fraim-framework 2.0.163 → 2.0.165

package/dist/src/ai-hub/desktop-main.js

@@ -273,7 +273,10 @@ async function bootstrap() {
     const options = parseArgs(process.argv.slice(2));
     // Single-instance lock — if another instance is already running, focus it
     // and exit rather than spawning a second server + window.
-    const gotLock = electron_1.app.requestSingleInstanceLock();
+    // Skip when FRAIM_AI_HUB_FAKE_HOST=1 (test mode) so Playwright can launch
+    // a test instance alongside the real desktop app without the lock killing it.
+    const skipSingleInstance = process.env.FRAIM_AI_HUB_FAKE_HOST === '1';
+    const gotLock = skipSingleInstance || electron_1.app.requestSingleInstanceLock();
     if (!gotLock) {
         electron_1.app.quit();
         return;

package/dist/src/ai-hub/hosts.js

@@ -436,17 +436,10 @@ function machineLevelStorageGuard(jobId) {
             '- If the exact machine-level paths cannot be written, fail the phase and report the concrete filesystem error.',
         ].join('\n');
     }
-    if (normalized === 'organization-onboarding') {
-        const orgContext = path_1.default.join(userFraim, 'personalized-employee', 'context', 'org_context.md');
-        const orgRules = path_1.default.join(userFraim, 'personalized-employee', 'rules', 'org_rules.md');
-        return [
-            'Storage scope guardrail:',
-            '- Organization onboarding artifacts are machine-level, not repo-level.',
-            `- Required write targets: ${orgContext} and ${orgRules}.`,
-            '- Do not write, validate, call canonical, commit, or open a PR for repo-local fraim/personalized-employee/context/org_context.md or fraim/personalized-employee/rules/org_rules.md as substitutes.',
-            '- If the exact machine-level paths cannot be written, fail the phase and report the concrete filesystem error.',
-        ].join('\n');
-    }
+    // organization-onboarding intentionally has no guardrail here: the job's
+    // submit phase is backend-aware and owns the write-path procedure (git PR /
+    // cloud publish / machine-level fallback), so duplicating it in runtime
+    // prompt text would be redundant (issue #563 review).
     return null;
 }
 // If ~/.gemini/settings.json has a wrong/test FRAIM_API_KEY, patch it with the

