selected ?? readRepoConfig()?.organization_id;
+  const org = selected ?? readRepoConfigUnlessBlocked()?.organization_id;
   async function requireOrgForSetupRoute(what) {
     const orgId2 = org ?? (await api.me()).org_id;
     if (!orgId2) {
       throw expected(
-        `No organization to ${what} against. Pass --org <uuid>, or run this from a repo with .wayai.yaml.`
+        `No organization to ${what} against. Pass --org <uuid>, or run this from a repo scoped by \`wayai init\`.`
       );
     }
     return orgId2;
   }
   return {
-    async request(method, path36, body) {
-      const envelope = await api.dataRequest(method, path36, body, org);
+    async request(method, path35, body) {
+      const envelope = await api.dataRequest(method, path35, body, org);
       return envelope.data;
     },
-    async requestRaw(method, path36, body) {
-      const body_ = await api.dataRequest(method, path36, body, org);
+    async requestRaw(method, path35, body) {
+      const body_ = await api.dataRequest(method, path35, body, org);
       return body_;
     },
     async collectPages(makePath) {
@@ -18940,40 +19243,8 @@ var init_client = __esm({
   }
 });
 
-// src/lib/base-binding.ts
-var binding2, getBaseBindingPath, readBaseBinding, writeBaseBinding, clearBaseBinding, autoBindBaseIfUnbound, assertBaseMatchesBinding, assertNoBindingBlocksBaseCreation;
-var init_base_binding = __esm({
-  "src/lib/base-binding.ts"() {
-    "use strict";
-    init_base_id();
-    init_worktree_binding();
-    binding2 = createWorktreeBinding({
-      filename: "wayai-base-binding",
-      // `isPathSafeId`, not the API's base-id rule. The tripwire's duty is that a
-      // garbled or multi-line file read as unbound, which this grammar delivers;
-      // applying the mint rule instead would refuse to bind a base whose stored id
-      // predates it — a base the API still serves — and so lock the CLI out of the
-      // one workflow that could migrate off it.
-      isValidId: isPathSafeId,
-      noun: "base",
-      // States what is actually checked. "must be a slug" described no rule the
-      // reader could act on, and naming the API's rule here would name the wrong one.
-      idLabel: `base id (${PATH_SAFE_ID_RULE})`,
-      unbindCommand: "wayai bases unbind",
-      useCommand: "wayai bases use"
-    });
-    getBaseBindingPath = binding2.getBindingPath;
-    readBaseBinding = binding2.readBinding;
-    writeBaseBinding = binding2.writeBinding;
-    clearBaseBinding = binding2.clearBinding;
-    autoBindBaseIfUnbound = binding2.autoBindIfUnbound;
-    assertBaseMatchesBinding = binding2.assertMatchesBinding;
-    assertNoBindingBlocksBaseCreation = binding2.assertNoBindingBlocksCreation;
-  }
-});
-
 // src/data/helpers.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 function pathSegment(id, label = "id") {
   if (!isPathSafeId(id)) {
     throw expected(`Invalid ${label}: ${JSON.stringify(id)}. An id may use ${PATH_SAFE_ID_RULE}.`);
@@ -19001,7 +19272,7 @@ function parseData(data, flag) {
   let text = data;
   if (source !== void 0) {
     try {
-      text = readFileSync16(source, "utf-8");
+      text = readFileSync15(source, "utf-8");
     } catch (e) {
       throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -19128,9 +19399,9 @@ var init_types2 = __esm({
 // src/data/config-as-code/config-writer.ts
 import * as fs16 from "fs";
 import * as path19 from "path";
-import * as yaml8 from "js-yaml";
-function dump4(value) {
-  return yaml8.dump(value, YAML_DUMP_OPTIONS);
+import * as yaml9 from "js-yaml";
+function dump5(value) {
+  return yaml9.dump(value, YAML_DUMP_OPTIONS);
 }
 function omitUndefined(obj) {
   const out = {};
@@ -19188,7 +19459,7 @@ function writeBaseFolder(folder, meta, config) {
       `Refusing to write ${folder}: the path crosses a symlink. Remove it and pull again.`
     );
   }
-  writeFileIfChanged(folder, path19.join(folder, BASE_META_FILE), dump4(metaFileObject(meta)), delta);
+  writeFileIfChanged(folder, path19.join(folder, BASE_META_FILE), dump5(metaFileObject(meta)), delta);
   for (const kind of ENTITY_KINDS) {
     const dir = path19.join(folder, ENTITY_DIRS[kind]);
     const entities = config[kind] ?? [];
@@ -19202,7 +19473,7 @@ function writeBaseFolder(folder, meta, config) {
       }
       const file = `${id}.yaml`;
       keep.add(file);
-      writeFileIfChanged(folder, path19.join(dir, file), dump4(toFileObject(kind, entity)), delta);
+      writeFileIfChanged(folder, path19.join(dir, file), dump5(toFileObject(kind, entity)), delta);
     }
     pruneOrphans(folder, dir, keep, delta);
   }
@@ -19363,7 +19634,7 @@ var init_api = __esm({
 // src/data/config-as-code/config-parser.ts
 import * as fs17 from "fs";
 import * as path20 from "path";
-import * as yaml9 from "js-yaml";
+import * as yaml10 from "js-yaml";
 function readEntityDir(folder, dir) {
   if (!ensureRealSubdirNoSymlink(folder, dir, false)) {
     throw expected(`Refusing to read ${dir}: it is a symlink, not a config directory.`);
@@ -19379,7 +19650,7 @@ function readEntityDir(folder, dir) {
     }
     let parsed;
     try {
-      parsed = yaml9.load(bytes.toString("utf-8"));
+      parsed = yaml10.load(bytes.toString("utf-8"));
     } catch (err) {
       throw expected(`Failed to parse ${abs}: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -19561,7 +19832,7 @@ async function pullBase(gitRootOrNull, selector, args2) {
     console.log(`Production base mirrored (read-only) \u2192 ${folder}`);
     return;
   }
-  assertBaseMatchesBinding(baseId);
+  assertInScope("bases", baseId);
   if (target.exists && !autoConfirm) {
     const ok = await confirm(
       `Overwrite local files in ${path21.relative(gitRoot, target.folder)} with the server config for "${sanitizeTerminalText(baseId)}"?`
@@ -19580,7 +19851,7 @@ async function pullBase(gitRootOrNull, selector, args2) {
   );
   if (!isFirstPull) printLocalFileChanges(delta);
   console.log("  Credential values are not written. Manage them with `wayai bases credentials`.");
-  autoBindBaseIfUnbound(baseId);
+  seedScopeIfEmpty("bases", baseId);
   if (record.origin_base_id) {
     await mirrorLinkedProduction(client, basesDir, record.origin_base_id);
   }
@@ -19605,7 +19876,7 @@ async function createDeclaredPreview(client, target, parsed, autoConfirm) {
     );
   }
   const name = meta.name ?? path21.basename(target.folder);
-  assertNoBindingBlocksBaseCreation(name);
+  assertScopeAllowsCreation("bases", name);
   if (!autoConfirm) {
     const ok = await confirm(
