@wayai/cli 0.3.151 → 0.3.152

package/dist/index.js

@@ -8942,7 +8942,7 @@ var init_api_client = __esm({
     init_sentry();
     init_mask_secrets();
     RETRYABLE_BACKOFF_MS = [500, 1e3, 2e3];
-    delay = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+    delay = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
     ApiError = class extends Error {
       status;
       body;
@@ -9607,7 +9607,7 @@ var init_api_client = __esm({
        * `dataErrorMessage` recovers the envelope's own message for display.
        *
        * `orgId` is the caller's org SELECTOR (the `--org` flag, else the repo's
-       * `.wayai.yaml`), not an authorization claim: the backend validates it against
+       * `wayai-ws/wayai.yaml`), not an authorization claim: the backend validates it against
        * the caller's grants and attests only the validated result. A multi-org user
        * needs it to pick; a single-org user can omit it.
        *
@@ -14516,34 +14516,15 @@ function resolveLayout(gitRoot, layout = WAYAI_LAYOUT) {
   const newWs = path.join(gitRoot, layout.wsDir);
   const legacyWs = path.join(gitRoot, layout.legacy.wsDir);
   const legacyOrg = path.join(gitRoot, layout.legacy.orgAtRoot);
-  const newExists = isDirectory(newWs);
   const legacyExists = isDirectory(legacyWs) || isDirectory(legacyOrg);
   const basesDir = path.join(newWs, layout.basesSubdir);
-  if (newExists) {
-    return {
-      hubsDir: path.join(newWs, layout.hubsSubdir),
-      orgDir: path.join(newWs, layout.orgSubdir),
-      basesDir,
-      isLegacy: false,
-      legacyAlsoPresent: legacyExists
-    };
-  }
-  if (legacyExists) {
-    return {
-      hubsDir: legacyWs,
-      orgDir: legacyOrg,
-      basesDir,
-      isLegacy: true,
-      legacyAlsoPresent: false
-    };
+  const hubsDir = path.join(newWs, layout.hubsSubdir);
+  const orgDir = path.join(newWs, layout.orgSubdir);
+  const newDisplacesLegacy = () => isDirectory(hubsDir) || isDirectory(orgDir) || isDirectory(basesDir);
+  if (legacyExists && !newDisplacesLegacy()) {
+    return { hubsDir: legacyWs, orgDir: legacyOrg, basesDir, isLegacy: true, legacyAlsoPresent: false };
   }
-  return {
-    hubsDir: path.join(newWs, layout.hubsSubdir),
-    orgDir: path.join(newWs, layout.orgSubdir),
-    basesDir,
-    isLegacy: false,
-    legacyAlsoPresent: false
-  };
+  return { hubsDir, orgDir, basesDir, isLegacy: false, legacyAlsoPresent: legacyExists };
 }
 function resolveBasesDir(gitRoot) {
   return resolveLayout(gitRoot).basesDir;
@@ -14960,111 +14941,344 @@ var init_workspace = __esm({
   }
 });
 
+// src/lib/workspace-manifest.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+import * as yaml2 from "js-yaml";
+function workspaceManifestPath(gitRoot) {
+  return path3.join(gitRoot, WAYAI_LAYOUT.wsDir, WORKSPACE_MANIFEST_FILE);
+}
+function rootConfigPath(gitRoot) {
+  return path3.join(gitRoot, ROOT_CONFIG_FILE);
+}
+function loadYamlMapping(file) {
+  let raw;
+  try {
+    raw = fs3.readFileSync(file, "utf-8");
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "absent" };
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  let doc;
+  try {
+    doc = yaml2.load(raw);
+  } catch (err) {
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  if (doc === void 0 || doc === null) return { kind: "ok", doc: {} };
+  if (typeof doc !== "object" || Array.isArray(doc)) {
+    return { kind: "malformed", reason: "expected a YAML mapping of settings" };
+  }
+  return { kind: "ok", doc };
+}
+function loadWorkspaceManifest(gitRoot) {
+  return loadYamlMapping(workspaceManifestPath(gitRoot));
+}
+var WORKSPACE_MANIFEST_FILE, WORKSPACE_MANIFEST_LABEL, ROOT_CONFIG_FILE;
+var init_workspace_manifest = __esm({
+  "src/lib/workspace-manifest.ts"() {
+    "use strict";
+    init_layout();
+    WORKSPACE_MANIFEST_FILE = "wayai.yaml";
+    WORKSPACE_MANIFEST_LABEL = `${WAYAI_LAYOUT.wsDir}/${WORKSPACE_MANIFEST_FILE}`;
+    ROOT_CONFIG_FILE = ".wayai.yaml";
+  }
+});
+
 // src/lib/repo-config.ts
 var repo_config_exports = {};
 __export(repo_config_exports, {
+  _resetRepoConfigNotices: () => _resetRepoConfigNotices,
+  planOrgMigration: () => planOrgMigration,
   readRepoConfig: () => readRepoConfig,
+  readRepoConfigUnlessBlocked: () => readRepoConfigUnlessBlocked,
+  readRepoScopeBlocker: () => readRepoScopeBlocker,
   requireRepoConfig: () => requireRepoConfig,
+  resolveRepoConfig: () => resolveRepoConfig,
   writeRepoConfig: () => writeRepoConfig
 });
-import * as fs3 from "fs";
-import * as path3 from "path";
-import * as yaml2 from "js-yaml";
-function warnAboutLegacyFields(found) {
-  if (legacyFieldsWarned || found.length === 0) return;
-  legacyFieldsWarned = true;
-  console.warn(
-    `Note: .wayai.yaml contains deprecated field(s) ${found.join(", ")}. These are ignored \u2014 only organization_id is used now. You can remove them.`
-  );
+import * as fs4 from "fs";
+import * as path4 from "path";
+import * as yaml3 from "js-yaml";
+function noticeOnce(key, emit) {
+  if (noticed.has(key)) return;
+  noticed.add(key);
+  emit();
+}
+function _resetRepoConfigNotices() {
+  noticed.clear();
+}
+function readOrgFields(doc) {
+  const raw = doc.organization_id;
+  if (raw === void 0 || raw === null) {
+    if (typeof doc.organization === "string") {
+      return {
+        kind: "invalid",
+        detail: "it uses the old format (organization: <name>) \u2014 replace it with organization_id: <uuid>"
+      };
+    }
+    return { kind: "none" };
+  }
+  if (typeof raw !== "string" || !UUID_RE2.test(raw.trim())) {
+    return { kind: "invalid", detail: "organization_id must be a UUID" };
+  }
+  const name = typeof doc.organization_name === "string" && doc.organization_name.trim() ? doc.organization_name.trim() : void 0;
+  const config = { organization_id: raw.trim() };
+  if (name) config.organization_name = name;
+  return { kind: "declared", config };
+}
+function declarationFrom(load11) {
+  if (load11.kind === "absent") return { kind: "none" };
+  if (load11.kind === "malformed") return { kind: "invalid", detail: `it does not parse (${load11.reason})` };
+  return readOrgFields(load11.doc);
+}
+function legacyFieldsIn(load11) {
+  if (load11.kind !== "ok") return [];
+  return LEGACY_FIELDS.filter((f) => load11.doc[f] !== void 0);
+}
+function resolve2(gitRoot) {
+  const manifestFile = workspaceManifestPath(gitRoot);
+  const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
+  if (manifest.kind === "invalid") {
+    return { kind: "invalid", source: "manifest", file: manifestFile, detail: manifest.detail };
+  }
+  const rootFile = rootConfigPath(gitRoot);
+  const rootLoad = loadYamlMapping(rootFile);
+  const root = declarationFrom(rootLoad);
+  if (manifest.kind === "declared") {
+    if (root.kind === "declared" && root.config.organization_id !== manifest.config.organization_id) {
+      return {
+        kind: "conflict",
+        manifestOrg: manifest.config.organization_id,
+        rootOrg: root.config.organization_id
+      };
+    }
+    return {
+      kind: "ok",
+      resolved: { config: manifest.config, source: "manifest", path: manifestFile },
+      legacyRootFields: []
+    };
+  }
+  if (root.kind === "declared") {
+    return {
+      kind: "ok",
+      resolved: { config: root.config, source: "root", path: rootFile },
+      legacyRootFields: legacyFieldsIn(rootLoad)
+    };
+  }
+  if (root.kind === "invalid") {
+    return { kind: "invalid", source: "root", file: rootFile, detail: root.detail };
+  }
+  return { kind: "none" };
+}
+function conflictMessage(manifestOrg, rootOrg, remedy = RECONCILE_REMEDY) {
+  return [
+    "Refusing to guess the organization: two files in this repo name different ones.",
+    `  ${WORKSPACE_MANIFEST_LABEL} -> ${manifestOrg}   (the workspace manifest)`,
+    `  ${ROOT_CONFIG_FILE} -> ${rootOrg}   (deprecated fallback)`,
+    "",
+    ...remedy
+  ].join("\n");
+}
+function rebindRefusal(requestedOrg, rootOrg) {
+  return [
+    `Refusing to re-bind the organization: ${ROOT_CONFIG_FILE} still names a different one, and it is read as a fallback.`,
+    `  requested        -> ${requestedOrg}`,
+    `  ${ROOT_CONFIG_FILE}      -> ${rootOrg}   (deprecated fallback)`,
+    "",
+    `Delete ${ROOT_CONFIG_FILE} (or set its organization_id to ${requestedOrg}), then re-run.`,
+    "Nothing was written \u2014 this repo still resolves to the organization it had."
+  ].join("\n");
+}
+function invalidMessage(file, detail) {
+  return [
+    `Invalid organization binding in ${file}: ${detail}.`,
+    "",
+    "  organization_id: <your-org-uuid>",
+    "",
+    "Run `wayai init` to set up the workspace."
+  ].join("\n");
+}
+function missingMessage() {
+  return [
+    "This repository is not scoped to an organization.",
+    `Declare it in ${WORKSPACE_MANIFEST_LABEL}:`,
+    "",
+    "  organization_id: <your-org-uuid>",
+    "",
+    "Run `wayai init` to set up the workspace."
+  ].join("\n");
+}
+function report(r, posture) {
+  switch (r.kind) {
+    case "ok":
+      if (r.resolved.source !== "root") return;
+      noticeOnce(
+        "root-fallback",
+        () => console.warn(
+          `Note: this repo's organization binding is still in ${ROOT_CONFIG_FILE} at the repository root. It belongs in the workspace manifest ${WORKSPACE_MANIFEST_LABEL} \u2014 run \`wayai migrate\` to copy it there.`
+        )
+      );
+      if (r.legacyRootFields.length > 0) {
+        noticeOnce(
+          "legacy-fields",
+          () => console.warn(
+            `Note: ${ROOT_CONFIG_FILE} contains deprecated field(s) ${r.legacyRootFields.join(", ")}. These are ignored \u2014 only organization_id is used now. You can remove them.`
+          )
+        );
+      }
+      return;
+    case "invalid": {
+      const emit = () => console.error(invalidMessage(r.file, r.detail));
+      if (posture === "hard") emit();
+      else noticeOnce(`invalid:${r.source}`, emit);
+      return;
+    }
+    case "conflict":
+      console.error(conflictMessage(r.manifestOrg, r.rootOrg));
+      return;
+    case "none":
+      if (posture === "hard") console.error(missingMessage());
+      return;
+  }
+}
+function resolveRepoConfig(root) {
+  const gitRoot = root ?? findGitRoot();
+  if (!gitRoot) return null;
+  const r = resolve2(gitRoot);
+  report(r, "soft");
+  return r.kind === "ok" ? r.resolved : null;
 }
 function readRepoConfig(root) {
+  return resolveRepoConfig(root)?.config ?? null;
+}
+function readRepoConfigUnlessBlocked(root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) return null;
-  const configPath3 = path3.join(gitRoot, ".wayai.yaml");
-  if (!fs3.existsSync(configPath3)) return null;
-  try {
-    const content = fs3.readFileSync(configPath3, "utf-8");
-    const config = yaml2.load(content);
-    if (!config?.organization_id || typeof config.organization_id !== "string") {
-      if (config?.organization && typeof config.organization === "string") {
-        console.error(
-          ".wayai.yaml uses the old format (organization: name). Replace it with organization_id: <uuid>."
-        );
-      }
+  const r = resolve2(gitRoot);
+  switch (r.kind) {
+    case "ok":
+      report(r, "soft");
+      return r.resolved.config;
+    case "none":
       return null;
-    }
-    if (!UUID_RE2.test(config.organization_id)) return null;
-    const presentLegacy = LEGACY_FIELDS.filter((f) => config[f] !== void 0);
-    warnAboutLegacyFields(presentLegacy);
-    const organizationName = typeof config.organization_name === "string" && config.organization_name.trim() ? config.organization_name.trim() : void 0;
+    case "conflict":
+      throw expected(conflictMessage(r.manifestOrg, r.rootOrg));
+    case "invalid":
+      throw expected(invalidMessage(r.file, r.detail));
+  }
+}
+function requireRepoConfig(root) {
+  const gitRoot = root ?? findGitRoot();
+  const r = gitRoot ? resolve2(gitRoot) : { kind: "none" };
+  report(r, "hard");
+  if (r.kind === "ok") return r.resolved.config;
+  return process.exit(1);
+}
+function readRepoScopeBlocker(root) {
+  const gitRoot = root ?? findGitRoot();
+  if (!gitRoot) return null;
+  const r = resolve2(gitRoot);
+  if (r.kind === "conflict") {
     return {
-      organization_id: config.organization_id,
-      organization_name: organizationName
+      kind: "conflict",
+      manifest_organization_id: r.manifestOrg,
+      root_organization_id: r.rootOrg
     };
-  } catch {
-    return null;
   }
+  if (r.kind === "invalid") return { kind: "invalid", path: r.file, detail: r.detail };
+  return null;
 }
-function requireRepoConfig(root) {
-  const config = readRepoConfig(root);
-  if (!config) {
-    console.error("Missing or invalid .wayai.yaml at the repository root.");
-    console.error("The file must contain organization_id:");
-    console.error("");
-    console.error("  organization_id: <your-org-uuid>");
-    console.error("");
-    console.error("Run `wayai init` to set up the workspace.");
-    process.exit(1);
+function planOrgMigration(gitRoot) {
+  const manifest = declarationFrom(loadWorkspaceManifest(gitRoot));
+  const root = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
+  if (root.kind !== "declared") return { kind: "nothing" };
+  if (manifest.kind === "declared") {
+    if (manifest.config.organization_id === root.config.organization_id) return { kind: "nothing" };
+    return {
+      kind: "refuse",
+      message: conflictMessage(manifest.config.organization_id, root.config.organization_id, [
+        "Reconcile them by hand \u2014 migrate cannot know which one you meant."
+      ])
+    };
+  }
+  if (manifest.kind === "invalid") {
+    return {
+      kind: "refuse",
+      message: `Cannot copy the organization binding: ${WORKSPACE_MANIFEST_LABEL} is unusable \u2014 ${manifest.detail}. Fix or delete it, then re-run \`wayai migrate\`.`
+    };
   }
-  return config;
+  return { kind: "copy", config: root.config };
 }
 function writeRepoConfig(config, root) {
   const gitRoot = root ?? findGitRoot();
   if (!gitRoot) {
     throw new Error("Not inside a git repository. Run `git init` first.");
   }
-  const configPath3 = path3.join(gitRoot, ".wayai.yaml");
+  const stale = declarationFrom(loadYamlMapping(rootConfigPath(gitRoot)));
+  if (stale.kind === "declared" && stale.config.organization_id !== config.organization_id) {
+    throw expected(rebindRefusal(config.organization_id, stale.config.organization_id));
+  }
+  const load11 = loadWorkspaceManifest(gitRoot);
+  if (load11.kind === "malformed") {
+    throw expected(
+      `Cannot write the organization binding: ${WORKSPACE_MANIFEST_LABEL} does not parse (${load11.reason}). Fix or delete it, then re-run.`
+    );
+  }
+  const { organization_id: _id, organization_name: _name, ...rest } = load11.kind === "ok" ? load11.doc : {};
   const doc = { organization_id: config.organization_id };
   if (config.organization_name?.trim()) doc.organization_name = config.organization_name.trim();
-  const content = yaml2.dump(doc, { quotingType: '"', forceQuotes: false });
-  fs3.writeFileSync(configPath3, content, "utf-8");
-  return configPath3;
+  Object.assign(doc, rest);
+  const file = workspaceManifestPath(gitRoot);
+  fs4.mkdirSync(path4.dirname(file), { recursive: true });
+  fs4.writeFileSync(
+    file,
+    yaml3.dump(doc, { lineWidth: -1, quotingType: '"', forceQuotes: false }),
+    "utf-8"
+  );
+  return file;
 }
-var LEGACY_FIELDS, legacyFieldsWarned;
+var LEGACY_FIELDS, noticed, RECONCILE_REMEDY;
 var init_repo_config = __esm({
   "src/lib/repo-config.ts"() {
     "use strict";
+    init_expected();
     init_workspace();
     init_utils();
+    init_workspace_manifest();
     LEGACY_FIELDS = ["project_id", "project_name", "hub_id", "hub_name"];
-    legacyFieldsWarned = false;
+    noticed = /* @__PURE__ */ new Set();
+    RECONCILE_REMEDY = [
+      "Keep the organization_id you actually work in and delete the other declaration.",
+      `\`wayai init\` rewrites ${WORKSPACE_MANIFEST_LABEL}; the root file is yours to remove.`
+    ];
   }
 });
 
