bazilion 0.7.0 → 0.9.0

package/dist/cli.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand as defineCommand23, runCommand, showUsage } from "citty";
+import { defineCommand as defineCommand25, runCommand, showUsage } from "citty";
 
 // package.json
 var package_default = {
   name: "bazilion",
-  version: "0.7.0",
-  description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/groups/skills, and run the local daemon.",
+  version: "0.9.0",
+  description: "Multi-agent runtime CLI \u2014 spawn LLM agents, manage profiles/teams/skills, and run the local daemon.",
   license: "MIT",
   repository: {
     type: "git",
@@ -49,9 +49,9 @@ var package_default = {
     access: "public"
   },
   dependencies: {
-    "@earendil-works/pi-agent-core": "^0.79.10",
-    "@earendil-works/pi-ai": "^0.79.10",
-    "@earendil-works/pi-coding-agent": "^0.79.10",
+    "@earendil-works/pi-agent-core": "^0.80.6",
+    "@earendil-works/pi-ai": "^0.80.6",
+    "@earendil-works/pi-coding-agent": "^0.80.6",
     "@hono/node-server": "^2.0.6",
     "@mozilla/readability": "^0.6.0",
     "@tanstack/react-router": "1.170.16",
@@ -277,13 +277,13 @@ function asPaths(v) {
   return v ? Array.isArray(v) ? v : [v] : [];
 }
 var spawnCmd = defineCommand({
-  meta: { name: "spawn", description: "Spawn an agent from a profile into a group" },
+  meta: { name: "spawn", description: "Spawn an agent from a profile into a team" },
   args: {
     profile: { type: "string", required: true, description: "Profile id" },
     name: { type: "string", description: "Agent name (defaults to profile name)" },
-    group: {
+    team: {
       type: "string",
-      description: "Group to join (defaults to 'default')"
+      description: "Team to join (defaults to 'default')"
     },
     model: { type: "string", description: "Override profile default model" },
     reasoning: {
@@ -293,14 +293,21 @@ var spawnCmd = defineCommand({
   },
   async run({ args }) {
     const client = createClient2();
+    const teamId = args.team ?? "default";
+    const policy = await client.get(
+      `/api/teams/${encodeURIComponent(teamId)}/policy`
+    );
     const body = {
       profileId: args.profile,
       name: args.name,
       model: args.model,
       reasoningLevel: args.reasoning,
-      groupId: args.group
+      teamId,
+      teamExpectedRevision: policy.teamPolicy.revision,
+      placement: "open"
     };
-    const agent = await client.post("/api/agents", body);
+    const response = await client.post("/api/agents", body);
+    const agent = response.agent;
     console.log(`spawned agent ${agent.id} (${agent.name})`);
     console.log(`dir: ${agent.dir}`);
   }
@@ -364,12 +371,12 @@ var listCmd = defineCommand({
   async run({ args }) {
     const client = createClient2();
     const q = args.all ? "?includeArchived=true" : "";
-    const list = await client.get(`/api/agents${q}`);
-    if (list.length === 0) {
+    const list3 = await client.get(`/api/agents${q}`);
+    if (list3.length === 0) {
       console.log("(no agents)");
       return;
     }
-    const rows = list.map(
+    const rows = list3.map(
       (a) => args.long ? [a.id, a.status, a.name, a.profileId] : (
         // Short UUID prefix — all CLI commands accept 4+ char prefixes now.
         [a.id.slice(0, 8), a.status, a.name]
@@ -392,7 +399,7 @@ var showCmd = defineCommand({
     console.log(`profile: ${r.profile.id}`);
     console.log(`model:   ${r.model}`);
     console.log(`dir:     ${r.agent.dir}`);
-    console.log(`group:   ${r.group.id} ${r.group.path}`);
+    console.log(`team:   ${r.team.id} ${r.team.path}`);
     console.log("skills:");
     if (r.skills.length === 0) {
       console.log("  (none)");
@@ -430,7 +437,13 @@ var deleteCmd = defineCommand({
   },
   async run({ args }) {
     const client = createClient2();
-    await client.del(`/api/agents/${args.id}`);
+    const agent = await client.get(`/api/agents/${encodeURIComponent(args.id)}`);
+    const policy = await client.get(
+      `/api/teams/${encodeURIComponent(agent.team.id)}/policy`
+    );
+    await client.del(
+      `/api/agents/${encodeURIComponent(args.id)}?expectedTeamRevision=${policy.teamPolicy.revision}`
+    );
     console.log(`deleted agent ${args.id}`);
   }
 });
@@ -632,8 +645,8 @@ var chatContextCmd = defineCommand({
     if (ctx.systemPrompt.skillsListChars > 0) {
       console.log(`  skills line: ${ctx.systemPrompt.skillsListChars.toLocaleString()} chars`);
     }
-    if (ctx.systemPrompt.groupListChars > 0) {
-      console.log(`  group block: ${ctx.systemPrompt.groupListChars.toLocaleString()} chars`);
+    if (ctx.systemPrompt.teamListChars > 0) {
+      console.log(`  team block: ${ctx.systemPrompt.teamListChars.toLocaleString()} chars`);
     }
     if (ctx.systemPrompt.userMdChars > 0) {
       console.log(`  user_md block: ${ctx.systemPrompt.userMdChars.toLocaleString()} chars`);
@@ -662,10 +675,10 @@ var chatContextCmd = defineCommand({
       }
       console.log("");
     }
-    console.log("## group");
-    console.log(`    - ${ctx.group.id} (${ctx.group.name}): ${ctx.group.path}`);
-    if (ctx.group.userMdChars > 0) {
-      console.log(`    user_md: ${ctx.group.userMdChars.toLocaleString()} chars`);
+    console.log("## team");
+    console.log(`    - ${ctx.team.id} (${ctx.team.name}): ${ctx.team.path}`);
+    if (ctx.team.userMdChars > 0) {
+      console.log(`    user_md: ${ctx.team.userMdChars.toLocaleString()} chars`);
     }
     console.log("");
     console.log("## history");
@@ -736,15 +749,38 @@ var skillAddCmd = defineCommand({
   meta: { name: "add", description: "Attach a skill to an agent" },
   args: {
     agent: { type: "positional", required: true },
-    skill: { type: "positional", required: true }
+    skill: { type: "positional", required: true },
+    "allow-warnings": {
+      type: "boolean",
+      description: "Attach even when the static skill scan reports findings"
+    }
   },
   async run({ args }) {
     const client = createClient2();
-    const body = { skill: args.skill };
-    await client.post(`/api/agents/${args.agent}/skills`, body);
+    const body = { skill: args.skill, allowFindings: args["allow-warnings"] };
+    try {
+      await client.post(`/api/agents/${args.agent}/skills`, body);
+    } catch (err) {
+      if (err instanceof ApiClientError && err.body.code === "skill_scan_blocked") {
+        console.error(`error: ${err.body.error}`);
+        printSkillFindings(err.body.findings ?? []);
+        console.error("  hint: inspect the skill, then rerun with --allow-warnings to confirm");
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
+    }
     console.log(`attached skill ${args.skill} to ${args.agent}`);
   }
 });
+function printSkillFindings(findings) {
+  if (findings.length === 0) return;
+  console.error("scan findings:");
+  for (const f of findings) {
+    const line = f.line ? ` line ${f.line}` : "";
+    console.error(`  ${f.severity}: ${f.code}${line} - ${f.message}`);
+  }
+}
 var skillRmCmd = defineCommand({
   meta: { name: "rm", description: "Detach a skill from an agent" },
   args: {
@@ -765,16 +801,28 @@ var skillCmd = defineCommand({
   }
 });
 var moveCmd = defineCommand({
-  meta: { name: "move", description: "Move an agent to a different group" },
+  meta: { name: "move", description: "Move an agent to a different team" },
   args: {
     agent: { type: "positional", required: true },
-    group: { type: "positional", required: true }
+    team: { type: "positional", required: true }
   },
   async run({ args }) {
     const client = createClient2();
-    const body = { groupId: args.group };
-    await client.patch(`/api/agents/${args.agent}/group`, body);
-    console.log(`moved ${args.agent} to group ${args.group}`);
+    const [agent, destination] = await Promise.all([
+      client.get(`/api/agents/${encodeURIComponent(args.agent)}`),
+      client.get(`/api/teams/${encodeURIComponent(args.team)}/policy`)
+    ]);
+    const source = await client.get(
+      `/api/teams/${encodeURIComponent(agent.team.id)}/policy`
+    );
+    const body = {
+      teamId: args.team,
+      sourceExpectedRevision: source.teamPolicy.revision,
+      destinationExpectedRevision: destination.teamPolicy.revision,
+      placement: "open"
+    };
+    await client.patch(`/api/agents/${args.agent}/team`, body);
+    console.log(`moved ${args.agent} to team ${args.team}`);
   }
 });
 var sessionHeadCmd = defineCommand({
@@ -829,15 +877,102 @@ var agentCommand = defineCommand({
   }
 });
 
+// src/commands/approval.ts
+import { defineCommand as defineCommand2 } from "citty";
+var list = defineCommand2({
+  meta: { name: "list", description: "List communication approval queue/history" },
+  args: {
+    status: { type: "string", default: "pending" },
+    team: { type: "string" },
+    json: { type: "boolean" }
+  },
+  async run({ args }) {
+    const query = new URLSearchParams({ status: args.status, limit: "100" });
+    if (args.team) query.set("teamId", args.team);
+    const body = await createClient2().get(
+      `/api/approvals?${query}`
+    );
+    if (args.json) return console.log(JSON.stringify(body, null, 2));
+    if (!body.approvals.length) return console.log("(no approvals)");
+    for (const line of columnize([
+      ["id", "status", "path", "origin", "expires"],
+      ...body.approvals.map((item) => [
+        item.id,
+        item.status,
+        `${endpoint(item.source)} -> ${endpoint(item.target)}`,
+        item.origin,
+        new Date(item.expiresAt).toISOString()
+      ])
+    ]))
+      console.log(line);
+  }
+});
+var show = defineCommand2({
+  meta: { name: "show", description: "Show one approval including payload and audit events" },
+  args: { id: { type: "positional", required: true }, json: { type: "boolean" } },
+  async run({ args }) {
+    const item = await createClient2().get(
+      `/api/approvals/${encodeURIComponent(args.id)}`
+    );
+    if (args.json) return console.log(JSON.stringify(item, null, 2));
+    console.log(`# ${item.id}`);
+    console.log(`status:    ${item.status}`);
+    console.log(`attempt:   ${item.attemptKind}:${item.attemptId}`);
+    console.log(`path:      ${endpoint(item.source)} -> ${endpoint(item.target)}`);
+    console.log(`origin:    ${item.origin}`);
+    console.log(`expires:   ${new Date(item.expiresAt).toISOString()}`);
+    console.log(
+      `revisions: ${item.policyRefs.map((ref) => `${ref.teamId}@${ref.revision}`).join(", ")}`
+    );
+    console.log(`events:    ${item.events.map((event) => event.event).join(" -> ")}`);
+  }
+});
+function decision(name) {
+  return defineCommand2({
+    meta: {
+      name,
+      description: name === "approve" ? "Approve and deliver one captured attempt" : `${name === "deny" ? "Deny" : "Cancel"} one pending attempt`
+    },
+    args: {
+      id: { type: "positional", required: true },
+      reason: { type: "string" },
+      yes: { type: "boolean", description: "Required explicit non-interactive confirmation" },
+      json: { type: "boolean" }
+    },
+    async run({ args }) {
+      if (!args.yes) throw new Error(`refusing ${name}: review with approval show, then pass --yes`);
+      const item = await createClient2().post(
+        `/api/approvals/${encodeURIComponent(args.id)}/${name}`,
+        args.reason ? { reason: args.reason } : {}
+      );
+      if (args.json) console.log(JSON.stringify(item, null, 2));
+      else console.log(`${item.id}: ${item.status}`);
+    }
+  });
+}
+function endpoint(value) {
+  return value.kind === "agent" ? `agent:${value.id}` : value.kind === "user" ? `user:${value.teamId}` : `outside:${value.teamId}`;
+}
+var approvalCommand = defineCommand2({
+  meta: { name: "approval", description: "Manage communication approval queue and history" },
+  subCommands: {
+    list,
+    show,
+    approve: decision("approve"),
+    deny: decision("deny"),
+    cancel: decision("cancel")
+  }
+});
+
 // src/commands/auth.ts
 import { loginOpenAICodex } from "@earendil-works/pi-ai/oauth";
-import { defineCommand as defineCommand2 } from "citty";
+import { defineCommand as defineCommand3 } from "citty";
 function formatExpiry(ms) {
   if (!ms) return "(unknown)";
   const d = new Date(ms);
   return d.toISOString().replace(/\.\d+Z$/, "Z");
 }
-var openaiLoginCmd = defineCommand2({
+var openaiLoginCmd = defineCommand3({
   meta: {
     name: "login",
     description: "Connect your ChatGPT account via OAuth (browser sign-in)"
@@ -879,7 +1014,7 @@ var openaiLoginCmd = defineCommand2({
     console.log("  bazilion provider models-set openai-codex gpt-5.3-codex-spark");
   }
 });
-var openaiLogoutCmd = defineCommand2({
+var openaiLogoutCmd = defineCommand3({
   meta: {
     name: "logout",
     description: "Forget the stored ChatGPT OAuth credentials"
@@ -890,7 +1025,7 @@ var openaiLogoutCmd = defineCommand2({
     console.log("disconnected ChatGPT OAuth credentials");
   }
 });
-var openaiStatusCmd = defineCommand2({
+var openaiStatusCmd = defineCommand3({
   meta: {
     name: "status",
     description: "Show ChatGPT OAuth connection status"
@@ -907,7 +1042,7 @@ var openaiStatusCmd = defineCommand2({
     console.log(`access token expires: ${formatExpiry(status.expiresAt)}`);
   }
 });
-var openaiCmd = defineCommand2({
+var openaiCmd = defineCommand3({
   meta: {
     name: "openai",
     description: "Manage ChatGPT (OAuth) authentication"
@@ -918,7 +1053,7 @@ var openaiCmd = defineCommand2({
     status: openaiStatusCmd
   }
 });
-var authCommand = defineCommand2({
+var authCommand = defineCommand3({
   meta: {
     name: "auth",
     description: "OAuth-based provider authentication (ChatGPT account, etc.)"
@@ -934,8 +1069,8 @@ import { createWriteStream, existsSync as existsSync2, mkdirSync, readdirSync, r
 import { resolve } from "path";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
-import { defineCommand as defineCommand3 } from "citty";
-var createCmd = defineCommand3({
+import { defineCommand as defineCommand4 } from "citty";
+var createCmd = defineCommand4({
   meta: { name: "create", description: "Download a tar.gz backup of ~/.bazilion from the server" },
   args: {
     output: {
@@ -976,7 +1111,7 @@ async function probeServerRunning(port) {
     return false;
   }
 }
-var restoreCmd = defineCommand3({
+var restoreCmd = defineCommand4({
   meta: {
     name: "restore",
     description: "Extract a backup tar.gz into ~/.bazilion (offline; server must be stopped)"
@@ -1029,7 +1164,7 @@ var restoreCmd = defineCommand3({
     console.log("start the server with: bazilion serve  (migrations apply automatically)");
   }
 });
-var backupCommand = defineCommand3({
+var backupCommand = defineCommand4({
   meta: { name: "backup", description: "Create or restore a ~/.bazilion tar.gz backup" },
   subCommands: {
     create: createCmd,
@@ -1043,7 +1178,7 @@ var backupCommand = defineCommand3({
 });
 