       `Create a new preview "${sanitizeTerminalText(name)}" from "${sanitizeTerminalText(meta.origin_base_id)}"?`
@@ -19624,7 +19895,7 @@ async function createDeclaredPreview(client, target, parsed, autoConfirm) {
   writeBaseFolder(target.folder, { ...meta, ...metaFromRecord(record, id) }, config);
   console.log(`Created preview "${sanitizeTerminalText(id)}".`);
   printWarnings((record.warnings ?? []).map((w) => sanitizeTerminalText(w.message)));
-  autoBindBaseIfUnbound(id);
+  seedScopeIfEmpty("bases", id);
   return id;
 }
 async function pushBase(gitRootOrNull, selector, args2) {
@@ -19662,13 +19933,13 @@ async function pushBase(gitRootOrNull, selector, args2) {
         `"${sanitizeTerminalText(baseId)}" is a ${sanitizeTerminalText(record.environment)} base. Push operates on previews \u2014 promote with \`wayai bases promote\`.`
       );
     }
-    assertBaseMatchesBinding(baseId);
+    assertInScope("bases", baseId);
   }
   const diff = await diffConfig(client, baseId, config);
   printLintWarnings(diff.warnings);
   if (isDiffEmpty(diff)) {
     console.log(`No changes \u2014 preview "${sanitizeTerminalText(baseId)}" already matches your files.`);
-    if (!dryRun) autoBindBaseIfUnbound(baseId);
+    if (!dryRun) seedScopeIfEmpty("bases", baseId);
     return;
   }
   console.log(renderDiff(diff));
@@ -19720,7 +19991,7 @@ Delete ${removals.length} server ${word} not in your files? Record types cascade
   }
   console.log(`
 Pushed to preview "${sanitizeTerminalText(baseId)}".`);
-  autoBindBaseIfUnbound(baseId);
+  seedScopeIfEmpty("bases", baseId);
 }
 var init_sync = __esm({
   "src/data/config-as-code/sync.ts"() {
@@ -19732,7 +20003,7 @@ var init_sync = __esm({
     init_terminal_output();
     init_base_id();
     init_push();
-    init_base_binding();
+    init_worktree_scope();
     init_api();
     init_config_parser();
     init_config_writer();
@@ -19759,7 +20030,7 @@ __export(push_exports, {
 });
 import * as fs18 from "fs";
 import * as path22 from "path";
-import * as yaml10 from "js-yaml";
+import * as yaml11 from "js-yaml";
 function parseArgs5(args2) {
   let autoConfirm = false;
   let label;
@@ -19873,7 +20144,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     for (const file of yamlFiles) {
       try {
         const content = fs18.readFileSync(path22.join(agentsDir, file), "utf-8");
-        const agent = yaml10.load(content);
+        const agent = yaml11.load(content);
         if (agent?.id && agent.name) {
           agentsWithIds.push({ id: agent.id, name: agent.name });
         }
@@ -19886,7 +20157,7 @@ async function autoRenameAgentFiles(client, hubId, hubFolder, organizationId, re
     const yamlPath = resolveHubYamlPath(hubFolder);
     if (!yamlPath) return;
     const yamlContent = fs18.readFileSync(yamlPath, "utf-8");
-    const config = yaml10.load(yamlContent);
+    const config = yaml11.load(yamlContent);
     agentsWithIds = (config.agents || []).filter((a) => !!a.id && !!a.name);
   }
   if (agentsWithIds.length === 0) return;
@@ -20036,7 +20307,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
     } else {
       console.log("No changes to push; folder renamed.");
     }
-    autoBindIfUnbound(hubId);
+    seedScopeIfEmpty("hubs", hubId);
     return true;
   }
   console.log("\nChanges to push:");
@@ -20052,7 +20323,7 @@ async function pushSingleHub(client, hubId, hubFolder, autoConfirm, organization
   const result = await client.push(hubId, wireConfig, organizationId);
   printSyncResult(result);
   await syncAfterPush(client, hubId, hubFolder, organizationId);
-  autoBindIfUnbound(hubId);
+  seedScopeIfEmpty("hubs", hubId);
   return true;
 }
 function selectExistingHub(workspaceDir, allHubs, selector, wsLabel) {
@@ -20118,7 +20389,7 @@ hub_environment: preview
 ${content}`;
   }
   fs18.writeFileSync(hubYamlPath, updated, "utf-8");
-  autoBindIfUnbound(hubId);
+  seedScopeIfEmpty("hubs", hubId);
   await pushSingleHub(client, hubId, newHub.hubFolder, opts.autoConfirm, opts.organizationId, { skipAgentRename: true });
 }
 function reportUnresolvedPushTarget(reason, existingHubs, newHubs, selector, wsLabel) {
@@ -20188,11 +20459,11 @@ async function pushCommand(args2) {
       console.warn("Note: --label is only used when creating a new hub. To change an existing hub's label, use `wayai relabel`.");
     }
     console.log(`Target hub: ${path22.basename(existing.hubFolder)} (${existing.hubId})`);
-    assertHubMatchesBinding(existing.hubId, path22.basename(existing.hubFolder));
+    assertInScope("hubs", existing.hubId, path22.basename(existing.hubFolder));
     await pushSingleHub(client, existing.hubId, existing.hubFolder, autoConfirm, organizationId);
     return;
   }
-  assertNoBindingBlocksHubCreation(resolution.target.hub.hubName);
+  assertScopeAllowsCreation("hubs", resolution.target.hub.hubName);
   await createAndPushNewHub(client, resolution.target.hub, { autoConfirm, label, organizationId });
 }
 var LOCAL_CHANGE_LIST_CAP;
@@ -20211,7 +20482,7 @@ var init_push = __esm({
     init_layout();
     init_workspace_files();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_subtree_routing();
     LOCAL_CHANGE_LIST_CAP = 20;
   }
@@ -20285,7 +20556,7 @@ async function pullCommand(args2) {
     console.log(`Production hub mirrored (read-only) \u2192 ${folder}`);
     return;
   }
-  assertHubMatchesBinding(hubId);
+  assertInScope("hubs", hubId);
   let hubFolder = existingFolder;
   let wroteFiles = false;
   if (!hubFolder) {
@@ -20344,7 +20615,7 @@ async function pullCommand(args2) {
       printLocalFileChanges(delta);
     }
   }
-  if (wroteFiles) autoBindIfUnbound(hubId);
+  if (wroteFiles) seedScopeIfEmpty("hubs", hubId);
   if (payload.production_hub_id) {
     await mirrorLinkedProduction2(client, workspaceDir, payload.production_hub_id, organizationId);
   }
@@ -20406,7 +20677,7 @@ var init_pull = __esm({
     init_layout();
     init_workspace_files();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_subtree_routing();
     MIRROR_MARKER_PREFIX2 = "# Read-only mirror of production hub";
   }
@@ -20472,7 +20743,7 @@ async function createCommand(args2) {
     }
     process.exit(1);
   }
-  assertNoBindingBlocksHubCreation(resolution.hub.hubName);
+  assertScopeAllowsCreation("hubs", resolution.hub.hubName);
   await createAndPushNewHub(client, resolution.hub, { autoConfirm, label, organizationId });
 }
 var init_create = __esm({
@@ -20484,7 +20755,7 @@ var init_create = __esm({
     init_workspace();
     init_layout();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
   }
 });
 