 // src/lib/utils.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
+import * as fs5 from "fs";
+import * as path5 from "path";
 import * as readline from "readline";
 function prompt(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(question, (answer) => {
       rl.close();
-      resolve7(answer.trim());
+      resolve8(answer.trim());
     });
   });
 }
 function confirm(question) {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(`${question} [y/N]: `, (answer) => {
       rl.close();
-      resolve7(answer.trim().toLowerCase() === "y");
+      resolve8(answer.trim().toLowerCase() === "y");
     });
   });
 }
 function promptSecret(question) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const originalWrite = rl._writeToOutput;
     let firstWrite = true;
@@ -15080,25 +15294,25 @@ function promptSecret(question) {
       rl._writeToOutput = originalWrite;
       process.stdout.write("\n");
       rl.close();
-      resolve7(answer);
+      resolve8(answer);
     });
   });
 }
 function readStdin() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => {
       data += chunk;
     });
-    process.stdin.on("end", () => resolve7(data.trim()));
+    process.stdin.on("end", () => resolve8(data.trim()));
     process.stdin.on("error", reject);
   });
 }
 function resolveHubYamlPath(hubFolder) {
   for (const filename of ["hub.yaml", "wayai.yaml"]) {
-    const yamlPath = path4.join(hubFolder, filename);
-    if (fs4.existsSync(yamlPath)) return yamlPath;
+    const yamlPath = path5.join(hubFolder, filename);
+    if (fs5.existsSync(yamlPath)) return yamlPath;
   }
   return null;
 }
@@ -15175,8 +15389,8 @@ async function resolveOrganizationId(client, orgIdFlag) {
     }
     return { organizationId: orgIdFlag };
   }
-  const { readRepoConfig: readRepoConfig2 } = await Promise.resolve().then(() => (init_repo_config(), repo_config_exports));
-  const repoConfig = readRepoConfig2();
+  const { readRepoConfigUnlessBlocked: readRepoConfigUnlessBlocked2 } = await Promise.resolve().then(() => (init_repo_config(), repo_config_exports));
+  const repoConfig = readRepoConfigUnlessBlocked2();
   if (repoConfig) {
     return { organizationId: repoConfig.organization_id, organizationName: repoConfig.organization_name };
   }
@@ -15312,7 +15526,7 @@ var init_registry = __esm({
         surviving: null,
         clause: 1,
         shipped: true,
-        reason: "One root org binding (`.wayai.yaml`), so one `init`."
+        reason: "One org binding per repo (`wayai-ws/wayai.yaml`), so one `init`."
       },
       {
         original: "update",
@@ -15563,8 +15777,8 @@ var init_registry = __esm({
 });
 
 // src/lib/version-cache.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync } from "fs";
-import { dirname as dirname3, join as join6 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 import { homedir as homedir2 } from "os";
 function getVersionCachePath(filename = CLI_CACHE_FILE) {
   return join6(homedir2(), ".wayai", filename);
@@ -15572,7 +15786,7 @@ function getVersionCachePath(filename = CLI_CACHE_FILE) {
 function readVersionCache(filename = CLI_CACHE_FILE) {
   try {
     const path35 = getVersionCachePath(filename);
-    if (!existsSync4(path35)) return null;
+    if (!existsSync3(path35)) return null;
     const parsed = JSON.parse(readFileSync5(path35, "utf-8"));
     if (typeof parsed.lastCheck !== "number") return null;
     if (parsed.latest !== null && typeof parsed.latest !== "string") return null;
@@ -15594,8 +15808,8 @@ function isVersionCacheStale(filename = CLI_CACHE_FILE, maxAgeMs = MAX_AGE_24H_M
 }
 function writeVersionCache(filename, cache) {
   const path35 = getVersionCachePath(filename);
-  const dir = dirname3(path35);
-  if (!existsSync4(dir)) mkdirSync(dir, { recursive: true });
+  const dir = dirname4(path35);
+  if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
   writeFileSync2(path35, JSON.stringify(cache));
 }
 function touchVersionCache(filename) {
@@ -15613,9 +15827,9 @@ var init_version_cache = __esm({
 });
 
