cc-workspace 4.7.1 → 5.2.1

package/bin/cli.js

@@ -56,18 +56,28 @@ function fail(msg)     { console.error(`  ${c.red}✗${c.reset} ${c.red}${msg}${
 function info(msg)     { console.log(`  ${c.blue}▸${c.reset} ${msg}`); }
 function step(msg)     { console.log(`\n${c.bold}${c.white}  ${msg}${c.reset}`); }
 function hr()          { console.log(`${c.dim}  ${"─".repeat(50)}${c.reset}`); }
+function dryOk(msg)    { console.log(`  ${c.cyan}→${c.reset} ${c.dim}(dry-run)${c.reset} ${msg}`); }
 
 // ─── FS helpers ─────────────────────────────────────────────
-function mkdirp(dir) { fs.mkdirSync(dir, { recursive: true }); }
+let DRY_RUN = false;
 
-function copyFile(src, dest) { fs.copyFileSync(src, dest); }
+function mkdirp(dir) {
+  if (DRY_RUN) { dryOk(`mkdir -p ${dir}`); return; }
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function copyFile(src, dest) {
+  if (DRY_RUN) { dryOk(`copy ${path.basename(src)} → ${dest}`); return; }
+  fs.copyFileSync(src, dest);
+}
 
 function copyDir(src, dest) {
-  mkdirp(dest);
+  if (DRY_RUN) { dryOk(`copy dir ${path.basename(src)}/ → ${dest}`); return; }
+  fs.mkdirSync(dest, { recursive: true });
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     const srcPath = path.join(src, entry.name);
     const destPath = path.join(dest, entry.name);
-    entry.isDirectory() ? copyDir(srcPath, destPath) : copyFile(srcPath, destPath);
+    entry.isDirectory() ? copyDir(srcPath, destPath) : fs.copyFileSync(srcPath, destPath);
   }
 }
 
@@ -78,10 +88,16 @@ function readVersion() {
 }
 
 function writeVersion(v) {
+  if (DRY_RUN) { dryOk(`write version ${v} → ${VERSION_FILE}`); return; }
   mkdirp(CLAUDE_DIR);
   fs.writeFileSync(VERSION_FILE, v + "\n");
 }
 
+function writeFile(filePath, content) {
+  if (DRY_RUN) { dryOk(`write ${filePath}`); return; }
+  fs.writeFileSync(filePath, content);
+}
+
 function semverCompare(a, b) {
   const pa = a.split(".").map(Number);
   const pb = b.split(".").map(Number);
@@ -102,9 +118,12 @@ function needsUpdate(force) {
 // ─── Detect project type ────────────────────────────────────
 function detectProjectType(dir) {
   const has = (f) => fs.existsSync(path.join(dir, f));
-  const pkgHas = (kw) => {
-    try { return fs.readFileSync(path.join(dir, "package.json"), "utf8").includes(kw); }
-    catch { return false; }
+  const pkgDeps = () => {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+      const all = { ...pkg.dependencies, ...pkg.devDependencies };
+      return (name) => name in all;
+    } catch { return () => false; }
   };
   if (has("composer.json")) return "PHP/Laravel";
   if (has("pom.xml")) return "Java/Spring";
@@ -113,11 +132,12 @@ function detectProjectType(dir) {
   if (has("go.mod")) return "Go";
   if (has("Cargo.toml")) return "Rust";
   if (has("package.json")) {
-    if (pkgHas("quasar")) return "Vue/Quasar";
-    if (pkgHas("nuxt")) return "Vue/Nuxt";
-    if (pkgHas("next")) return "React/Next";
-    if (pkgHas('"vue"')) return "Vue";
-    if (pkgHas('"react"')) return "React";
+    const hasDep = pkgDeps();
+    if (hasDep("@quasar/app") || hasDep("@quasar/app-vite") || hasDep("@quasar/app-webpack") || hasDep("quasar")) return "Vue/Quasar";
+    if (hasDep("nuxt") || hasDep("nuxt3")) return "Vue/Nuxt";
+    if (hasDep("next")) return "React/Next";
+    if (hasDep("vue")) return "Vue";
+    if (hasDep("react")) return "React";
     return "Node.js";
   }
   return "unknown";
@@ -143,6 +163,9 @@ function typeBadge(type) {
 }
 
 // ─── Install global components ──────────────────────────────
+// v5.2: Only agents are global (needed for --agent CLI).
+// Skills and rules are now LOCAL to orchestrator/.claude/ to avoid
+// polluting non-orchestrator Claude sessions.
 function installGlobals(force) {
   const installed = readVersion();
   const shouldUpdate = needsUpdate(force);
@@ -157,44 +180,64 @@ function installGlobals(force) {
     : `Installing global components`
   );
 
-  mkdirp(GLOBAL_SKILLS);
-  mkdirp(GLOBAL_RULES);
   mkdirp(GLOBAL_AGENTS);
 