@@ -20637,7 +20908,7 @@ async function replicateCommand(args2) {
     payload.preview_label,
     payload.branch_name
   );
-  autoBindIfUnbound(previewHubId);
+  seedScopeIfEmpty("hubs", previewHubId);
   if (folderPreExisted) printLocalFileChanges(delta);
   console.log(`Preview written to ${path25.basename(hubFolder)}`);
   console.log(`  Switch to it with: wayai use ${path25.basename(hubFolder)}`);
@@ -20653,7 +20924,7 @@ var init_replicate = __esm({
     init_workspace();
     init_layout();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_contracts();
   }
 });
@@ -20716,7 +20987,7 @@ async function relabelCommand(args2) {
     console.log("This is a read-only production mirror \u2014 production hubs have no preview label. Relabel the linked preview hub instead.");
     return;
   }
-  assertHubMatchesBinding(target.hubId, path26.basename(target.hubFolder));
+  assertInScope("hubs", target.hubId, path26.basename(target.hubFolder));
   console.log(normalizedLabel ? `Setting preview label to "${normalizedLabel}"...` : "Clearing preview label...");
   const { data } = await client.relabelPreview(target.hubId, normalizedLabel);
   const row = data[0];
@@ -20745,7 +21016,7 @@ var init_relabel = __esm({
     init_workspace();
     init_layout();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     init_contracts();
   }
 });
@@ -20872,7 +21143,7 @@ async function publishCommand(args2) {
       return;
     }
   }
-  assertHubMatchesBinding(hubId, hubFolder ? path27.basename(hubFolder) : void 0);
+  assertInScope("hubs", hubId, hubFolder ? path27.basename(hubFolder) : void 0);
   await runPublish(client, { hubId, localConfig, organizationId, autoConfirm });
 }
 var STATUS_STYLE;
@@ -20888,7 +21159,7 @@ var init_publish = __esm({
     init_layout();
     init_resource_files();
     init_repo_config();
-    init_hub_binding();
+    init_worktree_scope();
     STATUS_STYLE = {
       added: { sym: "+", color: 32 },
       // green
@@ -20900,77 +21171,151 @@ var init_publish = __esm({
   }
 });
 
+// src/lib/scope-selector.ts
+import * as path28 from "path";
+function findAddFlag(args2) {
+  return args2.find((arg) => arg === "--add" || arg.startsWith("--add="));
+}
+function isValuedFlag(token) {
+  return token.includes("=");
+}
+function resolveScopeSelector(verb, args2) {
+  const { hubFlag, baseFlag, positional } = parseRoutingTokens(args2);
+  if (hubFlag !== void 0 && baseFlag !== void 0) {
+    throw expected(mixedInvocationRefusal(verb, hubFlag, baseFlag));
+  }
+  assertValueIsNotAFlag(verb, "--hub", hubFlag);
+  assertValueIsNotAFlag(verb, "--base", baseFlag);
+  assertFlagWasGivenAValue(verb, "--hub", args2, hubFlag);
+  assertFlagWasGivenAValue(verb, "--base", args2, baseFlag);
+  if (hubFlag !== void 0) return { axis: "hubs", target: hubFlag, gitRoot: findGitRoot() };
+  if (baseFlag !== void 0) return { axis: "bases", target: baseFlag, gitRoot: findGitRoot() };
+  if (positional === void 0) return null;
+  const gitRoot = findGitRoot();
+  const layout = gitRoot ? resolveLayout(gitRoot) : null;
+  const resolved = resolveSelectorSubtree(layout, positional, process.cwd());
+  if (resolved.kind === "both") {
+    throw expected(mixedInvocationRefusal(verb, resolved.target, resolved.target));
+  }
+  if (resolved.kind === "hubs" || resolved.kind === "bases") {
+    return { axis: resolved.kind, target: resolved.target, gitRoot };
+  }
+  return { axis: "hubs", target: positional, gitRoot };
+}
+function assertValueIsNotAFlag(verb, flag, captured) {
+  if (captured === void 0 || !captured.startsWith("-")) return;
+  throw refusal(verb, flag, `but got ${JSON.stringify(captured)} \u2014 which is a flag, not a hub or base`);
+}
+function assertFlagWasGivenAValue(verb, flag, args2, captured) {
+  if (captured !== void 0 && captured !== "") return;
+  if (!args2.some((arg) => arg === flag || arg.startsWith(`${flag}=`))) return;
+  throw refusal(verb, flag, "but no target followed it");
+}
+function refusal(verb, flag, problem) {
+  return expected(
+    `\`wayai ${verb} ${flag}\` needs a target, ${problem}.
+  wayai ${verb} ${flag} <hub-or-base>`
+  );
+}
+function resolveHubSelectorToId(gitRoot, selector) {
+  if (UUID_RE2.test(selector)) return selector;
+  const workspaceDir = detectWorkspace()?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
+  if (!workspaceDir) {
+    throw expected("Not inside a git repository, and no UUID provided.");
+  }
+  const match = findHubByFolderName(workspaceDir, selector);
+  if (match) return match.hubId;
+  const newHubs = scanNewHubs(workspaceDir);
+  const pending = newHubs.find((h) => path28.basename(h.hubFolder) === selector);
+  if (pending) {
+    throw expected(
+      `"${selector}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
+Create it first \u2014 the worktree scope picks it up automatically afterward:
+  wayai create ${selector}`
+    );
+  }
+  throw expected(
+    [
+      `No hub matching "${selector}" found in ${hubsDirLabel(gitRoot)}/. Pass a UUID or a folder name from:`,
+      ...scanWorkspaceHubs(workspaceDir).map((h) => `  ${path28.basename(h.hubFolder)} (${h.hubId})`),
+      ...newHubs.map(
+        (h) => `  ${path28.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path28.basename(h.hubFolder)}\`)`
+      )
+    ].join("\n")
+  );
+}
+function resolveScopeTarget(selector) {
+  const { axis, target, gitRoot } = selector;
+  if (axis === "hubs") {
+    return { axis, id: resolveHubSelectorToId(gitRoot, target) };
+  }
+  const id = resolveBaseSelectorToId(gitRoot, target);
+  assertValidBaseSelector(id, "base id");
+  return { axis, id };
+}
+var init_scope_selector = __esm({
+  "src/lib/scope-selector.ts"() {
+    "use strict";
+    init_expected();
+    init_base_workspace();
+    init_layout();
+    init_subtree_routing();
+    init_utils();
+    init_workspace();
+  }
+});
+
 // src/commands/use.ts
 var use_exports = {};
 __export(use_exports, {
   useCommand: () => useCommand
 });
-import * as path28 from "path";
 async function useCommand(args2) {
-  const target = args2[0];
-  if (!target || target.startsWith("-")) {
-    console.error("Usage: wayai use <hub_uuid|folder-name>");
-    process.exit(1);
-  }
-  let hubId;
-  if (UUID_RE2.test(target)) {
-    hubId = target;
-  } else {
-    const workspace = detectWorkspace();
-    const gitRoot = findGitRoot();
-    const workspaceDir = workspace?.workspaceDir ?? (gitRoot ? resolveLayout(gitRoot).hubsDir : null);
-    if (!workspaceDir) {
-      console.error("Not inside a git repository, and no UUID provided.");
-      process.exit(1);
-    }
-    const wsLabel = hubsDirLabel(gitRoot);
-    const match = findHubByFolderName(workspaceDir, target);
-    if (!match) {
-      const newHubs = scanNewHubs(workspaceDir);
-      const pending = newHubs.find((h) => path28.basename(h.hubFolder) === target);
-      if (pending) {
-        console.error(
-          `"${target}" is a new hub that hasn't been created on the platform yet, so it has no id to bind to.
-Create it first \u2014 the worktree binds automatically afterward:
-  wayai create ${target}`
-        );
-        process.exit(1);
-      }
-      console.error(`No hub matching "${target}" found in ${wsLabel}/. Pass a UUID or a folder name from:`);
-      for (const h of scanWorkspaceHubs(workspaceDir)) {
-        console.error(`  ${path28.basename(h.hubFolder)} (${h.hubId})`);
-      }
-      for (const h of newHubs) {
-        console.error(`  ${path28.basename(h.hubFolder)} (new \u2014 "${h.hubName}", run \`wayai create ${path28.basename(h.hubFolder)}\`)`);
-      }
-      process.exit(1);
-    }
-    hubId = match.hubId;
+  const addFlag = findAddFlag(args2);
+  if (addFlag !== void 0 && isValuedFlag(addFlag)) {
+    throw expected(
+      [
+        `\`--add\` is a boolean flag \u2014 write it bare, not ${JSON.stringify(addFlag)}.`,
+        "  wayai use --add <selector>   # widen the worktree scope",
+        "  wayai use <selector>         # replace that axis instead"
+      ].join("\n")
+    );
   }
-  const previous = readBinding();
-  if (previous === hubId) {
-    console.log(`Worktree already bound to ${hubId}.`);
+  const add = addFlag !== void 0;
+  const selector = resolveScopeSelector("use", args2);
+  if (!selector) throw expected(USAGE);
+  const { axis, id } = resolveScopeTarget(selector);
+  const noun = axisNoun(axis);
+  if (add) {
+    const widened = addToScope(axis, id);
+    console.log(
+      widened ? `Worktree scope widened \u2014 now ${describeAxis(axis, widened)}.` : `Worktree scope already includes ${noun} ${id}.`
+    );
     return;
   }
-  try {
-    writeBinding(hubId);
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-  }
-  if (previous) {
-    console.log(`Worktree rebound: ${previous} \u2192 ${hubId}`);
-  } else {
-    console.log(`Worktree bound to hub ${hubId}.`);
+  const previous = readScope()[axis];
+  if (previous.length === 1 && previous[0] === id) {
+    console.log(`Worktree already bound to ${noun} ${id}.`);
+    return;
   }
+  setScopeAxis(axis, [id]);
+  console.log(
+    previous.length > 0 ? `Worktree rebound: ${previous.join(", ")} \u2192 ${id}.` : `Worktree bound to ${noun} ${id}.`
+  );
 }
+var USAGE;
 var init_use = __esm({
   "src/commands/use.ts"() {
     "use strict";
-    init_hub_binding();
-    init_workspace();
-    init_layout();
-    init_utils();
+    init_expected();
+    init_scope_selector();
+    init_worktree_scope();
+    USAGE = [
+      "Usage: wayai use [--add] <hub_uuid|folder-name|hubs/<name>|bases/<name>>",
+      "       wayai use [--add] --hub <hub> | --base <base>",
+      "",
+      "  --add   widen the worktree scope instead of replacing that axis"
+    ].join("\n");
   }
 });
 