 // src/lib/skill-version.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
 import { join as join7 } from "path";
-import * as yaml3 from "js-yaml";
+import * as yaml4 from "js-yaml";
 function skillInstallPaths(skillName) {
   return HARNESS_SKILL_DIRS.map((dir) => `${dir}/skills/${skillName}/${SKILL_FILENAME}`);
 }
@@ -15624,7 +15838,7 @@ function parseFrontmatterVersion(content) {
   if (!match) return null;
   let parsed;
   try {
-    parsed = yaml3.load(match[1]);
+    parsed = yaml4.load(match[1]);
   } catch {
     return null;
   }
@@ -15636,7 +15850,7 @@ function findInstalledSkills(projectRoot, paths = SKILL_INSTALL_PATHS) {
   const found = [];
   for (const rel of paths) {
     const path35 = join7(projectRoot, rel);
-    if (!existsSync5(path35)) continue;
+    if (!existsSync4(path35)) continue;
     let version = null;
     try {
       version = parseFrontmatterVersion(readFileSync6(path35, "utf-8"));
@@ -15673,22 +15887,22 @@ __export(config_exports, {
   readConfig: () => readConfig,
   writeConfig: () => writeConfig
 });
-import * as fs5 from "fs";
-import * as path5 from "path";
+import * as fs6 from "fs";
+import * as path6 from "path";
 import * as os from "os";
 function configDir() {
-  return path5.join(os.homedir(), ".wayai");
+  return path6.join(os.homedir(), ".wayai");
 }
 function configPath() {
-  return path5.join(configDir(), "config.json");
+  return path6.join(configDir(), "config.json");
 }
 function getConfigPath() {
   return configPath();
 }
 function readConfig() {
-  if (!fs5.existsSync(configPath())) return null;
+  if (!fs6.existsSync(configPath())) return null;
   try {
-    const content = fs5.readFileSync(configPath(), "utf-8");
+    const content = fs6.readFileSync(configPath(), "utf-8");
     const parsed = JSON.parse(content);
     if (!parsed.api_url) return null;
     return {
@@ -15701,13 +15915,13 @@ function readConfig() {
   }
 }
 function writeConfig(config) {
-  if (!fs5.existsSync(configDir())) {
-    fs5.mkdirSync(configDir(), { recursive: true });
+  if (!fs6.existsSync(configDir())) {
+    fs6.mkdirSync(configDir(), { recursive: true });
   }
   let existing = {};
-  if (fs5.existsSync(configPath())) {
+  if (fs6.existsSync(configPath())) {
     try {
-      existing = JSON.parse(fs5.readFileSync(configPath(), "utf-8"));
+      existing = JSON.parse(fs6.readFileSync(configPath(), "utf-8"));
     } catch {
     }
   }
@@ -15715,14 +15929,14 @@ function writeConfig(config) {
   delete existing.access_token;
   delete existing.refresh_token;
   Object.assign(existing, config);
-  fs5.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + "\n", {
+  fs6.writeFileSync(configPath(), JSON.stringify(existing, null, 2) + "\n", {
     mode: 384
     // owner-only read/write
   });
 }
 function deleteConfig() {
-  if (fs5.existsSync(configPath())) {
-    fs5.unlinkSync(configPath());
+  if (fs6.existsSync(configPath())) {
+    fs6.unlinkSync(configPath());
   }
 }
 var init_config = __esm({
@@ -15732,14 +15946,14 @@ var init_config = __esm({
 });
 
 // src/lib/token-store.ts
-import * as fs6 from "fs";
-import * as path6 from "path";
+import * as fs7 from "fs";
+import * as path7 from "path";
 import * as os2 from "os";
 function configDir2() {
-  return path6.join(os2.homedir(), ".wayai");
+  return path7.join(os2.homedir(), ".wayai");
 }
 function configPath2() {
-  return path6.join(configDir2(), "config.json");
+  return path7.join(configDir2(), "config.json");
 }
 function manualCleanupCommand(account) {
   if (process.platform === "darwin") {
@@ -15791,9 +16005,9 @@ async function getKeyring() {
   return keyringCache;
 }
 function readLegacyConfigFile() {
-  if (!fs6.existsSync(configPath2())) return null;
+  if (!fs7.existsSync(configPath2())) return null;
   try {
-    return JSON.parse(fs6.readFileSync(configPath2(), "utf-8"));
+    return JSON.parse(fs7.readFileSync(configPath2(), "utf-8"));
   } catch {
     return null;
   }
@@ -15806,7 +16020,7 @@ function stripTokensFromFile() {
     if (k === "token" || k === "access_token" || k === "refresh_token") continue;
     cleaned[k] = v;
   }
-  fs6.writeFileSync(configPath2(), JSON.stringify(cleaned, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(cleaned, null, 2) + "\n", { mode: 384 });
 }
 async function migrateLegacyTokens() {
   const legacy = readLegacyConfigFile();
@@ -15957,8 +16171,8 @@ async function clearTokens() {
       }
     }
   }
-  if (fs6.existsSync(configPath2())) {
-    fs6.unlinkSync(configPath2());
+  if (fs7.existsSync(configPath2())) {
+    fs7.unlinkSync(configPath2());
   }
 }
 function readMetadataExpiresAt() {
@@ -15972,7 +16186,7 @@ function writeMetadataExpiresAt(expires_at) {
   delete existing.refresh_token;
   existing.token_expires_at = expires_at;
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 function clearMetadataExpiresAt() {
   const existing = readLegacyConfigFile();
@@ -15982,11 +16196,11 @@ function clearMetadataExpiresAt() {
   delete existing.refresh_token;
   delete existing.token_expires_at;
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 function ensureConfigDir() {
-  if (!fs6.existsSync(configDir2())) {
-    fs6.mkdirSync(configDir2(), { recursive: true });
+  if (!fs7.existsSync(configDir2())) {
+    fs7.mkdirSync(configDir2(), { recursive: true });
   }
 }
 function writeFileFallback(tokens) {
@@ -15997,7 +16211,7 @@ function writeFileFallback(tokens) {
   delete existing.token_expires_at;
   Object.assign(existing, tokens);
   ensureConfigDir();
-  fs6.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
+  fs7.writeFileSync(configPath2(), JSON.stringify(existing, null, 2) + "\n", { mode: 384 });
 }
 var KEYRING_SERVICE, KEY_WAY_TOKEN, KEY_OAUTH_ACCESS, KEY_OAUTH_REFRESH, keyringCache, StaleKeyringSlotError;
 var init_token_store = __esm({
@@ -16106,7 +16320,7 @@ async function validateToken(apiUrl, token) {
   }
 }
 function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const server = http.createServer((req, res) => {
       const url = new URL(req.url || "/", `http://127.0.0.1:${port}`);
       if (url.pathname === "/callback") {
@@ -16132,7 +16346,7 @@ function startCallbackServer(port, expectedState, timeoutMs = 12e4) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login successful!</h2><p>You can close this tab and return to your terminal.</p></body></html>");
           server.close();
-          resolve7({ code, port });
+          resolve8({ code, port });
         } else {
           res.writeHead(400, { "Content-Type": "text/html" });
           res.end("<html><body><h2>Login failed</h2><p>No authorization code received</p></body></html>");
@@ -16239,14 +16453,14 @@ __export(skill_symlink_exports, {
   healClaudeSkillLink: () => healClaudeSkillLink,
   healSkillLinkForCommand: () => healSkillLinkForCommand
 });
-import { existsSync as existsSync8, lstatSync, mkdirSync as mkdirSync4, rmSync, symlinkSync } from "fs";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync5, rmSync, symlinkSync } from "fs";
 import { join as join10 } from "path";
 function healClaudeSkillLink(root) {
   try {
     const source = join10(root, ".agents", "skills", SKILL_NAME);
-    if (!existsSync8(join10(source, SKILL_FILENAME))) return false;
+    if (!existsSync7(join10(source, SKILL_FILENAME))) return false;
     const link = join10(root, ".claude", "skills", SKILL_NAME);
-    if (existsSync8(join10(link, SKILL_FILENAME))) return false;
+    if (existsSync7(join10(link, SKILL_FILENAME))) return false;
     let entry = null;
     try {
       entry = lstatSync(link);
@@ -16257,7 +16471,7 @@ function healClaudeSkillLink(root) {
       if (!entry.isSymbolicLink()) return false;
       rmSync(link, { force: true });
     }
-    mkdirSync4(join10(root, ".claude", "skills"), { recursive: true });
+    mkdirSync5(join10(root, ".claude", "skills"), { recursive: true });
     symlinkSync(join10("..", "..", ".agents", "skills", SKILL_NAME), link, "dir");
     return true;
   } catch {
@@ -16344,10 +16558,10 @@ import * as readline2 from "readline";
 function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({ input: process.stdin, output: process.stdout });
   const display = defaultValue ? `${question} [${defaultValue}]: ` : `${question}: `;
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     rl.question(display, (answer) => {
       rl.close();
-      resolve7(answer.trim() || defaultValue || "");
+      resolve8(answer.trim() || defaultValue || "");
     });
   });
 }
@@ -16475,8 +16689,8 @@ async function tryOpenBrowser(url) {
       cmd = "xdg-open";
       args2 = [url];
     }
-    return new Promise((resolve7) => {
-      execFile(cmd, args2, (err) => resolve7(!err));
+    return new Promise((resolve8) => {
+      execFile(cmd, args2, (err) => resolve8(!err));
     });
   } catch {
     return false;
@@ -16541,9 +16755,9 @@ var init_base_id = __esm({
 