 // src/commands/completion.ts
-import { defineCommand as defineCommand4 } from "citty";
+import { defineCommand as defineCommand5 } from "citty";
 async function walk(cmd, path, out) {
   const subsRaw = cmd.subCommands ?? {};
   const subNames = Object.keys(subsRaw);
@@ -1148,7 +1283,7 @@ function fishScript(flat) {
 `;
 }
 function completionCommand(main2) {
-  return defineCommand4({
+  return defineCommand5({
     meta: {
       name: "completion",
       description: "Print a shell completion script (bash, zsh, or fish)"
@@ -1173,13 +1308,13 @@ function completionCommand(main2) {
 }
 
 // src/commands/config.ts
-import { defineCommand as defineCommand5 } from "citty";
+import { defineCommand as defineCommand6 } from "citty";
 function displayValue(f) {
   if (!f.set) return "(unset)";
   if (f.kind === "secret") return f.preview ?? "(set)";
   return f.value ?? "(set)";
 }
-var listCmd2 = defineCommand5({
+var listCmd2 = defineCommand6({
   meta: {
     name: "list",
     description: "List every configurable field (credentials + URLs) across all services"
@@ -1202,7 +1337,7 @@ var listCmd2 = defineCommand5({
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var setCmd = defineCommand5({
+var setCmd = defineCommand6({
   meta: {
     name: "set",
     description: "Set a configurable field (auto-routes to secrets or plaintext store)"
@@ -1229,7 +1364,7 @@ var setCmd = defineCommand5({
     console.log(`${state.envVar} (${state.kind}): ${displayValue(state)}`);
   }
 });
-var rmCmd = defineCommand5({
+var rmCmd = defineCommand6({
   meta: { name: "rm", description: "Remove a configurable field value" },
   args: {
     envVar: { type: "positional", required: true, description: "Env var name to clear" }
@@ -1240,7 +1375,7 @@ var rmCmd = defineCommand5({
     console.log(`removed ${args.envVar}`);
   }
 });
-var configCommand = defineCommand5({
+var configCommand = defineCommand6({
   meta: {
     name: "config",
     description: "Manage service configuration \u2014 credentials (encrypted) and URLs/IDs (plaintext), unified under one CLI"
@@ -1257,7 +1392,7 @@ import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync3 } from "fs";
 import { connect } from "net";
 import { join as join2 } from "path";
-import { defineCommand as defineCommand6 } from "citty";
+import { defineCommand as defineCommand7 } from "citty";
 var bundledDaemonEntry = join2(import.meta.dirname, "daemon.js");
 var sourceDaemonEntry = join2(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry = existsSync3(bundledDaemonEntry) ? bundledDaemonEntry : sourceDaemonEntry;
@@ -1351,7 +1486,7 @@ function spawnProcess(label, entry2, env) {
     stdio: "inherit"
   });
 }
-var dashboardCommand = defineCommand6({
+var dashboardCommand = defineCommand7({
   meta: {
     name: "dashboard",
     description: "Start the bazilion daemon and bundled web UI"
@@ -1470,8 +1605,8 @@ var dashboardCommand = defineCommand6({
 });
 
 // src/commands/doctor.ts
-import { defineCommand as defineCommand7 } from "citty";
-var doctorCommand = defineCommand7({
+import { defineCommand as defineCommand8 } from "citty";
+var doctorCommand = defineCommand8({
   meta: { name: "doctor", description: "Diagnose your bazilion install" },
   async run() {
     const client = createClient2();
@@ -1498,7 +1633,7 @@ var doctorCommand = defineCommand7({
         console.log(
           `  ${r.database.activeAgents} active agent(s) (${r.database.totalAgents} total)`
         );
-        console.log(`  ${r.database.groups} group(s)`);
+        console.log(`  ${r.database.teams} team(s)`);
       } else {
         check("open database", false, r.database.error);
       }
@@ -1582,178 +1717,6 @@ var doctorCommand = defineCommand7({
   }
 });
 
-// src/commands/group.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { stdin as stdin2 } from "process";
-import { defineCommand as defineCommand8 } from "citty";
-var addCmd = defineCommand8({
-  meta: {
-    name: "add",
-    description: "Register a group at ~/.bazilion/groups/<slug>/ (use --link to point at an existing tree)"
-  },
-  args: {
-    id: { type: "positional", required: true, description: "Group slug" },
-    name: { type: "string", description: "Display name (defaults to slug)" },
-    link: {
-      type: "string",
-      description: "Absolute path of an existing directory; the group slot becomes a symlink to it"
-    }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    const body = {
-      id: args.id,
-      ...args.name ? { name: args.name } : {},
-      ...args.link ? { link: args.link } : {}
-    };
-    const g = await client.post("/api/groups", body);
-    console.log(`registered group ${g.id} at ${g.path}`);
-  }
-});
-var listCmd3 = defineCommand8({
-  meta: { name: "list", description: "List groups" },
-  async run() {
-    const client = createClient2();
-    const list = await client.get("/api/groups");
-    if (list.length === 0) {
-      console.log("(no groups)");
-      return;
-    }
-    const rows = list.map((g) => [g.id, g.path]);
-    for (const line of columnize(rows)) console.log(line);
-  }
-});
-var rmCmd2 = defineCommand8({
-  meta: { name: "rm", description: "Remove a group registration" },
-  args: {
-    id: { type: "positional", required: true }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    await client.del(`/api/groups/${args.id}`);
-    console.log(`removed group ${args.id}`);
-  }
-});
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of stdin2) chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8");
-}
-var userMdShowCmd = defineCommand8({
-  meta: { name: "show", description: "Print the group's USER.md" },
-  args: { id: { type: "positional", required: true } },
-  async run({ args }) {
-    const client = createClient2();
-    const g = await client.get(`/api/groups/${args.id}`);
-    process.stdout.write(g.userMd);
-    if (g.userMd && !g.userMd.endsWith("\n")) process.stdout.write("\n");
-  }
-});
-var userMdSetCmd = defineCommand8({
-  meta: {
-    name: "set",
-    description: "Replace the group's USER.md (from --file, --from-stdin, or inline text)"
-  },
-  args: {
-    id: { type: "positional", required: true },
-    file: { type: "string", description: "Read content from a file path" },
-    "from-stdin": { type: "boolean", description: "Read content from stdin" },
-    text: { type: "string", description: "Inline content" }
-  },
-  async run({ args }) {
-    let content;
-    if (args["from-stdin"]) content = await readStdin();
-    else if (args.file) content = readFileSync3(args.file, "utf8");
-    else if (args.text !== void 0) content = args.text;
-    else {
-      console.error("group user-md set: provide --file, --from-stdin, or --text");
-      process.exit(2);
-    }
-    const client = createClient2();
-    const body = { userMd: content };
-    await client.put(`/api/groups/${args.id}/user-md`, body);
-    console.log(`updated USER.md for group ${args.id} (${content.length} bytes)`);
-  }
-});
-var userMdClearCmd = defineCommand8({
-  meta: { name: "clear", description: "Clear the group's USER.md to empty" },
-  args: { id: { type: "positional", required: true } },
-  async run({ args }) {
-    const client = createClient2();
-    const body = { userMd: "" };
-    await client.put(`/api/groups/${args.id}/user-md`, body);
-    console.log(`cleared USER.md for group ${args.id}`);
-  }
-});
-var userMdCmd = defineCommand8({
-  meta: { name: "user-md", description: "View or edit a group's USER.md" },
-  subCommands: {
-    show: userMdShowCmd,
-    set: userMdSetCmd,
-    clear: userMdClearCmd
-  }
-});
-var topicFormatShowCmd = defineCommand8({
-  meta: { name: "show", description: "Print the group's Telegram topic-name template" },
-  args: { id: { type: "positional", required: true } },
-  async run({ args }) {
-    const client = createClient2();
-    const g = await client.get(`/api/groups/${args.id}`);
-    console.log(g.telegramTopicNameFormat ?? "(default naming)");
-  }
-});
-var topicFormatSetCmd = defineCommand8({
-  meta: {
-    name: "set",
-    description: "Set the topic-name template. Tokens: {agent.name} {group.name} {group.slug} (must include {agent.name})"
-  },
-  args: {
-    id: { type: "positional", required: true },
-    format: {
-      type: "positional",
-      required: true,
-      description: 'e.g. "{group.name} / {agent.name}"'
-    }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    const body = { format: args.format };
-    const g = await client.put(`/api/groups/${args.id}/topic-format`, body);
-    console.log(`set topic-name template for group ${args.id}: ${g.telegramTopicNameFormat}`);
-  }
-});
-var topicFormatClearCmd = defineCommand8({
-  meta: { name: "clear", description: "Clear the template (revert to built-in naming)" },
-  args: { id: { type: "positional", required: true } },
-  async run({ args }) {
-    const client = createClient2();
-    const body = { format: null };
-    await client.put(`/api/groups/${args.id}/topic-format`, body);
-    console.log(`cleared topic-name template for group ${args.id}`);
-  }
-});
-var topicFormatCmd = defineCommand8({
-  meta: {
-    name: "topic-format",
-    description: "View or edit a group's Telegram forum-topic name template"
-  },
-  subCommands: {
-    show: topicFormatShowCmd,
-    set: topicFormatSetCmd,
-    clear: topicFormatClearCmd
-  }
-});
-var groupCommand = defineCommand8({
-  meta: { name: "group", description: "Manage groups (collaboration contexts)" },
-  subCommands: {
-    add: addCmd,
-    list: listCmd3,
-    rm: rmCmd2,
-    "user-md": userMdCmd,
-    "topic-format": topicFormatCmd
-  }
-});
-
 // src/commands/inbox.ts
 import { defineCommand as defineCommand9 } from "citty";
 function decodeText(payload) {
@@ -1767,11 +1730,11 @@ function decodeText(payload) {
 function messageRow(m) {
   const when = new Date(m.createdAt).toISOString();
   const state = m.readAt ? "read" : "NEW";
-  const text = decodeText(m.payload);
-  const preview = text.length > 60 ? `${text.slice(0, 60)}\u2026` : text;
+  const text2 = decodeText(m.payload);
+  const preview = text2.length > 60 ? `${text2.slice(0, 60)}\u2026` : text2;
   return [m.id, state, when, `from:${m.fromAgentId.slice(0, 8)}`, `"${preview}"`];
 }
-var listCmd4 = defineCommand9({
+var listCmd3 = defineCommand9({
   meta: { name: "list", description: "List messages in an agent inbox" },
   args: {
     agent: { type: "positional", required: true, description: "Recipient agent id" },
@@ -1824,14 +1787,14 @@ var readCmd = defineCommand9({
 var inboxCommand = defineCommand9({
   meta: { name: "inbox", description: "Inspect agent inboxes" },
   subCommands: {
-    list: listCmd4,
+    list: listCmd3,
     show: showCmd2,
     read: readCmd
   }
 });
 