@@ -21022,9 +21367,10 @@ async function migrateCommand(_args) {
   const newOrg = path29.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
-  if (!hasLegacyWs && !hasLegacyOrg) {
-    console.log(`Already migrated \u2014 no legacy ${WAYAI_LAYOUT.legacy.wsDir}/ or ${WAYAI_LAYOUT.legacy.orgAtRoot}/ to move.`);
-    return;
+  const orgPlan = planOrgMigration(gitRoot);
+  if (orgPlan.kind === "refuse") {
+    console.error(orgPlan.message);
+    process.exit(1);
   }
   if (hasLegacyWs && isDirectory(newHubs)) {
     console.error(
@@ -21050,10 +21396,30 @@ async function migrateCommand(_args) {
     usedFsFallback ||= how === "fs";
     moved.push(`${WAYAI_LAYOUT.legacy.orgAtRoot}/ \u2192 ${rel(newOrg)}/`);
   }
-  console.log(`Migrated to the ${WAYAI_LAYOUT.wsDir}/ layout:`);
-  for (const m of moved) console.log(`  ${m}`);
-  if (usedFsFallback) {
-    console.log("\n(Some dirs were moved on disk, not via git \u2014 they will show as untracked.)");
+  if (moved.length > 0) {
+    console.log(`Migrated to the ${WAYAI_LAYOUT.wsDir}/ layout:`);
+    for (const m of moved) console.log(`  ${m}`);
+    if (usedFsFallback) {
+      console.log("\n(Some dirs were moved on disk, not via git \u2014 they will show as untracked.)");
+    }
+  }
+  const copiedOrg = orgPlan.kind === "copy";
+  if (copiedOrg) {
+    writeRepoConfig(orgPlan.config, gitRoot);
+    console.log(`${moved.length > 0 ? "\n" : ""}Copied the organization binding into ${WORKSPACE_MANIFEST_LABEL}.`);
+    console.log(
+      `  ${ROOT_CONFIG_FILE} is KEPT on purpose \u2014 an older CLI in a teammate's environment or in CI still requires it.`
+    );
+    console.log(
+      "  It stays a supported fallback until the next major, which removes both the fallback and the file."
+    );
+    console.log("  Delete it once every environment that runs this repo reads the manifest.");
+  }
+  if (moved.length === 0 && !copiedOrg) {
+    console.log(
+      `Already migrated \u2014 no legacy ${WAYAI_LAYOUT.legacy.wsDir}/ or ${WAYAI_LAYOUT.legacy.orgAtRoot}/ to move, and no organization binding to copy into ${WORKSPACE_MANIFEST_LABEL}.`
+    );
+    return;
   }
   console.log("\nNext steps:");
   console.log('  git add -A && git commit -m "chore: migrate to wayai-ws layout"');
@@ -21064,6 +21430,8 @@ var init_migrate = __esm({
     "use strict";
     init_workspace();
     init_layout();
+    init_repo_config();
+    init_workspace_manifest();
   }
 });
 
@@ -21072,19 +21440,71 @@ var unbind_exports = {};
 __export(unbind_exports, {
   unbindCommand: () => unbindCommand
 });
-async function unbindCommand(_args) {
-  const previous = readBinding();
-  if (!previous) {
-    console.log("No worktree binding to clear.");
+async function unbindCommand(args2) {
+  const addFlag = findAddFlag(args2);
+  if (addFlag !== void 0) {
+    throw expected(
+      [
+        `\`wayai unbind\` does not take ${JSON.stringify(addFlag)}.`,
+        "  wayai unbind <selector>      # remove one entry from the worktree scope",
+        "  wayai unbind                 # clear the whole scope (both hubs and bases)",
+        "  wayai use --add <selector>   # WIDEN the scope instead (the opposite change)"
+      ].join("\n")
+    );
+  }
+  const selector = resolveScopeSelector("unbind", args2);
+  if (!selector) {
+    if (args2.length > 0) {
+      throw expected(
+        [
+          `\`wayai unbind ${args2.join(" ")}\` does not name anything to remove.`,
+          "",
+          "Refusing rather than clearing the whole scope \u2014 that is what a BARE",
+          "`wayai unbind` does, and it is not what this invocation asked for.",
+          "  wayai unbind <selector>   # remove one entry",
+          "  wayai unbind              # clear the whole scope (both hubs and bases)"
+        ].join("\n")
+      );
+    }
+    const described = describeScope(readScope());
+    clearScope();
+    console.log(
+      described ? `Worktree scope cleared (was ${described}).` : "No worktree scope to clear."
+    );
     return;
   }
-  clearBinding();
-  console.log(`Worktree unbound (was: ${previous}).`);
+  const scope = readScope();
+  const literal = AXIS_ORDER.filter((axis2) => scope[axis2].includes(selector.target));
+  const literalAxis = literal.includes(selector.axis) ? selector.axis : literal.length === 1 ? literal[0] : null;
+  if (literalAxis) {
+    announce(literalAxis, selector.target, removeFromScope(literalAxis, selector.target) ?? []);
+    return;
+  }
+  const { axis, id } = resolveScopeTarget(selector);
+  const remaining = removeFromScope(axis, id);
+  if (!remaining) {
+    const described = describeScope(scope);
+    throw expected(
+      [
+        `${axisNoun(axis)} ${id} is not in this worktree's scope.`,
+        described ? `This worktree is scoped to ${described}.` : "This worktree has no scope."
+      ].join("\n")
+    );
+  }
+  announce(axis, id, remaining);
+}
+function announce(axis, id, remaining) {
+  const noun = axisNoun(axis);
+  console.log(
+    remaining.length > 0 ? `Removed ${noun} ${id} from the worktree scope (${axis}: ${remaining.join(", ")}).` : `Removed ${noun} ${id} \u2014 this worktree is no longer scoped to any ${noun}.`
+  );
 }
 var init_unbind = __esm({
   "src/commands/unbind.ts"() {
     "use strict";
-    init_hub_binding();
+    init_expected();
+    init_scope_selector();
+    init_worktree_scope();
   }
 });
 
