agent-trellis 0.1.0 → 0.3.0

package/dist/adapters/mcpPlan.d.ts

@@ -6,12 +6,17 @@
  * each adapter turns this into plan items using its own read/write
  * mechanism (JSON merge vs. TOML section splice).
  *
- * No automatic removal here (design.md D7, trellis-mcp-sync-p2): unlike a
- * skill's symlink, a plain key has no ownership marker, so "not in
- * canonical anymore" can't be distinguished from "the user configured
- * this directly." Only create/repair + refuse.
+ * Removal is NOT decided here (design.md D7, trellis-mcp-sync-p2): unlike
+ * a skill's symlink, a plain key has no ownership marker of its own, so
+ * "not in canonical anymore" can't be distinguished from "the user
+ * configured this directly" from this function's storage-agnostic view
+ * alone. Each format-specific caller (`jsonMcp.ts`'s `planJsonMcp`,
+ * `codex.ts`'s own `planMcp`) computes removal candidates itself, against
+ * `src/lib/mcpOwnership.ts`'s ledger and that format's own current
+ * on-disk content (trellis-mcp-lifecycle-parity) — this function only
+ * ever returns create/repair + refuse.
  */
-import type { AgentId, McpConfig, McpServerDef } from "../core/types.js";
+import type { AgentId, McpConfig, McpServerDef, SecretsPolicy } from "../core/types.js";
 export declare const HUB_ENTRY_NAME = "trellis-hub";
 export interface DesiredMcpEntry {
     name: string;
@@ -25,4 +30,4 @@ export interface McpPlanResult {
     desired: DesiredMcpEntry[];
     conflicts: McpConflict[];
 }
-export declare function resolveMcpPlan(agentId: AgentId, mcp: McpConfig): McpPlanResult;
+export declare function resolveMcpPlan(agentId: AgentId, mcp: McpConfig, managedAgents: readonly AgentId[], policy: SecretsPolicy): McpPlanResult;