 // src/lib/worktree-scope.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import * as fs7 from "fs";
-import * as path7 from "path";
-import * as yaml4 from "js-yaml";
+import * as fs8 from "fs";
+import * as path8 from "path";
+import * as yaml5 from "js-yaml";
 function axisNoun(axis) {
   return AXES[axis].noun;
 }
@@ -16557,7 +16771,7 @@ function resolveGitDir() {
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
-    gitDir = raw ? path7.resolve(cwd, raw) : null;
+    gitDir = raw ? path8.resolve(cwd, raw) : null;
   } catch {
     gitDir = null;
   }
@@ -16566,12 +16780,12 @@ function resolveGitDir() {
 }
 function getScopePath() {
   const gitDir = resolveGitDir();
-  return gitDir ? path7.join(gitDir, SCOPE_FILE) : null;
+  return gitDir ? path8.join(gitDir, SCOPE_FILE) : null;
 }
 function legacyPaths() {
   const gitDir = resolveGitDir();
   if (!gitDir) return [];
-  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path7.join(gitDir, f));
+  return AXIS_ORDER.flatMap((axis) => AXES[axis].legacyFiles).map((f) => path8.join(gitDir, f));
 }
 function emptyScope() {
   return { hubs: [], bases: [] };
@@ -16595,7 +16809,7 @@ function readLegacyAxis(axis) {
   for (const filename of legacyFiles) {
     let raw;
     try {
-      raw = fs7.readFileSync(path7.join(gitDir, filename), "utf-8");
+      raw = fs8.readFileSync(path8.join(gitDir, filename), "utf-8");
     } catch (err) {
       if (err.code === "ENOENT") continue;
       throw err;
@@ -16610,7 +16824,7 @@ function readScope() {
   if (!scopePath) return emptyScope();
   let raw;
   try {
-    raw = fs7.readFileSync(scopePath, "utf-8");
+    raw = fs8.readFileSync(scopePath, "utf-8");
   } catch (err) {
     if (err.code === "ENOENT") {
       return { hubs: readLegacyAxis("hubs"), bases: readLegacyAxis("bases") };
@@ -16619,7 +16833,7 @@ function readScope() {
   }
   let doc;
   try {
-    doc = yaml4.load(raw);
+    doc = yaml5.load(raw);
   } catch {
     return emptyScope();
   }
@@ -16630,7 +16844,7 @@ function readScope() {
 function sweepLegacyFiles() {
   for (const legacyPath of legacyPaths()) {
     try {
-      fs7.unlinkSync(legacyPath);
+      fs8.unlinkSync(legacyPath);
     } catch {
     }
   }
@@ -16646,14 +16860,14 @@ function writeScope(scope) {
   if (!scopePath) {
     throw expected("Not inside a git repository \u2014 cannot write the worktree scope.");
   }
-  const body = yaml4.dump({ hubs: scope.hubs, bases: scope.bases }, { flowLevel: 1 });
+  const body = yaml5.dump({ hubs: scope.hubs, bases: scope.bases }, { flowLevel: 1 });
   const tmpPath = `${scopePath}.tmp-${process.pid}`;
   try {
-    fs7.writeFileSync(tmpPath, body, "utf-8");
-    fs7.renameSync(tmpPath, scopePath);
+    fs8.writeFileSync(tmpPath, body, "utf-8");
+    fs8.renameSync(tmpPath, scopePath);
   } catch (err) {
     try {
-      fs7.unlinkSync(tmpPath);
+      fs8.unlinkSync(tmpPath);
     } catch {
     }
     throw asExpectedEnvironmentError(err);
@@ -16689,7 +16903,7 @@ function clearScope() {
   let removed = false;
   for (const target of [...scopePath ? [scopePath] : [], ...legacyPaths()]) {
     try {
-      fs7.unlinkSync(target);
+      fs8.unlinkSync(target);
       removed = true;
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
@@ -16794,7 +17008,6 @@ __export(status_exports, {
   parseArgs: () => parseArgs,
   statusCommand: () => statusCommand
 });
-import * as path8 from "path";
 function parseArgs(args2) {
   return { json: args2.includes("--json") };
 }
@@ -16814,19 +17027,19 @@ function buildSkillState() {
     paths: installs.map((i) => i.path)
   };
 }
-function buildWorkspaceState(repoConfig) {
-  if (!repoConfig) return { scoped: false, path: null, hub_count: 0 };
+function buildWorkspaceState(resolved) {
+  if (!resolved) return { scoped: false, path: null, hub_count: 0 };
   const ws = detectWorkspace();
-  const gitRoot = ws?.gitRoot ?? findGitRoot();
   const hubCount = ws ? scanWorkspaceHubs(ws.workspaceDir).length : 0;
-  const yamlPath = gitRoot ? path8.join(gitRoot, ".wayai.yaml") : null;
-  return { scoped: true, path: yamlPath, hub_count: hubCount };
+  return { scoped: true, path: resolved.path, hub_count: hubCount };
 }
 async function statusCommand(args2, pkg2) {
   const { json } = parseArgs(args2);
   const config = readConfig();
-  const repoConfig = readRepoConfig();
-  const workspace = buildWorkspaceState(repoConfig);
+  const resolvedRepo = resolveRepoConfig();
+  const repoConfig = resolvedRepo?.config ?? null;
+  const workspace = buildWorkspaceState(resolvedRepo);
+  const repoScopeBlocker = resolvedRepo ? null : readRepoScopeBlocker();
   const cachedCliLatest = readCachedLatest(CLI_CACHE_FILE);
   const cliLatest = cachedCliLatest && isNewerVersion(cachedCliLatest, pkg2.version) ? cachedCliLatest : null;
   const skill = buildSkillState();
@@ -16849,6 +17062,7 @@ async function statusCommand(args2, pkg2) {
       orgs: [],
       active_org: null,
       workspace,
+      repo_scope_blocker: repoScopeBlocker,
       worktree_scope: scope,
       worktree_binding: { hub_id: boundHubId },
       worktree_lock: { hub_id: boundHubId }
@@ -16905,6 +17119,7 @@ async function statusCommand(args2, pkg2) {
     orgs,
     active_org: activeOrg,
     workspace,
+    repo_scope_blocker: repoScopeBlocker,
     worktree_scope: scope,
     worktree_binding: { hub_id: boundHubId },
     worktree_lock: { hub_id: boundHubId }
@@ -16934,8 +17149,17 @@ async function statusCommand(args2, pkg2) {
     console.log(`Repository scope:`);
     console.log(`  Organization: ${orgLine}`);
     console.log(`  Hubs: ${workspace.hub_count}`);
+  } else if (repoScopeBlocker?.kind === "conflict") {
+    console.log("Repository scope: UNRESOLVED \u2014 two files name different organizations:");
+    console.log(`  ${WORKSPACE_MANIFEST_LABEL} -> ${repoScopeBlocker.manifest_organization_id}`);
+    console.log(`  ${ROOT_CONFIG_FILE} -> ${repoScopeBlocker.root_organization_id}`);
+    console.log(`  Delete or correct ${ROOT_CONFIG_FILE}; until then every command refuses.`);
+  } else if (repoScopeBlocker?.kind === "invalid") {
+    console.log(`Repository scope: UNRESOLVED \u2014 ${repoScopeBlocker.path} is unusable (${repoScopeBlocker.detail}).`);
   } else {
-    console.log("No .wayai.yaml found \u2014 run `wayai init` to scope this repo to an organization.");
+    console.log(
+      `No organization binding found in ${WORKSPACE_MANIFEST_LABEL} \u2014 run \`wayai init\` to scope this repo to an organization.`
+    );
   }
   if (scope.hubs.length > 0 || scope.bases.length > 0) {
     console.log("Worktree scope: (run `wayai unbind` to clear)");
@@ -16952,6 +17176,7 @@ var init_status = __esm({
     init_config();
     init_auth();
     init_repo_config();
+    init_workspace_manifest();
     init_workspace();
     init_worktree_scope();
     init_api_client();
@@ -17035,7 +17260,7 @@ var init_constants = __esm({
 });
 
 // src/lib/workspace-files.ts
-import * as fs8 from "fs";
+import * as fs9 from "fs";
 import * as path9 from "path";
 function perHubAgentsMd(hubFolderName) {
   return [
@@ -17052,12 +17277,13 @@ function perHubAgentsMd(hubFolderName) {
   ].join("\n");
 }
 function isWorkspace(gitRoot) {
-  if (fs8.existsSync(path9.join(gitRoot, ".wayai.yaml"))) return true;
+  if (fs9.existsSync(workspaceManifestPath(gitRoot))) return true;
+  if (fs9.existsSync(rootConfigPath(gitRoot))) return true;
   return isDirectory(resolveLayout(gitRoot).hubsDir);
 }
 function writeIfAbsent(filePath, content) {
-  if (fs8.existsSync(filePath)) return null;
-  fs8.writeFileSync(filePath, content, "utf-8");
+  if (fs9.existsSync(filePath)) return null;
+  fs9.writeFileSync(filePath, content, "utf-8");
   return path9.basename(filePath);
 }
 function ensureWorkspaceFiles(gitRoot) {
@@ -17075,6 +17301,7 @@ var init_workspace_files = __esm({
     "use strict";
     init_constants();
     init_layout();
+    init_workspace_manifest();
     CLAUDE_MD_SHIM = "@AGENTS.md\n";
     ROOT_AGENTS_MD = [
       "# Working with WayAI",
@@ -17112,12 +17339,12 @@ __export(init_exports, {
   initCommand: () => initCommand,
   parseArgs: () => parseArgs3
 });
-import { mkdirSync as mkdirSync5 } from "fs";
+import { mkdirSync as mkdirSync6 } from "fs";
 import path10 from "path";
 function ensureHubsDir(gitRoot) {
   const hubsDir = resolveLayout(gitRoot).hubsDir;
   if (isDirectory(hubsDir)) return null;
-  mkdirSync5(hubsDir, { recursive: true });
+  mkdirSync6(hubsDir, { recursive: true });
   return `${path10.relative(gitRoot, hubsDir)}/`;
 }
 function parseArgs3(args2) {
@@ -17252,18 +17479,18 @@ var init_init = __esm({
 });
 
 // src/lib/fs-safety.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as path11 from "path";
 function fileHasBytes(abs, data) {
   let st;
   try {
-    st = fs9.lstatSync(abs);
+    st = fs10.lstatSync(abs);
   } catch {
     return false;
   }
   if (!st.isFile() || st.isSymbolicLink()) return false;
   try {
-    return fs9.readFileSync(abs).equals(data);
+    return fs10.readFileSync(abs).equals(data);
   } catch {
     return false;
   }
@@ -17272,8 +17499,8 @@ function realpathContained(root, abs) {
   let realRoot;
   let realAbs;
   try {
-    realRoot = fs9.realpathSync(root);
-    realAbs = fs9.realpathSync(abs);
+    realRoot = fs10.realpathSync(root);
+    realAbs = fs10.realpathSync(abs);
   } catch {
     return false;
   }
@@ -17281,13 +17508,13 @@ function realpathContained(root, abs) {
 }
 function mkdirTolerateRace(dir) {
   try {
-    fs9.mkdirSync(dir);
+    fs10.mkdirSync(dir);
     return true;
   } catch (err) {
     if (err.code !== "EEXIST") throw err;
     let st;
     try {
-      st = fs9.lstatSync(dir);
+      st = fs10.lstatSync(dir);
     } catch {
       st = void 0;
     }
@@ -17299,7 +17526,7 @@ function ensureRealSubdirNoSymlink(root, target, create) {
   const targetResolved = path11.resolve(target);
   if (targetResolved !== rootResolved && !targetResolved.startsWith(rootResolved + path11.sep)) return false;
   try {
-    if (!fs9.lstatSync(rootResolved).isDirectory()) return false;
+    if (!fs10.lstatSync(rootResolved).isDirectory()) return false;
   } catch {
     return false;
   }
@@ -17310,7 +17537,7 @@ function ensureRealSubdirNoSymlink(root, target, create) {
     cur = path11.join(cur, segment);
     let st;
     try {
-      st = fs9.lstatSync(cur);
+      st = fs10.lstatSync(cur);
     } catch {
       st = void 0;
     }
@@ -17327,8 +17554,8 @@ function ensureRealSubdirNoSymlink(root, target, create) {
 function readFileNoFollow(root, abs) {
   if (!ensureRealSubdirNoSymlink(root, path11.dirname(abs), false)) return null;
   try {
-    if (!fs9.lstatSync(abs).isFile()) return null;
-    return fs9.readFileSync(abs);
+    if (!fs10.lstatSync(abs).isFile()) return null;
+    return fs10.readFileSync(abs);
   } catch {
     return null;
   }
@@ -17338,11 +17565,11 @@ function writeFileNoFollow(root, abs, data) {
   if (!ensureRealSubdirNoSymlink(root, parent, true)) return false;
   let st;
   try {
-    st = fs9.lstatSync(abs);
+    st = fs10.lstatSync(abs);
   } catch {
   }
-  if (st?.isSymbolicLink()) fs9.rmSync(abs);
-  fs9.writeFileSync(abs, data);
+  if (st?.isSymbolicLink()) fs10.rmSync(abs);
+  fs10.writeFileSync(abs, data);
   return true;
 }
 var init_fs_safety = __esm({
@@ -17352,7 +17579,7 @@ var init_fs_safety = __esm({
 });
 
