crewly 1.20.153 → 1.20.154

package/README.md

@@ -25,6 +25,18 @@ Under the hood, Crewly is an open-source multi-agent orchestration platform that
 
 ## Quick Start
 
+```bash
+curl -fsSL https://crewlyai.com/install.sh | bash
+```
+
+The installer needs no `sudo`: if your global npm folder is not writable (a system Node on Linux), it installs Crewly under `~/.crewly/npm-global` and adds that to your PATH. Then it runs the setup wizard (the same as `crewly init`). When it finishes, open a new terminal and run:
+
+```bash
+crewly start
+```
+
+**Prefer npm?** With Node from nvm, fnm or Homebrew (your user owns the global npm folder):
+
 ```bash
 npm install -g crewly
 crewly init
@@ -41,8 +53,6 @@ crewly init
 crewly start
 ```
 
-Node installed with nvm, fnm or Homebrew does not need this.
-
 The `init` command walks you through provider selection, installs agent skills, and scaffolds a `.crewly/` directory. Then `crewly start` launches the backend server and opens the web dashboard. From there:
 
 1. Create a **team** with agents assigned to roles
@@ -216,7 +226,15 @@ types into them — so the API must not be open to the network. The rules:
 - **OKR approvals are owner-only.** `POST /api/missions/:id/approve|reject` require the
   token even from loopback and refuse agent sessions (`403 owner_approval_required`);
   agent PTYs never inherit `CREWLY_API_TOKEN`.
-- `/health` and the static dashboard assets stay open. `POST /api/cloud/mobile-pair`
+- **`/health` needs the token from other addresses too** (since #825). Loopback gets the
+  same response as before. Any other address without the token gets the same `401` as
+  `/api`, so a phone on your Wi-Fi without the token falls back to the Cloud relay instead
+  of picking a LAN connection it cannot use. **If you monitor `/health` from another
+  machine** (uptime checker, load balancer, a reverse proxy in front of Docker), either
+  send the token or set `CREWLY_PUBLIC_HEALTH=1` to keep it open. Behind Docker's port
+  mapping even `curl localhost:8787/health` *on the host* is a non-loopback call; the
+  container's own `HEALTHCHECK` runs inside the container and is unaffected.
+- The static dashboard assets stay open. `POST /api/cloud/mobile-pair`
   is token-gated like everything else (it hands out the Cloud session).
 
 ## Docker

package/config/constants.ts

@@ -295,7 +295,20 @@ export const API_SECURITY_CONSTANTS = {
 		TRUST_PROXY: 'CREWLY_TRUST_PROXY',
 		/** Set to `1`/`true` to force headless (no display) detection */
 		HEADLESS: 'CREWLY_HEADLESS',
+		/**
+		 * Set to `1`/`true` to keep `GET /health` open to non-loopback callers
+		 * without the API token (#825). For deployments that monitor /health
+		 * from another machine or through a public reverse proxy.
+		 */
+		PUBLIC_HEALTH: 'CREWLY_PUBLIC_HEALTH',
 	},
+	/**
+	 * Backend-only secrets that agent PTYs must not inherit from the backend's
+	 * process.env. No agent, skill or runtime reads them (the Slack bridge runs
+	 * in the backend), and an agent that runs `env` would print them into
+	 * scrollback and its session log.
+	 */
+	AGENT_ENV_DENYLIST: ['SLACK_BOT_TOKEN', 'SLACK_APP_TOKEN', 'SLACK_SIGNING_SECRET'] as readonly string[],
 	/** Default bind host — every interface, for backward compatibility */
 	DEFAULT_BIND_HOST: '0.0.0.0',
 	/** Loopback-only bind host suggested in the startup warning */
@@ -1407,6 +1420,71 @@ export const CLOUD_DISCONNECT_NOTICE_CONSTANTS = {
 	SLACK_REQUEST_TIMEOUT_MS: 15 * 1000,
 } as const;
 