package/dist/adapters/mcpPlan.js

@@ -6,13 +6,19 @@
  * each adapter turns this into plan items using its own read/write
  * mechanism (JSON merge vs. TOML section splice).
  *
- * No automatic removal here (design.md D7, trellis-mcp-sync-p2): unlike a
- * skill's symlink, a plain key has no ownership marker, so "not in
- * canonical anymore" can't be distinguished from "the user configured
- * this directly." Only create/repair + refuse.
+ * Removal is NOT decided here (design.md D7, trellis-mcp-sync-p2): unlike
+ * a skill's symlink, a plain key has no ownership marker of its own, so
+ * "not in canonical anymore" can't be distinguished from "the user
+ * configured this directly" from this function's storage-agnostic view
+ * alone. Each format-specific caller (`jsonMcp.ts`'s `planJsonMcp`,
+ * `codex.ts`'s own `planMcp`) computes removal candidates itself, against
+ * `src/lib/mcpOwnership.ts`'s ledger and that format's own current
+ * on-disk content (trellis-mcp-lifecycle-parity) — this function only
+ * ever returns create/repair + refuse.
  */
 import { isInScope } from "../core/adapter.js";
 import { codexBearerTokenEnvVar } from "../lib/tomlSection.js";
+import { resolveSecretEnv } from "../lib/secretEnv.js";
 export const HUB_ENTRY_NAME = "trellis-hub";
 const CODEX_STDIO_URL_CRASH_NOTE = ' On Codex specifically, this crashes the entire process at startup ("url is not supported for stdio"), not just this one server — see docs/research.md.';
 function collisionMessage(name, agentId) {
@@ -30,7 +36,7 @@ const DANGEROUS_LITERAL_PATTERNS = [
     { label: "mcp-router token (mcpr_)", pattern: /mcpr_/ },
 ];
 function findLiteralSecret(def) {
-    const candidates = [def.command, def.url, ...(def.args ?? []), ...Object.values(def.headers ?? {})].filter((v) => typeof v === "string");
+    const candidates = [def.command, def.url, ...(def.args ?? []), ...Object.values(def.headers ?? {}), ...Object.values(def.staticEnv ?? {})].filter((v) => typeof v === "string");
     for (const candidate of candidates) {
         for (const { label, pattern } of DANGEROUS_LITERAL_PATTERNS) {
             if (pattern.test(candidate)) {
@@ -40,7 +46,22 @@ function findLiteralSecret(def) {
     }
     return undefined;
 }
-export function resolveMcpPlan(agentId, mcp) {
+/**
+ * Name-only `env` entries that don't resolve to anything would otherwise
+ * be written and silently break the agent's connection to that server —
+ * found via real-machine dogfooding (trellis-mcp-static-env-and-disabled-servers
+ * proposal.md "Why"). Uses the identical `resolveSecretEnv` `secrets
+ * audit`/the pi bridge already call, so this and a later `secrets audit`
+ * run can never disagree about what resolves.
+ */
+function findUnresolvedEnvName(def, policy) {
+    const names = def.env ?? [];
+    if (names.length === 0)
+        return undefined;
+    const resolved = resolveSecretEnv(names, policy);
+    return names.find((name) => !resolved[name]);
+}
+export function resolveMcpPlan(agentId, mcp, managedAgents, policy) {
     if (mcp.hub) {
         if (mcp.knownHostInjected.includes(HUB_ENTRY_NAME)) {
             return { desired: [], conflicts: [{ name: HUB_ENTRY_NAME, message: collisionMessage(HUB_ENTRY_NAME, agentId) }] };
@@ -50,7 +71,10 @@ export function resolveMcpPlan(agentId, mcp) {
     const desired = [];
     const conflicts = [];
     for (const [name, def] of Object.entries(mcp.servers)) {
-        if (!isInScope(agentId, def.agents)) {
+        if (def.enabled === false) {
+            continue;
+        }
+        if (!isInScope(agentId, def.agents, managedAgents)) {
             continue;
         }
         if (mcp.knownHostInjected.includes(name)) {
@@ -77,6 +101,15 @@ export function resolveMcpPlan(agentId, mcp) {
             });
             continue;
         }
+        const unresolvedName = findUnresolvedEnvName(def, policy);
+        if (unresolvedName) {
+            const source = policy.envFile ?? "process environment";
+            conflicts.push({
+                name,
+                message: `refusing to write MCP server "${name}": its declared env var "${unresolvedName}" has no resolvable value in ${source} — writing it now would silently break this server's connection once the agent starts it (trellis-mcp-static-env-and-disabled-servers)`,
+            });
+            continue;
+        }
         desired.push({ name, def });
     }
     return { desired, conflicts };

package/dist/adapters/pi.d.ts

@@ -11,6 +11,7 @@
  */
 import type { AdapterPlanItem, AdapterProbeResult, AdapterVerifyResult, TrellisAdapter } from "../core/adapter.js";
 import type { CanonicalSource } from "../core/types.js";
+import type { BackupSession } from "../lib/backup.js";
 export declare class PiAdapter implements TrellisAdapter {
     private readonly homeDir;
     readonly name = "pi";
@@ -18,6 +19,6 @@ export declare class PiAdapter implements TrellisAdapter {
     constructor(homeDir?: string);
     probe(): Promise<AdapterProbeResult>;
     plan(canonical: CanonicalSource): Promise<AdapterPlanItem[]>;
-    apply(plan: AdapterPlanItem[]): Promise<void>;
+    apply(plan: AdapterPlanItem[], backup: BackupSession): Promise<void>;
     verify(canonical: CanonicalSource): Promise<AdapterVerifyResult>;
 }