package/dist/src/ai-hub/server.js

@@ -50,30 +50,7 @@ const https_1 = __importDefault(require("https"));
 const types_1 = require("../first-run/types");
 const learning_context_builder_1 = require("../local-mcp-server/learning-context-builder");
 const project_fraim_paths_1 = require("../core/utils/project-fraim-paths");
-const PERSONA_AVATAR_SEEDS = {
-    maestro: { seed: 'MAESTRO-founder-mode', bg: 'fde68a' },
-    beza: { seed: 'BEZA-strategist', bg: 'c7d2fe' },
-    pam: { seed: 'PAM-product', bg: 'ddd6fe' },
-    swen: { seed: 'SWEN-engineer', bg: 'bfdbfe' },
-    qasm: { seed: 'QASM-quality', bg: 'a7f3d0' },
-    huxley: { seed: 'HUXLEY-design', bg: 'fbcfe8' },
-    gautam: { seed: 'Gautam-marketing', bg: 'fed7aa' },
-    cela: { seed: 'CELA-legal', bg: 'cbd5e1' },
-    sekhar: { seed: 'SEKHAR-security', bg: 'fecaca' },
-    ashley: { seed: 'Ashley-assistant', bg: 'fde68a' },
-    mandy: { seed: 'MANDY-manager', bg: 'ede9fe' },
-    hari: { seed: 'HARI-hr', bg: 'ccfbf1' },
-    careena: { seed: 'CAREENA-career-coach', bg: 'e0f2fe' },
-    ricardo: { seed: 'RICARDO-recruiter', bg: 'ede9fe' },
-    sade: { seed: 'SADE-salesforce-dev', bg: 'bae6fd' },
-    sam: { seed: 'SAM-sales-manager', bg: 'bbf7d0' },
-    casey: { seed: 'CASEY-customer-cx', bg: 'fecdd3' },
-};
-function buildPersonaAvatarUrl(personaKey) {
-    const data = PERSONA_AVATAR_SEEDS[personaKey] ?? { seed: personaKey, bg: 'f1f5f9' };
-    const params = new URLSearchParams({ seed: data.seed, backgroundColor: data.bg, radius: '50' });
-    return `https://api.dicebear.com/9.x/notionists/svg?${params.toString()}`;
-}
+const persona_hiring_1 = require("../config/persona-hiring");
 const catalog_1 = require("./catalog");
 const agent_token_prices_1 = require("../local-mcp-server/agent-token-prices");
 const hosts_1 = require("./hosts");
@@ -602,19 +579,41 @@ function resolveSafeArtifactPath(rawPath, projectPath) {
     return safeRoots.some((root) => pathWithin(root, resolved)) ? resolved : null;
 }
 function hubOpenFile(filePath) {
-    if (process.platform === 'win32') {
-        (0, child_process_1.spawn)('powershell.exe', ['-NoProfile', '-Command', 'Start-Process -LiteralPath $args[0]', filePath], {
-            detached: true,
-            stdio: 'ignore',
-            windowsHide: true,
-        }).unref();
-        return;
-    }
-    if (process.platform === 'darwin') {
-        (0, child_process_1.spawn)('open', [filePath], { detached: true, stdio: 'ignore' }).unref();
-        return;
-    }
-    (0, child_process_1.spawn)('xdg-open', [filePath], { detached: true, stdio: 'ignore' }).unref();
+    return new Promise((resolve, reject) => {
+        const args = process.platform === 'win32'
+            ? [
+                '-NoProfile',
+                '-ExecutionPolicy',
+                'Bypass',
+                '-Command',
+                '& { param($p) try { Invoke-Item -LiteralPath $p; exit 0 } catch { Write-Error $_; exit 1 } }',
+                filePath,
+            ]
+            : process.platform === 'darwin'
+                ? [filePath]
+                : [filePath];
+        const command = process.platform === 'win32'
+            ? 'powershell.exe'
+            : process.platform === 'darwin'
+                ? 'open'
+                : 'xdg-open';
+        const child = (0, child_process_1.spawn)(command, args, {
+            stdio: ['ignore', 'ignore', 'pipe'],
+            windowsHide: process.platform === 'win32',
+        });
+        let stderr = '';
+        child.stderr?.on('data', (chunk) => {
+            stderr += String(chunk);
+        });
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(stderr.trim() || `Open command failed with exit code ${code ?? 'unknown'}.`));
+        });
+    });
 }
 function buildManagedLoginCommand(command) {
     const managedPath = (0, managed_agent_paths_1.buildPathWithManagedAgentBins)(process.env.PATH);
@@ -1114,36 +1113,6 @@ class AiHubServer {
     // Lightweight markdown → .docx. Shared by the GET (file path) and POST (inline
     // content) export routes so a conversational deliverable with no on-disk file