 // src/lib/resource-files.ts
-import * as fs10 from "fs";
+import * as fs11 from "fs";
 import * as path12 from "path";
 import * as crypto3 from "crypto";
 function isBinaryFile(filename) {
@@ -17399,14 +17626,14 @@ function computeHash(data) {
 }
 function scanResourceFiles(dir, prefix = "") {
   const files = [];
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
       files.push(...scanResourceFiles(path12.join(dir, entry.name), relPath));
     } else if (entry.isFile()) {
       const fullPath = path12.join(dir, entry.name);
-      const stat2 = fs10.statSync(fullPath);
+      const stat2 = fs11.statSync(fullPath);
       if (stat2.size > MAX_RESOURCE_FILE_SIZE3) {
         console.warn(`  Warning: skipping ${relPath} (${(stat2.size / 1024 / 1024).toFixed(1)}MB exceeds 10MB limit)`);
         continue;
@@ -17416,7 +17643,7 @@ function scanResourceFiles(dir, prefix = "") {
         mime_type: guessMimeType(entry.name),
         file_size: stat2.size
       };
-      const data = fs10.readFileSync(fullPath);
+      const data = fs11.readFileSync(fullPath);
       fileEntry.hash = computeHash(data);
       if (isBinaryFile(entry.name)) {
         fileEntry.content_base64 = data.toString("base64");
@@ -17476,7 +17703,7 @@ function writeResourceFileTree(resDir, files, root, log) {
     return;
   }
   if (files.length === 0) {
-    if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
+    if (fs11.existsSync(resDir)) cleanOrphanFiles(resDir, "", /* @__PURE__ */ new Set(), root, log);
     return;
   }
   const writtenPaths = /* @__PURE__ */ new Set();
@@ -17497,18 +17724,18 @@ function writeResourceFileTree(resDir, files, root, log) {
       writtenPaths.delete(file.path);
     }
   }
-  if (fs10.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
+  if (fs11.existsSync(resDir)) cleanOrphanFiles(resDir, "", writtenPaths, root, log);
 }
 function cleanOrphanFiles(dir, prefix, writtenPaths, root, log) {
-  const entries = fs10.readdirSync(dir, { withFileTypes: true });
+  const entries = fs11.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
     const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;
     const fullPath = path12.join(dir, entry.name);
     if (entry.isDirectory()) {
       cleanOrphanFiles(fullPath, relPath, writtenPaths, root, log);
-      if (fs10.readdirSync(fullPath).length === 0) fs10.rmdirSync(fullPath);
+      if (fs11.readdirSync(fullPath).length === 0) fs11.rmdirSync(fullPath);
     } else if (!writtenPaths.has(relPath)) {
-      fs10.unlinkSync(fullPath);
+      fs11.unlinkSync(fullPath);
       if (log && root) log.removed.push(path12.relative(root, fullPath));
     }
   }
@@ -17529,8 +17756,8 @@ async function downloadBinaryFiles(resDir, files, root, log) {
       }
       if (file.hash) {
         try {
-          const st = fs10.lstatSync(filePath);
-          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs10.readFileSync(filePath)) === file.hash) continue;
+          const st = fs11.lstatSync(filePath);
+          if (st.isFile() && !st.isSymbolicLink() && computeHash(fs11.readFileSync(filePath)) === file.hash) continue;
         } catch {
         }
       }
@@ -17584,7 +17811,7 @@ var init_resource_files = __esm({
 });
 
 // src/lib/eval-attachments.ts
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as path13 from "path";
 function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
   const raw = turn.attachments;
@@ -17608,7 +17835,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
     }
     let stat2;
     try {
-      stat2 = fs11.statSync(abs);
+      stat2 = fs12.statSync(abs);
     } catch {
     }
     if (!stat2?.isFile()) {
@@ -17622,7 +17849,7 @@ function resolveTurnAttachments(hubFolder, turn, label, bytesByHash) {
         `${label}: attachment "${entry}" is ${(stat2.size / 1024 / 1024).toFixed(1)}MB, over the 10MB limit.`
       );
     }
-    const data = fs11.readFileSync(abs);
+    const data = fs12.readFileSync(abs);
     const hash = computeHash(data);
     const fileName = path13.basename(abs);
     const mimeType = guessMimeType(fileName) ?? "application/octet-stream";
@@ -17730,16 +17957,16 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     console.warn(`  Warning: ${ATTACHMENTS_DIR}/ is not reachable inside the hub folder without a symlink; skipping attachment sync.`);
     return result;
   }
-  if (!fs11.existsSync(attachDir)) return result;
+  if (!fs12.existsSync(attachDir)) return result;
   for (const dl of downloads) {
     const abs = path13.resolve(hubFolder, dl.relPath);
     if (abs !== attachDir && !abs.startsWith(attachDir + path13.sep)) continue;
     let existing;
     try {
-      existing = fs11.lstatSync(abs);
+      existing = fs12.lstatSync(abs);
     } catch {
     }
-    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs11.readFileSync(abs)) === dl.hash) {
+    if (existing?.isFile() && !existing.isSymbolicLink() && computeHash(fs12.readFileSync(abs)) === dl.hash) {
       continue;
     }
     try {
@@ -17757,11 +17984,11 @@ async function downloadEvalAttachments(hubFolder, downloads) {
     }
   }
   const keep = new Set(downloads.map((d) => path13.resolve(hubFolder, d.relPath)));
-  for (const name of fs11.readdirSync(attachDir)) {
+  for (const name of fs12.readdirSync(attachDir)) {
     const abs = path13.join(attachDir, name);
-    const st = fs11.lstatSync(abs);
+    const st = fs12.lstatSync(abs);
     if ((st.isFile() || st.isSymbolicLink()) && !keep.has(abs)) {
-      fs11.rmSync(abs);
+      fs12.rmSync(abs);
       result.removed.push(path13.relative(hubFolder, abs));
     }
   }
@@ -17779,20 +18006,20 @@ var init_eval_attachments = __esm({
 });
 
 // src/lib/parser.ts
-import * as fs12 from "fs";
+import * as fs13 from "fs";
 import * as path14 from "path";
-import * as yaml5 from "js-yaml";
+import * as yaml6 from "js-yaml";
 function parseHubFolder(hubFolder, opts) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) {
     throw expected(`hub.yaml not found in ${hubFolder}`);
   }
-  const yamlContent = fs12.readFileSync(yamlPath, "utf-8");
+  const yamlContent = fs13.readFileSync(yamlPath, "utf-8");
   let config;
   try {
-    config = yaml5.load(yamlContent);
+    config = yaml6.load(yamlContent);
   } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${yamlPath}: ${err.message}`);
     }
     throw err;
@@ -17815,8 +18042,8 @@ function parseHubFolder(hubFolder, opts) {
     if (typeof resolved.instructions === "string" && resolved.instructions.endsWith(".md")) {
       const instrValue = resolved.instructions;
       const instructionsPath = instrValue.startsWith("agents/") ? path14.join(hubFolder, instrValue) : path14.join(hubFolder, "agents", instrValue);
-      if (fs12.existsSync(instructionsPath)) {
-        resolved.instructions = fs12.readFileSync(instructionsPath, "utf-8");
+      if (fs13.existsSync(instructionsPath)) {
+        resolved.instructions = fs13.readFileSync(instructionsPath, "utf-8");
       } else {
         throw expected(
           `Agent instructions file not found: ${instructionsPath} (referenced by agent "${agent.name}")`
@@ -17824,8 +18051,8 @@ function parseHubFolder(hubFolder, opts) {
       }
     } else if (resolved.instructions === void 0 && typeof agent.name === "string") {
       const conventionPath = path14.join(hubFolder, "agents", `${slugify(agent.name)}.md`);
-      if (fs12.existsSync(conventionPath)) {
-        resolved.instructions = fs12.readFileSync(conventionPath, "utf-8");
+      if (fs13.existsSync(conventionPath)) {
+        resolved.instructions = fs13.readFileSync(conventionPath, "utf-8");
       }
     }
     return resolved;
@@ -17880,17 +18107,17 @@ function parseHubFolder(hubFolder, opts) {
 }
 function scanEvalYamlFiles(hubFolder, bytesByHash) {
   const evalsDir = path14.join(hubFolder, "evals");
-  if (!fs12.existsSync(evalsDir)) return [];
+  if (!fs13.existsSync(evalsDir)) return [];
   const evals = [];
   const seen = /* @__PURE__ */ new Set();
-  const topEntries = fs12.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const topEntries = fs13.readdirSync(evalsDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of topEntries) {
     if (entry.isFile() && entry.name.endsWith(".yaml")) {
       collectEval(evals, seen, path14.join(evalsDir, entry.name), `evals/${entry.name}`, null, hubFolder, bytesByHash);
     } else if (entry.isDirectory()) {
       const setName = entry.name;
       const setDir = path14.join(evalsDir, setName);
-      const setEntries = fs12.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      const setEntries = fs13.readdirSync(setDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
       for (const sub of setEntries) {
         if (sub.isDirectory()) {
           throw expected(
@@ -17919,12 +18146,12 @@ function collectEval(evals, seen, filePath, relPath, setName, hubFolder, bytesBy
   evals.push(evalEntry);
 }
 function parseEvalYaml(filePath, relPath, setName, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml5.load(content);
+    raw = yaml6.load(content);
   } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -18022,10 +18249,10 @@ function parseFixtureField(raw, label, key) {
 }
 function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   const journeysDir = path14.join(hubFolder, "journeys");
-  if (!fs12.existsSync(journeysDir)) return [];
+  if (!fs13.existsSync(journeysDir)) return [];
   const journeys = [];
   const seen = /* @__PURE__ */ new Set();
-  const entries = fs12.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
     if (entry.isDirectory()) {
       throw expected(
@@ -18046,12 +18273,12 @@ function scanJourneyYamlFiles(hubFolder, bytesByHash) {
   return journeys;
 }
 function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
-  const content = fs12.readFileSync(filePath, "utf-8");
+  const content = fs13.readFileSync(filePath, "utf-8");
   let raw;
   try {
-    raw = yaml5.load(content);
+    raw = yaml6.load(content);
   } catch (err) {
-    if (err instanceof yaml5.YAMLException) {
+    if (err instanceof yaml6.YAMLException) {
       throw expected(`Invalid YAML in ${relPath}: ${err.message}`);
     }
     throw err;
@@ -18102,18 +18329,18 @@ function parseJourneyYaml(filePath, relPath, hubFolder, bytesByHash) {
 }
 function scanAgentYamlFiles(hubFolder) {
   const agentsDir = path14.join(hubFolder, "agents");
-  if (!fs12.existsSync(agentsDir)) return [];
-  const yamlFiles = fs12.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
+  if (!fs13.existsSync(agentsDir)) return [];
+  const yamlFiles = fs13.readdirSync(agentsDir).filter((f) => f.endsWith(".yaml")).sort();
   if (yamlFiles.length === 0) return [];
   const agents = [];
   for (const file of yamlFiles) {
     const filePath = path14.join(agentsDir, file);
-    const content = fs12.readFileSync(filePath, "utf-8");
+    const content = fs13.readFileSync(filePath, "utf-8");
     let agent;
     try {
-      agent = yaml5.load(content);
+      agent = yaml6.load(content);
     } catch (err) {
-      if (err instanceof yaml5.YAMLException) {
+      if (err instanceof yaml6.YAMLException) {
         throw expected(`Invalid YAML in agents/${file}: ${err.message}`);
       }
       throw err;
@@ -18143,7 +18370,7 @@ function parseResources(hubFolder, configResources) {
     if (res.skill_name) resource.skill_name = res.skill_name;
     const resSlug = slugify(resource.name);
     const resDir = path14.join(resourcesDir, resSlug);
-    if (fs12.existsSync(resDir)) {
+    if (fs13.existsSync(resDir)) {
       const files = scanResourceFiles(resDir, "");
       if (files.length > 0) {
         resource.files = files;
@@ -18191,9 +18418,9 @@ var init_diff_display = __esm({
 });
 