 // src/commands/login.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { defineCommand as defineCommand10 } from "citty";
 function normalizeServer(raw) {
   let url;
@@ -1870,7 +1833,7 @@ var loginCommand = defineCommand10({
         `${paths.authFile} not found. Start the daemon with "bazilion serve" first \u2014 login stores the remote there.`
       );
     }
-    const auth = JSON.parse(readFileSync4(paths.authFile, "utf8"));
+    const auth = JSON.parse(readFileSync3(paths.authFile, "utf8"));
     if (args.clear) {
       if (!auth.remote) {
         console.log("no remote stored \u2014 nothing to clear");
@@ -1912,7 +1875,7 @@ function serverRow(s) {
     where
   ];
 }
-var addCmd2 = defineCommand11({
+var addCmd = defineCommand11({
   meta: { name: "add", description: "Register an MCP server" },
   args: {
     name: { type: "positional", required: true, description: "Unique name ([a-zA-Z0-9_])" },
@@ -1939,7 +1902,7 @@ var addCmd2 = defineCommand11({
     console.log(`${server.id}	${server.name}	${server.transport}`);
   }
 });
-var listCmd5 = defineCommand11({
+var listCmd4 = defineCommand11({
   meta: { name: "list", description: "List MCP servers" },
   async run() {
     const client = createClient2();
@@ -1960,7 +1923,7 @@ var showCmd3 = defineCommand11({
     console.log(JSON.stringify(server, null, 2));
   }
 });
-var rmCmd3 = defineCommand11({
+var rmCmd2 = defineCommand11({
   meta: { name: "rm", description: "Delete an MCP server" },
   args: { id: { type: "positional", required: true } },
   async run({ args }) {
@@ -2008,10 +1971,10 @@ var testCmd = defineCommand11({
 var mcpCommand = defineCommand11({
   meta: { name: "mcp", description: "Manage MCP servers" },
   subCommands: {
-    add: addCmd2,
-    list: listCmd5,
+    add: addCmd,
+    list: listCmd4,
     show: showCmd3,
-    rm: rmCmd3,
+    rm: rmCmd2,
     enable: enableCmd,
     disable: disableCmd,
     test: testCmd
@@ -2024,39 +1987,39 @@ function encodeKey(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
 var writeCmd = defineCommand12({
-  meta: { name: "write", description: "Write an entry into a group's shared memory" },
+  meta: { name: "write", description: "Write an entry into a team's shared memory" },
   args: {
-    group: { type: "positional", required: true, description: "Group slug" },
+    team: { type: "positional", required: true, description: "Team slug" },
     key: { type: "positional", required: true, description: "Memory key (path under memory/)" },
     content: { type: "positional", required: true, description: "Content to write" }
   },
   async run({ args }) {
     const client = createClient2();
     const entry2 = await client.put(
-      `/api/groups/${args.group}/memory/${encodeKey(args.key)}`,
+      `/api/teams/${args.team}/memory/${encodeKey(args.key)}`,
       { content: args.content }
     );
     console.log(`wrote ${entry2.key} (${entry2.content.length} bytes)`);
   }
 });
 var readCmd2 = defineCommand12({
-  meta: { name: "read", description: "Read an entry from a group's shared memory" },
+  meta: { name: "read", description: "Read an entry from a team's shared memory" },
   args: {
-    group: { type: "positional", required: true, description: "Group slug" },
+    team: { type: "positional", required: true, description: "Team slug" },
     key: { type: "positional", required: true }
   },
   async run({ args }) {
     const client = createClient2();
     const entry2 = await client.get(
-      `/api/groups/${args.group}/memory/${encodeKey(args.key)}`
+      `/api/teams/${args.team}/memory/${encodeKey(args.key)}`
     );
     console.log(entry2.content);
   }
 });
 var searchCmd = defineCommand12({
-  meta: { name: "search", description: "Search a group's shared memory" },
+  meta: { name: "search", description: "Search a team's shared memory" },
   args: {
-    group: { type: "positional", required: true, description: "Group slug" },
+    team: { type: "positional", required: true, description: "Team slug" },
     query: { type: "positional", required: true },
     limit: { type: "string", description: "Max results (default 10)" }
   },
@@ -2064,7 +2027,7 @@ var searchCmd = defineCommand12({
     const client = createClient2();
     const limit = args.limit ? Number.parseInt(args.limit, 10) : 10;
     const params = new URLSearchParams({ q: args.query, limit: String(limit) });
-    const hits = await client.get(`/api/groups/${args.group}/memory/search?${params}`);
+    const hits = await client.get(`/api/teams/${args.team}/memory/search?${params}`);
     if (hits.length === 0) {
       console.log("(no matches)");
       return;
@@ -2074,14 +2037,14 @@ var searchCmd = defineCommand12({
     }
   }
 });
-var listCmd6 = defineCommand12({
-  meta: { name: "list", description: "List all entries in a group's shared memory" },
+var listCmd5 = defineCommand12({
+  meta: { name: "list", description: "List all entries in a team's shared memory" },
   args: {
-    group: { type: "positional", required: true, description: "Group slug" }
+    team: { type: "positional", required: true, description: "Team slug" }
   },
   async run({ args }) {
     const client = createClient2();
-    const all = await client.get(`/api/groups/${args.group}/memory`);
+    const all = await client.get(`/api/teams/${args.team}/memory`);
     if (all.length === 0) {
       console.log("(no memory entries)");
       return;
@@ -2091,36 +2054,36 @@ var listCmd6 = defineCommand12({
     }
   }
 });
-var rmCmd4 = defineCommand12({
-  meta: { name: "rm", description: "Remove an entry from a group's shared memory" },
+var rmCmd3 = defineCommand12({
+  meta: { name: "rm", description: "Remove an entry from a team's shared memory" },
   args: {
-    group: { type: "positional", required: true, description: "Group slug" },
+    team: { type: "positional", required: true, description: "Team slug" },
     key: { type: "positional", required: true }
   },
   async run({ args }) {
     const client = createClient2();
-    await client.del(`/api/groups/${args.group}/memory/${encodeKey(args.key)}`);
+    await client.del(`/api/teams/${args.team}/memory/${encodeKey(args.key)}`);
     console.log(`removed ${args.key}`);
   }
 });
 var memoryCommand = defineCommand12({
   meta: {
     name: "memory",
-    description: "Manage a group's shared memory (BM25-indexed markdown notes)"
+    description: "Manage a team's shared memory (BM25-indexed markdown notes)"
   },
   subCommands: {
     write: writeCmd,
     read: readCmd2,
     search: searchCmd,
-    list: listCmd6,
-    rm: rmCmd4
+    list: listCmd5,
+    rm: rmCmd3
   }
 });
 
 // src/commands/profile.ts
 import { spawn as spawn3 } from "child_process";
 import { randomBytes } from "crypto";
-import { readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir } from "os";
 import { join as join3 } from "path";
 
@@ -2196,7 +2159,7 @@ var createCmd2 = defineCommand13({
   },
   async run({ args }) {
     const skillsMode = parseSkillsMode(args["skills-mode"]);
-    const readTemplate = (path) => path ? readFileSync5(path, "utf8") : void 0;
+    const readTemplate = (path) => path ? readFileSync4(path, "utf8") : void 0;
     const body = {
       id: args.id,
       name: args.name,
@@ -2215,16 +2178,16 @@ var createCmd2 = defineCommand13({
     console.log(`created profile ${profile.id} at ${profile.dir}`);
   }
 });
-var listCmd7 = defineCommand13({
+var listCmd6 = defineCommand13({
   meta: { name: "list", description: "List profiles" },
   async run() {
     const client = createClient2();
-    const list = await client.get("/api/profiles");
-    if (list.length === 0) {
+    const list3 = await client.get("/api/profiles");
+    if (list3.length === 0) {
       console.log("(no profiles)");
       return;
     }
-    const rows = list.map((p) => [p.id, p.defaultModel, p.name]);
+    const rows = list3.map((p) => [p.id, p.defaultModel, p.name]);
     for (const line of columnize(rows)) console.log(line);
   }
 });
@@ -2283,7 +2246,7 @@ var editCmd2 = defineCommand13({
         child.on("close", (c) => resolve3(c ?? 0));
       });
       if (code !== 0) throw new Error(`editor exited with code ${code}`);
-      const updated = readFileSync5(tmpPath, "utf8");
+      const updated = readFileSync4(tmpPath, "utf8");
       if (updated === content) {
         console.log("(no changes)");
         return;
@@ -2348,7 +2311,7 @@ var profileCommand = defineCommand13({
   meta: { name: "profile", description: "Manage profiles" },
   subCommands: {
     create: createCmd2,
-    list: listCmd7,
+    list: listCmd6,
     show: showCmd4,
     edit: editCmd2,
     update: updateCmd,
@@ -2356,295 +2319,71 @@ var profileCommand = defineCommand13({
   }
 });
 