package/dist/adapters/pi.js

@@ -56,7 +56,7 @@ export class PiAdapter {
         const canonicalRoot = dirname(canonical.instructionsFile);
         const agentDir = join(this.homeDir, ".pi", "agent");
         const desiredSkills = canonical.skills
-            .filter((skill) => isInScope(this.id, skill.scope))
+            .filter((skill) => isInScope(this.id, skill.scope, canonical.managedAgents))
             .map((skill) => ({ name: skill.name, target: skill.dir }));
         const skillItems = planSymlinks({
             rootDir: join(agentDir, "skills"),
@@ -82,8 +82,8 @@ export class PiAdapter {
         });
         return [...skillItems, ...instructionsItems, ...extensionItems];
     }
-    async apply(plan) {
-        await applySymlinkPlan(plan);
+    async apply(plan, backup) {
+        await applySymlinkPlan(plan, backup);
     }
     async verify(canonical) {
         const snapshot = await piProbe.probe(this.homeDir);
@@ -91,7 +91,7 @@ export class PiAdapter {
             return { ok: false, mismatches: ["pi is not present on this machine"] };
         }
         const mismatches = [];
-        const desiredNames = new Set(canonical.skills.filter((s) => isInScope(this.id, s.scope)).map((s) => s.name));
+        const desiredNames = new Set(canonical.skills.filter((s) => isInScope(this.id, s.scope, canonical.managedAgents)).map((s) => s.name));
         const actualSkills = new Set(snapshot.skillRoots.flatMap((root) => root.skills).map((s) => s.name));
         for (const name of desiredNames) {
             if (!actualSkills.has(name)) {

package/dist/adapters/symlinkPlan.d.ts

@@ -4,6 +4,7 @@
  * trellis-sync-p1/specs/skill-instructions-sync/spec.md) — built once,
  * reused by every adapter rather than reimplemented per agent.
  */
+import { type BackupSession } from "../lib/backup.js";
 import type { AdapterPlanItem } from "../core/adapter.js";
 export interface DesiredSymlink {
     /** Basename this entry should have under `rootDir`. */
@@ -28,6 +29,9 @@ export declare function planSymlinks(opts: {
     canonicalRoot: string;
     kind: "skill" | "instructions" | "extension";
 }): AdapterPlanItem[];
-/** Executes a `planSymlinks` result. "conflict" is report-only — see
- * src/core/adapter.ts's `apply()` doc for why this never throws. */
-export declare function applySymlinkPlan(plan: AdapterPlanItem[]): Promise<void>;
+/** Executes a `planSymlinks` result through the run's backup session
+ * (trellis-backup-rollback) — every create/repair/remove is recorded
+ * before it happens; `backup` performs the actual filesystem write, this
+ * function never calls `fs/promises` itself. "conflict" is report-only —
+ * see src/core/adapter.ts's `apply()` doc for why this never throws. */
+export declare function applySymlinkPlan(plan: AdapterPlanItem[], backup: BackupSession): Promise<void>;