+/**
+ * Project tickets (specs/2026-09-28-project-tickets.md): a project's own
+ * backlog, one markdown file per ticket under `<project>/.crewly/tickets/`,
+ * tracked in git. Shared by the backend service, the CLI migration command
+ * and (mirrored) the frontend board.
+ */
+export const PROJECT_TICKET_CONSTANTS = {
+	/** Folder inside the project's `.crewly` data dir */
+	DIR_NAME: 'tickets',
+	/** Repo-relative folder, used for git tracking checks */
+	REPO_RELATIVE_DIR: '.crewly/tickets',
+	/** Counter file (tracked): `{ "prefix": "CRW", "next": 13 }` */
+	COUNTER_FILENAME: '.counter.json',
+	/** Cross-process lockfile (ignored by the folder's own .gitignore) */
+	LOCK_FILENAME: '.lock',
+	/** The folder's own .gitignore (keeps the lock and temp files out of version control) */
+	FOLDER_GITIGNORE_CONTENT: '# Crewly: transient files, never commit\n.lock\n*.tmp.*\n',
+	/** A lockfile older than this is considered left behind by a crashed writer (ms) */
+	LOCK_STALE_MS: 30 * 1000,
+	/** Wait between lock attempts (ms) */
+	LOCK_RETRY_MS: 25,
+	/** Give up acquiring the lock after this long (ms) */
+	LOCK_TIMEOUT_MS: 10 * 1000,
+	/** Ticket statuses, in board order */
+	STATUSES: ['backlog', 'ready', 'in_progress', 'review', 'done', 'cancelled'] as const,
+	/** Priorities, highest first */
+	PRIORITIES: ['P0', 'P1', 'P2', 'P3'] as const,
+	/** Priority of a ticket created without one */
+	DEFAULT_PRIORITY: 'P2',
+	/** Status of a ticket created without one (and of every worker-created ticket) */
+	DEFAULT_STATUS: 'backlog',
+	/** Fallback id prefix when the project name has no letters/digits */
+	FALLBACK_PREFIX: 'T',
+	/** Max characters of the id prefix derived from the project name */
+	MAX_PREFIX_LENGTH: 4,
+	/** Max characters of the slug in the file name */
+	MAX_SLUG_LENGTH: 48,
+	/** Section headings the service reads / writes */
+	SECTIONS: {
+		DESCRIPTION: 'Description',
+		ACCEPTANCE: 'Acceptance criteria',
+		LOG: 'Log',
+	},
+	/** `source` value stamped by the v1 migration */
+	MIGRATION_SOURCE: 'v1-migration',
+	/** v1 status folders whose files are imported (done/ and blocked/ are not) */
+	MIGRATION_STATUS_FOLDERS: ['open', 'in_progress'] as const,
+	/** v1 task root inside the project's `.crewly` data dir */
+	MIGRATION_V1_DIR: 'tasks',
+	/** Lines appended to the project's .gitignore when the tickets folder is ignored */
+	GITIGNORE_BLOCK: [
+		'# Crewly project tickets are tracked (specs/2026-09-28-project-tickets.md)',
+		'!.crewly/',
+		'.crewly/*',
+		'!.crewly/tickets/',
+		'!.crewly/tickets/**',
+	] as const,
+	/** WorkItem metadata key linking a WorkItem to its project ticket */
+	WORK_ITEM_METADATA_KEY: 'projectTicket',
+	/** How often the sweep reconciles tickets with their WorkItems (ms) */
+	SYNC_SWEEP_INTERVAL_MS: 60 * 1000,
+	/** Successor hops followed from a ticket's WorkItem before giving up */
+	MAX_SUCCESSOR_HOPS: 8,
+} as const;
+
 /**
  * Type helpers for extracting literal types from constants
  */