-// src/commands/profile-group.ts
-import { spawn as spawn4 } from "child_process";
-import { randomBytes as randomBytes2 } from "crypto";
-import { readFileSync as readFileSync6, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join4 } from "path";
+// src/commands/provider.ts
 import { defineCommand as defineCommand14 } from "citty";
-var createCmd3 = defineCommand14({
-  meta: { name: "create", description: "Create a new profile group (team template)" },
+var listCmd7 = defineCommand14({
+  meta: {
+    name: "list",
+    description: "List all providers with enabled/disabled state and curated model counts"
+  },
   args: {
-    id: { type: "positional", required: true, description: "Profile group slug" },
-    name: { type: "string", description: "Display name (defaults to slug)" },
-    "user-md-file": {
-      type: "string",
-      description: "Path to a starter USER.md; seeded into a freshly-created target group"
-    }
+    enabled: { type: "boolean", description: "Show only enabled providers" }
   },
   async run({ args }) {
-    const body = { id: args.id };
-    if (args.name) body.name = args.name;
-    if (args["user-md-file"]) body.userMd = readFileSync6(args["user-md-file"], "utf8");
-    const client = createClient2();
-    const created = await client.post("/api/profile-groups", body);
-    console.log(`created profile group ${created.id}`);
-  }
-});
-var listCmd8 = defineCommand14({
-  meta: { name: "list", description: "List profile groups" },
-  async run() {
     const client = createClient2();
-    const list = await client.get("/api/profile-groups");
-    if (list.length === 0) {
-      console.log("(no profile groups)");
+    const { providers } = await client.get("/api/config/providers");
+    const filtered = args.enabled ? providers.filter((p) => p.enabled) : providers;
+    if (filtered.length === 0) {
+      console.log("(no providers to show)");
       return;
     }
-    const rows = list.map((g) => [g.id, String(g.memberCount), g.name]);
+    const rows = filtered.map((p) => [
+      p.id,
+      p.enabled ? "enabled" : "disabled",
+      `${p.curated.length} curated`,
+      `${p.catalog.length} catalog`,
+      p.enabled ? "" : `(set ${p.envHint})`
+    ]);
     for (const line of columnize(rows)) console.log(line);
   }
 });
-var showCmd5 = defineCommand14({
-  meta: { name: "show", description: "Show profile group details + members" },
+var modelsCmd = defineCommand14({
+  meta: {
+    name: "models",
+    description: "Show curated + catalog + live models for one provider"
+  },
   args: {
-    id: { type: "positional", required: true },
-    json: { type: "boolean", description: "Emit full JSON (members + basics)" }
+    name: { type: "positional", required: true, description: "Provider name" }
   },
   async run({ args }) {
     const client = createClient2();
-    const detail = await client.get(`/api/profile-groups/${args.id}`);
-    if (args.json) {
-      console.log(JSON.stringify(detail, null, 2));
-      return;
+    const { providers } = await client.get("/api/config/providers");
+    const p = providers.find((x) => x.id === args.name);
+    if (!p) {
+      console.error(`unknown provider: ${args.name}`);
+      process.exit(1);
     }
-    console.log(`# ${detail.group.id}`);
-    console.log(`name:    ${detail.group.name}`);
-    console.log(
-      `user-md: ${detail.group.userMd ? `${detail.group.userMd.length} chars` : "(none)"}`
-    );
-    console.log("");
-    if (detail.members.length === 0) {
-      console.log("(no members)");
-      return;
+    console.log(`# ${p.id} (${p.enabled ? "enabled" : "disabled"})`);
+    if (!p.enabled) console.log(`  (set ${p.envHint} to enable)`);
+    console.log("\n## curated");
+    if (p.curated.length === 0) console.log("  (none \u2014 use `provider models-set` to pin some)");
+    else for (const m of p.curated) console.log(`  ${m}`);
+    console.log("\n## catalog (from pi-ai)");
+    if (p.catalog.length === 0) console.log("  (empty)");
+    else for (const m of p.catalog) console.log(`  ${m}`);
+    if (p.live) {
+      console.log("\n## live (from upstream /v1/models)");
+      if (p.live.error) console.log(`  (error: ${p.live.error})`);
+      else if (p.live.models.length === 0) console.log("  (empty)");
+      else for (const m of p.live.models) console.log(`  ${m}`);
     }
-    console.log("members:");
-    const rows = [
-      ["#", "profile", "agent-name", "model-override", "reasoning"],
-      ...detail.members.map((m) => [
-        String(m.position),
-        m.profileId,
-        m.agentName,
-        m.modelOverride ?? "-",
-        m.reasoningLevel ?? "-"
-      ])
-    ];
-    for (const line of columnize(rows)) console.log(`  ${line}`);
   }
 });
-var updateCmd2 = defineCommand14({
-  meta: { name: "update", description: "Update profile group basics (name, user-md)" },
-  args: {
-    id: { type: "positional", required: true },
-    name: { type: "string", description: "New display name" },
-    "user-md-file": {
-      type: "string",
-      description: "Path to new USER.md content (pass empty string to clear)"
-    }
-  },
-  async run({ args }) {
-    const body = {};
-    if (args.name !== void 0) body.name = args.name;
-    if (args["user-md-file"] !== void 0) {
-      body.userMd = args["user-md-file"] === "" ? null : readFileSync6(args["user-md-file"], "utf8");
-    }
-    if (Object.keys(body).length === 0) {
-      throw new Error("nothing to update \u2014 pass at least one of --name/--user-md-file");
-    }
-    const client = createClient2();
-    const updated = await client.patch(`/api/profile-groups/${args.id}`, body);
-    console.log(`updated profile group ${updated.id}`);
-  }
-});
-var editCmd3 = defineCommand14({
-  meta: { name: "edit", description: "Edit the member array in $EDITOR (JSON)" },
-  args: {
-    id: { type: "positional", required: true }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    const detail = await client.get(`/api/profile-groups/${args.id}`);
-    const editable = detail.members.map((m) => ({
-      profileId: m.profileId,
-      agentName: m.agentName,
-      modelOverride: m.modelOverride,
-      reasoningLevel: m.reasoningLevel
-    }));
-    const before = `${JSON.stringify(editable, null, 2)}
-`;
-    const tmpPath = join4(
-      tmpdir2(),
-      `bazilion-profile-group-${args.id}-${randomBytes2(4).toString("hex")}.json`
-    );
-    writeFileSync4(tmpPath, before);
-    try {
-      const editor = process.env.EDITOR ?? process.env.VISUAL ?? "vi";
-      const code = await new Promise((resolve3, reject) => {
-        const child = spawn4(editor, [tmpPath], { stdio: "inherit" });
-        child.on("error", reject);
-        child.on("close", (c) => resolve3(c ?? 0));
-      });
-      if (code !== 0) throw new Error(`editor exited with code ${code}`);
-      const after = readFileSync6(tmpPath, "utf8");
-      if (after === before) {
-        console.log("(no changes)");
-        return;
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(after);
-      } catch (err) {
-        throw new Error(`invalid JSON: ${err.message}`);
-      }
-      if (!Array.isArray(parsed)) {
-        throw new Error("expected a JSON array of members");
-      }
-      const body = {
-        members: parsed.map((s, i) => {
-          const row = s;
-          if (!row || typeof row.profileId !== "string" || typeof row.agentName !== "string") {
-            throw new Error(`member ${i}: profileId and agentName are required strings`);
-          }
-          return {
-            profileId: row.profileId,
-            agentName: row.agentName,
-            modelOverride: row.modelOverride ?? null,
-            reasoningLevel: row.reasoningLevel === null || row.reasoningLevel === void 0 ? null : row.reasoningLevel
-          };
-        })
-      };
-      await client.put(`/api/profile-groups/${args.id}/members`, body);
-      console.log(`saved ${body.members.length} member(s)`);
-    } finally {
-      try {
-        rmSync3(tmpPath, { force: true });
-      } catch {
-      }
-    }
-  }
-});
-var deleteCmd3 = defineCommand14({
-  meta: { name: "delete", description: "Delete a profile group (does not affect spawned agents)" },
-  args: {
-    id: { type: "positional", required: true }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    await client.del(`/api/profile-groups/${args.id}`);
-    console.log(`deleted profile group ${args.id}`);
-  }
-});
-var spawnCmd2 = defineCommand14({
-  meta: { name: "spawn", description: "Spawn the whole team into a group (transactional)" },
-  args: {
-    id: { type: "positional", required: true },
-    group: {
-      type: "string",
-      description: "Target group slug (overrides the template default)"
-    },
-    "user-md-file": {
-      type: "string",
-      description: "Path to USER.md content to seed (only takes effect on a fresh target group)"
-    }
-  },
-  async run({ args }) {
-    const body = {};
-    if (args.group) body.groupSlug = args.group;
-    if (args["user-md-file"]) body.userMd = readFileSync6(args["user-md-file"], "utf8");
-    const client = createClient2();
-    const result = await client.post(
-      `/api/profile-groups/${args.id}/spawn`,
-      body
-    );
-    console.log(`spawned ${result.agents.length} agent(s) into group ${result.groupSlug}`);
-    const rows = result.agents.map((a) => [a.id, a.name]);
-    for (const line of columnize(rows)) console.log(`  ${line}`);
-    if (result.orphanAgentIds && result.orphanAgentIds.length > 0) {
-      console.error("");
-      console.error(`warning: ${result.orphanAgentIds.length} orphan agent dir(s) left on disk:`);
-      for (const id of result.orphanAgentIds) console.error(`  ${id}`);
-      process.exitCode = 1;
-    }
-  }
-});
-var profileGroupCommand = defineCommand14({
-  meta: { name: "profile-group", description: "Manage profile groups" },
-  subCommands: {
-    create: createCmd3,
-    list: listCmd8,
-    show: showCmd5,
-    update: updateCmd2,
-    edit: editCmd3,
-    delete: deleteCmd3,
-    spawn: spawnCmd2
-  }
-});
-
-// src/commands/provider.ts
-import { defineCommand as defineCommand15 } from "citty";
-var listCmd9 = defineCommand15({
-  meta: {
-    name: "list",
-    description: "List all providers with enabled/disabled state and curated model counts"
-  },
-  args: {
-    enabled: { type: "boolean", description: "Show only enabled providers" }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    const { providers } = await client.get("/api/config/providers");
-    const filtered = args.enabled ? providers.filter((p) => p.enabled) : providers;
-    if (filtered.length === 0) {
-      console.log("(no providers to show)");
-      return;
-    }
-    const rows = filtered.map((p) => [
-      p.id,
-      p.enabled ? "enabled" : "disabled",
-      `${p.curated.length} curated`,
-      `${p.catalog.length} catalog`,
-      p.enabled ? "" : `(set ${p.envHint})`
-    ]);
-    for (const line of columnize(rows)) console.log(line);
-  }
-});
-var modelsCmd = defineCommand15({
-  meta: {
-    name: "models",
-    description: "Show curated + catalog + live models for one provider"
-  },
-  args: {
-    name: { type: "positional", required: true, description: "Provider name" }
-  },
-  async run({ args }) {
-    const client = createClient2();
-    const { providers } = await client.get("/api/config/providers");
-    const p = providers.find((x) => x.id === args.name);
-    if (!p) {
-      console.error(`unknown provider: ${args.name}`);
-      process.exit(1);
-    }
-    console.log(`# ${p.id} (${p.enabled ? "enabled" : "disabled"})`);
-    if (!p.enabled) console.log(`  (set ${p.envHint} to enable)`);
-    console.log("\n## curated");
-    if (p.curated.length === 0) console.log("  (none \u2014 use `provider models-set` to pin some)");
-    else for (const m of p.curated) console.log(`  ${m}`);
-    console.log("\n## catalog (from pi-ai)");
-    if (p.catalog.length === 0) console.log("  (empty)");
-    else for (const m of p.catalog) console.log(`  ${m}`);
-    if (p.live) {
-      console.log("\n## live (from upstream /v1/models)");
-      if (p.live.error) console.log(`  (error: ${p.live.error})`);
-      else if (p.live.models.length === 0) console.log("  (empty)");
-      else for (const m of p.live.models) console.log(`  ${m}`);
-    }
-  }
-});
-var modelsSetCmd = defineCommand15({
-  meta: {
-    name: "models-set",
-    description: "Replace the curated model list for a provider (comma-separated)"
-  },
+var modelsSetCmd = defineCommand14({
+  meta: {
+    name: "models-set",
+    description: "Replace the curated model list for a provider (comma-separated)"
+  },
   args: {
     name: { type: "positional", required: true, description: "Provider name" },
     models: {
@@ -2665,7 +2404,7 @@ var modelsSetCmd = defineCommand15({
     for (const m of saved.models) console.log(`  ${m}`);
   }
 });
-var enableCmd2 = defineCommand15({
+var enableCmd2 = defineCommand14({
   meta: { name: "enable", description: "Toggle a provider on so agents can use it" },
   args: {
     name: { type: "positional", required: true, description: "Provider id (e.g. anthropic)" }
@@ -2679,7 +2418,7 @@ var enableCmd2 = defineCommand15({
     console.log(`${res.name}: enabled`);
   }
 });
-var disableCmd2 = defineCommand15({
+var disableCmd2 = defineCommand14({
   meta: {
     name: "disable",
     description: "Toggle a provider off \u2014 agents will refuse its model strings"
@@ -2696,7 +2435,7 @@ var disableCmd2 = defineCommand15({
     console.log(`${res.name}: disabled`);
   }
 });
-var testCmd2 = defineCommand15({
+var testCmd2 = defineCommand14({
   meta: { name: "test", description: "Send a single chat to a model and print the reply" },
   args: {
     model: {
@@ -2717,10 +2456,10 @@ var testCmd2 = defineCommand15({
     }
   }
 });
-var providerCommand = defineCommand15({
+var providerCommand = defineCommand14({
   meta: { name: "provider", description: "Manage and test LLM providers" },
   subCommands: {
-    list: listCmd9,
+    list: listCmd7,
     enable: enableCmd2,
     disable: disableCmd2,
     models: modelsCmd,
@@ -2730,8 +2469,8 @@ var providerCommand = defineCommand15({
 });
 
 // src/commands/send.ts
-import { defineCommand as defineCommand16 } from "citty";
-var sendCommand = defineCommand16({
+import { defineCommand as defineCommand15 } from "citty";
+var sendCommand = defineCommand15({
   meta: {
     name: "send",
     description: "Send a message from one agent to another"
@@ -2747,20 +2486,29 @@ var sendCommand = defineCommand16({
       from: args.from,
       payload: { text: args.message }
     };
-    const msg = await client.post(`/api/agents/${args.to}/messages`, body);
-    console.log(`sent message ${msg.id}`);
+    const result = await client.post(
+      `/api/agents/${args.to}/messages`,
+      body
+    );
+    if ("approvalId" in result) {
+      console.log(
+        `pending approval ${result.approvalId} (expires ${new Date(result.expiresAt).toISOString()})`
+      );
+      return;
+    }
+    console.log(`sent message ${result.id}`);
   }
 });
 
 // src/commands/serve.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
-import { defineCommand as defineCommand17 } from "citty";
-var bundledDaemonEntry2 = join5(import.meta.dirname, "daemon.js");
-var sourceDaemonEntry2 = join5(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
+import { join as join4 } from "path";
+import { defineCommand as defineCommand16 } from "citty";
+var bundledDaemonEntry2 = join4(import.meta.dirname, "daemon.js");
+var sourceDaemonEntry2 = join4(import.meta.dirname, "..", "..", "..", "daemon", "src", "index.ts");
 var daemonEntry2 = existsSync5(bundledDaemonEntry2) ? bundledDaemonEntry2 : sourceDaemonEntry2;
-var serveCommand = defineCommand17({
+var serveCommand = defineCommand16({
   meta: {
     name: "serve",
     description: "Start the bazilion daemon (HTTP API)"
@@ -2793,7 +2541,7 @@ var serveCommand = defineCommand17({
     console.log(`starting bazilion daemon at http://${host}:${port}`);
     console.log("(web UI runs separately: cd apps/web && pnpm dev)");
     const nodeArgs2 = daemonEntry2.endsWith(".ts") ? ["--import", "tsx/esm", daemonEntry2] : [daemonEntry2];
-    const proc = spawn5("node", nodeArgs2, {
+    const proc = spawn4("node", nodeArgs2, {
       env,
       stdio: "inherit"
     });
@@ -2827,10 +2575,16 @@ var serveCommand = defineCommand17({
 });
 