-  // Skills
-  const skipDirs = new Set(["rules", "agents", "hooks", "templates"]);
-  let skillCount = 0;
-  for (const entry of fs.readdirSync(SKILLS_DIR, { withFileTypes: true })) {
-    if (!entry.isDirectory() || skipDirs.has(entry.name)) continue;
-    copyDir(path.join(SKILLS_DIR, entry.name), path.join(GLOBAL_SKILLS, entry.name));
-    skillCount++;
-  }
-  ok(`${skillCount} skills`);
-
-  // Rules
-  const rulesDir = path.join(SKILLS_DIR, "rules");
-  if (fs.existsSync(rulesDir)) {
-    let n = 0;
-    for (const f of fs.readdirSync(rulesDir)) {
-      if (f.endsWith(".md")) { copyFile(path.join(rulesDir, f), path.join(GLOBAL_RULES, f)); n++; }
-    }
-    ok(`${n} rules`);
-  }
-
-  // Agents
+  // Agents (global — required for claude --agent)
   const agentsDir = path.join(SKILLS_DIR, "agents");
   if (fs.existsSync(agentsDir)) {
     let n = 0;
     for (const f of fs.readdirSync(agentsDir)) {
       if (f.endsWith(".md")) { copyFile(path.join(agentsDir, f), path.join(GLOBAL_AGENTS, f)); n++; }
     }
-    ok(`${n} agents`);
+    ok(`${n} agents ${c.dim}(global — ~/.claude/agents/)${c.reset}`);
   }
 
+  // ── Migration: clean old global skills & rules from previous versions ──
+  cleanLegacyGlobals();
+
   writeVersion(PKG.version);
   return true;
 }
 
+// ─── Clean legacy global skills & rules ─────────────────────
+// Previous versions installed skills and rules into ~/.claude/skills/
+// and ~/.claude/rules/. These now live in orchestrator/.claude/ locally.
+// This function removes only cc-workspace-owned entries, not user-created ones.
+function cleanLegacyGlobals() {
+  let cleaned = 0;
+
+  // Skills that cc-workspace installed globally
+  if (fs.existsSync(GLOBAL_SKILLS)) {
+    const skipDirs = new Set(["rules", "agents", "hooks", "templates"]);
+    const ourSkills = fs.readdirSync(SKILLS_DIR, { withFileTypes: true })
+      .filter(e => e.isDirectory() && !skipDirs.has(e.name))
+      .map(e => e.name);
+    for (const name of ourSkills) {
+      const target = path.join(GLOBAL_SKILLS, name);
+      if (fs.existsSync(target)) {
+        if (DRY_RUN) { dryOk(`remove legacy global skill ${name}/`); }
+        else { fs.rmSync(target, { recursive: true }); }
+        cleaned++;
+      }
+    }
+  }
+
+  // Rules that cc-workspace installed globally
+  const ourRules = ["context-hygiene.md", "model-routing.md"];
+  for (const f of ourRules) {
+    const fp = path.join(GLOBAL_RULES, f);
+    if (fs.existsSync(fp)) {
+      if (DRY_RUN) { dryOk(`remove legacy global rule ${f}`); }
+      else { fs.unlinkSync(fp); }
+      cleaned++;
+    }
+  }
+
+  if (cleaned > 0) {
+    ok(`${cleaned} legacy global entries cleaned ${c.dim}(skills & rules now local to orchestrator/)${c.reset}`);
+  }
+}
+
 // ─── Generate settings.json with hooks ──────────────────────
 // Claude Code hook format: { matcher: { tools: [...] }, hooks: [{ type: "command", command: "...", timeout: N }] }
 // For hooks without tool matcher: { hooks: [{ type: "command", command: "...", timeout: N }] }
@@ -231,6 +274,7 @@ function generateSettings(orchDir) {
         withMatcher("Teammate", "validate-spawn-prompt.sh", 5)
       ],
       SessionStart: [
+        withoutMatcher("orphan-cleanup.sh", 10),
         withoutMatcher("session-start-context.sh", 10)
       ],
       UserPromptSubmit: [
@@ -256,25 +300,20 @@ function generateSettings(orchDir) {
       ]
     }
   };
-  fs.writeFileSync(path.join(orchDir, ".claude", "settings.json"), JSON.stringify(settings, null, 2) + "\n");
+  writeFile(path.join(orchDir, ".claude", "settings.json"), JSON.stringify(settings, null, 2) + "\n");
 }
 
-// ─── Block hook ──────────────────────────────────────────────
-// block-orchestrator-writes is now ONLY in team-lead agent frontmatter.
-// It is NOT in settings.json (would be inherited by teammates, blocking their writes).
-// The generateBlockHook() function was removed in v4.1.4.
-
 // ─── CLAUDE.md content ──────────────────────────────────────
 function claudeMdContent() {
   return `# Orchestrator v${PKG.version}
 
-You are the tech lead. You never code in repos — you can write in orchestrator/.
-You clarify, plan, delegate, track.
+You are the tech lead. You never write application code in repos.
+You clarify, plan, manage git directly, delegate to teammates, run micro-QA.
 
 ## Security
-- \`disallowedTools: Bash\` — no direct shell
-- \`tools\` : Read, Write, Edit, Glob, Grep, Task(implementer, Explore), Teammate, SendMessage
-- Hook \`PreToolUse\` path-aware: allows orchestrator/, blocks sibling repos
+- \`tools\`: Read, Write, Edit, Bash, Glob, Grep, Task(implementer, Explore), Teammate, SendMessage
+- Bash allowed for: git (branch, worktree, log), test/typecheck in /tmp/ worktrees (micro-QA)
+- Hook \`PreToolUse\` path-aware: Write/Edit/MultiEdit only allowed in orchestrator/
 
 > settings.json contains env vars + hooks registration.
 