 // src/lib/yaml-writer.ts
-import * as fs13 from "fs";
+import * as fs14 from "fs";
 import * as path15 from "path";
-import * as yaml6 from "js-yaml";
+import * as yaml7 from "js-yaml";
 function writeFileIfChanged(hubFolder, absPath, content, log) {
   const buf = Buffer.from(content, "utf-8");
   if (fileHasBytes(absPath, buf)) return;
@@ -18242,15 +18469,15 @@ function buildEvalYamlObject(evalEntry, slug) {
 function writeHubFolder(hubFolder, payload, options = {}) {
   const log = { changed: [], removed: [] };
   const agentsDir = path15.join(hubFolder, "agents");
-  if (!fs13.existsSync(hubFolder)) {
-    fs13.mkdirSync(hubFolder, { recursive: true });
+  if (!fs14.existsSync(hubFolder)) {
+    fs14.mkdirSync(hubFolder, { recursive: true });
   }
-  if (!fs13.existsSync(agentsDir)) {
-    fs13.mkdirSync(agentsDir, { recursive: true });
+  if (!fs14.existsSync(agentsDir)) {
+    fs14.mkdirSync(agentsDir, { recursive: true });
   }
   const yamlPayload = buildYamlPayload(payload);
   const agentFiles = extractAgentFiles(payload);
-  const yamlContent = yaml6.dump(yamlPayload, YAML_DUMP_OPTIONS);
+  const yamlContent = yaml7.dump(yamlPayload, YAML_DUMP_OPTIONS);
   writeFileIfChanged(hubFolder, path15.join(hubFolder, "hub.yaml"), yamlContent, log);
   if (options.seedAgentContext ?? true) {
     for (const seeded of [
@@ -18261,8 +18488,8 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     }
   }
   const oldYamlPath = path15.join(hubFolder, "wayai.yaml");
-  if (fs13.existsSync(oldYamlPath)) {
-    fs13.unlinkSync(oldYamlPath);
+  if (fs14.existsSync(oldYamlPath)) {
+    fs14.unlinkSync(oldYamlPath);
     log.removed.push(path15.relative(hubFolder, oldYamlPath));
   }
   const yamlSlugs = writeAgentYamlFiles(hubFolder, agentsDir, payload.agents || [], log);
@@ -18271,20 +18498,20 @@ function writeHubFolder(hubFolder, payload, options = {}) {
     mdSlugs.add(slug);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.md`), content, log);
   }
-  const existingFiles = fs13.readdirSync(agentsDir);
+  const existingFiles = fs14.readdirSync(agentsDir);
   for (const file of existingFiles) {
     if (file.endsWith(".yaml")) {
       const slug = file.slice(0, -5);
       if (!yamlSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs14.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     } else if (file.endsWith(".md")) {
       const slug = file.slice(0, -3);
       if (!mdSlugs.has(slug)) {
         const orphan = path15.join(agentsDir, file);
-        fs13.unlinkSync(orphan);
+        fs14.unlinkSync(orphan);
         log.removed.push(path15.relative(hubFolder, orphan));
       }
     }
@@ -18297,10 +18524,10 @@ function writeHubFolder(hubFolder, payload, options = {}) {
 function setPreviewLabelInHubYaml(hubFolder, label) {
   const yamlPath = resolveHubYamlPath(hubFolder);
   if (!yamlPath) return;
-  const obj = yaml6.load(fs13.readFileSync(yamlPath, "utf-8")) ?? {};
+  const obj = yaml7.load(fs14.readFileSync(yamlPath, "utf-8")) ?? {};
   if (label) obj.preview_label = label;
   else delete obj.preview_label;
-  fs13.writeFileSync(yamlPath, yaml6.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
+  fs14.writeFileSync(yamlPath, yaml7.dump(obj, YAML_DUMP_OPTIONS), "utf-8");
 }
 function buildYamlPayload(payload) {
   const result = {
@@ -18345,7 +18572,7 @@ function writeAgentYamlFiles(hubFolder, agentsDir, agents, log) {
     slugs.add(slug);
     const entry = { ...agent };
     delete entry.instructions;
-    const yamlContent = yaml6.dump(entry, YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(entry, YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(agentsDir, `${slug}.yaml`), yamlContent, log);
   }
   return slugs;
@@ -18365,17 +18592,17 @@ function extractAgentFiles(payload) {
 function writeEvalYamlFiles(hubFolder, evals, log) {
   const evalsDir = path15.join(hubFolder, "evals");
   if (evals.length === 0) {
-    if (fs13.existsSync(evalsDir)) {
+    if (fs14.existsSync(evalsDir)) {
       cleanEvalOrphans(hubFolder, evalsDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(evalsDir).length === 0) fs13.rmdirSync(evalsDir);
+        if (fs14.readdirSync(evalsDir).length === 0) fs14.rmdirSync(evalsDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(evalsDir)) {
-    fs13.mkdirSync(evalsDir, { recursive: true });
+  if (!fs14.existsSync(evalsDir)) {
+    fs14.mkdirSync(evalsDir, { recursive: true });
   }
   const writtenRelPaths = /* @__PURE__ */ new Set();
   for (const evalEntry of evals) {
@@ -18389,42 +18616,42 @@ function writeEvalYamlFiles(hubFolder, evals, log) {
     }
     if (setName) {
       const setDir = path15.join(evalsDir, setName);
-      if (!fs13.existsSync(setDir)) {
-        fs13.mkdirSync(setDir, { recursive: true });
+      if (!fs14.existsSync(setDir)) {
+        fs14.mkdirSync(setDir, { recursive: true });
       }
     }
-    const yamlContent = yaml6.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(buildEvalYamlObject(evalEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, targetPath, yamlContent, log);
     writtenRelPaths.add(relPath);
   }
   cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log);
 }
 function cleanEvalOrphans(hubFolder, evalsDir, writtenRelPaths, log) {
-  const entries = fs13.readdirSync(evalsDir, { withFileTypes: true });
+  const entries = fs14.readdirSync(evalsDir, { withFileTypes: true });
   for (const entry of entries) {
     const fullPath = path15.join(evalsDir, entry.name);
     if (entry.isFile()) {
       if (entry.name.endsWith(".yaml") && !writtenRelPaths.has(entry.name)) {
-        fs13.unlinkSync(fullPath);
+        fs14.unlinkSync(fullPath);
         log.removed.push(path15.relative(hubFolder, fullPath));
       }
       continue;
     }
     if (entry.isDirectory()) {
       const setName = entry.name;
-      const subEntries = fs13.readdirSync(fullPath, { withFileTypes: true });
+      const subEntries = fs14.readdirSync(fullPath, { withFileTypes: true });
       for (const sub of subEntries) {
         if (sub.isFile() && sub.name.endsWith(".yaml")) {
           const relPath = `${setName}/${sub.name}`;
           if (!writtenRelPaths.has(relPath)) {
             const orphan = path15.join(fullPath, sub.name);
-            fs13.unlinkSync(orphan);
+            fs14.unlinkSync(orphan);
             log.removed.push(path15.relative(hubFolder, orphan));
           }
         }
       }
       try {
-        if (fs13.readdirSync(fullPath).length === 0) fs13.rmdirSync(fullPath);
+        if (fs14.readdirSync(fullPath).length === 0) fs14.rmdirSync(fullPath);
       } catch {
       }
     }
@@ -18463,35 +18690,35 @@ function buildJourneyYamlObject(journeyEntry, slug) {
 function writeJourneyYamlFiles(hubFolder, journeys, log) {
   const journeysDir = path15.join(hubFolder, "journeys");
   if (journeys.length === 0) {
-    if (fs13.existsSync(journeysDir)) {
+    if (fs14.existsSync(journeysDir)) {
       cleanJourneyOrphans(hubFolder, journeysDir, /* @__PURE__ */ new Set(), log);
       try {
-        if (fs13.readdirSync(journeysDir).length === 0) fs13.rmdirSync(journeysDir);
+        if (fs14.readdirSync(journeysDir).length === 0) fs14.rmdirSync(journeysDir);
       } catch {
       }
     }
     return;
   }
-  if (!fs13.existsSync(journeysDir)) {
-    fs13.mkdirSync(journeysDir, { recursive: true });
+  if (!fs14.existsSync(journeysDir)) {
+    fs14.mkdirSync(journeysDir, { recursive: true });
   }
   const writtenFiles = /* @__PURE__ */ new Set();
   const usedSlugs = /* @__PURE__ */ new Set();
   for (const journeyEntry of journeys) {
     const slug = ensureUniqueSlug(slugify(journeyEntry.name), usedSlugs);
     const fileName = `${slug}.yaml`;
-    const yamlContent = yaml6.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
+    const yamlContent = yaml7.dump(buildJourneyYamlObject(journeyEntry, slug), YAML_DUMP_OPTIONS);
     writeFileIfChanged(hubFolder, path15.join(journeysDir, fileName), yamlContent, log);
     writtenFiles.add(fileName);
   }
   cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log);
 }
 function cleanJourneyOrphans(hubFolder, journeysDir, writtenFiles, log) {
-  const entries = fs13.readdirSync(journeysDir, { withFileTypes: true });
+  const entries = fs14.readdirSync(journeysDir, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.isFile() && entry.name.endsWith(".yaml") && !writtenFiles.has(entry.name)) {
       const orphan = path15.join(journeysDir, entry.name);
-      fs13.unlinkSync(orphan);
+      fs14.unlinkSync(orphan);
       log.removed.push(path15.relative(hubFolder, orphan));
     }
   }
@@ -18505,12 +18732,12 @@ function writeResourceFiles(hubFolder, resources, log) {
     const resDir = path15.join(resourcesDir, resSlug);
     writeResourceFileTree(resDir, resource.files || [], hubFolder, log);
   }
-  if (fs13.existsSync(resourcesDir)) {
-    const existingDirs = fs13.readdirSync(resourcesDir, { withFileTypes: true });
+  if (fs14.existsSync(resourcesDir)) {
+    const existingDirs = fs14.readdirSync(resourcesDir, { withFileTypes: true });
     for (const entry of existingDirs) {
       if (entry.isDirectory() && !currentSlugs.has(entry.name)) {
         const orphanDir = path15.join(resourcesDir, entry.name);
-        fs13.rmSync(orphanDir, { recursive: true, force: true });
+        fs14.rmSync(orphanDir, { recursive: true, force: true });
         log.removed.push(`${path15.relative(hubFolder, orphanDir)}/`);
       }
     }
@@ -18599,15 +18826,15 @@ var init_terminal_output = __esm({
 });
 