@@ -22405,8 +22825,8 @@ function installEvalSignalHandlers(input) {
   let signalCount = 0;
   let disposed = false;
   let settle;
-  const settled = new Promise((resolve7) => {
-    settle = resolve7;
+  const settled = new Promise((resolve8) => {
+    settle = resolve8;
   });
   const listeners = /* @__PURE__ */ new Map();
   const dispose = () => {
@@ -22756,7 +23176,7 @@ Timeout after ${timeoutSeconds}s${queuedSeconds > 0 ? ` (${queuedSeconds}s of it
   process.exit(1);
 }
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 function parseRunNumbers(raw) {
   if (!raw || raw.startsWith("--")) {
@@ -23028,7 +23448,7 @@ __export(eval_capture_exports, {
 });
 import * as fs24 from "fs";
 import * as path31 from "path";
-import * as yaml11 from "js-yaml";
+import * as yaml12 from "js-yaml";
 function isValidSetName(name) {
   if (name.length === 0 || name === "." || name === "..") return false;
   if (name.startsWith(".")) return false;
@@ -23134,7 +23554,7 @@ async function evalCaptureCommand(args2) {
   };
   const yamlObj = buildEvalYamlObject(evalEntry, slug);
   fs24.mkdirSync(targetDir, { recursive: true });
-  fs24.writeFileSync(targetPath, yaml11.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
+  fs24.writeFileSync(targetPath, yaml12.dump(yamlObj, YAML_DUMP_OPTIONS), "utf-8");
   const relPath = path31.relative(process.cwd(), targetPath);
   console.log(`
 Wrote ${relPath}`);
@@ -24507,7 +24927,7 @@ var init_set_connection_credential = __esm({
 // src/lib/org-workspace.ts
 import * as fs25 from "fs";
 import * as path32 from "path";
-import * as yaml12 from "js-yaml";
+import * as yaml13 from "js-yaml";
 function getOrgDir(gitRoot) {
   return resolveLayout(gitRoot).orgDir;
 }
@@ -24518,7 +24938,7 @@ function parseOrgResources(orgDir) {
   const manifestPath = path32.join(orgDir, ORG_MANIFEST_NAME);
   let manifest = {};
   if (fs25.existsSync(manifestPath)) {
-    manifest = yaml12.load(fs25.readFileSync(manifestPath, "utf-8")) ?? {};
+    manifest = yaml13.load(fs25.readFileSync(manifestPath, "utf-8")) ?? {};
   }
   const rawResources = Array.isArray(manifest.resources) ? manifest.resources : [];
   const resourcesDir = path32.join(orgDir, "resources");
@@ -24551,7 +24971,7 @@ function writeOrgResources(orgDir, payload) {
   });
   fs25.writeFileSync(
     path32.join(orgDir, ORG_MANIFEST_NAME),
-    yaml12.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
+    yaml13.dump({ version: 1, resources: manifestResources }, YAML_DUMP_OPTIONS),
     "utf-8"
   );
   const resourcesDir = path32.join(orgDir, "resources");
@@ -25373,7 +25793,7 @@ async function runSkillInstall(positional) {
   console.log("Reload your agent (e.g. restart Claude Code) to pick up the skill.");
 }
 async function runSandboxExec(positional, flagArgs) {
-  const USAGE = 'wayai admin sandbox exec [--cmd "<command>" | <command>] --hub <hub_id> --connection <connection_id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]';
+  const USAGE2 = 'wayai admin sandbox exec [--cmd "<command>" | <command>] --hub <hub_id> --connection <connection_id> [--egress open|allowlist|isolated] [--allow <host> ...] [--timeout <ms>] [--json]';
   let hubId;
   let connectionId;
   let egress;
@@ -25427,7 +25847,7 @@ async function runSandboxExec(positional, flagArgs) {
   const positionalCmd = positional[0];
   if (positional.length > 1) {
     console.error("Provide the command as a single quoted argument (or use --cmd).");
-    console.error(USAGE);
+    console.error(USAGE2);
     process.exit(1);
   }
   if (positionalCmd && cmdFlag) {
@@ -25436,7 +25856,7 @@ async function runSandboxExec(positional, flagArgs) {
   }
   const cmd = cmdFlag ?? positionalCmd;
   if (!cmd || !hubId || !connectionId) {
-    console.error(USAGE);
+    console.error(USAGE2);
     process.exit(1);
   }
   const body = {
@@ -25533,8 +25953,8 @@ function parseScopedTargetFlags(flagArgs, usage3, opts = {}) {
   return { body: { scope: "hub", hub_id: hubId, dry_run: dryRun }, targetLabel: `hub ${hubId}`, dryRun, yes, jsonOutput };
 }
 async function runRepairTeamOrphans(flagArgs) {
-  const USAGE = "wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
-  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin hubs repair-team-orphans --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE2);
   if (!dryRun && !yes && !jsonOutput) {
     console.log(`About to PURGE dangling team references in: ${targetLabel}.`);
     console.log("Memberships pointing at a deleted team are removed (HubDO + UserDO mirror); conversations pinned to one are unassigned.");
@@ -25580,8 +26000,8 @@ async function runRepairTeamOrphans(flagArgs) {
   }
 }
 async function runRepairLegacyOrgGrants(flagArgs) {
-  const USAGE = "wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]";
-  const scoped = parseScopedTargetFlags(flagArgs, USAGE, {
+  const USAGE2 = "wayai admin orgs repair-legacy-grants --all | --org <org_id> [--dry-run] [--yes] [--json]";
+  const scoped = parseScopedTargetFlags(flagArgs, USAGE2, {
     scopes: ["all", "org"],
     allLabel: "ALL organizations (platform-wide)"
   });
@@ -25633,8 +26053,8 @@ async function runRepairLegacyOrgGrants(flagArgs) {
   }
 }
 async function runHarnessMassDestroy(flagArgs) {
-  const USAGE = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
-  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin harness mass-destroy --all | --org <org_id> | --hub <hub_id> [--dry-run] [--yes] [--json]";
+  const { body, targetLabel, dryRun, yes, jsonOutput } = parseScopedTargetFlags(flagArgs, USAGE2);
   if (!dryRun && !yes && !jsonOutput) {
     console.log(`About to REAP every live harness sandbox / token / slot in: ${targetLabel}.`);
     console.log("This destroys running sandboxes and revokes their tokens. Run with --dry-run first to see the blast radius.");
@@ -25688,8 +26108,8 @@ function rejectHarnessFlags(flagArgs, usage3) {
   process.exit(1);
 }
 async function runHarnessToggle(enable, flagArgs) {
-  const USAGE = "wayai admin harness enable|disable";
-  rejectHarnessFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin harness enable|disable";
+  rejectHarnessFlags(flagArgs, USAGE2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   let value;
@@ -25710,8 +26130,8 @@ async function runHarnessToggle(enable, flagArgs) {
   }
 }
 async function runHarnessStatus(flagArgs) {
-  const USAGE = "wayai admin harness status";
-  rejectHarnessFlags(flagArgs, USAGE);
+  const USAGE2 = "wayai admin harness status";
+  rejectHarnessFlags(flagArgs, USAGE2);
   const { config, accessToken } = await requireAuth();
   const client = new ApiClient({ apiUrl: config.api_url, accessToken });
   let value = 0;
@@ -26612,26 +27032,26 @@ async function reportGetCommand(args2) {
       console.log(JSON.stringify(result, null, 2));
       return;
     }
-    const { report, messages } = result;
-    const title = sanitizeTerminalText(report.title);
-    const description = sanitizeTerminalText(report.description);
-    console.log(`Report ${report.report_id}`);
+    const { report: report2, messages } = result;
+    const title = sanitizeTerminalText(report2.title);
+    const description = sanitizeTerminalText(report2.description);
+    console.log(`Report ${report2.report_id}`);
     console.log(`  title:          ${title}`);
     console.log(`  description:    ${description.replace(/\n/g, "\n                  ")}`);
-    console.log(`  status:         ${report.status}`);
-    console.log(`  classification: ${report.classification}`);
-    if (report.contest_count > 0) console.log(`  contests:       ${report.contest_count}`);
-    if (report.dismissal_final) console.log("  dismissal:      final (non-contestable)");
+    console.log(`  status:         ${report2.status}`);
+    console.log(`  classification: ${report2.classification}`);
+    if (report2.contest_count > 0) console.log(`  contests:       ${report2.contest_count}`);
+    if (report2.dismissal_final) console.log("  dismissal:      final (non-contestable)");
     if (messages.length > 0) {
       console.log("\n  Thread:");
       for (const m of messages) {
         console.log(`    [${m.author_role}] ${sanitizeTerminalText(m.body)}`);
       }
     }
-    if (report.status === "shipped") {
+    if (report2.status === "shipped") {
       console.log(`
-  This fix is shipped. Run \`wayai report accept ${report.report_id}\` if it works,`);
-      console.log(`  or \`wayai report contest ${report.report_id} --reason "..."\` if it does not.`);
+  This fix is shipped. Run \`wayai report accept ${report2.report_id}\` if it works,`);
+      console.log(`  or \`wayai report contest ${report2.report_id} --reason "..."\` if it does not.`);
     }
   } catch (err) {
     reportActionError(err);
@@ -26911,7 +27331,7 @@ var init_actions = __esm({
 