package/dist/adapters/symlinkPlan.js

@@ -5,9 +5,10 @@
  * reused by every adapter rather than reimplemented per agent.
  */
 import { existsSync, lstatSync, readdirSync, readlinkSync } from "node:fs";
-import { mkdir, rm, symlink } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 import { join, resolve, sep } from "node:path";
 import { isSymlinkTo } from "../lib/fsIdentity.js";
+import { currentLinkTarget } from "../lib/backup.js";
 function isUnderRoot(path, root) {
     const normalizedRoot = resolve(root);
     const normalizedPath = resolve(path);
@@ -37,14 +38,27 @@ export function planSymlinks(opts) {
         if (isSymlinkTo(path, target)) {
             continue; // already correct — no-op
         }
-        if (existsSync(path) && !lstatSync(path).isSymbolicLink()) {
-            items.push({
-                action: "conflict",
-                kind,
-                target: path,
-                description: `${path} exists and is not a Trellis-managed symlink — left untouched`,
-            });
-            continue;
+        if (existsSync(path)) {
+            const isSymlink = lstatSync(path).isSymbolicLink();
+            // A symlink whose stored target resolves outside canonicalRoot is
+            // owned by something else (e.g. a user's own dotfile-management
+            // setup) — repairing it as if it were a stale Trellis entry would
+            // silently steal that ownership. Raw readlink, not realpath: a
+            // symlink Trellis itself left pointing at a since-removed canonical
+            // entry is broken by construction and must still be treated as
+            // ours to repair, not thrown out to a conflict by a realpath error.
+            const isForeign = isSymlink && !isUnderRoot(readlinkSync(path), canonicalRootResolved);
+            if (!isSymlink || isForeign) {
+                items.push({
+                    action: "conflict",
+                    kind,
+                    target: path,
+                    description: isForeign
+                        ? `${path} exists as a symlink to ${readlinkSync(path)}, not owned by Trellis — left untouched`
+                        : `${path} exists and is not a Trellis-managed symlink — left untouched`,
+                });
+                continue;
+            }
         }
         items.push({
             action: "create",
@@ -100,21 +114,33 @@ export function planSymlinks(opts) {
     }
     return items;
 }
-/** Executes a `planSymlinks` result. "conflict" is report-only — see
- * src/core/adapter.ts's `apply()` doc for why this never throws. */
-export async function applySymlinkPlan(plan) {
+/** Executes a `planSymlinks` result through the run's backup session
+ * (trellis-backup-rollback) — every create/repair/remove is recorded
+ * before it happens; `backup` performs the actual filesystem write, this
+ * function never calls `fs/promises` itself. "conflict" is report-only —
+ * see src/core/adapter.ts's `apply()` doc for why this never throws. */
+export async function applySymlinkPlan(plan, backup) {
     for (const item of plan) {
         if (item.action === "conflict")
             continue;
         if (item.action === "remove") {
-            await rm(item.target, { force: true });
+            const oldTarget = await currentLinkTarget(item.target);
+            if (oldTarget === undefined)
+                continue; // already gone — no-op, nothing to record
+            await backup.removeSymlink(item.target, oldTarget);
             continue;
         }
-        // "create": rootDir may not exist yet (first sync ever for this agent)
+        // "create" also covers repair — rootDir may not exist yet (first
+        // sync ever for this agent).
         if (!item.linkTarget)
             continue;
         await mkdir(resolve(item.target, ".."), { recursive: true });
-        await rm(item.target, { force: true }); // clear a wrong-target symlink before repointing
-        await symlink(item.linkTarget, item.target);
+        const oldTarget = await currentLinkTarget(item.target);
+        if (oldTarget === undefined) {
+            await backup.createSymlink(item.target, item.linkTarget);
+        }
+        else {
+            await backup.repairSymlink(item.target, oldTarget, item.linkTarget);
+        }
     }
 }

package/dist/cli.js

@@ -9,10 +9,13 @@ import { runInit } from "./commands/init.js";
 import { runMigrate } from "./commands/migrate.js";
 import { runOnboard } from "./commands/onboard.js";
 import { runSync } from "./commands/sync.js";
-import { runMcpSync } from "./commands/mcp.js";
+import { runMcpSync, runMcpList, runMcpAdd, runMcpRemove, parseMcpAddArgs } from "./commands/mcp.js";
 import { runSecretsAudit } from "./commands/secretsAudit.js";
+import { runRollback } from "./commands/rollback.js";
+import { runSkillList, runSkillAdd, runSkillRemove } from "./commands/skill.js";
+import { runMemorySync } from "./commands/memory.js";
 import { parseSyncArgs } from "./lib/syncArgs.js";
-const KNOWN_COMMANDS = ["onboard", "init", "migrate", "doctor", "sync", "mcp", "secrets"];
+const KNOWN_COMMANDS = ["onboard", "init", "migrate", "doctor", "sync", "mcp", "skill", "memory", "secrets", "rollback"];
 function printUsage() {
     console.log(`trellis - a single source of capability for every coding agent
 