@@ -283,6 +322,8 @@ You clarify, plan, delegate, track.
 cd orchestrator/
 claude --agent workspace-init   # first time: diagnostic + config
 claude --agent team-lead         # work sessions
+claude --agent reviewer          # evidence-based code review (standalone or Phase 5)
+claude --agent security-auditor  # security audit (standalone or Phase 5 when needed)
 claude --agent e2e-validator     # E2E validation of completed plans
 \`\`\`
 
@@ -294,11 +335,18 @@ Run once. Idempotent — can be re-run to re-diagnose.
 ## 4 session modes
 | Mode | Description |
 |------|-------------|
-| **A — Full** | Clarify → Plan → Validate → Dispatch in waves → QA |
+| **A — Full** | Clarify → Plan → Validate → Git setup → Dispatch teammates → QA |
 | **B — Quick plan** | Specs → Plan → Dispatch |
 | **C — Go direct** | Immediate dispatch |
 | **D — Single-service** | 1 repo, no waves |
 
+## Git model (v5)
+- Opus creates session branches and worktrees directly via Bash AFTER plan validation
+- ONE teammate per repo handles all its commit units sequentially
+- Micro-QA (Bash tests + Haiku diff) runs after EVERY commit before greenlighting next
+- Worktrees persist in /tmp/ until session close (/session close <n>)
+- Source branch: from workspace.md per repo, or override in initial prompt
+
 ## Config
 - Project context: \`./workspace.md\`
 - Project constitution: \`./constitution.md\`
@@ -306,41 +354,48 @@ Run once. Idempotent — can be re-run to re-diagnose.
 - Service profiles: \`./plans/service-profiles.md\`
 - Active plans: \`./plans/*.md\`
 - Active sessions: \`./.sessions/*.json\`
+- Skills: \`./.claude/skills/\` (local to orchestrator)
+- Rules: \`./.claude/rules/\` (local to orchestrator)
+- Agents: \`~/.claude/agents/\` (global — needed for --agent CLI)
 - E2E config: \`./e2e/e2e-config.md\`
 - E2E reports: \`./e2e/reports/\`
 
-## Skills (13)
-- **dispatch-feature**: 4 modes, clarify → plan → waves → collect → verify
-- **qa-ruthless**: adversarial QA, min 3 findings per service
+## Skills (13) + Agents (6)
+- **dispatch-feature**: 4 modes, clarify → plan → git setup → 1 teammate/repo → micro-QA → verify
+- **qa-ruthless**: adversarial QA (opus), min 3 findings per service
 - **cross-service-check**: inter-repo consistency
 - **incident-debug**: multi-layer diagnostic
-- **plan-review**: plan sanity check (haiku)
+- **plan-review**: plan sanity check (sonnet — constitution compliance)
 - **merge-prep**: pre-merge, conflicts, PR summaries
-- **cycle-retrospective**: post-cycle learning (haiku)
+- **cycle-retrospective**: MANDATORY post-cycle learning
 - **refresh-profiles**: re-reads repo CLAUDE.md files (haiku)
 - **bootstrap-repo**: generates a CLAUDE.md for a repo (haiku)
 - **e2e-validator**: E2E validation of completed plans (beta) — containers + Chrome
-- **/session**: list, status, close parallel sessions
+- **/session**: list, status, close parallel sessions (includes worktree cleanup)
 - **/doctor**: full workspace diagnostic
-- **/cleanup**: remove orphan worktrees + stale sessions
+- **/cleanup**: remove orphan worktrees (session-aware) + stale sessions
+- **reviewer** (agent): evidence-based code review — scope check, architecture, constitution compliance
+- **security-auditor** (agent): security audit — auth flows, tenant isolation, secrets, CVEs, input validation
 
 ## Rules
-1. No code in repos — delegate to teammates
+1. No application code in repos — delegate to teammates
 2. Can write in orchestrator/ (plans, workspace.md, constitution.md)
-3. Clarify ambiguities BEFORE planning (except mode C)
-4. All plans in markdown in \`./plans/\`
-5. Dispatch via Agent Teams (Teammate tool) in waves
-6. Full constitution (all rules from constitution.md) in every spawn prompt
-7. UX standards injected for frontend teammates
-8. Each teammate detects dead code
-9. Escalate arch decisions not covered by the plan
-10. Ruthless QA — UX violations = blocking
-11. Compact after each cycle
-12. Hooks are warning-only — never blocking
-13. Retrospective cycle after each completed feature
-14. Session branches for parallel isolation — teammates use session/{name}, never create own branches
-15. Never \`git checkout -b\` in repos — use \`git branch\` (no checkout) to avoid disrupting parallel sessions
-16. E2E validation via \`claude --agent e2e-validator\` after plans are complete
+3. Can run git commands on repos (branch, worktree, log) and tests in /tmp/ worktrees
+4. Clarify ambiguities BEFORE planning (except mode C)
+5. All plans in markdown in \`./plans/\`
+6. Create worktrees AFTER plan validation, not before
+7. ONE teammate per repo — handles all commit units sequentially
+8. Full constitution (all rules from constitution.md) in every spawn prompt
+9. UX standards injected for frontend teammates
+10. Micro-QA (Bash + Haiku) after every commit — mandatory
+11. Escalate arch decisions not covered by the plan
+12. Ruthless QA — UX violations = blocking
+13. Teammates must run tests before signaling — reject signals without test results
+14. Hooks are warning-only — never blocking
+15. cycle-retrospective is MANDATORY in Phase 5 — not optional
+16. Worktrees live until session close — never prune active session worktrees
+17. Never \`git checkout -b\` in repos — use \`git branch\` (no checkout)
+18. E2E validation via \`claude --agent e2e-validator\` after plans are complete
 `;
 }
 