 // src/commands/skill.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7, statSync } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync } from "fs";
 import { basename as basename2, resolve as resolve2 } from "path";
-import { defineCommand as defineCommand18 } from "citty";
-var listCmd10 = defineCommand18({
+import { defineCommand as defineCommand17 } from "citty";
+function printFindings(findings, prefix = "  ") {
+  for (const f of findings) {
+    const line = f.line ? ` line ${f.line}` : "";
+    console.log(`${prefix}${f.severity}: ${f.code}${line} - ${f.message}`);
+  }
+}
+var listCmd8 = defineCommand17({
   meta: { name: "list", description: "List installed skills (or those attached to an agent)" },
   args: {
     agent: { type: "string", description: "Filter to skills attached to this agent" }
@@ -2860,9 +2614,18 @@ var listCmd10 = defineCommand18({
       s.parseError ? `(parse error: ${s.parseError})` : s.description
     ]);
     for (const line of columnize(rows)) console.log(line);
+    const flagged = skills.filter((s) => s.scanFindings && s.scanFindings.length > 0);
+    if (flagged.length > 0) {
+      console.log("");
+      console.log("scan findings:");
+      for (const s of flagged) {
+        console.log(`${s.name}:`);
+        printFindings(s.scanFindings ?? []);
+      }
+    }
   }
 });
-var importCmd = defineCommand18({
+var importCmd = defineCommand17({
   meta: {
     name: "import",
     description: "Import skills from openclaw, a directory, or a local .zip archive"
@@ -2880,19 +2643,36 @@ var importCmd = defineCommand18({
     const absFrom = resolve2(args.from);
     const isLocalZip = args.from.toLowerCase().endsWith(".zip") && existsSync6(absFrom) && statSync(absFrom).isFile();
     let result;
-    if (isLocalZip) {
-      const bytes = readFileSync7(absFrom);
-      const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
-      const fd = new FormData();
-      fd.set("file", file);
-      if (args.force) fd.set("force", "true");
-      result = await client.postMultipart("/api/skills/import", fd);
-    } else {
-      const body = {
-        source: args.from,
-        force: args.force
-      };
-      result = await client.post("/api/skills/import", body);
+    try {
+      if (isLocalZip) {
+        const bytes = readFileSync5(absFrom);
+        const file = new File([bytes], basename2(absFrom), { type: "application/zip" });
+        const fd = new FormData();
+        fd.set("file", file);
+        if (args.force) fd.set("force", "true");
+        result = await client.postMultipart("/api/skills/import", fd);
+      } else {
+        const body = {
+          source: args.from,
+          force: args.force
+        };
+        result = await client.post("/api/skills/import", body);
+      }
+    } catch (err) {
+      if (err instanceof ApiClientError && err.body.code === "skill_scan_blocked") {
+        console.error(`error: ${err.body.error}`);
+        if (err.body.findings && err.body.findings.length > 0) {
+          console.error("scan findings:");
+          for (const f of err.body.findings) {
+            const line = f.line ? ` line ${f.line}` : "";
+            console.error(`  ${f.severity}: ${f.code}${line} - ${f.message}`);
+          }
+        }
+        console.error("  hint: inspect the skill, then rerun with --force to confirm");
+        process.exitCode = 1;
+        return;
+      }
+      throw err;
     }
     if (result.imported.length === 0 && result.skipped.length === 0) {
       console.log("(nothing to import)");
@@ -2904,9 +2684,17 @@ var importCmd = defineCommand18({
     for (const s of result.skipped) {
       console.log(`skipped ${s.name}: ${s.reason}`);
     }
+    if (result.findings && Object.keys(result.findings).length > 0) {
+      console.log("");
+      console.log("confirmed scan findings:");
+      for (const [name, findings] of Object.entries(result.findings)) {
+        console.log(`${name}:`);
+        printFindings(findings);
+      }
+    }
   }
 });
-var rmCmd5 = defineCommand18({
+var rmCmd4 = defineCommand17({
   meta: { name: "rm", description: "Remove an installed skill" },
   args: {
     name: { type: "positional", required: true }
@@ -2917,18 +2705,844 @@ var rmCmd5 = defineCommand18({
     console.log(`removed skill ${args.name}`);
   }
 });
-var skillCommand = defineCommand18({
+var skillCommand = defineCommand17({
   meta: { name: "skill", description: "Manage the skill library" },
   subCommands: {
-    list: listCmd10,
+    list: listCmd8,
     import: importCmd,
-    rm: rmCmd5
+    rm: rmCmd4
   }
 });
 