     // can still be downloaded for Word annotation.
-    async markdownToDocxBuffer(md) {
-        const html = md
-            .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-            // headings
-            .replace(/^#### (.+)$/gm, '<h4>$1</h4>')
-            .replace(/^### (.+)$/gm, '<h3>$1</h3>')
-            .replace(/^## (.+)$/gm, '<h2>$1</h2>')
-            .replace(/^# (.+)$/gm, '<h1>$1</h1>')
-            // bold, italic, code
-            .replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>')
-            .replace(/\*(.+?)\*/g, '<em>$1</em>')
-            .replace(/`(.+?)`/g, '<code>$1</code>')
-            // unordered lists
-            .replace(/^[-*] (.+)$/gm, '<li>$1</li>')
-            // horizontal rules
-            .replace(/^---+$/gm, '<hr/>')
-            // paragraphs (double newlines)
-            .replace(/\n{2,}/g, '</p><p>')
-            .replace(/^/, '<p>')
-            .replace(/$/, '</p>')
-            // clean up list items into a ul
-            .replace(/(<li>.+<\/li>\n?)+/g, (m) => `<ul>${m}</ul>`);
-        // eslint-disable-next-line @typescript-eslint/no-var-requires
-        const htmlToDocx = require('html-to-docx');
-        return await htmlToDocx(`<html><body>${html}</body></html>`, null, {
-            table: { row: { cantSplit: true } },
-            footer: false,
-            pageNumber: false,
-        });
-    }
     prepareStartPayload(projectPath, hostId, selectedJobId, instructions) {
         const explicit = (0, manager_turns_1.extractExplicitFraimInvocation)(instructions);
         const resolvedJobId = explicit?.jobId || selectedJobId;
@@ -1202,7 +1171,7 @@ class AiHubServer {
             key: bundle.personaKey,
             displayName: bundle.catalogMetadata.displayName,
             role: bundle.catalogMetadata.role,
-            avatarUrl: buildPersonaAvatarUrl(bundle.personaKey),
+            avatarUrl: (0, persona_hiring_1.buildPersonaAvatarUrl)(bundle.personaKey),
             pricingLabel: bundle.catalogMetadata.pricingLabel,
             status: 'locked',
             hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
@@ -1240,7 +1209,7 @@ class AiHubServer {
                 key: bundle.personaKey,
                 displayName: bundle.catalogMetadata.displayName,
                 role: bundle.catalogMetadata.role,
-                avatarUrl: buildPersonaAvatarUrl(bundle.personaKey),
+                avatarUrl: (0, persona_hiring_1.buildPersonaAvatarUrl)(bundle.personaKey),
                 pricingLabel: hiredKeys.has(bundle.personaKey) ? '' : bundle.catalogMetadata.pricingLabel,
                 status: (hiredKeys.has(bundle.personaKey) ? 'hired' : 'locked'),
                 hireUrl: buildHubPersonaHireUrl(bundle.personaKey, bundle.defaultHireMode),
@@ -1583,6 +1552,14 @@ class AiHubServer {
                 ? path_1.default.resolve(body.projectPath)
                 : this.projectPath;
             const loc = (0, learning_context_builder_1.resolveTeamContextFile)(projectPath, body.key);
+            if (loc.managedByOrgSync || !loc.writePath) {
+                // Enforcement only: block editing a synced org file (it would be
+                // overwritten on next sync). The how-to-change procedure lives in the
+                // organization-onboarding job, not in this error body (issue #563 review).
+                return res.status(409).json({
+                    error: 'This organization file is managed by org sync and is read-only here.'
+                });
+            }
             const dest = path_1.default.resolve(loc.writePath);
             // Path-traversal guard: the resolved destination must live under a
             // personalized-employee directory (covers both ~/.fraim/... and repo-local).
@@ -1600,59 +1577,7 @@ class AiHubServer {
             // Re-read so the client gets the canonical post-write state (present flips).
             return res.json(readContextFile(projectPath, body.key));
         });
-        // ── Issue #512 R7: Artifact export (md → docx) ──────────────────────────