package/config/hooks/agent-status/report.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Crewly agent-status hook — tells the backend when Claude Code is waiting on
+# the user (a permission prompt or a question) and when it stops waiting.
+#
+# Spec: specs/2026-09-26-agent-waiting-on-human.md (#815, hook ingestion).
+#
+# Wired by the backend into the per-session settings file it already passes
+# with `claude --settings <file>` (the control-plane guard's file) for:
+#   Notification, PermissionRequest, Stop, UserPromptSubmit, PostToolUse
+#
+# Usage: bash report.sh            # hook JSON on stdin
+#
+# PRIVACY: the stdin JSON can hold tool_input, file contents, prompts and a
+# transcript path, any of which may contain secrets. This script extracts
+# exactly two TOP-LEVEL fields — hook_event_name and notification_type — keeps them only
+# if they are plain identifiers ([A-Za-z_], max 64 chars), and sends those plus
+# the session name. Nothing else from stdin is sent, printed or logged.
+#
+# It never blocks or slows the agent: every path exits 0, and the POST has a
+# 2-second ceiling. A failed POST is dropped silently (the backend's screen
+# detection still covers the state).
+
+set -u
+
+INPUT="$(cat)"
+SESSION="${CREWLY_SESSION_NAME:-}"
+API_URL="${CREWLY_API_URL:-http://localhost:${WEB_PORT:-8787}}"
+
+# No session => nothing to attribute the event to.
+[ -z "$SESSION" ] && exit 0
+
+# Pull one TOP-LEVEL string field out of the JSON without echoing the rest.
+# Only a real JSON parser can tell a top-level key from the same key nested in
+# tool_input (a regex cannot: `"hook_event_name":"Stop"` inside a command would
+# spoof the event). So: jq, else node's JSON.parse, else nothing — the event is
+# dropped and the backend's screen detection still covers the state.
+field() {
+	local name="$1" value=""
+	if command -v jq >/dev/null 2>&1; then
+		value="$(printf '%s' "$INPUT" | jq -r --arg k "$name" 'if type == "object" then (.[$k] // empty | select(type == "string")) else empty end' 2>/dev/null)"
+	elif command -v node >/dev/null 2>&1; then
+		value="$(printf '%s' "$INPUT" | node -e '
+			let s = "";
+			process.stdin.on("data", (c) => { s += c; });
+			process.stdin.on("end", () => {
+				try {
+					const o = JSON.parse(s);
+					const v = o && typeof o === "object" && !Array.isArray(o) ? o[process.argv[1]] : undefined;
+					if (typeof v === "string") process.stdout.write(v);
+				} catch { /* not JSON: send nothing */ }
+			});' "$name" 2>/dev/null)"
+	fi
+	# Keep only a plain identifier; anything else is discarded, not sanitised.
+	if printf '%s' "$value" | grep -Eq '^[A-Za-z_]{1,64}$'; then
+		printf '%s' "$value"
+	fi
+}
+
+EVENT="$(field hook_event_name)"
+[ -z "$EVENT" ] && exit 0
+NOTIFICATION_TYPE="$(field notification_type)"
+
+if [ -n "$NOTIFICATION_TYPE" ]; then
+	BODY="{\"event\":\"$EVENT\",\"notificationType\":\"$NOTIFICATION_TYPE\"}"
+else
+	BODY="{\"event\":\"$EVENT\"}"
+fi
+
+ARGS=(-s -o /dev/null --max-time 2 -X POST "$API_URL/api/agent-hooks"
+	-H "Content-Type: application/json"
+	-H "User-Agent: crewly-agent-status-hook/1"
+	-H "X-Agent-Session: $SESSION")
+if [ -n "${CREWLY_AGENT_AUTHORIZATION:-}" ]; then
+	ARGS+=(-H "X-Agent-Authorization: b64:$(printf '%s' "$CREWLY_AGENT_AUTHORIZATION" | base64 | tr -d '\n')")
+fi
+
+curl "${ARGS[@]}" --data "$BODY" >/dev/null 2>&1 || true
+exit 0