@@ -433,14 +488,17 @@ function updateLocal() {
     const obsoleteHooks = ["block-orchestrator-writes.sh", "worktree-create-context.sh", "verify-cycle-complete.sh", "guard-session-checkout.sh"];
     for (const f of obsoleteHooks) {
       const fp = path.join(hooksDir, f);
-      if (fs.existsSync(fp)) fs.unlinkSync(fp);
+      if (fs.existsSync(fp)) {
+        if (DRY_RUN) dryOk(`remove obsolete ${f}`);
+        else fs.unlinkSync(fp);
+      }
     }
     const hooksSrc = path.join(SKILLS_DIR, "hooks");
     if (fs.existsSync(hooksSrc)) {
       for (const f of fs.readdirSync(hooksSrc)) {
         if (!f.endsWith(".sh")) continue;
         copyFile(path.join(hooksSrc, f), path.join(hooksDir, f));
-        fs.chmodSync(path.join(hooksDir, f), 0o755);
+        if (!DRY_RUN) fs.chmodSync(path.join(hooksDir, f), 0o755);
         count++;
       }
     }
@@ -454,6 +512,30 @@ function updateLocal() {
     ok("settings.json regenerated");
   }
 
+  // ── Skills (local — always overwrite) ──
+  const localSkills = path.join(orchDir, ".claude", "skills");
+  mkdirp(localSkills);
+  const skipDirs = new Set(["rules", "agents", "hooks", "templates"]);
+  let skillCount = 0;
+  for (const entry of fs.readdirSync(SKILLS_DIR, { withFileTypes: true })) {
+    if (!entry.isDirectory() || skipDirs.has(entry.name)) continue;
+    copyDir(path.join(SKILLS_DIR, entry.name), path.join(localSkills, entry.name));
+    skillCount++;
+  }
+  ok(`${skillCount} skills ${c.dim}(local — orchestrator/.claude/skills/)${c.reset}`);
+
+  // ── Rules (local — always overwrite) ──
+  const localRules = path.join(orchDir, ".claude", "rules");
+  mkdirp(localRules);
+  const rulesDir = path.join(SKILLS_DIR, "rules");
+  if (fs.existsSync(rulesDir)) {
+    let ruleCount = 0;
+    for (const f of fs.readdirSync(rulesDir)) {
+      if (f.endsWith(".md")) { copyFile(path.join(rulesDir, f), path.join(localRules, f)); ruleCount++; }
+    }
+    ok(`${ruleCount} rules ${c.dim}(local — orchestrator/.claude/rules/)${c.reset}`);
+  }
+
   // ── Templates (always overwrite — reference docs) ──
   const templatesDir = path.join(SKILLS_DIR, "templates");
   const localTemplates = path.join(orchDir, "templates");
@@ -470,13 +552,13 @@ function updateLocal() {
 
   // ── CLAUDE.md (always overwrite — generated file, not user content) ──
   const claudeMd = path.join(orchDir, "CLAUDE.md");
-  fs.writeFileSync(claudeMd, claudeMdContent());
+  writeFile(claudeMd, claudeMdContent());
   ok("CLAUDE.md updated");
 
   // ── Plan template (always overwrite — structure only) ──
   const planTpl = path.join(orchDir, "plans", "_TEMPLATE.md");
   if (fs.existsSync(path.join(orchDir, "plans"))) {
-    fs.writeFileSync(planTpl, planTemplateContent());
+    writeFile(planTpl, planTemplateContent());
     ok("_TEMPLATE.md updated");
   }
 
@@ -536,7 +618,7 @@ function setupWorkspace(workspacePath, projectName) {
   if (!fs.existsSync(wsMd)) {
     const tpl = path.join(orchDir, "templates", "workspace.template.md");
     if (fs.existsSync(tpl)) copyFile(tpl, wsMd);
-    else fs.writeFileSync(wsMd, `# Workspace: ${projectName}\n\n## Projet\n[UNCONFIGURED]\n`);
+    else writeFile(wsMd, `# Workspace: ${projectName}\n\n## Projet\n[UNCONFIGURED]\n`);
     ok(`workspace.md ${c.dim}[UNCONFIGURED]${c.reset}`);
   } else {
     warn("workspace.md exists — skipped");
@@ -547,7 +629,7 @@ function setupWorkspace(workspacePath, projectName) {
   if (!fs.existsSync(constMd)) {
     const tpl = path.join(orchDir, "templates", "constitution.template.md");
     if (fs.existsSync(tpl)) copyFile(tpl, constMd);
-    else fs.writeFileSync(constMd, [
+    else writeFile(constMd, [
       `# Constitution — ${projectName}`, "",
       "> Define your project's non-negotiable engineering principles here.",
       "> The orchestrator and every teammate must follow these rules without exception.", "",
@@ -570,12 +652,37 @@ function setupWorkspace(workspacePath, projectName) {
     for (const f of fs.readdirSync(hooksSrc)) {
       if (!f.endsWith(".sh")) continue;
       copyFile(path.join(hooksSrc, f), path.join(hooksDir, f));
-      fs.chmodSync(path.join(hooksDir, f), 0o755);
+      if (!DRY_RUN) fs.chmodSync(path.join(hooksDir, f), 0o755);
       hookCount++;
     }
   }
   ok(`${hookCount} hooks ${c.dim}(all warning-only)${c.reset}`);
 