 // src/lib/base-workspace.ts
-import * as fs14 from "fs";
+import * as fs15 from "fs";
 import * as path17 from "path";
-import * as yaml7 from "js-yaml";
+import * as yaml8 from "js-yaml";
 function readBaseMeta(folder) {
   const bytes = readFileNoFollow(folder, path17.join(folder, BASE_META_FILE));
   if (bytes === null) return null;
   let doc;
   try {
-    doc = yaml7.load(bytes.toString("utf-8"));
+    doc = yaml8.load(bytes.toString("utf-8"));
   } catch {
     return null;
   }
@@ -18617,7 +18844,7 @@ function readBaseMeta(folder) {
 function listBaseFolders(basesDir) {
   let entries;
   try {
-    entries = fs14.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
+    entries = fs15.readdirSync(basesDir).filter((entry) => !entry.startsWith("."));
   } catch {
     return [];
   }
@@ -18704,7 +18931,7 @@ function resolveBaseSelectorToId(gitRoot, selector) {
 }
 function hasBaseMetaFile(folder) {
   try {
-    return fs14.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
+    return fs15.lstatSync(path17.join(folder, BASE_META_FILE)).isFile();
   } catch {
     return false;
   }
@@ -18722,25 +18949,17 @@ var init_base_workspace = __esm({
 });
 
 // src/lib/subtree-routing.ts
-import * as fs15 from "fs";
 import * as path18 from "path";
-import * as yaml8 from "js-yaml";
 function readRepoDefaults(gitRoot) {
-  const file = path18.join(gitRoot, WAYAI_LAYOUT.wsDir, REPO_DEFAULTS_FILE);
-  let doc;
-  try {
-    doc = yaml8.load(fs15.readFileSync(file, "utf-8"));
-  } catch {
-    return {};
-  }
-  if (!doc || typeof doc !== "object") return {};
-  const raw = doc;
+  const load11 = loadWorkspaceManifest(gitRoot);
+  if (load11.kind !== "ok") return {};
+  const raw = load11.doc;
   const str = (v) => {
     if (typeof v !== "string" || !v.trim()) return void 0;
     const value = v.trim();
     if (value.includes("/") || value.includes(path18.sep) || value === "." || value === "..") {
       console.warn(
-        `Warning: ignoring ${JSON.stringify(value)} in ${WAYAI_LAYOUT.wsDir}/${REPO_DEFAULTS_FILE} \u2014 a default names a hub or base, not a path.`
+        `Warning: ignoring ${JSON.stringify(value)} in ${WORKSPACE_MANIFEST_LABEL} \u2014 a default names a hub or base, not a path.`
       );
       return void 0;
     }
@@ -18828,11 +19047,11 @@ function routeSubtree(options) {
     return {
       ok: false,
       refusal: [
-        `\`wayai ${verb}\` does not take --org: it operates on the organization named by .wayai.yaml at the repo root.`,
+        `\`wayai ${verb}\` does not take --org: it operates on the organization named by ${WORKSPACE_MANIFEST_LABEL}.`,
         "",
         "To act on another organization:",
         "  wayai bases <command> --org <uuid>   # the Data surface honors it",
-        "  # or run from a checkout whose .wayai.yaml names that organization"
+        "  # or run from a checkout whose workspace manifest names that organization"
       ].join("\n")
     };
   }
@@ -18899,15 +19118,15 @@ function requireSubtree(verb, args2, gitRoot) {
   }
   return { subtree: result.subtree, selector: result.selector };
 }
-var REPO_DEFAULTS_FILE, VALUE_FLAGS;
+var VALUE_FLAGS;
 var init_subtree_routing = __esm({
   "src/lib/subtree-routing.ts"() {
     "use strict";
     init_layout();
     init_terminal_output();
+    init_workspace_manifest();
     init_workspace();
     init_base_workspace();
-    REPO_DEFAULTS_FILE = "wayai.yaml";
     VALUE_FLAGS = /* @__PURE__ */ new Set(["--hub", "--base", "--label", "--org"]);
   }
 });
@@ -18934,12 +19153,12 @@ async function createDataClient(orgId) {
   if (selected !== void 0 && !UUID_RE2.test(selected)) {
     throw expected(`Invalid --org: ${JSON.stringify(selected)}. Expected an organization UUID.`);
   }
-  const org = selected ?? readRepoConfig()?.organization_id;
+  const org = selected ?? readRepoConfigUnlessBlocked()?.organization_id;
   async function requireOrgForSetupRoute(what) {
     const orgId2 = org ?? (await api.me()).org_id;
     if (!orgId2) {
       throw expected(
-        `No organization to ${what} against. Pass --org <uuid>, or run this from a repo with .wayai.yaml.`
+        `No organization to ${what} against. Pass --org <uuid>, or run this from a repo scoped by \`wayai init\`.`
       );
     }
     return orgId2;
@@ -19025,7 +19244,7 @@ var init_client = __esm({
 });
 
 // src/data/helpers.ts
-import { readFileSync as readFileSync16 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 function pathSegment(id, label = "id") {
   if (!isPathSafeId(id)) {
     throw expected(`Invalid ${label}: ${JSON.stringify(id)}. An id may use ${PATH_SAFE_ID_RULE}.`);
@@ -19053,7 +19272,7 @@ function parseData(data, flag) {
   let text = data;
   if (source !== void 0) {
     try {
-      text = readFileSync16(source, "utf-8");
+      text = readFileSync15(source, "utf-8");
     } catch (e) {
       throw expected(`${prefix}${source}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -21148,9 +21367,10 @@ async function migrateCommand(_args) {
   const newOrg = path29.join(newWs, WAYAI_LAYOUT.orgSubdir);
   const hasLegacyWs = isDirectory(legacyWs);
   const hasLegacyOrg = isDirectory(legacyOrg);
-  if (!hasLegacyWs && !hasLegacyOrg) {
-    console.log(`Already migrated \u2014 no legacy ${WAYAI_LAYOUT.legacy.wsDir}/ or ${WAYAI_LAYOUT.legacy.orgAtRoot}/ to move.`);
-    return;
+  const orgPlan = planOrgMigration(gitRoot);
+  if (orgPlan.kind === "refuse") {
+    console.error(orgPlan.message);
+    process.exit(1);
   }
   if (hasLegacyWs && isDirectory(newHubs)) {
     console.error(
@@ -21176,10 +21396,30 @@ async function migrateCommand(_args) {
     usedFsFallback ||= how === "fs";
     moved.push(`${WAYAI_LAYOUT.legacy.orgAtRoot}/ \u2192 ${rel(newOrg)}/`);
   }
-  console.log(`Migrated to the ${WAYAI_LAYOUT.wsDir}/ layout:`);
-  for (const m of moved) console.log(`  ${m}`);
-  if (usedFsFallback) {
-    console.log("\n(Some dirs were moved on disk, not via git \u2014 they will show as untracked.)");
+  if (moved.length > 0) {
+    console.log(`Migrated to the ${WAYAI_LAYOUT.wsDir}/ layout:`);
+    for (const m of moved) console.log(`  ${m}`);
+    if (usedFsFallback) {
+      console.log("\n(Some dirs were moved on disk, not via git \u2014 they will show as untracked.)");
+    }
+  }
+  const copiedOrg = orgPlan.kind === "copy";
+  if (copiedOrg) {
+    writeRepoConfig(orgPlan.config, gitRoot);
+    console.log(`${moved.length > 0 ? "\n" : ""}Copied the organization binding into ${WORKSPACE_MANIFEST_LABEL}.`);
+    console.log(
+      `  ${ROOT_CONFIG_FILE} is KEPT on purpose \u2014 an older CLI in a teammate's environment or in CI still requires it.`
+    );
+    console.log(
+      "  It stays a supported fallback until the next major, which removes both the fallback and the file."
+    );
+    console.log("  Delete it once every environment that runs this repo reads the manifest.");
+  }
+  if (moved.length === 0 && !copiedOrg) {
+    console.log(
+      `Already migrated \u2014 no legacy ${WAYAI_LAYOUT.legacy.wsDir}/ or ${WAYAI_LAYOUT.legacy.orgAtRoot}/ to move, and no organization binding to copy into ${WORKSPACE_MANIFEST_LABEL}.`
+    );
+    return;
   }
   console.log("\nNext steps:");
   console.log('  git add -A && git commit -m "chore: migrate to wayai-ws layout"');
@@ -21190,6 +21430,8 @@ var init_migrate = __esm({
     "use strict";
     init_workspace();
     init_layout();
+    init_repo_config();
+    init_workspace_manifest();
   }
 });
 
@@ -22583,8 +22825,8 @@ function installEvalSignalHandlers(input) {
   let signalCount = 0;
   let disposed = false;
   let settle;
-  const settled = new Promise((resolve7) => {
-    settle = resolve7;
+  const settled = new Promise((resolve8) => {
+    settle = resolve8;
   });
   const listeners = /* @__PURE__ */ new Map();
   const dispose = () => {
@@ -22934,7 +23176,7 @@ Timeout after ${timeoutSeconds}s${queuedSeconds > 0 ? ` (${queuedSeconds}s of it
   process.exit(1);
 }
 function sleep(ms) {
-  return new Promise((resolve7) => setTimeout(resolve7, ms));
+  return new Promise((resolve8) => setTimeout(resolve8, ms));
 }
 function parseRunNumbers(raw) {
   if (!raw || raw.startsWith("--")) {
@@ -26790,26 +27032,26 @@ async function reportGetCommand(args2) {
       console.log(JSON.stringify(result, null, 2));
       return;
     }
-    const { report, messages } = result;
-    const title = sanitizeTerminalText(report.title);
-    const description = sanitizeTerminalText(report.description);
-    console.log(`Report ${report.report_id}`);
+    const { report: report2, messages } = result;
+    const title = sanitizeTerminalText(report2.title);
+    const description = sanitizeTerminalText(report2.description);
+    console.log(`Report ${report2.report_id}`);
     console.log(`  title:          ${title}`);
     console.log(`  description:    ${description.replace(/\n/g, "\n                  ")}`);
-    console.log(`  status:         ${report.status}`);
-    console.log(`  classification: ${report.classification}`);
-    if (report.contest_count > 0) console.log(`  contests:       ${report.contest_count}`);
-    if (report.dismissal_final) console.log("  dismissal:      final (non-contestable)");
+    console.log(`  status:         ${report2.status}`);
+    console.log(`  classification: ${report2.classification}`);
+    if (report2.contest_count > 0) console.log(`  contests:       ${report2.contest_count}`);
+    if (report2.dismissal_final) console.log("  dismissal:      final (non-contestable)");
     if (messages.length > 0) {
       console.log("\n  Thread:");
       for (const m of messages) {
         console.log(`    [${m.author_role}] ${sanitizeTerminalText(m.body)}`);
       }
     }
-    if (report.status === "shipped") {
+    if (report2.status === "shipped") {
       console.log(`
-  This fix is shipped. Run \`wayai report accept ${report.report_id}\` if it works,`);
-      console.log(`  or \`wayai report contest ${report.report_id} --reason "..."\` if it does not.`);
+  This fix is shipped. Run \`wayai report accept ${report2.report_id}\` if it works,`);
+      console.log(`  or \`wayai report contest ${report2.report_id} --reason "..."\` if it does not.`);
     }
   } catch (err) {
     reportActionError(err);
@@ -27089,7 +27331,7 @@ var init_actions = __esm({
 