package/config/hooks/control-plane-guard/pretooluse-bash.sh

@@ -0,0 +1,241 @@
+#!/usr/bin/env bash
+# Crewly control-plane guard — Claude Code PreToolUse hook for the Bash tool.
+#
+# Spec: specs/2026-09-24-control-plane-isolation.md, Part 3 item 3.
+#
+# Usage (wired by the backend through `claude --settings <file>`):
+#   bash pretooluse-bash.sh <protected-paths-file>   # PreToolUse JSON on stdin
+#
+# The paths file holds one absolute path per line (a file, or a directory
+# whose whole subtree is protected). Lines starting with '#' are ignored.
+#
+# Blocks a Bash command that WRITES a protected path. It looks for:
+#   - redirection onto the path            (>, >>, >|)
+#   - a mutating verb whose arguments name it
+#         rm rmdir unlink chmod chown chgrp truncate touch tee mv shred
+#   - in-place editors                     (sed -i, perl -i, gsed -i)
+#   - copy/link onto it as the destination (cp ln install rsync: last argument)
+#   - dd of=<path>
+#   - git checkout/restore/rm/mv/apply naming it
+# Reads (cat, grep, jq, head, ls, cp FROM the path, ...) stay allowed.
+#
+# Exit codes follow the Claude Code hook contract:
+#   0  allowed (stdout: what was checked)
+#   2  blocked (stderr: the rule and path that matched, fed back to the agent)
+#   1  guard could not check anything (no paths loaded). This is a non-blocking
+#      error, never a silent pass (team norm: a guard reports what it examined).
+#
+# Coverage limits, stated so a clean result is not over-read:
+#   - an interpreter one-liner (python -c, node -e) that writes the path is NOT seen
+#   - a path built at runtime (variables other than $HOME, cd + relative path
+#     from a different directory, globs, base64) is NOT seen
+#   - calls to the loopback API are NOT seen
+
+set -u
+
+PATHS_FILE="${1:-}"
+PREFIX="control-plane-guard:"
+
+INPUT="$(cat)"
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "$PREFIX jq not found — 0 protected path(s) checked, guard inactive for this call" >&2
+  exit 1
+fi
+
+TOOL_NAME="$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)"
+COMMAND="$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)"
+CWD="$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)"
+
+if [ "$TOOL_NAME" != "Bash" ]; then
+  echo "$PREFIX not a Bash call (${TOOL_NAME:-unknown}) — nothing to check"
+  exit 0
+fi
+
+# ---- load protected paths -------------------------------------------------
+PROTECTED=()
+if [ -n "$PATHS_FILE" ] && [ -f "$PATHS_FILE" ]; then
+  while IFS= read -r line || [ -n "$line" ]; do
+    [ -z "$line" ] && continue
+    case "$line" in \#*) continue ;; esac
+    PROTECTED+=("${line%/}")
+  done < "$PATHS_FILE"
+fi
+
+if [ "${#PROTECTED[@]}" -eq 0 ]; then
+  echo "$PREFIX NO PATHS CHECKED — protected-paths file missing or empty (${PATHS_FILE:-<none>}); refusing to report this command as safe" >&2
+  exit 1
+fi
+
+# ---- normalise the command ------------------------------------------------
+# Expand the home forms an agent would type, and drop quotes so a quoted
+# path compares equal to a bare one.
+NORM="$COMMAND"
+HOME_DIR="${HOME:-}"
+if [ -n "$HOME_DIR" ]; then
+  NORM="${NORM//\$\{HOME\}/$HOME_DIR}"
+  NORM="${NORM//\$HOME/$HOME_DIR}"
+  NORM="${NORM//\~\//$HOME_DIR/}"
+fi
+NORM="${NORM//\"/}"
+NORM="${NORM//\'/}"
+
+# Split into simple-command segments on ; & | and newlines. A segment keeps
+# its own redirections, so `cat f > /tmp/x` and `echo x > f` are judged apart.
+# Pure bash (BSD sed has no \n in replacements). The redirection operators
+# that contain & or | (>&, &>, >|) are shielded first so they are not split.
+NL=$'\n'
+SPLIT="$NORM"
+SPLIT="${SPLIT//>|/__CPG_GT_PIPE__}"
+SPLIT="${SPLIT//>&/__CPG_GT_AMP__}"
+SPLIT="${SPLIT//&>/__CPG_AMP_GT__}"
+SPLIT="${SPLIT//;/$NL}"
+SPLIT="${SPLIT//|/$NL}"
+SPLIT="${SPLIT//&/$NL}"
+SPLIT="${SPLIT//__CPG_GT_PIPE__/>|}"
+SPLIT="${SPLIT//__CPG_GT_AMP__/>&}"
+SPLIT="${SPLIT//__CPG_AMP_GT__/&>}"
+SEGMENTS=()
+while IFS= read -r seg; do
+  [ -n "${seg//[[:space:]]/}" ] && SEGMENTS+=("$seg")
+done <<< "$SPLIT"
+
+# Forms of a protected path that a command might contain: the absolute path,
+# and when it sits under the call's cwd, the cwd-relative path (with and
+# without a leading ./).
+path_forms() {
+  local p="$1"
+  printf '%s\n' "$p"
+  if [ -n "$CWD" ] && [ "${p#"${CWD%/}"/}" != "$p" ]; then
+    local rel="${p#"${CWD%/}"/}"
+    printf '%s\n' "$rel"
+    printf '%s\n' "./$rel"
+  fi
+}
+
+# word_hits WORD FORM — true when WORD names FORM itself or something under it.
+word_hits() {