-        // GET /api/ai-hub/artifact/export-docx?path=<abs-path-to-md>
-        // Converts a markdown file to .docx using html-to-docx and streams the result.
-        // The manager downloads it, annotates in Word, and saves it in place on disk
-        // (no upload). The agent then reads the comments + tracked changes via the
-        // `apply-docx-changes-to-md` skill (registry script extract-docx-edits.js)
-        // during the address-feedback phase.
-        this.app.get('/api/ai-hub/artifact/export-docx', async (req, res) => {
-            const rawPath = typeof req.query.path === 'string' ? req.query.path : '';
-            if (!rawPath)
-                return res.status(400).json({ error: 'path is required.' });
-            // Safety: path must be under the current workspace or a known safe root.
-            const resolved = resolveSafeArtifactPath(rawPath, this.projectPath);
-            if (!resolved)
-                return res.status(403).json({ error: 'Path outside allowed roots.' });
-            if (!fs_1.default.existsSync(resolved))
-                return res.status(404).json({ error: 'File not found.' });
-            try {
-                const md = fs_1.default.readFileSync(resolved, 'utf8');
-                const docxBuf = await this.markdownToDocxBuffer(md);
-                const basename = path_1.default.basename(resolved, path_1.default.extname(resolved));
-                res.setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document');
-                res.setHeader('Content-Disposition', `attachment; filename="${basename}.docx"`);
-                res.send(docxBuf);
-            }
-            catch (err) {
-                res.status(500).json({ error: err instanceof Error ? err.message : 'Export failed.' });
-            }
-        });
-        // POST /api/ai-hub/artifact/export-docx  { content, filename? }
-        // Converts inline markdown (the employee's conversational deliverable) to .docx
-        // when the run produced no on-disk file — e.g. an onboarding answer to an empty
-        // repo. Keeps the "annotate in Word" review flow working instead of erroring
-        // with "no local artifact path available".
-        this.app.post('/api/ai-hub/artifact/export-docx', async (req, res) => {
-            const content = typeof req.body?.content === 'string' ? req.body.content : '';
-            if (!content.trim())
-                return res.status(400).json({ error: 'content is required.' });
-            const rawName = typeof req.body?.filename === 'string' && req.body.filename.trim()
-                ? req.body.filename.trim()
-                : 'deliverable';
-            const safeName = rawName.replace(/[^a-zA-Z0-9._ -]/g, '').replace(/\.docx?$/i, '').slice(0, 80) || 'deliverable';
-            try {
-                const docxBuf = await this.markdownToDocxBuffer(content);
-                res.setHeader('Content-Type', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document');
-                res.setHeader('Content-Disposition', `attachment; filename="${safeName}.docx"`);
-                res.send(docxBuf);
-            }
-            catch (err) {
-                res.status(500).json({ error: err instanceof Error ? err.message : 'Export failed.' });
-            }
-        });
-        this.app.post('/api/ai-hub/artifact/open', (req, res) => {
+        this.app.post('/api/ai-hub/artifact/open', async (req, res) => {
             const rawPath = typeof req.body?.path === 'string' ? req.body.path : '';
             const projectPath = typeof req.body?.projectPath === 'string' && req.body.projectPath.length > 0
                 ? path_1.default.resolve(req.body.projectPath)
@@ -1665,7 +1590,7 @@ class AiHubServer {
             if (!fs_1.default.existsSync(resolved))
                 return res.status(404).json({ error: 'File not found.' });
             try {
-                hubOpenFile(resolved);
+                await hubOpenFile(resolved);
                 return res.json({ ok: true, path: resolved });
             }
             catch (err) {