-// src/commands/telegram.ts
+// src/commands/team.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { stdin as stdin2 } from "process";
 import { defineCommand as defineCommand19 } from "citty";
-var setCmd2 = defineCommand19({
+
+// src/commands/team-policy.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { defineCommand as defineCommand18 } from "citty";
+
+// src/team-interchange.ts
+var TEAM_POLICY_INTERCHANGE_VERSION = 1;
+var TEAM_DOCUMENT_KIND = "bazilion.team-template";
+var TEAM_POLICY_DOCUMENT_KIND = "bazilion.team-policy";
+var reasoning = /* @__PURE__ */ new Set(["off", "minimal", "low", "medium", "high", "xhigh"]);
+var templateKinds = /* @__PURE__ */ new Set(["user", "outside_team", "slot"]);
+var liveKinds = /* @__PURE__ */ new Set(["user", "outside_team", "agent"]);
+function object(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  return value;
+}
+function text(value, label) {
+  if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is required`);
+  return value.trim();
+}
+function nullableText(value, label) {
+  if (value === null || value === void 0) return null;
+  if (typeof value !== "string") throw new Error(`${label} must be a string or null`);
+  return value;
+}
+function endpointKey(kind, key) {
+  return `${kind}:${key ?? "-"}`;
+}
+function exportTeamDocument(detail) {
+  const keyById = new Map(detail.slots.map((slot, index) => [slot.slotId, `slot-${index + 1}`]));
+  return {
+    version: TEAM_POLICY_INTERCHANGE_VERSION,
+    kind: TEAM_DOCUMENT_KIND,
+    template: {
+      id: detail.template.id,
+      name: detail.template.name,
+      userMd: detail.template.userMd
+    },
+    slots: detail.slots.map((slot) => ({
+      key: keyById.get(slot.slotId),
+      profileId: slot.profileId,
+      agentName: slot.agentName,
+      modelOverride: slot.modelOverride,
+      reasoningLevel: slot.reasoningLevel,
+      layoutPosition: slot.layoutPosition,
+      display: slot.display
+    })),
+    edges: detail.edges.map((edge) => ({
+      sourceKind: edge.sourceKind,
+      sourceKey: edge.sourceKind === "slot" ? keyById.get(edge.sourceId ?? "") ?? null : null,
+      targetKind: edge.targetKind,
+      targetKey: edge.targetKind === "slot" ? keyById.get(edge.targetId ?? "") ?? null : null,
+      posture: edge.posture
+    }))
+  };
+}
+function parseTeamDocument(value) {
+  const root = object(value, "document");
+  if (root.version !== TEAM_POLICY_INTERCHANGE_VERSION)
+    throw new Error(`unsupported Team Policy document version: ${String(root.version)}`);
+  if (root.kind !== TEAM_DOCUMENT_KIND)
+    throw new Error(`invalid document kind: expected ${TEAM_DOCUMENT_KIND}`);
+  const meta = object(root.template, "template");
+  const rawSlots = Array.isArray(root.slots) ? root.slots : null;
+  const rawEdges = Array.isArray(root.edges) ? root.edges : null;
+  if (!rawSlots || !rawEdges) throw new Error("slots and edges must be arrays");
+  const keys = /* @__PURE__ */ new Set();
+  const slots = rawSlots.map((raw, index) => {
+    const slot = object(raw, `slot ${index}`);
+    const key = text(slot.key, `slot ${index} key`);
+    if (keys.has(key)) throw new Error(`duplicate slot key: ${key}`);
+    keys.add(key);
+    const level = slot.reasoningLevel;
+    if (level !== null && level !== void 0 && !reasoning.has(level))
+      throw new Error(`slot ${index} has invalid reasoningLevel`);
+    const position = slot.layoutPosition;
+    if (position !== null && position !== void 0 && (!position || typeof position !== "object" || Array.isArray(position) || !Number.isFinite(position.x) || !Number.isFinite(position.y)))
+      throw new Error(`slot ${index} has invalid layoutPosition`);
+    const display = slot.display;
+    if (display !== null && display !== void 0 && (!display || typeof display !== "object" || Array.isArray(display)))
+      throw new Error(`slot ${index} has invalid display`);
+    return {
+      key,
+      profileId: text(slot.profileId, `slot ${index} profileId`),
+      agentName: text(slot.agentName, `slot ${index} agentName`),
+      modelOverride: nullableText(slot.modelOverride, `slot ${index} modelOverride`),
+      reasoningLevel: level ?? null,
+      layoutPosition: position ?? null,
+      display: display ?? null
+    };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  const edges = rawEdges.map((raw, index) => {
+    const edge = object(raw, `edge ${index}`);
+    if (!templateKinds.has(String(edge.sourceKind)) || !templateKinds.has(String(edge.targetKind)))
+      throw new Error(`edge ${index} has invalid endpoint kind`);
+    const sourceKind = edge.sourceKind;
+    const targetKind = edge.targetKind;
+    const sourceKey = nullableText(edge.sourceKey, `edge ${index} sourceKey`);
+    const targetKey = nullableText(edge.targetKey, `edge ${index} targetKey`);
+    const posture = edge.posture === void 0 || edge.posture === "allow" ? "allow" : edge.posture === "approval_required" ? "approval_required" : null;
+    if (!posture) throw new Error(`edge ${index} has invalid posture`);
+    if (sourceKind === "slot" !== Boolean(sourceKey))
+      throw new Error(`edge ${index} source slot key is missing or invalid`);
+    if (targetKind === "slot" !== Boolean(targetKey))
+      throw new Error(`edge ${index} target slot key is missing or invalid`);
+    if (sourceKey && !keys.has(sourceKey))
+      throw new Error(`edge ${index} references missing slot ${sourceKey}`);
+    if (targetKey && !keys.has(targetKey))
+      throw new Error(`edge ${index} references missing slot ${targetKey}`);
+    const signature = `${endpointKey(sourceKind, sourceKey)}->${endpointKey(targetKind, targetKey)}`;
+    if (endpointKey(sourceKind, sourceKey) === endpointKey(targetKind, targetKey))
+      throw new Error(`edge ${index} is a self edge`);
+    if (seen.has(signature)) throw new Error(`duplicate edge: ${signature}`);
+    seen.add(signature);
+    return { sourceKind, sourceKey, targetKind, targetKey, posture };
+  });
+  return {
+    version: 1,
+    kind: TEAM_DOCUMENT_KIND,
+    template: {
+      id: text(meta.id, "template id"),
+      name: text(meta.name, "template name"),
+      userMd: nullableText(meta.userMd, "template userMd")
+    },
+    slots,
+    edges
+  };
+}
+function teamImportBody(document, existing) {
+  const currentByKey = existing ? new Map(existing.slots.map((slot, index) => [`slot-${index + 1}`, slot.slotId])) : /* @__PURE__ */ new Map();
+  const slots = document.slots.map((slot) => ({
+    ...currentByKey.has(slot.key) ? { slotId: currentByKey.get(slot.key) } : { clientKey: slot.key },
+    profileId: slot.profileId,
+    agentName: slot.agentName,
+    modelOverride: slot.modelOverride,
+    reasoningLevel: slot.reasoningLevel,
+    layoutPosition: slot.layoutPosition,
+    display: slot.display
+  }));
+  const idByKey = new Map(
+    slots.map((slot, index) => [
+      document.slots[index]?.key,
+      slot.slotId ?? slot.clientKey ?? null
+    ])
+  );
+  const edges = document.edges.map((edge) => ({
+    sourceKind: edge.sourceKind,
+    sourceId: edge.sourceKind === "slot" ? idByKey.get(edge.sourceKey ?? "") : null,
+    targetKind: edge.targetKind,
+    targetId: edge.targetKind === "slot" ? idByKey.get(edge.targetKey ?? "") : null,
+    posture: edge.posture
+  }));
+  return { slots, edges };
+}
+function parseTeamPolicyDocument(value) {
+  const root = object(value, "document");
+  if (root.version !== 1)
+    throw new Error(`unsupported Team Policy document version: ${String(root.version)}`);
+  if (root.kind !== TEAM_POLICY_DOCUMENT_KIND)
+    throw new Error(`invalid document kind: expected ${TEAM_POLICY_DOCUMENT_KIND}`);
+  if (!Number.isInteger(root.expectedRevision) || Number(root.expectedRevision) < 1)
+    throw new Error("expectedRevision must be a positive integer");
+  if (!Array.isArray(root.edges)) throw new Error("edges must be an array");
+  const seen = /* @__PURE__ */ new Set();
+  const edges = root.edges.map((raw, index) => {
+    const edge = object(raw, `edge ${index}`);
+    if (!liveKinds.has(String(edge.sourceKind)) || !liveKinds.has(String(edge.targetKind)))
+      throw new Error(`edge ${index} has invalid endpoint kind`);
+    const sourceKind = edge.sourceKind;
+    const targetKind = edge.targetKind;
+    const sourceId = nullableText(edge.sourceId, `edge ${index} sourceId`);
+    const targetId = nullableText(edge.targetId, `edge ${index} targetId`);
+    if (sourceKind === "agent" !== Boolean(sourceId) || targetKind === "agent" !== Boolean(targetId))
+      throw new Error(`edge ${index} Agent id is missing or invalid`);
+    const signature = `${endpointKey(sourceKind, sourceId)}->${endpointKey(targetKind, targetId)}`;
+    if (endpointKey(sourceKind, sourceId) === endpointKey(targetKind, targetId))
+      throw new Error(`edge ${index} is a self edge`);
+    if (seen.has(signature)) throw new Error(`duplicate edge: ${signature}`);
+    seen.add(signature);
+    return { sourceKind, sourceId, targetKind, targetId };
+  });
+  return {
+    version: 1,
+    kind: TEAM_POLICY_DOCUMENT_KIND,
+    teamId: text(root.teamId, "teamId"),
+    expectedRevision: Number(root.expectedRevision),
+    edges
+  };
+}
+function exportTeamPolicy(teamId, revision, edges) {
+  return {
+    version: 1,
+    kind: TEAM_POLICY_DOCUMENT_KIND,
+    teamId,
+    expectedRevision: revision,
+    edges: edges.map(({ sourceKind, sourceId, targetKind, targetId, posture }) => ({
+      sourceKind,
+      sourceId,
+      targetKind,
+      targetId,
+      posture
+    }))
+  };
+}
+function edgeDiff(before, after) {
+  const signature = (edge) => `${endpointKey(edge.sourceKind, edge.sourceId ?? null)} -> ${endpointKey(edge.targetKind, edge.targetId ?? null)} [${edge.posture ?? "allow"}]`;
+  const left = new Set(before.map(signature));
+  const right = new Set(after.map(signature));
+  return {
+    added: [...right].filter((value) => !left.has(value)).sort(),
+    removed: [...left].filter((value) => !right.has(value)).sort()
+  };
+}
+
+// src/commands/team-policy.ts
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync6(path, "utf8"));
+  } catch (error) {
+    throw new Error(`invalid JSON: ${error.message}`);
+  }
+}
+function endpoint2(value, teamId) {
+  if (value === "user") return { kind: "user", teamId };
+  if (value.startsWith("agent:") && value.length > 6) return { kind: "agent", id: value.slice(6) };
+  if (value.startsWith("outside:") && value.length > 8)
+    return { kind: "outside_team", teamId: value.slice(8) };
+  throw new Error("endpoint must be user, agent:<id>, or outside:<team-id>");
+}
+function printPolicy(detail) {
+  console.log(`# Team ${detail.teamPolicy.teamId} policy`);
+  console.log(`revision:   ${detail.teamPolicy.revision}`);
+  console.log(
+    `baseline:   ${detail.baseline ? `${detail.baseline.templateId}@${detail.baseline.templateRevision}` : "(none)"}`
+  );
+  console.log(`members:    ${detail.members.length}`);
+  console.log(`edges:      ${detail.edges.length}`);
+  if (detail.edges.length) {
+    console.log("");
+    for (const line of columnize([
+      ["source", "target"],
+      ...detail.edges.map((edge) => [
+        `${edge.sourceKind}:${edge.sourceId ?? "-"}`,
+        `${edge.targetKind}:${edge.targetId ?? "-"}`
+      ])
+    ]))
+      console.log(line);
+  }
+}
+var show2 = defineCommand18({
+  meta: { name: "show", description: "Show the one effective live policy for a Team" },
+  args: {
+    team: { type: "positional", required: true },
+    json: { type: "boolean", description: "Emit the canonical aggregate as JSON" }
+  },
+  async run({ args }) {
+    const detail = await createClient2().get(
+      `/api/teams/${encodeURIComponent(args.team)}/policy`
+    );
+    if (args.json) console.log(JSON.stringify(detail, null, 2));
+    else printPolicy(detail);
+  }
+});
+var exportCommand = defineCommand18({
+  meta: { name: "export", description: "Export a revisioned Team policy document" },
+  args: { team: { type: "positional", required: true } },
+  async run({ args }) {
+    const detail = await createClient2().get(
+      `/api/teams/${encodeURIComponent(args.team)}/policy`
+    );
+    console.log(
+      JSON.stringify(
+        exportTeamPolicy(args.team, detail.teamPolicy.revision, detail.edges),
+        null,
+        2
+      )
+    );
+  }
+});
+function printEdgeDiff(current, edges) {
+  const diff2 = edgeDiff(current.edges, edges);
+  console.log(`Team: ${current.teamPolicy.teamId}`);
+  console.log(`Revision: ${current.teamPolicy.revision}`);
+  console.log(`Edges: +${diff2.added.length} -${diff2.removed.length}`);
+  for (const value of diff2.added) console.log(`  + ${value}`);
+  for (const value of diff2.removed) console.log(`  - ${value}`);
+}
+var importCommand = defineCommand18({
+  meta: {
+    name: "import",
+    description: "Validate, diff, and explicitly replace a Team policy"
+  },
+  args: {
+    team: { type: "positional", required: true },
+    file: { type: "positional", required: true },
+    "dry-run": { type: "boolean", description: "Validate and print the diff only" },
+    apply: { type: "boolean", description: "Apply non-interactively after printing the diff" },
+    "expected-revision": {
+      type: "string",
+      description: "Expected current Team revision (defaults to document revision)"
+    },
+    force: {
+      type: "boolean",
+      description: "Refetch current revision; requires --apply and still uses optimistic locking"
+    },
+    "confirm-current-revision": {
+      type: "string",
+      description: "Second force confirmation: the freshly displayed current revision"
+    }
+  },
+  async run({ args }) {
+    if (args.force && !args.apply)
+      throw new Error("--force requires --apply (interactive force is intentionally unsupported)");
+    const document = parseTeamPolicyDocument(readJson(args.file));
+    if (document.teamId !== args.team)
+      throw new Error(`document belongs to Team ${document.teamId}, not ${args.team}`);
+    const client = createClient2();
+    const current = await client.get(
+      `/api/teams/${encodeURIComponent(args.team)}/policy`
+    );
+    printEdgeDiff(current, document.edges);
+    if (args["dry-run"]) return console.log("valid: no changes applied");
+    if (!args.apply) throw new Error("refusing mutation: review the diff, then pass --apply");
+    const supplied = args["expected-revision"] ? Number.parseInt(args["expected-revision"], 10) : document.expectedRevision;
+    const expectedRevision = args.force ? current.teamPolicy.revision : supplied;
+    if (args.force && Number.parseInt(args["confirm-current-revision"] ?? "", 10) !== current.teamPolicy.revision)
+      throw new Error(
+        `--force requires --confirm-current-revision ${current.teamPolicy.revision} after reviewing the fresh diff`
+      );
+    if (!Number.isInteger(expectedRevision) || expectedRevision < 1)
+      throw new Error("expected revision must be a positive integer");
+    const body = {
+      expectedRevision,
+      edges: document.edges
+    };
+    const updated = await client.put(
+      `/api/teams/${encodeURIComponent(args.team)}/policy`,
+      body
+    );
+    console.log(`updated Team ${args.team} policy to revision ${updated.teamPolicy.revision}`);
+  }
+});
+var diff = defineCommand18({
+  meta: { name: "diff", description: "Compare live policy with its retained baseline source" },
+  args: {
+    team: { type: "positional", required: true },
+    json: { type: "boolean", description: "Emit canonical diff JSON" }
+  },
+  async run({ args }) {
+    const result = await createClient2().get(
+      `/api/teams/${encodeURIComponent(args.team)}/policy/diff`
+    );
+    if (args.json) return console.log(JSON.stringify(result, null, 2));
+    console.log(`# Team ${args.team} source diff`);
+    console.log(
+      `status:   ${result.baseline ? result.sourceDiverged ? "source diverged" : "source current" : "no baseline"}`
+    );
+    console.log(`revision: ${result.liveRevision}`);
+    console.log(
+      `edges:    +${result.comparison.addedSinceBaseline.length} -${result.comparison.removedSinceBaseline.length}`
+    );
+    console.log(
+      `slots:    +${result.comparison.currentSourceAddedSlotIds.length} -${result.comparison.currentSourceRemovedSlotIds.length}`
+    );
+  }
+});
+var evaluate = defineCommand18({
+  meta: {
+    name: "evaluate",
+    description: "Evaluate a communication path without sending or recording a block"
+  },
+  args: {
+    team: { type: "positional", required: true, description: "Owning Team for context" },
+    source: { type: "string", required: true, description: "user | agent:<id> | outside:<team>" },
+    target: { type: "string", required: true, description: "user | agent:<id> | outside:<team>" },
+    origin: { type: "string", default: "cli-diagnostic" },
+    json: { type: "boolean", description: "Emit decision JSON" }
+  },
+  async run({ args }) {
+    const result = await createClient2().post(
+      "/api/communication/evaluate",
+      {
+        source: endpoint2(args.source, args.team),
+        target: endpoint2(args.target, args.team),
+        origin: args.origin,
+        attemptKind: "cli_evaluate",
+        attemptId: `diagnostic:${args.team}`
+      }
+    );
+    if (args.json) return console.log(JSON.stringify(result, null, 2));
+    console.log(`${result.decision.toUpperCase()} ${result.channel}: ${result.reasonCode}`);
+    console.log(result.reason);
+    console.log(
+      `policy revisions: ${result.policyRefs.map((ref) => `${ref.teamId}@${ref.revision}`).join(", ") || "-"}`
+    );
+  }
+});
+var blocks = defineCommand18({
+  meta: { name: "blocks", description: "List paginated durable communication denials" },
+  args: {
+    team: { type: "positional", required: true },
+    limit: { type: "string", default: "50" },
+    cursor: { type: "string" },
+    source: { type: "string" },
+    target: { type: "string" },
+    channel: { type: "string" },
+    origin: { type: "string" },
+    reason: { type: "string", description: "Reason code" },
+    from: { type: "string", description: "Epoch milliseconds or ISO timestamp" },
+    to: { type: "string", description: "Epoch milliseconds or ISO timestamp" },
+    json: { type: "boolean", description: "Emit page JSON including nextCursor" }
+  },
+  async run({ args }) {
+    const query = new URLSearchParams({ limit: args.limit });
+    for (const [key, value] of [
+      ["cursor", args.cursor],
+      ["source", args.source],
+      ["target", args.target],
+      ["channel", args.channel],
+      ["origin", args.origin],
+      ["reasonCode", args.reason],
+      ["from", args.from],
+      ["to", args.to]
+    ])
+      if (value) query.set(key, value);
+    const page = await createClient2().get(
+      `/api/teams/${encodeURIComponent(args.team)}/policy/blocks?${query}`
+    );
+    if (args.json) return console.log(JSON.stringify(page, null, 2));
+    if (!page.blocks.length) console.log("(no blocks)");
+    else
+      for (const line of columnize([
+        ["time", "source", "target", "channel", "origin", "reason"],
+        ...page.blocks.map((block) => [
+          new Date(block.created_at).toISOString(),
+          `${block.source_kind}:${block.source_id ?? "-"}`,
+          `${block.target_kind}:${block.target_id ?? "-"}`,
+          block.channel,
+          block.origin,
+          block.reason_code
+        ])
+      ]))
+        console.log(line);
+    if (page.nextCursor) console.log(`next cursor: ${page.nextCursor}`);
+  }
+});
+var teamPolicyCommand = defineCommand18({
+  meta: { name: "policy", description: "Inspect and manage the Team-owned live policy" },
+  subCommands: {
+    show: show2,
+    export: exportCommand,
+    import: importCommand,
+    diff,
+    evaluate,
+    blocks
+  }
+});
+
+// src/commands/team.ts
+var addCmd2 = defineCommand19({
+  meta: {
+    name: "add",
+    description: "Register a team at ~/.bazilion/teams/<slug>/ (use --link to point at an existing tree)"
+  },
+  args: {
+    id: { type: "positional", required: true, description: "Team slug" },
+    name: { type: "string", description: "Display name (defaults to slug)" },
+    link: {
+      type: "string",
+      description: "Absolute path of an existing directory; the team slot becomes a symlink to it"
+    }
+  },
+  async run({ args }) {
+    const client = createClient2();
+    const body = {
+      id: args.id,
+      ...args.name ? { name: args.name } : {},
+      ...args.link ? { link: args.link } : {}
+    };
+    const g = await client.post("/api/teams", body);
+    console.log(`registered team ${g.id} at ${g.path}`);
+  }
+});
+var listCmd9 = defineCommand19({
+  meta: { name: "list", description: "List teams" },
+  async run() {
+    const client = createClient2();
+    const list3 = await client.get("/api/teams");
+    if (list3.length === 0) {
+      console.log("(no teams)");
+      return;
+    }
+    const rows = list3.map((g) => [g.id, g.path]);
+    for (const line of columnize(rows)) console.log(line);
+  }
+});
+var rmCmd5 = defineCommand19({
+  meta: { name: "rm", description: "Remove a team registration" },
+  args: {
+    id: { type: "positional", required: true }
+  },
+  async run({ args }) {
+    const client = createClient2();
+    const policy = await client.get(
+      `/api/teams/${encodeURIComponent(args.id)}/policy`
+    );
+    await client.del(
+      `/api/teams/${encodeURIComponent(args.id)}?expectedTeamPolicyRevision=${policy.teamPolicy.revision}`
+    );
+    console.log(`removed team ${args.id}`);
+  }
+});
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of stdin2) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8");
+}
+var userMdShowCmd = defineCommand19({
+  meta: { name: "show", description: "Print the team's USER.md" },
+  args: { id: { type: "positional", required: true } },
+  async run({ args }) {
+    const client = createClient2();
+    const g = await client.get(`/api/teams/${args.id}`);
+    process.stdout.write(g.userMd);
+    if (g.userMd && !g.userMd.endsWith("\n")) process.stdout.write("\n");
+  }
+});
+var userMdSetCmd = defineCommand19({
+  meta: {
+    name: "set",
+    description: "Replace the team's USER.md (from --file, --from-stdin, or inline text)"
+  },
+  args: {
+    id: { type: "positional", required: true },
+    file: { type: "string", description: "Read content from a file path" },
+    "from-stdin": { type: "boolean", description: "Read content from stdin" },
+    text: { type: "string", description: "Inline content" }
+  },
+  async run({ args }) {
+    let content;
+    if (args["from-stdin"]) content = await readStdin();
+    else if (args.file) content = readFileSync7(args.file, "utf8");
+    else if (args.text !== void 0) content = args.text;
+    else {
+      console.error("team user-md set: provide --file, --from-stdin, or --text");
+      process.exit(2);
+    }
+    const client = createClient2();
+    const body = { userMd: content };
+    await client.put(`/api/teams/${args.id}/user-md`, body);
+    console.log(`updated USER.md for team ${args.id} (${content.length} bytes)`);
+  }
+});
+var userMdClearCmd = defineCommand19({
+  meta: { name: "clear", description: "Clear the team's USER.md to empty" },
+  args: { id: { type: "positional", required: true } },
+  async run({ args }) {
+    const client = createClient2();
+    const body = { userMd: "" };
+    await client.put(`/api/teams/${args.id}/user-md`, body);
+    console.log(`cleared USER.md for team ${args.id}`);
+  }
+});
+var userMdCmd = defineCommand19({
+  meta: { name: "user-md", description: "View or edit a team's USER.md" },
+  subCommands: {
+    show: userMdShowCmd,
+    set: userMdSetCmd,
+    clear: userMdClearCmd
+  }
+});
+var topicFormatShowCmd = defineCommand19({
+  meta: { name: "show", description: "Print the team's Telegram topic-name template" },
+  args: { id: { type: "positional", required: true } },
+  async run({ args }) {
+    const client = createClient2();
+    const g = await client.get(`/api/teams/${args.id}`);
+    console.log(g.telegramTopicNameFormat ?? "(default naming)");
+  }
+});
+var topicFormatSetCmd = defineCommand19({
+  meta: {
+    name: "set",
+    description: "Set the topic-name template. Tokens: {agent.name} {team.name} {team.slug} (must include {agent.name})"
+  },
+  args: {
+    id: { type: "positional", required: true },
+    format: {
+      type: "positional",
+      required: true,
+      description: 'e.g. "{team.name} / {agent.name}"'
+    }
+  },
+  async run({ args }) {
+    const client = createClient2();
+    const body = { format: args.format };
+    const g = await client.put(`/api/teams/${args.id}/topic-format`, body);
+    console.log(`set topic-name template for team ${args.id}: ${g.telegramTopicNameFormat}`);
+  }
+});
+var topicFormatClearCmd = defineCommand19({
+  meta: { name: "clear", description: "Clear the template (revert to built-in naming)" },
+  args: { id: { type: "positional", required: true } },
+  async run({ args }) {
+    const client = createClient2();
+    const body = { format: null };
+    await client.put(`/api/teams/${args.id}/topic-format`, body);
+    console.log(`cleared topic-name template for team ${args.id}`);
+  }
+});
+var topicFormatCmd = defineCommand19({
+  meta: {
+    name: "topic-format",
+    description: "View or edit a team's Telegram forum-topic name template"
+  },
+  subCommands: {
+    show: topicFormatShowCmd,
+    set: topicFormatSetCmd,
+    clear: topicFormatClearCmd
+  }
+});
+var teamCommand = defineCommand19({
+  meta: { name: "team", description: "Manage teams (collaboration contexts)" },
+  subCommands: {
+    add: addCmd2,
+    list: listCmd9,
+    rm: rmCmd5,
+    "user-md": userMdCmd,
+    "topic-format": topicFormatCmd,
+    policy: teamPolicyCommand
+  }
+});
+
+// src/commands/team-template.ts
+import { readFileSync as readFileSync8 } from "fs";
+import { defineCommand as defineCommand20 } from "citty";
+function jsonFile(path) {
+  try {
+    return JSON.parse(readFileSync8(path, "utf8"));
+  } catch (error) {
+    throw new Error(`invalid JSON: ${error.message}`);
+  }
+}
+function printTeam(detail) {
+  console.log(`# ${detail.template.id} \u2014 ${detail.template.name}`);
+  console.log(`revision: ${detail.template.currentRevision}`);
+  console.log(`slots:    ${detail.slots.length}`);
+  console.log(`edges:    ${detail.edges.length}`);
+  if (detail.slots.length) {
+    console.log("");
+    for (const line of columnize([
+      ["slot", "profile", "Agent name", "model", "reasoning"],
+      ...detail.slots.map((slot, index) => [
+        String(index + 1),
+        slot.profileId,
+        slot.agentName,
+        slot.modelOverride ?? "-",
+        slot.reasoningLevel ?? "-"
+      ])
+    ]))
+      console.log(line);
+  }
+}
+var list2 = defineCommand20({
+  meta: { name: "list", description: "List canonical Team templates" },
+  args: { json: { type: "boolean", description: "Emit stable JSON" } },
+  async run({ args }) {
+    const rows = await createClient2().get("/api/team-templates");
+    if (args.json) return console.log(JSON.stringify(rows, null, 2));
+    if (!rows.length) return console.log("(no Team templates)");
+    for (const line of columnize([
+      ["id", "revision", "slots", "name"],
+      ...rows.map((row) => [row.id, String(row.currentRevision), String(row.slotCount), row.name])
+    ]))
+      console.log(line);
+  }
+});
+var show3 = defineCommand20({
+  meta: { name: "show", description: "Show a canonical Team template" },
+  args: {
+    id: { type: "positional", required: true },
+    json: { type: "boolean", description: "Emit the canonical API aggregate" }
+  },
+  async run({ args }) {
+    const detail = await createClient2().get(
+      `/api/team-templates/${encodeURIComponent(args.id)}`
+    );
+    if (args.json) console.log(JSON.stringify(detail, null, 2));
+    else printTeam(detail);
+  }
+});
+var exportCommand2 = defineCommand20({
+  meta: {
+    name: "export",
+    description: "Export a portable versioned Team-template document to stdout"
+  },
+  args: { id: { type: "positional", required: true } },
+  async run({ args }) {
+    const detail = await createClient2().get(
+      `/api/team-templates/${encodeURIComponent(args.id)}`
+    );
+    console.log(JSON.stringify(exportTeamDocument(detail), null, 2));
+  }
+});
+function printImportDiff(current, document) {
+  const before = current ? exportTeamDocument(current) : null;
+  console.log(`Team: ${current ? current.template.id : "(new)"} -> ${document.template.id}`);
+  console.log(`Roster: ${current?.slots.length ?? 0} -> ${document.slots.length}`);
+  const previousSlots = new Map(before?.slots.map((slot) => [slot.key, slot]) ?? []);
+  const nextSlots = new Map(document.slots.map((slot) => [slot.key, slot]));
+  for (const [key, slot] of nextSlots) {
+    const previous = previousSlots.get(key);
+    if (!previous) console.log(`  + ${key}: ${slot.profileId} / ${slot.agentName}`);
+    else if (JSON.stringify(previous) !== JSON.stringify(slot))
+      console.log(
+        `  ~ ${key}: ${previous.profileId} / ${previous.agentName} -> ${slot.profileId} / ${slot.agentName}`
+      );
+  }
+  for (const [key, slot] of previousSlots)
+    if (!nextSlots.has(key)) console.log(`  - ${key}: ${slot.profileId} / ${slot.agentName}`);
+  const toEdge = (edge) => ({
+    sourceKind: edge.sourceKind,
+    sourceId: edge.sourceKey,
+    targetKind: edge.targetKind,
+    targetId: edge.targetKey
+  });
+  const diff2 = edgeDiff(before?.edges.map(toEdge) ?? [], document.edges.map(toEdge));
+  console.log(`Edges: +${diff2.added.length} -${diff2.removed.length}`);
+  for (const value of diff2.added) console.log(`  + ${value}`);
+  for (const value of diff2.removed) console.log(`  - ${value}`);
+}
+var importCommand2 = defineCommand20({
+  meta: {
+    name: "import",
+    description: "Validate, diff, and explicitly apply a portable Team-template document"
+  },
+  args: {
+    file: { type: "positional", required: true, description: "JSON document path" },
+    "dry-run": { type: "boolean", description: "Validate and print the resolved diff only" },
+    apply: { type: "boolean", description: "Apply non-interactively after printing the diff" },
+    "expected-revision": {
+      type: "string",
+      description: "Required current revision when replacing an existing Team"
+    },
+    force: {
+      type: "boolean",
+      description: "Refetch current revision; requires --apply and still uses optimistic locking"
+    },
+    "confirm-current-revision": {
+      type: "string",
+      description: "Second force confirmation: the freshly displayed current revision"
+    }
+  },
+  async run({ args }) {
+    if (args.force && !args.apply)
+      throw new Error("--force requires --apply (interactive force is intentionally unsupported)");
+    const document = parseTeamDocument(jsonFile(args.file));
+    const client = createClient2();
+    let current = null;
+    try {
+      current = await client.get(
+        `/api/team-templates/${encodeURIComponent(document.template.id)}`
+      );
+    } catch (error) {
+      if (!(error instanceof ApiClientError) || error.status !== 404) throw error;
+    }
+    printImportDiff(current, document);
+    if (args["dry-run"]) {
+      console.log("valid: no changes applied");
+      return;
+    }
+    if (!args.apply) throw new Error("refusing mutation: review the diff, then pass --apply");
+    if (!current) {
+      const body2 = teamImportBody(document);
+      const created = await client.post("/api/team-templates/import", {
+        id: document.template.id,
+        name: document.template.name,
+        userMd: document.template.userMd,
+        slots: document.slots.map((slot, index) => ({
+          ...body2.slots[index],
+          clientKey: slot.key
+        })),
+        edges: body2.edges
+      });
+      console.log(
+        `created Team ${created.template.id} at revision ${created.template.currentRevision}`
+      );
+      return;
+    }
+    if (document.template.name !== current.template.name || document.template.userMd !== current.template.userMd)
+      throw new Error(
+        "replacement document metadata differs; update Team name/USER.md separately before import"
+      );
+    const supplied = Number.parseInt(args["expected-revision"] ?? "", 10);
+    const expectedRevision = args.force ? current.template.currentRevision : supplied;
+    if (args.force && Number.parseInt(args["confirm-current-revision"] ?? "", 10) !== current.template.currentRevision)
+      throw new Error(
+        `--force requires --confirm-current-revision ${current.template.currentRevision} after reviewing the fresh diff`
+      );
+    if (!Number.isInteger(expectedRevision) || expectedRevision < 1)
+      throw new Error("--expected-revision is required when replacing an existing Team");
+    const definition = teamImportBody(document, current);
+    const body = { expectedRevision, ...definition };
+    const updated = await client.put(
+      `/api/team-templates/${encodeURIComponent(document.template.id)}/definition`,
+      body
+    );
+    console.log(
+      `updated Team ${updated.template.id} to revision ${updated.template.currentRevision}`
+    );
+  }
+});
+var teamTemplateCommand = defineCommand20({
+  meta: {
+    name: "team-template",
+    description: "Inspect and exchange canonical Team templates"
+  },
+  subCommands: { list: list2, show: show3, export: exportCommand2, import: importCommand2 }
+});
+
+// src/commands/telegram.ts
+import { defineCommand as defineCommand21 } from "citty";
+var setCmd2 = defineCommand21({
   meta: {
     name: "set",
     description: "Save bot token + supergroup chat ID (paired write)"
@@ -2946,7 +3560,7 @@ var setCmd2 = defineCommand19({
     console.log(`saved \xB7 token ${state.botTokenPreview} \xB7 chat ${state.chatId}`);
   }
 });
-var clearCmd = defineCommand19({
+var clearCmd = defineCommand21({
   meta: {
     name: "clear",
     description: "Remove stored bot token + chat ID"
@@ -2957,7 +3571,7 @@ var clearCmd = defineCommand19({
     console.log("cleared");
   }
 });
-var showCmd6 = defineCommand19({
+var showCmd5 = defineCommand21({
   meta: {
     name: "show",
     description: "Show what credentials are stored (token is masked)"
@@ -2978,7 +3592,7 @@ var showCmd6 = defineCommand19({
     }
   }
 });
-var reconnectCmd = defineCommand19({
+var reconnectCmd = defineCommand21({
   meta: {
     name: "reconnect",
     description: "Apply a pending supergroup chat-id migration + re-activate the bot"
@@ -2989,7 +3603,7 @@ var reconnectCmd = defineCommand19({
     console.log(`reconnected \xB7 chat ${state.chatId}`);
   }
 });
-var configCmd = defineCommand19({
+var configCmd = defineCommand21({
   meta: {
     name: "config",
     description: "Manage Telegram credentials (bot token + chat ID)"
@@ -2997,10 +3611,10 @@ var configCmd = defineCommand19({
   subCommands: {
     set: setCmd2,
     clear: clearCmd,
-    show: showCmd6
+    show: showCmd5
   }
 });
-var healthCmd = defineCommand19({
+var healthCmd = defineCommand21({
   meta: {
     name: "health",
     description: "Run the four-step preflight against the Telegram Bot API"
@@ -3034,7 +3648,7 @@ var healthCmd = defineCommand19({
     if (!allOk) process.exitCode = 1;
   }
 });
-var botStatusCmd = defineCommand19({
+var botStatusCmd = defineCommand21({
   meta: {
     name: "status",
     description: "Show polling state of the live bot"
@@ -3059,7 +3673,7 @@ var botStatusCmd = defineCommand19({
     if (!p.running) process.exitCode = 1;
   }
 });
-var botRestartCmd = defineCommand19({
+var botRestartCmd = defineCommand21({
   meta: {
     name: "restart",
     description: "Force-restart the bot (tears down + brings up from current creds)"
@@ -3070,7 +3684,7 @@ var botRestartCmd = defineCommand19({
     console.log("restart requested");
   }
 });
-var botCmd = defineCommand19({
+var botCmd = defineCommand21({
   meta: {
     name: "bot",
     description: "Inspect / control the live polling bot"
@@ -3080,7 +3694,7 @@ var botCmd = defineCommand19({
     restart: botRestartCmd
   }
 });
-var bindCmd = defineCommand19({
+var bindCmd = defineCommand21({
   meta: {
     name: "bind",
     description: "Create a Telegram topic for an agent (manual fallback for /talk)"
@@ -3098,7 +3712,7 @@ var bindCmd = defineCommand19({
     console.log(`  ${result.deepLink}`);
   }
 });
-var unbindCmd = defineCommand19({
+var unbindCmd = defineCommand21({
   meta: {
     name: "unbind",
     description: "Clear an agent's Telegram topic binding (topic stays in Telegram as orphan)"
@@ -3112,7 +3726,7 @@ var unbindCmd = defineCommand19({
     console.log(`unbound agent ${args.agent}`);
   }
 });
-var listBindingsCmd = defineCommand19({
+var listBindingsCmd = defineCommand21({
   meta: {
     name: "list",
     description: "List agents and their Telegram topic bindings"
@@ -3129,18 +3743,18 @@ var listBindingsCmd = defineCommand19({
     if (bound.length > 0) {
       console.log("bound:");
       for (const a of bound) {
-        console.log(`  #${a.telegramTopicId}	${a.name}	(group: ${a.groupId})`);
+        console.log(`  #${a.telegramTopicId}	${a.name}	(team: ${a.teamId})`);
       }
     }
     if (unbound.length > 0) {
       console.log("unbound:");
       for (const a of unbound) {
-        console.log(`  \u2014	${a.name}	(group: ${a.groupId})`);
+        console.log(`  \u2014	${a.name}	(team: ${a.teamId})`);
       }
     }
   }
 });
-var allowCmd = defineCommand19({
+var allowCmd = defineCommand21({
   meta: { name: "allow", description: "Add a Telegram user id to the allowlist" },
   args: {
     userId: { type: "positional", required: true, description: "Numeric Telegram user id" },
@@ -3157,7 +3771,7 @@ var allowCmd = defineCommand19({
     console.log(`allowed ${u.userId} (${u.role})`);
   }
 });
-var denyCmd = defineCommand19({
+var denyCmd = defineCommand21({
   meta: { name: "deny", description: "Remove a Telegram user id from the allowlist" },
   args: { userId: { type: "positional", required: true } },
   async run({ args }) {
@@ -3166,7 +3780,7 @@ var denyCmd = defineCommand19({
     console.log(`removed ${args.userId}`);
   }
 });
-var allowedCmd = defineCommand19({
+var allowedCmd = defineCommand21({
   meta: { name: "allowed", description: "List allowlisted Telegram users" },
   async run() {
     const client = createClient2();
@@ -3181,7 +3795,7 @@ var allowedCmd = defineCommand19({
     }
   }
 });
-var telegramCommand = defineCommand19({
+var telegramCommand = defineCommand21({
   meta: {
     name: "telegram",
     description: "Telegram integration: credentials, health, bot lifecycle, bindings, access"
@@ -3202,7 +3816,7 @@ var telegramCommand = defineCommand19({
 