 // src/data/commands/attachments.ts
 import { Command as Command2 } from "commander";
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 function findAttachmentByFilename(attachments, filename) {
   return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
 }
@@ -26952,7 +27372,7 @@ function buildAttachmentsCommand() {
       printOutput(data, outputFormat(this));
       return;
     }
-    const body = readFileSync21(opts.file);
+    const body = readFileSync20(opts.file);
     await client.upload(uploadPathFrom(data?.upload_url), body, opts.contentType);
     printOutput({ ...data, uploaded: true }, outputFormat(this));
   });
@@ -27432,16 +27852,16 @@ var init_providers = __esm({
 
 // src/data/commands/report.ts
 import { Command as Command6 } from "commander";
-import { readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname11, join as join32 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname12, join as join31 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveCliVersion() {
   for (const candidate of [
-    join32(here, "..", "package.json"),
-    join32(here, "..", "..", "..", "package.json")
+    join31(here, "..", "package.json"),
+    join31(here, "..", "..", "..", "package.json")
   ]) {
     try {
-      const version = JSON.parse(readFileSync22(candidate, "utf-8")).version;
+      const version = JSON.parse(readFileSync21(candidate, "utf-8")).version;
       if (typeof version === "string" && version) return version;
     } catch {
     }
@@ -27475,10 +27895,10 @@ function reportActionError2(err) {
   throw err;
 }
 function buildBasesReportCommand() {
-  const report = new Command6("report").description(
+  const report2 = new Command6("report").description(
     "File a report to the Data triage queue and verify the outcome"
   );
-  report.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
+  report2.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
     "--dedup-key <key>",
     'Stable dedup key (e.g. "<file>::<test>"); collapses repeat occurrences'
   ).option("--severity <level>", "low | medium | high | critical").option("--steps <text>", "Steps to reproduce").option("--error-message <text>", "Exact error text if any").option("--context <text>", "Additional context (logs, request ids)").option("--locale <code>", "Notification locale (en | pt | es)", "en").option("--reporter-email <addr>", "Override reporter email (defaults to session email)").option("--base-id <id>", "Base the error relates to (defaults to the configured base)").option("--record-type <name>", "Record type the error relates to").option("--record-id <id>", "Record id (UUID) the error relates to").option("--external-id <id>", "External id of the related record").option("--external-source <src>", "External source of the related record").option("--relationship-id <id>", "Relationship id the error relates to").action(async function(opts) {
@@ -27529,7 +27949,7 @@ function buildBasesReportCommand() {
       );
     }
   });
-  report.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
+  report2.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
     const client = await createDataClient();
     const qs = opts.status ? `?status=${encodeURIComponent(opts.status)}` : "";
     try {
@@ -27552,7 +27972,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
+  report2.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
     const client = await createDataClient();
     try {
       const data = await client.request("GET", `/v1/reports/${pathSegment(reportId, "report id")}`);
@@ -27589,7 +28009,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
+  report2.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
     const client = await createDataClient();
     try {
       const data = await client.request(
@@ -27605,7 +28025,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
+  report2.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
     const client = await createDataClient();
     try {
       const data = await client.request(
@@ -27624,7 +28044,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  return report;
+  return report2;
 }
 var here;
 var init_report2 = __esm({
@@ -27637,13 +28057,13 @@ var init_report2 = __esm({
     init_terminal_output();
     init_workspace();
     init_skill_version();
-    here = dirname11(fileURLToPath2(import.meta.url));
+    here = dirname12(fileURLToPath2(import.meta.url));
   }
 });
 
 // src/data/commands/credentials.ts
 import { Command as Command7 } from "commander";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 function withValueSourceOptions(cmd, what) {
   return cmd.option(
     "--file <path>",
@@ -27656,7 +28076,7 @@ async function resolveValue(opts, label) {
       throw expected("--file cannot be combined with --value-stdin or --value-prompt \u2014 pass one.");
     }
     try {
-      return readFileSync23(opts.file).toString("base64");
+      return readFileSync22(opts.file).toString("base64");
     } catch (e) {
       throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -27805,7 +28225,7 @@ var init_credentials = __esm({
 