+  local w="$1" f="$2"
+  [ "$w" = "$f" ] && return 0
+  case "$w" in "$f"/*) return 0 ;; esac
+  return 1
+}
+
+# segment_writes SEGMENT FORM — prints the matched rule and returns 0 when the
+# segment writes FORM.
+segment_writes() {
+  local seg="$1" f="$2"
+
+  # 1. redirection targets
+  local rest="$seg" t word
+  while [ "${rest#*>}" != "$rest" ]; do
+    rest="${rest#*>}"
+    t="${rest#[>|]}"
+    t="${t#"${t%%[![:space:]]*}"}"
+    word="${t%%[[:space:]]*}"
+    if [ -n "$word" ] && word_hits "$word" "$f"; then
+      echo "redirection '>' onto it"; return 0
+    fi
+  done
+
+  # 2. verbs — strip the redirections, then word-split
+  local plain
+  plain="$(printf '%s' "$seg" | sed -E 's/[0-9]*>[>|]?[[:space:]]*[^[:space:]]+//g')"
+  local -a words
+  read -r -a words <<< "$plain"
+  [ "${#words[@]}" -eq 0 ] && return 1
+
+  local i=0
+  while [ "$i" -lt "${#words[@]}" ]; do
+    case "${words[$i]}" in
+      *=*|sudo|command|env|nohup|time|xargs|exec) i=$((i+1)) ;;
+      *) break ;;
+    esac
+  done
+  [ "$i" -ge "${#words[@]}" ] && return 1
+  local verb="${words[$i]##*/}"
+  local -a args=("${words[@]:$((i+1))}")
+  [ "${#args[@]}" -eq 0 ] && return 1
+
+  local a any=1
+  for a in "${args[@]}"; do
+    if word_hits "$a" "$f"; then any=0; break; fi
+  done
+
+  case "$verb" in
+    rm|rmdir|unlink|chmod|chown|chgrp|truncate|touch|tee|mv|shred)
+      [ "$any" -eq 0 ] && { echo "'$verb' on it"; return 0; } ;;
+    sed|gsed|perl)
+      if [ "$any" -eq 0 ]; then
+        for a in "${args[@]}"; do
+          case "$a" in -i*|--in-place*|-pi*|-*i) echo "'$verb -i' (in-place edit) on it"; return 0 ;; esac
+        done
+      fi ;;
+    cp|ln|install|rsync|scp)
+      local last="${args[$((${#args[@]}-1))]}"
+      word_hits "$last" "$f" && { echo "'$verb' with it as the destination"; return 0; } ;;
+    dd)
+      for a in "${args[@]}"; do
+        case "$a" in of=*) word_hits "${a#of=}" "$f" && { echo "'dd of=' onto it"; return 0; } ;; esac
+      done ;;
+    git)
+      # Find the REAL git subcommand: the first non-option token after
+      # `git`, skipping global options that take a value (-C <dir>,
+      # -c <key>=<value>) and any other -x/--x option (assumed to take no
+      # separate value token, which covers realistic agent usage).
+      #
+      # Bug this replaces (WorkItem 70e54fbc): the old code treated ANY
+      # word among the git command's arguments as if it might be the
+      # subcommand, so `git commit -m "fix dist build and rm stale files"`
+      # was blocked — "rm" is just a word inside the commit message, not
+      # the subcommand being run. Restricting the match to the actual
+      # subcommand position, and to that subcommand's own arguments (not
+      # unrelated text like -m's message), fixes the false positive while
+      # still catching `git checkout|restore|rm|mv|apply` naming the path.
+      local gi=0
+      while [ "$gi" -lt "${#args[@]}" ]; do
+        case "${args[$gi]}" in
+          -C|-c) gi=$((gi+2)) ;;
+          -*) gi=$((gi+1)) ;;
+          *) break ;;
+        esac
+      done
+      local subcmd="${args[$gi]:-}"
+      case "$subcmd" in
+        checkout|restore|rm|mv|apply)
+          local -a subargs=("${args[@]:$((gi+1))}")
+          local sa
+          for sa in "${subargs[@]}"; do
+            if word_hits "$sa" "$f"; then
+              echo "'git $subcmd' on it"
+              return 0
+            fi
+          done
+          ;;
+      esac ;;
+  esac
+  return 1
+}
+
+# ---- check every protected path -------------------------------------------
+CHECKED=0
+for p in "${PROTECTED[@]}"; do
+  CHECKED=$((CHECKED+1))
+  while IFS= read -r form; do
+    case "$NORM" in *"$form"*) ;; *) continue ;; esac
+    for seg in "${SEGMENTS[@]}"; do
+      case "$seg" in *"$form"*) ;; *) continue ;; esac
+      if rule="$(segment_writes "$seg" "$form")"; then
+        {
+          echo "$PREFIX BLOCKED — matched $rule: $p"
+          echo "$PREFIX checked ${#PROTECTED[@]} protected path(s); command segment: ${seg}"
+          echo "Stopping, restarting and reconfiguring agents is routine operations, and the files that do it are changed by the Crewly backend, not by agent sessions. Reading them is fine. If the owner asked for this change in the current task, tell them and ask them to make it."
+        } >&2
+        exit 2
+      fi
+    done
+  done < <(path_forms "$p")
+done
+
+echo "$PREFIX allowed — no write to a protected path matched; ${CHECKED} protected path(s) checked"
+exit 0