package/dist/src/cli/commands/first-run.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -9,7 +42,6 @@ const chalk_1 = __importDefault(require("chalk"));
 const child_process_1 = require("child_process");
 const server_1 = require("../../first-run/server");
 const session_service_1 = require("../../first-run/session-service");
-const server_2 = require("../../ai-hub/server");
 function openBrowser(url) {
     try {
         if (process.platform === 'win32') {
@@ -45,7 +77,10 @@ const runFirstRun = async (options) => {
         projectRoot: options.projectRoot,
     });
     const server = new server_1.FirstRunServer({ sessionService });
-    const port = await (0, server_2.findAvailablePort)(43120);
+    // Lazy import: ai-hub/server pulls server-only code not shipped in the client
+    // package; keep it out of the CLI startup graph so the packed client loads (#422).
+    const { findAvailablePort } = await Promise.resolve().then(() => __importStar(require('../../ai-hub/server')));
+    const port = await findAvailablePort(43120);
     const url = `http://127.0.0.1:${port}/first-run/`;
     await server.start(port);
     console.log(chalk_1.default.blue('Starting FRAIM first-run...'));

package/dist/src/cli/commands/hub.js

@@ -1,11 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hubCommand = void 0;
 const commander_1 = require("commander");
-const server_1 = require("../../ai-hub/server");
+// ai-hub/server pulls in server-only code (persona-hiring etc.) that is not
+// shipped in the client package; it is imported lazily inside the action below
+// to keep it out of the CLI startup graph so the packed client loads (issue #422).
 const git_utils_1 = require("../../core/utils/git-utils");
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
@@ -69,13 +104,14 @@ exports.hubCommand = new commander_1.Command('hub')
     .option('--no-open', 'Do not open the hub after startup')
     .option('--browser', 'Open in the default browser instead of the desktop shell')
     .action(async (options) => {
+    const { AiHubServer, findAvailablePort } = await Promise.resolve().then(() => __importStar(require('../../ai-hub/server')));
     const preferredPort = options.port || (0, git_utils_1.getPort)() + 100;
     const projectPath = path_1.default.resolve(options.projectPath || process.cwd());
     if (options.open) {
         const openedDesktop = !options.browser && openDesktopWindow(projectPath, preferredPort);
         if (!openedDesktop) {
-            const port = await (0, server_1.findAvailablePort)(preferredPort);
-            const server = new server_1.AiHubServer({ projectPath });
+            const port = await findAvailablePort(preferredPort);
+            const server = new AiHubServer({ projectPath });
             await server.start(port);
             const url = `http://127.0.0.1:${port}/ai-hub/`;
             console.log(`AI Hub running at ${url}`);
@@ -87,8 +123,8 @@ exports.hubCommand = new commander_1.Command('hub')
         console.log(`Project path: ${projectPath}`);
         return;
     }
-    const port = await (0, server_1.findAvailablePort)(preferredPort);
-    const server = new server_1.AiHubServer({ projectPath });
+    const port = await findAvailablePort(preferredPort);
+    const server = new AiHubServer({ projectPath });
     await server.start(port);
     const url = `http://127.0.0.1:${port}/ai-hub/`;
     console.log(`AI Hub running at ${url}`);

package/dist/src/cli/commands/init-project.js

@@ -210,22 +210,23 @@ const runInitProject = async (options = {}) => {
                 if (!isMinimalConversationMode(preferredMode)) {
                     console.log(chalk_1.default.blue(`   Platform: ${formatPlatformLabel(detection.provider)}`));
                 }
-            }
-            if (!isMinimalConversationMode(preferredMode)) {
-                const repo = detection.repository;
-                if (repo.owner && repo.name) {
-                    console.log(chalk_1.default.gray(`   Repository: ${repo.owner}/${repo.name}`));
-                }
-                else if (repo.organization && repo.project && repo.name) {
-                    console.log(chalk_1.default.gray(`   Organization: ${repo.organization}`));
-                    console.log(chalk_1.default.gray(`   Project: ${repo.project}`));
-                    console.log(chalk_1.default.gray(`   Repository: ${repo.name}`));
-                }
-                else if (repo.namespace && repo.name) {
-                    console.log(chalk_1.default.gray(`   Namespace: ${repo.namespace || '(none)'}`));
-                    console.log(chalk_1.default.gray(`   Repository: ${repo.name}`));
+                else {
+                    console.log(chalk_1.default.blue(`   Repository-backed project: ${formatPlatformLabel(detection.provider)}`));
                 }
             }
+            const repo = detection.repository;
+            if (repo.owner && repo.name) {
+                console.log(chalk_1.default.gray(`   Repository: ${repo.owner}/${repo.name}`));
+            }
+            else if (repo.organization && repo.project && repo.name) {
+                console.log(chalk_1.default.gray(`   Organization: ${repo.organization}`));
+                console.log(chalk_1.default.gray(`   Project: ${repo.project}`));
+                console.log(chalk_1.default.gray(`   Repository: ${repo.name}`));
+            }
+            else if (repo.namespace && repo.name) {
+                console.log(chalk_1.default.gray(`   Namespace: ${repo.namespace || '(none)'}`));
+                console.log(chalk_1.default.gray(`   Repository: ${repo.name}`));
+            }
         }
         else {
             result.mode = 'conversational';