 // src/commands/token.ts
 import { networkInterfaces } from "os";
-import { defineCommand as defineCommand20 } from "citty";
+import { defineCommand as defineCommand22 } from "citty";
 import qrcode from "qrcode-terminal";
 function tokenRow(t) {
   const last = t.lastUsedAt ? new Date(t.lastUsedAt).toISOString() : "(never)";
@@ -3236,7 +3850,7 @@ function resolveQrServer(override) {
   if (detected.warning) console.warn(`\u26A0 ${detected.warning}`);
   return detected.origin;
 }
-var createCmd4 = defineCommand20({
+var createCmd3 = defineCommand22({
   meta: { name: "create", description: "Mint a new web token (shown once)" },
   args: {
     label: { type: "positional", required: true, description: "Human-readable label" },
@@ -3267,7 +3881,7 @@ var createCmd4 = defineCommand20({
     qrcode.generate(pairUrl, { small: true }, (qr) => console.log(qr));
   }
 });
-var listCmd11 = defineCommand20({
+var listCmd10 = defineCommand22({
   meta: { name: "list", description: "List web tokens" },
   args: {
     all: { type: "boolean", description: "Include revoked tokens" }
@@ -3283,7 +3897,7 @@ var listCmd11 = defineCommand20({
     for (const line of columnize(tokens.map(tokenRow))) console.log(line);
   }
 });
-var showLocalCmd = defineCommand20({
+var showLocalCmd = defineCommand22({
   meta: {
     name: "show-local",
     description: "Print the bootstrap web token stored in ~/.bazilion/auth.json"
@@ -3293,7 +3907,7 @@ var showLocalCmd = defineCommand20({
     console.log(readAuthFile(paths.authFile).token);
   }
 });
-var revokeCmd = defineCommand20({
+var revokeCmd = defineCommand22({
   meta: { name: "revoke", description: "Revoke a web token" },
   args: {
     id: { type: "positional", required: true }
@@ -3304,19 +3918,19 @@ var revokeCmd = defineCommand20({
     console.log(`revoked token ${args.id}`);
   }
 });
-var tokenCommand = defineCommand20({
+var tokenCommand = defineCommand22({
   meta: { name: "token", description: "Manage web tokens for API/CLI clients" },
   subCommands: {
-    create: createCmd4,
-    list: listCmd11,
+    create: createCmd3,
+    list: listCmd10,
     revoke: revokeCmd,
     "show-local": showLocalCmd
   }
 });
 