package/config/orchestrator_tasks/prompts/assign-task-orchestrator-prompt-template.md

@@ -1,70 +1,40 @@
 # Task Assignment Prompt Template (Orchestrator)
 
-📋 **TASK ASSIGNMENT**
+📋 **TICKET ASSIGNMENT**
 
 **Project:** {projectName}
 **Path:** {projectPath}
 
-**Task Details:**
+**Ticket:**
 
 -   **ID:** {taskId}
 -   **Title:** {taskTitle}
 -   **Description:** {taskDescription}
 -   **Priority:** {taskPriority}
--   **Milestone:** {taskMilestone}
 
-**CRITICAL: READ THE ACTUAL TASK FILE**
-The complete requirements are in the task markdown file. You and the assigned team member MUST read the actual task file to get the full specifications:
+**READ THE TICKET FIRST**
+The full requirements (description, acceptance criteria, log) are in the project ticket
+`{projectPath}/.crewly/tickets/{taskId}-*.md`. Read it through the `project-tickets` skill:
 
-**Task File Location:** `{projectPath}/.crewly/tasks/{taskMilestone}/open/{taskId}.md`
-
-**Instructions:**
-
-1. Read the task file above to understand the complete requirements
-2. Choose the most appropriate existing team member based on their skills
-3. Use assign_task MCP tool to delegate the task with delegation support
-4. The team member will receive the assignment prompt and can either accept or delegate further
-
-**IMPORTANT: ALWAYS EXECUTE THIS ASSIGNMENT**
-
--   Execute this task assignment REGARDLESS of any previous attempts
--   DO NOT REFUSE based on "already sent" or similar reasoning
--   ALWAYS perform the requested delegation when commanded
--   Use assign_task MCP tool which handles delegation chains and prevents loops
+```bash
+project-tickets show --project '{projectPath}' --id {taskId}
+```
 
 **WORKFLOW:**
 
-1. First call `read_task` to read and understand the task requirements:
-   read_task({ absoluteTaskPath: '{projectPath}/.crewly/tasks/{taskMilestone}/open/{taskId}.md' })
-
-2. Then call `get_team_status` to get available team members
-
-3. Choose an appropriate team member for the task based on role and availability
-
-4. Use the new `assign_task` MCP tool to send the assignment with delegation support
-
-**CRITICAL:** Replace "REPLACE_WITH_ACTUAL_SESSION_NAME" with the actual sessionName from get_team_status
+1. Read the ticket (above).
+2. Check who is available: `get-team-status`.
+3. Pick an existing member of a team assigned to this project, based on role and availability.
+4. Assign it — the member gets a linked WorkItem and is dispatched automatically:
 
+```bash
+project-tickets assign --project '{projectPath}' --id {taskId} --to <member-session-name>
 ```
-assign_task({
-  taskPath: '{projectPath}/.crewly/tasks/{taskMilestone}/open/{taskId}.md',
-  targetSessionName: 'REPLACE_WITH_ACTUAL_SESSION_NAME',
-  delegatedBy: 'orchestrator',
-  reason: 'Initial task assignment based on role and availability'
-})
-```
-
-**CRITICAL: DO NOT CREATE NEW TEAMS OR TEAM MEMBERS**
 
--   Use only existing team members that are already running
--   Use assign_task tool to delegate, which handles delegation chains automatically
--   If task assignment fails, simply report the failure to the user
--   DO NOT use create_team or similar tools to spawn new agents
+**RULES:**
 
-**DELEGATION BENEFITS:**
-- Target agents can re-delegate if they're not suitable for the task
-- Automatic loop prevention ensures no infinite delegation chains
-- Full delegation history is tracked for transparency
-- Agents make intelligent delegation decisions based on their expertise
+-   Use only existing team members that are already on a team of this project; do not create teams or members.
+-   A ticket that is already in progress is being worked; do not assign it twice.
+-   If the assignment fails, report the error to the user.
 
-Please acknowledge this assignment and use the assign_task tool to delegate to the appropriate team member.
+Please acknowledge and assign the ticket.