package/dist/src/cli/commands/sync.js

@@ -144,6 +144,42 @@ const runSync = async (options) => {
             console.log(chalk_1.default.green('Removed legacy FRAIM sync block from .gitignore'));
         }
     };
+    // Issue #563: refresh the machine-level org cache (~/.fraim/org/) from the
+    // configured org backend. Failures never fail the sync: an existing cache is
+    // served stale with its age (R2.3, R4.3).
+    const refreshOrgCache = async (remoteUrl, apiKey) => {
+        // Org sync is a network round-trip to the org backend. In automated
+        // tests there is no org configured and no server to reach, so skip it
+        // entirely rather than emit warnings or attempt a real request. Local
+        // dev (--local / FRAIM_LOCAL_SYNC) passes the loopback URL + 'local-dev'
+        // key below, which syncOrgCache treats as "no cloud org" unless a git
+        // backend is configured, so it degrades cleanly without this guard.
+        if (process.env.TEST_MODE === 'true')
+            return;
+        const { syncOrgCache } = await Promise.resolve().then(() => __importStar(require('../utils/org-pack-sync')));
+        const outcome = await syncOrgCache({ remoteUrl, apiKey });
+        if (outcome.status === 'synced') {
+            console.log(chalk_1.default.green(`Org context synced (${outcome.metadata.backend}, version ${outcome.metadata.version.slice(0, 12)})`));
+        }
+        else if (outcome.status === 'stale') {
+            console.log(chalk_1.default.yellow(`Org source unreachable. Using cached org context from ${Math.round(outcome.ageHours)}h ago. Will refresh when reachable.`));
+        }
+        else if (outcome.status === 'absent') {
+            console.log(chalk_1.default.yellow(`Org context not synced: ${outcome.error}`));
+        }
+        // 'disabled' (no org configured) stays silent.
+        // R8.1: one-time publish offer for legacy machine-local org files. The
+        // publish itself runs through organization-onboarding (propose-and-approve);
+        // sync only surfaces the offer and never moves files on its own (R8.2).
+        if (outcome.status !== 'disabled') {
+            const { detectLegacyOrgArtifacts } = await Promise.resolve().then(() => __importStar(require('../utils/org-migration')));
+            const legacy = detectLegacyOrgArtifacts();
+            if (legacy.length > 0) {
+                console.log(chalk_1.default.yellow(`Found ${legacy.length} legacy machine-local org file(s) at ~/.fraim/personalized-employee/.`));
+                console.log(chalk_1.default.yellow('Run the organization-onboarding job to publish them to your shared org backend; the originals are archived to ~/.fraim/backups/.'));
+            }
+        }
+    };
     const isNpx = process.env.npm_config_prefix === undefined || process.env.npm_lifecycle_event === 'npx';
     const isGlobal = !isNpx && (process.env.npm_config_global === 'true' || process.env.npm_config_prefix);
     if (isGlobal && !options.skipUpdates) {
@@ -188,6 +224,7 @@ const runSync = async (options) => {
                     console.log(chalk_1.default.green(line));
                 }
             }
+            await refreshOrgCache(localUrl, 'local-dev');
             return;
         }
         console.error(chalk_1.default.red(`Local sync failed: ${result.error}`));
@@ -241,6 +278,7 @@ const runSync = async (options) => {
     if (adapterUpdates.length > 0) {
         console.log(chalk_1.default.green(`Updated FRAIM agent adapter files: ${adapterUpdates.join(', ')}`));
     }
+    await refreshOrgCache(config.remoteUrl || process.env.FRAIM_REMOTE_URL || 'https://fraim.wellnessatwork.me', apiKey);
 };
 exports.runSync = runSync;
 exports.syncCommand = new commander_1.Command('sync')