@@ -20,21 +23,32 @@ Usage:
   trellis <command>
 
 Commands:
-  onboard   Guided flow: init -> detect agents -> pick a base agent ->
-            migrate -> sync, in one command
-              --agent <agent>    non-interactive base-agent choice
-                                 (required with 2+ agents present and
-                                 no terminal to prompt in, e.g. --json)
-              --dry-run          preview the whole flow, write nothing
-              --json             machine-readable output, no report text
+  onboard   Guided flow: init -> detect agents -> pick a migration source ->
+            pick which agents to manage -> migrate -> sync -> mcp sync ->
+            secrets audit, in one command. Source (read from) and managed
+            set (written to) are independent; the source is not managed
+            by default.
+              --agent <agent>       non-interactive migration-source
+                                    choice (required with 2+ candidates
+                                    and no terminal to prompt in)
+              --manage <ids|none>   non-interactive managed-set choice,
+                                    e.g. --manage pi,codex ; --manage none
+                                    means "add nothing new this run"
+                                    (required with no terminal to prompt
+                                    in, e.g. --json)
+              --dry-run             preview the whole flow, write nothing
+              --json                machine-readable output, no report text
   init      Create ~/.trellis/ with a minimal valid skeleton if missing
               (never overwrites an existing file — fills in only what's
               missing) and prints which agents are present
               --json    machine-readable output, no report text
   migrate --from <agent>
-            Import an existing agent's real skills/instructions into
-            canonical source (claude-code | codex | kiro | pi). Never
-            overwrites differing content — reports a conflict instead.
+            Import an existing agent's real skills/instructions/MCP
+            servers into canonical source (claude-code | codex | kiro |
+            pi — pi has no static MCP config, mcp migrate-in is a no-op
+            for it). Never overwrites differing content — reports a
+            conflict instead.
+              --only skills|instructions|mcp   restrict to one category
               --dry-run    preview the plan, write nothing
               --json       machine-readable output, no report text
   doctor    Scan Claude Code / Codex / Kiro / pi for drift
@@ -47,12 +61,62 @@ Commands:
               --dry-run    preview the plan, write nothing
               --json       machine-readable output, no report text
   mcp sync  Distribute MCP servers to each agent's native config
-              (create/repair only — no automatic removal, see docs/roadmap.md)
+              (create/repair, plus ownership-ledger-gated removal — an
+              entry is only ever removed when it's still exactly what
+              Trellis itself last wrote there; see docs/roadmap.md)
+              --dry-run    preview the plan, write nothing
+              --json       machine-readable output, no report text
+  mcp list  List canonical MCP servers (transport, scope, enabled;
+              never prints resolved secret values)
+              --json    machine-readable output, no report text
+  mcp add <name> --transport stdio|http|sse ...
+            Add a canonical MCP server (refuses on an existing name,
+              no overwrite): --command <cmd> [--args a,b] (stdio) or
+              --url <url> (http/sse); [--headers k=v,...]
+              [--env NAME,...] [--static-env k=v,...] [--agents id,...]
+              [--enabled true|false]
+              --dry-run    preview the plan, write nothing
+              --json       machine-readable output, no report text
+  mcp remove <name>
+            Remove a canonical MCP server (canonical-side only — does
+              not touch any agent's already-synced native config)
+              --dry-run    preview the plan, write nothing
+              --json       machine-readable output, no report text
+  skill list
+            List canonical skills with resolved scope
               --json    machine-readable output, no report text
+  skill add <name> --from <path>
+            Import a real skill directory into canonical (refuses on
+              an existing name with different content, no overwrite)
+              --dry-run    preview the plan, write nothing
+              --json       machine-readable output, no report text
+  skill remove <name>
+            Remove a canonical skill (the next sync auto-removes the
+              now-stale symlink on every managed agent)
+              --dry-run    preview the plan, write nothing
+              --json       machine-readable output, no report text
+  memory sync
+            Ingest canonical memories/*.md into the shared-memory MCP
+              server's own on-disk knowledge-graph file (requires a
+              "memory" server with static_env.MEMORY_FILE_PATH set in
+              servers.yaml — see schema/servers.example.yaml; a no-op,
+              not an error, if unconfigured). Never touches an entity
+              or relation this didn't create.
+              --dry-run    preview the plan, write nothing
+              --json       machine-readable output, no report text
   secrets audit
             Scan each present agent's real MCP config for leaked
             credentials and unexpected env var names
               --json    machine-readable output, no report text
+  rollback [<run-id>]
+            Undo one recorded sync/mcp-sync/onboard run (every real write
+              it performed is backed up first, under
+              ~/.trellis/backups/) — omit <run-id> for the most recent
+              run. Refuses per-path (a conflict, not overwritten) if the
+              path changed since that run.
+              --list       show available backup runs, don't restore
+              --dry-run    preview what would be restored, write nothing
+              --json       machine-readable output, no report text
 