+  // ── Skills (local to orchestrator/) ──
+  step("Installing skills & rules");
+  const localSkills = path.join(orchDir, ".claude", "skills");
+  mkdirp(localSkills);
+  const skipDirs = new Set(["rules", "agents", "hooks", "templates"]);
+  let skillCount = 0;
+  for (const entry of fs.readdirSync(SKILLS_DIR, { withFileTypes: true })) {
+    if (!entry.isDirectory() || skipDirs.has(entry.name)) continue;
+    copyDir(path.join(SKILLS_DIR, entry.name), path.join(localSkills, entry.name));
+    skillCount++;
+  }
+  ok(`${skillCount} skills ${c.dim}(local — orchestrator/.claude/skills/)${c.reset}`);
+
+  // ── Rules (local to orchestrator/) ──
+  const localRules = path.join(orchDir, ".claude", "rules");
+  mkdirp(localRules);
+  const rulesSrc = path.join(SKILLS_DIR, "rules");
+  let ruleCount = 0;
+  if (fs.existsSync(rulesSrc)) {
+    for (const f of fs.readdirSync(rulesSrc)) {
+      if (f.endsWith(".md")) { copyFile(path.join(rulesSrc, f), path.join(localRules, f)); ruleCount++; }
+    }
+  }
+  ok(`${ruleCount} rules ${c.dim}(local — orchestrator/.claude/rules/)${c.reset}`);
+
   // ── Settings ──
   generateSettings(orchDir);
   ok(`settings.json ${c.dim}(env + hooks)${c.reset}`);
@@ -583,7 +690,7 @@ function setupWorkspace(workspacePath, projectName) {
   // ── CLAUDE.md ──
   const claudeMd = path.join(orchDir, "CLAUDE.md");
   if (!fs.existsSync(claudeMd)) {
-    fs.writeFileSync(claudeMd, claudeMdContent());
+    writeFile(claudeMd, claudeMdContent());
     ok("CLAUDE.md");
   } else {
     warn("CLAUDE.md exists — skipped");
@@ -592,14 +699,14 @@ function setupWorkspace(workspacePath, projectName) {
   // ── Plan template ──
   const planTpl = path.join(orchDir, "plans", "_TEMPLATE.md");
   if (!fs.existsSync(planTpl)) {
-    fs.writeFileSync(planTpl, planTemplateContent());
+    writeFile(planTpl, planTemplateContent());
     ok("Plan template");
   }
 
   // ── .gitignore ──
   const gi = path.join(orchDir, ".gitignore");
   if (!fs.existsSync(gi)) {
-    fs.writeFileSync(gi, [
+    writeFile(gi, [
       ".claude/bash-commands.log", ".claude/worktrees/", ".claude/modified-files.log",
       ".sessions/",
       "plans/*.md", "!plans/_TEMPLATE.md", "!plans/service-profiles.md",
@@ -651,7 +758,7 @@ function setupWorkspace(workspacePath, projectName) {
     profileLines.push(`- **CLAUDE.md** : ${r.hasClaude ? "present" : "ABSENT — /bootstrap-repo"}`);
     profileLines.push("");
   }
-  fs.writeFileSync(path.join(orchDir, "plans", "service-profiles.md"), profileLines.join("\n"));
+  writeFile(path.join(orchDir, "plans", "service-profiles.md"), profileLines.join("\n"));
 
   // ── Final summary ──
   log("");
@@ -661,14 +768,18 @@ function setupWorkspace(workspacePath, projectName) {
   log("");
   log(`  ${c.dim}Directory${c.reset}  ${orchDir}`);
   log(`  ${c.dim}Repos${c.reset}      ${repos.length} detected`);
-  log(`  ${c.dim}Hooks${c.reset}      ${hookCount} scripts`);
-  log(`  ${c.dim}Skills${c.reset}     13 ${c.dim}(~/.claude/skills/)${c.reset}`);
+  log(`  ${c.dim}Hooks${c.reset}      ${hookCount} scripts ${c.dim}(local)${c.reset}`);
+  log(`  ${c.dim}Skills${c.reset}     ${skillCount} ${c.dim}(local — orchestrator/.claude/skills/)${c.reset}`);
+  log(`  ${c.dim}Rules${c.reset}      ${ruleCount} ${c.dim}(local — orchestrator/.claude/rules/)${c.reset}`);
+  log(`  ${c.dim}Agents${c.reset}     6 ${c.dim}(global — ~/.claude/agents/)${c.reset}`);
   log("");
   log(`  ${c.bold}Next steps:${c.reset}`);
   log(`    ${c.cyan}cd orchestrator/${c.reset}`);
   log(`    ${c.cyan}claude --agent workspace-init${c.reset}   ${c.dim}# first time: diagnostic + config${c.reset}`);
   log(`    ${c.dim}  └─ type "go" to start the diagnostic${c.reset}`);
-  log(`    ${c.cyan}claude --agent team-lead${c.reset}        ${c.dim}# orchestration sessions${c.reset}`);
+  log(`    ${c.cyan}claude --agent team-lead${c.reset}        ${c.dim}# orchestration sessions (v5: git + micro-QA)${c.reset}`);
+  log(`    ${c.cyan}claude --agent reviewer${c.reset}         ${c.dim}# evidence-based code review${c.reset}`);
+  log(`    ${c.cyan}claude --agent security-auditor${c.reset} ${c.dim}# security audit${c.reset}`);
   log(`    ${c.cyan}claude --agent e2e-validator${c.reset}    ${c.dim}# E2E validation (beta)${c.reset}`);
   if (reposWithoutClaude.length > 0) {
     log("");
@@ -696,27 +807,22 @@ function doctor() {
     installed ? `v${installed} (package is v${PKG.version})` : "not installed — run: npx cc-workspace update"
   );
 