package/dist/src/cli/utils/git-org-sync.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchOrgRepoSnapshot = fetchOrgRepoSnapshot;
+/**
+ * Shallow snapshot of a customer-owned org repo (issue #563, git backend).
+ *
+ * Uses execSync git like the rest of the CLI (see core/utils/git-utils.ts);
+ * no new git dependency. The snapshot is a depth-1 clone of the default
+ * branch into a temp directory the caller copies from and then cleans up.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+/**
+ * Org repo URLs are restricted to real transport schemes plus scp-style
+ * SSH shorthand. This blocks git's command-executing transports
+ * (`ext::`, `fd::`) and option injection via URLs starting with `-`.
+ */
+const ALLOWED_GIT_URL = /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/|[\w.-]+@[\w.-]+:)/;
+/**
+ * Shallow-clone the org repo's default branch (R7.4). Throws on any git
+ * failure; callers translate failures into stale/absent outcomes.
+ */
+function fetchOrgRepoSnapshot(gitUrl) {
+    if (!ALLOWED_GIT_URL.test(gitUrl)) {
+        throw new Error(`Org repo URL has an unsupported scheme: ${gitUrl}`);
+    }
+    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'fraim-org-snap-'));
+    try {
+        // Arg-array exec (no shell) and `--` so the URL can never be parsed
+        // as a git option or shell metacharacters.
+        (0, child_process_1.execFileSync)('git', ['clone', '--depth=1', '--quiet', '--', gitUrl, '.'], {
+            cwd: dir,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            timeout: 60_000
+        });
+        const sha = (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], {
+            cwd: dir,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe']
+        }).trim();
+        return {
+            dir,
+            sha,
+            cleanup: () => fs_1.default.rmSync(dir, { recursive: true, force: true })
+        };
+    }
+    catch (error) {
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
+}

package/dist/src/cli/utils/org-migration.js

@@ -0,0 +1,50 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectLegacyOrgArtifacts = detectLegacyOrgArtifacts;
+exports.archiveLegacyOrgArtifacts = archiveLegacyOrgArtifacts;
+/**
+ * Legacy org artifact migration (issue #563, R8).
+ *
+ * Before #563, organization-onboarding wrote org_context.md and org_rules.md
+ * machine-locally under ~/.fraim/personalized-employee/. These helpers detect
+ * those files for a one-time publish offer and archive them (never delete)
+ * once the user accepts. Declining is safe: detection is read-only and the
+ * legacy resolution tier keeps working (AC8).
+ *
+ * Manager files are personal by design and are never migrated (R3.3).
+ */
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const project_fraim_paths_1 = require("../../core/utils/project-fraim-paths");
+const LEGACY_ORG_RELATIVE_PATHS = [
+    'context/org_context.md',
+    'rules/org_rules.md'
+];
+function detectLegacyOrgArtifacts() {
+    const root = path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'personalized-employee');
+    const detected = [];
+    for (const relativePath of LEGACY_ORG_RELATIVE_PATHS) {
+        const absolutePath = path_1.default.join(root, relativePath);
+        if (fs_1.default.existsSync(absolutePath)) {
+            detected.push({ absolutePath, relativePath });
+        }
+    }
+    return detected;
+}
+/**
+ * Move legacy org artifacts into a timestamped directory under
+ * ~/.fraim/backups/ (R8.1). Returns the backup directory path.
+ */
+function archiveLegacyOrgArtifacts(artifacts) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const backupDir = path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), 'backups', `org-migration-${stamp}`);
+    for (const artifact of artifacts) {
+        const destination = path_1.default.join(backupDir, artifact.relativePath);
+        fs_1.default.mkdirSync(path_1.default.dirname(destination), { recursive: true });
+        fs_1.default.renameSync(artifact.absolutePath, destination);
+    }
+    return backupDir;
+}