 // src/data/commands/attachments.ts
 import { Command as Command2 } from "commander";
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 function findAttachmentByFilename(attachments, filename) {
   return attachments.find((a) => a.key.endsWith(`/${filename}`)) ?? null;
 }
@@ -27130,7 +27372,7 @@ function buildAttachmentsCommand() {
       printOutput(data, outputFormat(this));
       return;
     }
-    const body = readFileSync21(opts.file);
+    const body = readFileSync20(opts.file);
     await client.upload(uploadPathFrom(data?.upload_url), body, opts.contentType);
     printOutput({ ...data, uploaded: true }, outputFormat(this));
   });
@@ -27610,16 +27852,16 @@ var init_providers = __esm({
 
 // src/data/commands/report.ts
 import { Command as Command6 } from "commander";
-import { readFileSync as readFileSync22 } from "fs";
-import { dirname as dirname11, join as join32 } from "path";
+import { readFileSync as readFileSync21 } from "fs";
+import { dirname as dirname12, join as join31 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function resolveCliVersion() {
   for (const candidate of [
-    join32(here, "..", "package.json"),
-    join32(here, "..", "..", "..", "package.json")
+    join31(here, "..", "package.json"),
+    join31(here, "..", "..", "..", "package.json")
   ]) {
     try {
-      const version = JSON.parse(readFileSync22(candidate, "utf-8")).version;
+      const version = JSON.parse(readFileSync21(candidate, "utf-8")).version;
       if (typeof version === "string" && version) return version;
     } catch {
     }
@@ -27653,10 +27895,10 @@ function reportActionError2(err) {
   throw err;
 }
 function buildBasesReportCommand() {
-  const report = new Command6("report").description(
+  const report2 = new Command6("report").description(
     "File a report to the Data triage queue and verify the outcome"
   );
-  report.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
+  report2.command("create").description("Submit a report to the Data triage queue (deduplicated)").requiredOption("--title <title>", "Short summary").requiredOption("--description <text>", "What happened").option("--source <source>", "Origin: cli_report (default) | review | security_audit").option("--classification <c>", "Nature: bug (default) | flaky_test | security | enhancement").option(
     "--dedup-key <key>",
     'Stable dedup key (e.g. "<file>::<test>"); collapses repeat occurrences'
   ).option("--severity <level>", "low | medium | high | critical").option("--steps <text>", "Steps to reproduce").option("--error-message <text>", "Exact error text if any").option("--context <text>", "Additional context (logs, request ids)").option("--locale <code>", "Notification locale (en | pt | es)", "en").option("--reporter-email <addr>", "Override reporter email (defaults to session email)").option("--base-id <id>", "Base the error relates to (defaults to the configured base)").option("--record-type <name>", "Record type the error relates to").option("--record-id <id>", "Record id (UUID) the error relates to").option("--external-id <id>", "External id of the related record").option("--external-source <src>", "External source of the related record").option("--relationship-id <id>", "Relationship id the error relates to").action(async function(opts) {
@@ -27707,7 +27949,7 @@ function buildBasesReportCommand() {
       );
     }
   });
-  report.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
+  report2.command("list").description("List your reports, newest first").option("--status <s>", "Filter by status (e.g. shipped \u2014 awaiting your verification)").action(async function(opts) {
     const client = await createDataClient();
     const qs = opts.status ? `?status=${encodeURIComponent(opts.status)}` : "";
     try {
@@ -27730,7 +27972,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
+  report2.command("get <report_id>").description("Show one of your reports: status + the message thread").action(async function(reportId) {
     const client = await createDataClient();
     try {
       const data = await client.request("GET", `/v1/reports/${pathSegment(reportId, "report id")}`);
@@ -27767,7 +28009,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
+  report2.command("accept <report_id>").description("Accept a shipped fix (\u2192 addressed)").action(async function(reportId) {
     const client = await createDataClient();
     try {
       const data = await client.request(
@@ -27783,7 +28025,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  report.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
+  report2.command("contest <report_id>").description("Contest a shipped fix or a dismissal (\u2192 back to triage)").requiredOption("--reason <text>", "Why the fix/dismissal is wrong").action(async function(reportId, opts) {
     const client = await createDataClient();
     try {
       const data = await client.request(
@@ -27802,7 +28044,7 @@ function buildBasesReportCommand() {
       reportActionError2(err);
     }
   });
-  return report;
+  return report2;
 }
 var here;
 var init_report2 = __esm({
@@ -27815,13 +28057,13 @@ var init_report2 = __esm({
     init_terminal_output();
     init_workspace();
     init_skill_version();
-    here = dirname11(fileURLToPath2(import.meta.url));
+    here = dirname12(fileURLToPath2(import.meta.url));
   }
 });
 
 // src/data/commands/credentials.ts
 import { Command as Command7 } from "commander";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 function withValueSourceOptions(cmd, what) {
   return cmd.option(
     "--file <path>",
@@ -27834,7 +28076,7 @@ async function resolveValue(opts, label) {
       throw expected("--file cannot be combined with --value-stdin or --value-prompt \u2014 pass one.");
     }
     try {
-      return readFileSync23(opts.file).toString("base64");
+      return readFileSync22(opts.file).toString("base64");
     } catch (e) {
       throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
     }
@@ -27983,7 +28225,7 @@ var init_credentials = __esm({
 
 // src/data/commands/sql.ts
 import { Command as Command8 } from "commander";
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync23 } from "fs";
 function buildBasesSqlCommand() {
   return withBaseOption(new Command8("sql")).description("Execute a read-only SQL query against base data").argument("[query]", "SQL query (SELECT only)").option("--file <path>", "Read SQL from a file instead of the argument").option(
     "--param <kv...>",
@@ -27993,7 +28235,7 @@ function buildBasesSqlCommand() {
     let query;
     if (opts.file) {
       try {
-        query = readFileSync24(opts.file, "utf-8").trim();
+        query = readFileSync23(opts.file, "utf-8").trim();
       } catch (e) {
         throw expected(`--file ${opts.file}: ${e instanceof Error ? e.message : "could not be read"}`);
       }
@@ -28648,7 +28890,7 @@ var init_file_types = __esm({
 
 // src/data/commands/files.ts
 import { Command as Command12 } from "commander";
-import { readFileSync as readFileSync25, writeFileSync as writeFileSync16 } from "fs";
+import { readFileSync as readFileSync24, writeFileSync as writeFileSync16 } from "fs";
 import { basename as basename18 } from "path";
 function renderFileDiff(fileType, filePath, from, to, d) {
   console.log(sanitizeTerminalText(`${fileType}/${filePath}: v${from} \u2192 v${to}`));
@@ -28697,7 +28939,7 @@ function buildFilesCommand() {
     "Upload a local file to a path (e.g. wayai files put reports q3/summary.pdf --file ./summary.pdf)"
   ).requiredOption("--file <local>", "Local file to upload").option("--content-type <type>", "MIME type", "application/octet-stream").action(async function(fileType, filePath, opts) {
     const base = pathSegment(requireBase(this), "--base");
-    const body = readFileSync25(opts.file);
+    const body = readFileSync24(opts.file);
     const client = await createDataClient();
     printOutput(
       await client.upload(
@@ -29658,7 +29900,7 @@ __export(program_exports, {
 });
 import { Command as Command22 } from "commander";
 function withDataGlobals(command2) {
-  return command2.option("--org <uuid>", "Organization to operate against (overrides .wayai.yaml)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
+  return command2.option("--org <uuid>", "Organization to operate against (overrides the repo's org binding)").option("--output <format>", "Output format: json or table", "table").option("--json", "Shorthand for --output json");
 }
 function routeErrorsToCli(command2) {
   command2.exitOverride().configureOutput({ outputError: () => {
@@ -29746,9 +29988,9 @@ init_errors2();
 init_mask_secrets();
 init_utils();
 init_registry();
-import { readFileSync as readFileSync26 } from "fs";
+import { readFileSync as readFileSync25 } from "fs";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname12, join as join33 } from "path";
+import { dirname as dirname13, join as join32 } from "path";
 
 // src/lib/version-refresh.ts
 init_version_cache();
@@ -29756,7 +29998,7 @@ init_skill_version();
 import { exec } from "child_process";
 var REFRESH_TIMEOUT_MS = 1e4;
 function refreshCliCache() {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     exec("npm view @wayai/cli version", { timeout: REFRESH_TIMEOUT_MS }, (err, stdout) => {
       if (!err) {
         const latest = stdout.trim();
@@ -29767,7 +30009,7 @@ function refreshCliCache() {
           }
         }
       }
-      resolve7();
+      resolve8();
     });
   });
 }
@@ -29793,8 +30035,8 @@ async function refreshSkillCache() {
 }
 async function refreshAdminSkillCache() {
   let timer;
-  const deadline = new Promise((resolve7) => {
-    timer = setTimeout(resolve7, REFRESH_TIMEOUT_MS);
+  const deadline = new Promise((resolve8) => {
+    timer = setTimeout(resolve8, REFRESH_TIMEOUT_MS);
   });
   await Promise.race([deadline, fetchAndCacheAdminSkillVersion().catch(() => {
   })]);
@@ -29903,8 +30145,8 @@ Run \`wayai admin skill install\` to update.`);
 }
 
 // src/index.ts
-var __dirname = dirname12(fileURLToPath3(import.meta.url));
-var pkg = JSON.parse(readFileSync26(join33(__dirname, "..", "package.json"), "utf-8"));
+var __dirname = dirname13(fileURLToPath3(import.meta.url));
+var pkg = JSON.parse(readFileSync25(join32(__dirname, "..", "package.json"), "utf-8"));
 var [, , command, ...args] = process.argv;
 var isBackgroundRefresh = command === REFRESH_COMMAND;
 if (!isBackgroundRefresh) initSentry(command, pkg.version);
@@ -30139,7 +30381,7 @@ Commands:
   logout             Clear stored credentials
   status             Show current auth and config status
   whoami             Show the authenticated identity (supports --json)
-  init               Set up .wayai.yaml (pick organization)
+  init               Scope this repo to an organization (pick one)
   create-credential  Create an organization credential (API key, token, etc.)
   update-credential  Update / rotate an organization credential (by name)
   set-connection-credential  Set a connection's credential directly (org link or --field/--stdin), preview or production
@@ -30222,7 +30464,7 @@ Flags:
   --version, -v          Show CLI version
 
 Org-scoped mode:
-  Each repository is scoped to a single organization via .wayai.yaml
+  Each repository is scoped to a single organization via wayai-ws/wayai.yaml
   (only \`organization_id\` is required). Hubs self-identify via \`hub.yaml\`
   inside their folder under \`workspace/\`.