-  // Global dirs
-  check("~/.claude/skills/", fs.existsSync(GLOBAL_SKILLS), "missing");
-  check("~/.claude/rules/", fs.existsSync(GLOBAL_RULES), "missing");
+  // Global: only agents expected
   check("~/.claude/agents/", fs.existsSync(GLOBAL_AGENTS), "missing");
 
-  // Skills count
-  if (fs.existsSync(GLOBAL_SKILLS)) {
-    const skills = fs.readdirSync(GLOBAL_SKILLS, { withFileTypes: true }).filter(e => e.isDirectory());
-    check(`Skills (${skills.length}/13)`, skills.length >= 13, `only ${skills.length} found`);
-  }
-
-  // Rules
-  for (const r of ["context-hygiene.md", "model-routing.md"]) {
-    check(`Rule: ${r}`, fs.existsSync(path.join(GLOBAL_RULES, r)), "missing");
-  }
-
   // Agents
-  for (const a of ["team-lead.md", "implementer.md", "workspace-init.md", "e2e-validator.md"]) {
+  for (const a of ["team-lead.md", "implementer.md", "workspace-init.md", "e2e-validator.md", "reviewer.md", "security-auditor.md"]) {
     check(`Agent: ${a}`, fs.existsSync(path.join(GLOBAL_AGENTS, a)), "missing");
   }
 
+  // Legacy detection: warn if skills/rules still in global
+  const legacySkills = fs.existsSync(GLOBAL_SKILLS) &&
+    fs.readdirSync(GLOBAL_SKILLS, { withFileTypes: true }).some(e => e.isDirectory() && e.name === "dispatch-feature");
+  const legacyRules = fs.existsSync(path.join(GLOBAL_RULES, "model-routing.md"));
+  if (legacySkills || legacyRules) {
+    warn(`Legacy global skills/rules detected in ~/.claude/ — run: npx cc-workspace update --force`);
+  }
+
   // jq
   let jqOk = false;
   try { execSync("jq --version", { stdio: "pipe" }); jqOk = true; } catch {}
@@ -727,21 +833,42 @@ function doctor() {
   const orchDir = path.join(cwd, "orchestrator");
   const inOrch = fs.existsSync(path.join(cwd, "workspace.md"));
   const hasOrch = fs.existsSync(orchDir);
+  const localDir = inOrch ? cwd : hasOrch ? orchDir : null;
+
+  if (localDir) {
+    step(inOrch ? "Local workspace (inside orchestrator/)" : "Local workspace (orchestrator/ found)");
+
+    if (inOrch) {
+      check("workspace.md", true, "");
+      check("constitution.md", fs.existsSync(path.join(localDir, "constitution.md")), "missing");
+      check("plans/", fs.existsSync(path.join(localDir, "plans")), "missing");
+      check("templates/", fs.existsSync(path.join(localDir, "templates")), "missing");
+      check(".claude/hooks/", fs.existsSync(path.join(localDir, ".claude", "hooks")), "missing");
+      check(".sessions/", fs.existsSync(path.join(localDir, ".sessions")), "missing — run: npx cc-workspace update");
+      check("e2e/", fs.existsSync(path.join(localDir, "e2e")), "missing — run: npx cc-workspace update");
+      const configured = !fs.readFileSync(path.join(localDir, "workspace.md"), "utf8").includes("[UNCONFIGURED]");
+      check("workspace.md configured", configured, "[UNCONFIGURED] — run: claude --agent workspace-init");
+    } else {
+      check("orchestrator/workspace.md", fs.existsSync(path.join(orchDir, "workspace.md")), "missing — run init");
+    }
+
+    // Local skills (v5.2+)
+    const localSkills = path.join(localDir, ".claude", "skills");
+    if (fs.existsSync(localSkills)) {
+      const skills = fs.readdirSync(localSkills, { withFileTypes: true }).filter(e => e.isDirectory());
+      const skipDirsDoctor = new Set(["rules", "agents", "hooks", "templates"]);
+      const expectedSkillCount = fs.readdirSync(SKILLS_DIR, { withFileTypes: true })
+        .filter(e => e.isDirectory() && !skipDirsDoctor.has(e.name)).length;
+      check(`Local skills (${skills.length}/${expectedSkillCount})`, skills.length >= expectedSkillCount, `only ${skills.length} found — run: npx cc-workspace update --force`);
+    } else {
+      check("Local skills", false, "missing .claude/skills/ — run: npx cc-workspace update --force");
+    }
 