 // src/data/commands/sql.ts
 import { Command as Command8 } from "commander";
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 function buildBasesSqlCommand() {
   return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
     "--param <kv...>",
@@ -27815,7 +28235,7 @@ function buildBasesSqlCommand() {
     let query;
     if (opts.file) {
       try {
-        query = readFileSync24(opts.file, "utf-8").trim();
+        query = readFileSync23(opts.file, "utf-8").trim();
       } catch (e) {
         throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
       }
@@ -27950,16 +28370,16 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
   ).option("--force", "Revoke even if the token appears to be in live use").action(async function(tokenId, opts) {
     const client = await createDataClient();
     const id = pathSegment(tokenId, "token id");
-    const path36 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
+    const path35 = (force) => `/v1/tokens/${id}${force ? "?force=true" : ""}`;
     const format = outputFormat(this);
     const revoked = (forced) => printOutput({ token_id: tokenId, revoked: true, forced }, format);
     if (opts.force) {
-      await client.request("DELETE", path36(true));
+      await client.request("DELETE", path35(true));
       revoked(true);
       return;
     }
     try {
-      await client.request("DELETE", path36(false));
+      await client.request("DELETE", path35(false));
       revoked(false);
     } catch (err) {
       if (!(err instanceof ApiError) || err.status !== 409 || dataErrorDetails(err)?.requires_force !== true) {
@@ -27974,7 +28394,7 @@ MCP URL: ${toolsetMcpUrl(slug)}`);
         console.error("Aborted.");
         return process.exit(1);
       }
-      await client.request("DELETE", path36(true));
+      await client.request("DELETE", path35(true));
       revoked(true);
     }
   });
@@ -28122,10 +28542,9 @@ var init_base_tags = __esm({
 
 // src/data/commands/bases.ts
 import { Command as Command10 } from "commander";
-import * as path35 from "path";
-function pageOf(path36, cursor) {
-  if (!cursor) return path36;
-  return `${path36}${path36.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
+function pageOf(path35, cursor) {
+  if (!cursor) return path35;
+  return `${path35}${path35.includes("?") ? "&" : "?"}cursor=${encodeURIComponent(cursor)}`;
 }
 function parseEnum(flag, value, allowed) {
   if (value === void 0) return void 0;
@@ -28282,9 +28701,9 @@ function buildBasesCommand() {
   });
   bases.command("list-previews <origin-id>").description("List preview bases cloned from a base (production or preview)").action(async function(originId) {
     const client = await createDataClient();
-    const path36 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
+    const path35 = `/v1/${pathSegment(originId, "origin base id")}/previews`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path36, cursor)),
+      await client.collectPages((cursor) => pageOf(path35, cursor)),
       outputFormat(this)
     );
   });
@@ -28331,45 +28750,52 @@ function buildBasesCommand() {
   });
   bases.command("promotions <production-id>").description("List promotion history for a production base").action(async function(productionId) {
     const client = await createDataClient();
-    const path36 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
+    const path35 = `/v1/${pathSegment(productionId, "production base id")}/promotions`;
     printOutput(
-      await client.collectPages((cursor) => pageOf(path36, cursor)),
+      await client.collectPages((cursor) => pageOf(path35, cursor)),
       outputFormat(this)
     );
   });
   bases.command("use <base>").description(
-    "Bind this worktree to a base so push/pull refuse to run against a different one"
+    "Deprecated alias of `wayai use bases/<id>` \u2014 scope this worktree to a base"
   ).action(async function(selector) {
-    const baseId = resolveSelectorToBaseId(selector);
-    const previous = readBaseBinding();
-    if (previous !== baseId) {
+    const baseId = resolveBaseSelectorToId(findGitRoot(), selector);
+    const previous = readScope().bases;
+    const changed = previous.length !== 1 || previous[0] !== baseId;
+    if (changed) {
       try {
-        writeBaseBinding(baseId);
+        setScopeAxis("bases", [baseId]);
       } catch (err) {
         throw expected(err instanceof Error ? err.message : String(err));
       }
     }
     if (outputFormat(this) === "json") {
-      printOutput({ base_id: baseId, previous_base_id: previous, changed: previous !== baseId }, "json");
+      printOutput(
+        { base_id: baseId, previous_base_id: previous[0] ?? null, changed },
+        "json"
+      );
       return;
     }
-    if (previous === baseId) {
+    if (!changed) {
       console.log(`Worktree already bound to base ${baseId}.`);
     } else {
       console.log(
-        previous ? `Worktree rebound: ${previous} -> ${baseId}.` : `Worktree bound to base ${baseId}.`
+        previous.length > 0 ? `Worktree rebound: ${previous.join(", ")} -> ${baseId}.` : `Worktree bound to base ${baseId}.`
       );
     }
   });
-  bases.command("unbind").description("Clear the base binding for this worktree").action(async function() {
-    const previous = readBaseBinding();
-    if (previous) clearBaseBinding();
+  bases.command("unbind").description("Deprecated alias of `wayai unbind bases/<id>` \u2014 clear the base scope").action(async function() {
+    const previous = readScope().bases;
+    if (previous.length > 0) setScopeAxis("bases", []);
     if (outputFormat(this) === "json") {
-      printOutput({ previous_base_id: previous, cleared: previous !== null }, "json");
+      printOutput(
+        { previous_base_id: previous[0] ?? null, cleared: previous.length > 0 },
+        "json"
+      );
       return;
     }
     console.log(
-      previous ? `Worktree unbound from base (was: ${previous}).` : "No base binding to clear."
+      previous.length > 0 ? `Worktree unbound from base (was: ${previous.join(", ")}).` : "No base binding to clear."
     );
   });
   bases.addCommand(buildBasesTokensCommand());
@@ -28381,13 +28807,6 @@ function buildBasesCommand() {
   bases.addCommand(buildBasesReportCommand());
   return bases;
 }
-function resolveSelectorToBaseId(selector) {
-  const gitRoot = findGitRoot();
-  if (!gitRoot || selector.includes("/") || selector.includes(path35.sep)) return selector;
-  if (!isPathSafeId(selector)) return selector;
-  const id = readBaseMeta(path35.join(resolveBasesDir(gitRoot), selector))?.base_id;
-  return typeof id === "string" && isPathSafeId(id) ? id : selector;
-}
 var init_bases = __esm({
   "src/data/commands/bases.ts"() {
     "use strict";
@@ -28405,10 +28824,8 @@ var init_bases = __esm({
     init_utils();
     init_terminal_output();
     init_workspace();
-    init_layout();
     init_base_workspace();
-    init_base_binding();
-    init_base_id();
+    init_worktree_scope();
     init_expected();
   }
 });
@@ -28473,7 +28890,7 @@ var init_file_types = __esm({
 