 See docs/roadmap.md for what's built vs. planned.`);
 }
@@ -71,7 +135,9 @@ async function main(argv) {
     if (command === "onboard") {
         const agentIndex = rest.indexOf("--agent");
         const agent = agentIndex >= 0 ? rest[agentIndex + 1] : undefined;
-        const { exitCode } = await runOnboard({ agent, dryRun: rest.includes("--dry-run"), json: rest.includes("--json") });
+        const manageIndex = rest.indexOf("--manage");
+        const manage = manageIndex >= 0 ? rest[manageIndex + 1] : undefined;
+        const { exitCode } = await runOnboard({ agent, manage, dryRun: rest.includes("--dry-run"), json: rest.includes("--json") });
         process.exitCode = exitCode;
         return;
     }
@@ -83,7 +149,9 @@ async function main(argv) {
     if (command === "migrate") {
         const fromIndex = rest.indexOf("--from");
         const from = fromIndex >= 0 ? rest[fromIndex + 1] : undefined;
-        const { exitCode } = await runMigrate({ from, dryRun: rest.includes("--dry-run"), json: rest.includes("--json") });
+        const onlyIndex = rest.indexOf("--only");
+        const only = onlyIndex >= 0 ? rest[onlyIndex + 1] : undefined;
+        const { exitCode } = await runMigrate({ from, only, dryRun: rest.includes("--dry-run"), json: rest.includes("--json") });
         process.exitCode = exitCode;
         return;
     }
@@ -105,13 +173,79 @@ async function main(argv) {
         return;
     }
     if (command === "mcp") {
-        const [subcommand] = rest;
+        const [subcommand, ...mcpRest] = rest;
+        const json = mcpRest.includes("--json");
+        const dryRun = mcpRest.includes("--dry-run");
+        if (subcommand === "sync") {
+            const { exitCode } = await runMcpSync({ json, dryRun });
+            process.exitCode = exitCode;
+            return;
+        }
+        if (subcommand === "list") {
+            process.exitCode = runMcpList({ json }).exitCode;
+            return;
+        }
+        if (subcommand === "add") {
+            const [name] = mcpRest;
+            process.exitCode = runMcpAdd(name, parseMcpAddArgs(mcpRest), { json, dryRun }).exitCode;
+            return;
+        }
+        if (subcommand === "remove") {
+            const [name] = mcpRest;
+            if (!name) {
+                console.error("Usage: trellis mcp remove <name>");
+                process.exitCode = 1;
+                return;
+            }
+            process.exitCode = runMcpRemove(name, { json, dryRun }).exitCode;
+            return;
+        }
+        console.error(`Unknown mcp subcommand: ${subcommand ?? "(none)"}\nUsage: trellis mcp sync|list|add <name>|remove <name>\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (command === "skill") {
+        const [subcommand, ...skillRest] = rest;
+        const json = skillRest.includes("--json");
+        const dryRun = skillRest.includes("--dry-run");
+        if (subcommand === "list") {
+            process.exitCode = runSkillList({ json }).exitCode;
+            return;
+        }
+        if (subcommand === "add") {
+            const [name] = skillRest;
+            const fromIndex = skillRest.indexOf("--from");
+            const from = fromIndex >= 0 ? skillRest[fromIndex + 1] : undefined;
+            if (!name || !from) {