-  if (inOrch) {
-    step("Local workspace (inside orchestrator/)");
-    check("workspace.md", true, "");
-    check("constitution.md", fs.existsSync(path.join(cwd, "constitution.md")), "missing");
-    check("plans/", fs.existsSync(path.join(cwd, "plans")), "missing");
-    check("templates/", fs.existsSync(path.join(cwd, "templates")), "missing");
-    check(".claude/hooks/", fs.existsSync(path.join(cwd, ".claude", "hooks")), "missing");
-    check(".sessions/", fs.existsSync(path.join(cwd, ".sessions")), "missing — run: npx cc-workspace update");
-    check("e2e/", fs.existsSync(path.join(cwd, "e2e")), "missing — run: npx cc-workspace update");
-    const configured = !fs.readFileSync(path.join(cwd, "workspace.md"), "utf8").includes("[UNCONFIGURED]");
-    check("workspace.md configured", configured, "[UNCONFIGURED] — run: claude --agent workspace-init");
-  } else if (hasOrch) {
-    step("Local workspace (orchestrator/ found)");
-    check("orchestrator/workspace.md", fs.existsSync(path.join(orchDir, "workspace.md")), "missing — run init");
+    // Local rules (v5.2+)
+    const localRules = path.join(localDir, ".claude", "rules");
+    for (const r of ["context-hygiene.md", "model-routing.md"]) {
+      check(`Local rule: ${r}`, fs.existsSync(path.join(localRules, r)), `missing — run: npx cc-workspace update --force`);
+    }
   } else {
     log(`\n  ${c.dim}No orchestrator/ found in cwd.${c.reset}`);
   }
@@ -795,26 +922,32 @@ const command = args[0];
 
 switch (command) {
   case "init": {
-    const workspace = args[1] || ".";
-    const name = args[2] || "My Project";
+    DRY_RUN = args.includes("--dry-run");
+    const filteredArgs = args.filter(a => a !== "--dry-run");
+    const workspace = filteredArgs[1] || ".";
+    const name = filteredArgs[2] || "My Project";
     log(BANNER);
+    if (DRY_RUN) log(`  ${c.yellow}${c.bold}DRY RUN${c.reset} — no files will be written\n`);
     installGlobals(false);
     setupWorkspace(workspace, name);
     break;
   }
 
   case "update": {
+    DRY_RUN = args.includes("--dry-run");
     const force = args.includes("--force");
     log(BANNER);
+    if (DRY_RUN) log(`  ${c.yellow}${c.bold}DRY RUN${c.reset} — no files will be written\n`);
     const updated = installGlobals(force);
     const localUpdated = (updated || force) ? updateLocal() : false;
     if (!updated && !force) {
       log(`\n  ${c.dim}Already up to date. Use --force to reinstall.${c.reset}\n`);
     } else {
       if (localUpdated) {
-        log(`\n  ${c.green}${c.bold}Update complete (globals + local orchestrator/).${c.reset}\n`);
+        log(`\n  ${c.green}${c.bold}Update complete (agents global + skills/rules/hooks local).${c.reset}\n`);
       } else {
-        log(`\n  ${c.green}${c.bold}Update complete (globals only — no local orchestrator/ found).${c.reset}\n`);
+        log(`\n  ${c.green}${c.bold}Update complete (agents only — no local orchestrator/ found).${c.reset}`);
+        log(`  ${c.dim}Run from workspace root or orchestrator/ to also update local skills, rules, and hooks.${c.reset}\n`);
       }
     }
     break;
@@ -843,7 +976,14 @@ switch (command) {
         return;
       }
 
-      // Skills
+      // Agents (global)
+      for (const f of ["team-lead.md", "implementer.md", "workspace-init.md", "e2e-validator.md", "reviewer.md", "security-auditor.md"]) {
+        const fp = path.join(GLOBAL_AGENTS, f);
+        if (fs.existsSync(fp)) fs.unlinkSync(fp);
+      }
+      ok("Agents removed");
+
+      // Legacy global skills (from versions < 5.2)
       if (fs.existsSync(GLOBAL_SKILLS)) {
         const skipDirs = new Set(["rules", "agents", "hooks", "templates"]);
         const skillDirs = fs.readdirSync(SKILLS_DIR, { withFileTypes: true })
@@ -854,22 +994,15 @@ switch (command) {
           const target = path.join(GLOBAL_SKILLS, name);
           if (fs.existsSync(target)) { fs.rmSync(target, { recursive: true }); n++; }
         }
-        ok(`${n} skills removed`);
+        if (n > 0) ok(`${n} legacy global skills removed`);
       }
 
-      // Rules
+      // Legacy global rules (from versions < 5.2)
       for (const f of ["context-hygiene.md", "model-routing.md"]) {
         const fp = path.join(GLOBAL_RULES, f);
         if (fs.existsSync(fp)) fs.unlinkSync(fp);
       }
-      ok("Rules removed");
-
-      // Agents
-      for (const f of ["team-lead.md", "implementer.md", "workspace-init.md", "e2e-validator.md"]) {
-        const fp = path.join(GLOBAL_AGENTS, f);
-        if (fs.existsSync(fp)) fs.unlinkSync(fp);
-      }
-      ok("Agents removed");
+      ok("Legacy global rules removed (if any)");
 