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "fs";
 import { basename as basename18 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
@@ -28522,7 +28939,7 @@ function buildFilesCommand() {
     "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
   ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
     const base = pathSegment(requireBase(this), "--base");
-    const body = readFileSync25(opts.file);
+    const body = readFileSync24(opts.file);
     const client = await createDataClient();
     printOutput(
       await client.upload(
@@ -28882,8 +29299,8 @@ function buildRecordsCommand() {
     const body = { data: parseData(opts.data) };
     if (opts.externalId) body.external_id = opts.externalId;
     if (opts.externalSource) body.external_source = opts.externalSource;
-    const path36 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
-    printOutput(await client.request("PUT", path36, body), outputFormat(this));
+    const path35 = opts.id ? `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${pathSegment(opts.id, "--id")}` : `/v1/${base}/records/${pathSegment(recordType2, "record_type")}`;
+    printOutput(await client.request("PUT", path35, body), outputFormat(this));
   });
   records.command("query <record_type>").description("List/search records: exact filters + fuzzy `search`, sorting, pagination").option(
     "--external-source <source>",
@@ -28918,9 +29335,9 @@ function buildRecordsCommand() {
   ).action(async function(recordType2, id, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path36 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
-    if (opts.externalSource) path36 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
-    printOutput(await client.request("GET", path36), outputFormat(this));
+    let path35 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    if (opts.externalSource) path35 += `?external_source=${encodeURIComponent(opts.externalSource)}`;
+    printOutput(await client.request("GET", path35), outputFormat(this));
   });
   records.command("delete <record_type> <id>").description(
     "Delete a record by internal ID, or by external_id (pass --external-source to scope it)"
@@ -28934,11 +29351,11 @@ function buildRecordsCommand() {
     }
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    let path36 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
+    let path35 = `/v1/${base}/records/${pathSegment(recordType2, "record_type")}/${recordKey(id, opts.externalSource)}`;
     if (opts.externalSource) {
-      path36 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
+      path35 += `?external_source=${encodeURIComponent(opts.externalSource)}&external_id=${encodeURIComponent(id)}`;
     }
-    await client.request("DELETE", path36);
+    await client.request("DELETE", path35);
     console.log("Deleted");
   });
   records.command("history <id>").description(
@@ -29103,8 +29520,8 @@ function buildRelationshipsCommand() {
     if (opts.data) body.data = parseData(opts.data);
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path36 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
-    printOutput(await client.request("PUT", path36, body), outputFormat(this));
+    const path35 = opts.id ? `/v1/${base}/relationships/${pathSegment(opts.id, "--id")}` : `/v1/${base}/relationships`;
+    printOutput(await client.request("PUT", path35, body), outputFormat(this));
   });
   relationships.command("get <id>").description(
     "Get a relationship by ID (or by its external key: pass the external_id with --rel-type)"
@@ -29337,8 +29754,8 @@ function buildToolsetsCommand() {
   toolsets.command("get <slug>").description("Get a toolset").option("--resolved", "Include resolved record_type schemas").action(async function(slug, opts) {
     const base = pathSegment(requireBase(this), "--base");
     const client = await createDataClient();
-    const path36 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
-    printOutput(await client.request("GET", path36), outputFormat(this));
+    const path35 = opts.resolved ? `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}/resolved` : `/v1/${base}/toolsets/${pathSegment(slug, "toolset slug")}`;
+    printOutput(await client.request("GET", path35), outputFormat(this));
   });
   toolsets.command("list").description("List all toolsets").action(async function() {
     const base = pathSegment(requireBase(this), "--base");
@@ -29483,7 +29900,7 @@ __export(program_exports, {
 });
 import { Command as Command22 } from "commander";
 function withDataGlobals(command2) {
-  return command2.option("--org <uuid>", "Organization to operate against (overrides .wayai.yaml)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
+  return command2.option("--org <uuid>", "Organization to operate against (overrides the repo's org binding)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
 }
 function routeErrorsToCli(command2) {
   command2.exitOverride().configureOutput({ outputError: () => {
@@ -29571,9 +29988,9 @@ init_errors2();
 init_mask_secrets();
 init_utils();
 init_registry();
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync25 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname12, join as join34 } from "path";
+import { dirname as dirname13, join as join32 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -29581,7 +29998,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -29592,7 +30009,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -29618,8 +30035,8 @@ async function refreshSkillCache() {
 }
 async function refreshAdminSkillCache() {
   let timer;
-  const deadline = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, REFRESH_TIMEOUT_MS);
+  const deadline = new Promise((resolve8) => {
+    timer = setTimeout(resolve8, REFRESH_TIMEOUT_MS);
   });
   await Promise.race([deadline, fetchAndCacheAdminSkillVersion().catch(() => {
   })]);
@@ -29728,8 +30145,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname12(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join34(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname13(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync25(join32(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -29964,7 +30381,7 @@ Commands:
   logout             Clear stored credentials
   status             Show current auth and config status
   whoami             Show the authenticated identity (supports --json)
-  init               Set up .wayai.yaml (pick organization)
+  init               Scope this repo to an organization (pick one)
   create-credential  Create an organization credential (API key, token, etc.)
   update-credential  Update / rotate an organization credential (by name)
   set-connection-credential  Set a connection's credential directly (org link or --field/--stdin), preview or production
@@ -29978,9 +30395,9 @@ Commands:
   sync               Alias of \`publish\` (not to be confused with sync-skills / sync-mcp)
   org create         Create a new organization (you become its owner)
   org <pull|push|diff>  Sync org-scoped resources as code (wayai-ws/org/)
-  use <hub>          Bind this worktree to a specific hub (UUID or folder name)
+  use [--add] <sel>  Scope this worktree to a hub or base (UUID, folder name, hubs/<n>, bases/<n>; --add widens)
   migrate            Move a legacy repo to the wayai-ws/{hubs,org} layout
-  unbind             Clear the worktree hub binding
+  unbind [<sel>]     Drop one entry from the worktree scope, or clear the whole scope
   send-message       Send a test message to a hub (preview or production; -f <path> to attach a file)
   conversations      List or inspect conversations
   alerts             Show a hub's active connection/credential alerts (run this FIRST when a hub misbehaves)
@@ -30002,8 +30419,8 @@ Commands:
 Data \u2014 one namespace per entity. Run \`wayai <namespace> --help\` for its tree.
 ${await dataHelpBlock()}
   bases promote      Promote a preview base to production (distinct from \`publish\`, which promotes a hub)
-  bases use <base>   Bind this worktree to a base (\`wayai use\` binds a hub)
-  bases unbind       Clear this worktree's base binding
+  bases use <base>   Deprecated alias of \`wayai use bases/<id>\`
+  bases unbind       Deprecated alias of \`wayai unbind bases/<id>\` (clears the base axis)
 
 Flags:
   --yes, -y              Skip confirmation prompts (useful for CI and scripting)
@@ -30047,7 +30464,7 @@ Flags:
   --version, -v          Show CLI version
 
 Org-scoped mode:
-  Each repository is scoped to a single organization via .wayai.yaml
+  Each repository is scoped to a single organization via wayai-ws/wayai.yaml
   (only \`organization_id\` is required). Hubs self-identify via \`hub.yaml\`
   inside their folder under \`workspace/\`.
 
@@ -30055,12 +30472,15 @@ Org-scoped mode:
   pull/push operate on the single hub in the workspace, or pass
   \`--hub <uuid|name>\` to disambiguate when multiple hubs exist.
 
-Worktree hub binding:
-  Each git checkout (main or linked worktree) can be bound to a single hub.
-  push/pull refuse to run against a different hub once bound. The binding is
-  auto-set on first successful pull (or new-hub creation) into an unbound
-  checkout. Use \`wayai use <hub>\` to bind manually and \`wayai unbind\` to clear.
-  The binding lives at \`<git-dir>/wayai-binding\` and is naturally per-checkout.
+Worktree scope:
+  Each git checkout (main or linked worktree) carries a scope: a set of hubs and
+  a set of bases, at \`<git-dir>/wayai-scope\` \u2014 per-checkout, never tracked.
+  push/pull/publish refuse to run against anything outside a non-empty set. Each
+  axis is seeded by the first successful pull/push/create into a checkout that
+  has none, and only widens on purpose: \`wayai use --add <sel>\` adds one,
+  \`wayai use <sel>\` replaces that axis, \`wayai unbind <sel>\` drops one entry and
+  bare \`wayai unbind\` clears everything. It is a routing tripwire, not a lock
+  and not authorization.
 
 Examples:
   wayai login