 // src/commands/trigger.ts
-import { defineCommand as defineCommand21 } from "citty";
-var addCmd3 = defineCommand21({
+import { defineCommand as defineCommand23 } from "citty";
+var addCmd3 = defineCommand23({
   meta: { name: "add", description: "Add a heartbeat / cron trigger to an agent" },
   args: {
     agent: { type: "positional", required: true },
@@ -3364,7 +3978,7 @@ function triggerRow(t) {
   const msgPreview = t.message.length > 60 ? `${t.message.slice(0, 60)}\u2026` : t.message;
   return [t.id, state, spec, `last: ${last}`, `"${msgPreview}"`];
 }
-var listCmd12 = defineCommand21({
+var listCmd11 = defineCommand23({
   meta: { name: "list", description: "List triggers for an agent" },
   args: {
     agent: { type: "positional", required: true }
@@ -3381,7 +3995,7 @@ var listCmd12 = defineCommand21({
     for (const line of columnize(triggers.map(triggerRow))) console.log(line);
   }
 });
-var rmCmd6 = defineCommand21({
+var rmCmd6 = defineCommand23({
   meta: { name: "rm", description: "Delete a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -3392,7 +4006,7 @@ var rmCmd6 = defineCommand21({
     console.log(`removed trigger ${args.id}`);
   }
 });
-var enableCmd3 = defineCommand21({
+var enableCmd3 = defineCommand23({
   meta: { name: "enable", description: "Enable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -3404,7 +4018,7 @@ var enableCmd3 = defineCommand21({
     console.log(`enabled trigger ${args.id}`);
   }
 });
-var disableCmd3 = defineCommand21({
+var disableCmd3 = defineCommand23({
   meta: { name: "disable", description: "Disable a trigger" },
   args: {
     id: { type: "positional", required: true }
@@ -3416,11 +4030,11 @@ var disableCmd3 = defineCommand21({
     console.log(`disabled trigger ${args.id}`);
   }
 });
-var triggerCommand = defineCommand21({
+var triggerCommand = defineCommand23({
   meta: { name: "trigger", description: "Manage agent heartbeats / cron triggers" },
   subCommands: {
     add: addCmd3,
-    list: listCmd12,
+    list: listCmd11,
     rm: rmCmd6,
     enable: enableCmd3,
     disable: disableCmd3
@@ -3428,9 +4042,9 @@ var triggerCommand = defineCommand21({
 });
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync4 } from "fs";
-import { join as join6 } from "path";
-import { defineCommand as defineCommand22 } from "citty";
+import { existsSync as existsSync7, readdirSync as readdirSync2, rmSync as rmSync3 } from "fs";
+import { join as join5 } from "path";
+import { defineCommand as defineCommand24 } from "citty";
 function makeLineReader() {
   let buffer = "";
   let ended = false;
@@ -3475,10 +4089,10 @@ async function askYes(readLine, prompt) {
 }
 function removePath(p) {
   if (!existsSync7(p)) return false;
-  rmSync4(p, { recursive: true, force: true });
+  rmSync3(p, { recursive: true, force: true });
   return true;
 }
-var uninstallCommand = defineCommand22({
+var uninstallCommand = defineCommand24({
   meta: {
     name: "uninstall",
     description: "Wipe bazilion state from ~/.bazilion (or BAZILION_HOME)"
@@ -3496,26 +4110,19 @@ var uninstallCommand = defineCommand22({
   },
   async run({ args }) {
     const paths = resolveCliPaths(args.home);
-    const dbFile = join6(paths.home, "bazilion.db");
-    const profilesDir = join6(paths.home, "profiles");
-    const agentsDir = join6(paths.home, "agents");
-    const groupsDir = join6(paths.home, "groups");
-    const skillsDir = join6(paths.home, "skills");
-    const logsDir = join6(paths.home, "logs");
+    const dbFile = join5(paths.home, "bazilion.db");
+    const profilesDir = join5(paths.home, "profiles");
+    const agentsDir = join5(paths.home, "agents");
+    const teamsDir = join5(paths.home, "teams");
+    const skillsDir = join5(paths.home, "skills");
+    const logsDir = join5(paths.home, "logs");
     if (!existsSync7(paths.home)) {
       console.log(`nothing to remove: ${paths.home} does not exist`);
       return;
     }
     console.log(`about to uninstall bazilion at ${paths.home}`);
     console.log("");
-    const dataTargets = [
-      dbFile,
-      `${dbFile}-wal`,
-      `${dbFile}-shm`,
-      profilesDir,
-      agentsDir,
-      groupsDir
-    ];
+    const dataTargets = [dbFile, `${dbFile}-wal`, `${dbFile}-shm`, profilesDir, agentsDir, teamsDir];
     const needsPrompt = !args.yes;
     const readLine = needsPrompt ? makeLineReader() : null;
     const wipeData = args.yes || await askYes(
@@ -3541,7 +4148,7 @@ var uninstallCommand = defineCommand22({
         if (removePath(p)) console.log(`removed ${p}`);
       }
       if (readdirSync2(paths.home).length === 0) {
-        rmSync4(paths.home, { recursive: true, force: true });
+        rmSync3(paths.home, { recursive: true, force: true });
         console.log(`removed ${paths.home}`);
       } else {
         console.log(`${paths.home} still has unmanaged files; left in place`);
@@ -3556,7 +4163,7 @@ var uninstallCommand = defineCommand22({
 
 // src/index.ts
 var VERSION = package_default.version;
-var main = defineCommand23({
+var main = defineCommand25({
   meta: {
     name: "bazilion",
     version: VERSION,
@@ -3565,9 +4172,10 @@ var main = defineCommand23({
   subCommands: {
     login: loginCommand,
     profile: profileCommand,
-    "profile-group": profileGroupCommand,
-    group: groupCommand,
+    team: teamCommand,
+    "team-template": teamTemplateCommand,
     agent: agentCommand,
+    approval: approvalCommand,
     skill: skillCommand,
     memory: memoryCommand,
     mcp: mcpCommand,
@@ -3622,12 +4230,22 @@ function printError(err) {
     console.error("  hint: host not found. Check BAZILION_SERVER / ~/.bazilion/auth.json.");
   }
 }
+function exitCodeForError(err) {
+  if (err instanceof ApiClientError) {
+    if (err.status === 401 || err.status === 403) return 4;
+    if (err.status === 409) return 3;
+    if (err.status === 400 || err.status === 422) return 2;
+    return 1;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return /invalid|unsupported|must be|require|refusing mutation|document belongs/.test(message) ? 2 : 1;
+}
 function printTopLevelHelp() {
   console.log(`Multi-agent runtime (bazilion v${VERSION})`);
   console.log("");
   console.log("USAGE bazilion <command> [args]");
   console.log("");
-  const groups = [
+  const teams = [
     {
       title: "setup",
       items: [
@@ -3641,8 +4259,8 @@ function printTopLevelHelp() {
       title: "catalog",
       items: [
         ["profile", "Manage profiles (templates agents are spawned from)"],
-        ["profile-group", "Manage profile groups (preconfigured team templates)"],
-        ["group", "Manage groups (collaboration context \u2014 filesystem root + USER.md + roster)"],
+        ["team-template", "Inspect and exchange reusable Team Templates"],
+        ["team", "Manage teams (collaboration context \u2014 filesystem root + USER.md + roster)"],
         ["skill", "Manage the skill library"],
         ["provider", "Manage and test LLM providers"],
         ["config", "Manage service config (credentials + URLs/IDs)"],
@@ -3652,8 +4270,9 @@ function printTopLevelHelp() {
     {
       title: "agents",
       items: [
+        ["approval", "Review and decide communication approval attempts"],
         ["agent", "Spawn, list, chat, archive agents"],
-        ["memory", "Read/write a group's shared memory"],
+        ["memory", "Read/write a team's shared memory"],
         ["send", "Send a message from one agent to another"],
         ["inbox", "Inspect agent inboxes"],
         ["trigger", "Manage agent heartbeats / cron triggers"]
@@ -3679,8 +4298,8 @@ function printTopLevelHelp() {
       items: [["completion", "Print shell completion script (bash | zsh | fish)"]]
     }
   ];
-  const nameWidth = 12;
-  for (const g of groups) {
+  const nameWidth = 15;
+  for (const g of teams) {
     console.log(`  ${g.title}`);
     for (const [name, desc] of g.items) {
       console.log(`    ${name.padEnd(nameWidth)}${desc}`);
@@ -3709,7 +4328,7 @@ async function entry() {
     await runCommand(main, { rawArgs });
   } catch (err) {
     printError(err);
-    process.exit(1);
+    process.exit(exitCodeForError(err));
   }
 }
 entry();