       // Version file
       if (fs.existsSync(VERSION_FILE)) fs.unlinkSync(VERSION_FILE);
@@ -878,6 +1011,7 @@ switch (command) {
       log("");
       log(`  ${c.green}${c.bold}Uninstall complete.${c.reset}`);
       log(`  ${c.dim}Local orchestrator/ directories are preserved — remove them manually if needed.${c.reset}`);
+      log(`  ${c.dim}(Skills, rules, hooks, settings, plans live in orchestrator/.claude/)${c.reset}`);
       log("");
       rl.close();
     })();
@@ -902,14 +1036,16 @@ switch (command) {
     log(BANNER);
     log(`  ${c.bold}Usage:${c.reset}`);
     log("");
-    log(`    ${c.cyan}npx cc-workspace init${c.reset} ${c.dim}[path] ["Project Name"]${c.reset}`);
+    log(`    ${c.cyan}npx cc-workspace init${c.reset} ${c.dim}[path] ["Project Name"] [--dry-run]${c.reset}`);
     log(`      Setup orchestrator/ in the target workspace.`);
     log(`      Installs global skills/rules/agents if version is newer.`);
+    log(`      ${c.dim}--dry-run: preview what would be created without writing files${c.reset}`);
     log("");
-    log(`    ${c.cyan}npx cc-workspace update${c.reset} ${c.dim}[--force]${c.reset}`);
+    log(`    ${c.cyan}npx cc-workspace update${c.reset} ${c.dim}[--force] [--dry-run]${c.reset}`);
     log(`      Update global components (skills, rules, agents).`);
     log(`      Also updates local orchestrator/ if found (hooks, settings, CLAUDE.md, templates).`);
     log(`      Never overwrites: workspace.md, constitution.md, plans/.`);
+    log(`      ${c.dim}--dry-run: preview what would be updated without writing files${c.reset}`);
     log("");
     log(`    ${c.cyan}npx cc-workspace doctor${c.reset}`);
     log(`      Check all components are installed and consistent.`);
@@ -936,6 +1072,8 @@ switch (command) {
     log(`    ${c.cyan}claude --agent workspace-init${c.reset}   ${c.dim}# first time${c.reset}`);
     log(`    ${c.dim}  └─ type "go" to start the diagnostic${c.reset}`);
     log(`    ${c.cyan}claude --agent team-lead${c.reset}        ${c.dim}# work sessions${c.reset}`);
+    log(`    ${c.cyan}claude --agent reviewer${c.reset}         ${c.dim}# code review${c.reset}`);
+    log(`    ${c.cyan}claude --agent security-auditor${c.reset} ${c.dim}# security audit${c.reset}`);
     log(`    ${c.cyan}claude --agent e2e-validator${c.reset}    ${c.dim}# E2E validation (beta)${c.reset}`);
     log("");
     break;
@@ -1033,9 +1171,16 @@ switch (command) {
         const ask = (q) => new Promise(r => rl.question(q, r));
 
         (async () => {
+          // Check gh CLI availability before PR step
+          let ghAvailable = false;
+          try { execSync("gh --version", { stdio: "pipe" }); ghAvailable = true; } catch {}
+
           // Step 1: offer to create PRs
+          if (!ghAvailable) {
+            info(`${c.dim}gh CLI not found — skipping PR creation (install: https://cli.github.com)${c.reset}`);
+          }
           for (const [name, repo] of Object.entries(session.repos || {})) {
-            if (!repo.branch_created) continue;
+            if (!repo.branch_created || !ghAvailable) continue;
             const repoPath = path.resolve(orchDir, repo.path);
             const answer = await ask(
               `  Create PR ${c.cyan}${repo.session_branch}${c.reset} → ${c.cyan}${repo.source_branch}${c.reset} in ${c.bold}${name}${c.reset}? [y/N] `
@@ -1053,9 +1198,44 @@ switch (command) {
             }
           }
 
-          // Step 2: offer to delete session branches
+          // Step 2: offer to remove worktrees
+          for (const [name, repo] of Object.entries(session.repos || {})) {
+            const worktreePath = repo.worktree_path;
+            if (!worktreePath || !fs.existsSync(worktreePath)) {
+              info(`Worktree ${worktreePath || "unknown"} for ${name} — not found, skipping`);
+              continue;
+            }
+            const repoPath = path.resolve(orchDir, repo.path);
+            // Check for uncommitted changes
+            let dirty = "";
+            try {
+              dirty = execSync(
+                `git -C "${worktreePath}" status --short 2>/dev/null`,
+                { encoding: "utf8", timeout: 5000 }
+              ).trim();
+            } catch { /* ignore */ }
+            if (dirty) {
+              warn(`${name}: worktree has uncommitted changes`);
+            }
+            const answer = await ask(
+              `  Remove worktree ${c.cyan}${worktreePath}${c.reset} for ${c.bold}${name}${c.reset}?${dirty ? ` ${c.red}(has uncommitted changes)${c.reset}` : ""} [y/N] `
+            );
+            if (answer.toLowerCase() === "y") {
+              try {
+                execSync(`git -C "${repoPath}" worktree remove "${worktreePath}" --force`,
+                  { encoding: "utf8", timeout: 10000 });
+                execSync(`git -C "${repoPath}" worktree prune`,
+                  { encoding: "utf8", timeout: 5000 });
+                ok(`Worktree removed for ${name}`);
+              } catch (e) {
+                fail(`Worktree removal failed for ${name}: ${e.stderr || e.message}`);
+              }
+            }
+          }
+
+          // Step 3: offer to delete session branches
           for (const [name, repo] of Object.entries(session.repos || {})) {
-            if (!repo.branch_created) continue;
+            if (!repo.session_branch) continue;
             const repoPath = path.resolve(orchDir, repo.path);
             // Check for unpushed commits before offering deletion
             let unpushed = "";
@@ -1073,7 +1253,6 @@ switch (command) {
             );
             if (answer.toLowerCase() === "y") {
               try {
-                // Use -D (force) — user already confirmed, branch may not be merged yet
                 execSync(`git -C "${repoPath}" branch -D "${repo.session_branch}"`,
                   { encoding: "utf8", timeout: 5000 });
                 ok(`Branch deleted in ${name}`);