+                console.error("Usage: trellis skill add <name> --from <path>");
+                process.exitCode = 1;
+                return;
+            }
+            process.exitCode = runSkillAdd(name, from, { json, dryRun }).exitCode;
+            return;
+        }
+        if (subcommand === "remove") {
+            const [name] = skillRest;
+            if (!name) {
+                console.error("Usage: trellis skill remove <name>");
+                process.exitCode = 1;
+                return;
+            }
+            process.exitCode = runSkillRemove(name, { json, dryRun }).exitCode;
+            return;
+        }
+        console.error(`Unknown skill subcommand: ${subcommand ?? "(none)"}\nUsage: trellis skill list|add <name> --from <path>|remove <name>\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (command === "memory") {
+        const [subcommand, ...memoryRest] = rest;
         if (subcommand !== "sync") {
-            console.error(`Unknown mcp subcommand: ${subcommand ?? "(none)"}\nUsage: trellis mcp sync\n`);
+            console.error(`Unknown memory subcommand: ${subcommand ?? "(none)"}\nUsage: trellis memory sync\n`);
             process.exitCode = 1;
             return;
         }
-        const { exitCode } = await runMcpSync({ json: rest.includes("--json") });
+        const { exitCode } = runMemorySync({ json: memoryRest.includes("--json"), dryRun: memoryRest.includes("--dry-run") });
         process.exitCode = exitCode;
         return;
     }
@@ -126,6 +260,15 @@ async function main(argv) {
         process.exitCode = exitCode;
         return;
     }
+    if (command === "rollback") {
+        const list = rest.includes("--list");
+        const dryRun = rest.includes("--dry-run");
+        const json = rest.includes("--json");
+        const runId = rest.find((arg) => !arg.startsWith("--"));
+        const { exitCode } = await runRollback({ runId, list, dryRun, json });
+        process.exitCode = exitCode;
+        return;
+    }
     console.error(`\`trellis ${command}\` is not implemented yet — this is a pre-alpha scaffold.\nSee docs/roadmap.md for status.`);
     process.exitCode = 1;
 }

package/dist/commands/init.js

@@ -71,6 +71,16 @@ reject_patterns:
 ${patternLines}
 `;
 }
+/** Zero managed agents is the correct starting point (trellis-managed-agents
+ * design.md D1) — `trellis onboard`'s managed-set selection is what
+ * populates this, never `init` guessing on its behalf. */
+function managedYamlTemplate() {
+    return `# Agents Trellis is authorized to write to. Empty means none yet —
+# run \`trellis onboard\` or list agent ids here yourself, e.g.:
+# agents: [pi, codex]
+agents: []
+`;
+}
 /**
  * Trellis never spawns an installer itself (global package installs are
  * exactly the kind of irreversible, system-wide action that needs the
@@ -102,6 +112,7 @@ export async function collectInitReport(homeDir = homedir()) {
         ensureFile(join(root, "agents.md"), AGENTS_MD_TEMPLATE),
         ensureFile(join(root, "mcp", "servers.yaml"), serversYamlTemplate()),
         ensureFile(join(root, "secrets.policy.yaml"), secretsPolicyYamlTemplate()),
+        ensureFile(join(root, "managed.yaml"), managedYamlTemplate()),
     ];
     const probes = [
         { agent: "claude-code", run: () => claudeCodeProbe.probe(homeDir) },