fraim-framework 2.0.183 → 2.0.184

package/dist/src/ai-hub/hosts.js

@@ -592,7 +592,7 @@ function parseFraimInvocation(message) {
     const trimmed = message.trim();
     if (!trimmed)
         return null;
-    const match = trimmed.match(/^[/$]fraim(?:\s+(\S+))?\s*([\s\S]*)$/);
+    const match = trimmed.match(/^[$/@]fraim(?:\s+(\S+))?\s*([\s\S]*)$/);
     if (!match)
         return null;
     return {

package/dist/src/ai-hub/manager-turns.js

@@ -6,14 +6,14 @@ exports.buildCommunicationStyleNote = buildCommunicationStyleNote;
 exports.buildManagerMessage = buildManagerMessage;
 function extractExplicitFraimInvocation(text) {
     const raw = String(text || '');
-    const match = raw.match(/(?:^|\n|\s)([$/]fraim)\s+([a-z0-9][a-z0-9-]*)(?=\s|$)/i);
+    const match = raw.match(/(?:^|\n|\s)([$/@]fraim)\s+([a-z0-9][a-z0-9-]*)(?=\s|$)/i);
     if (!match || match.index == null)
         return null;
     const before = raw.slice(0, match.index).trim();
     const after = raw.slice(match.index + match[0].length).trim();
     const remainder = [before, after].filter(Boolean).join('\n\n').trim();
     return {
-        symbol: match[1].toLowerCase() === '$fraim' ? '$fraim' : '/fraim',
+        symbol: match[1].toLowerCase(),
         jobId: match[2].toLowerCase(),
         remainder,
     };

package/dist/src/ai-hub/preferences.js

@@ -68,8 +68,10 @@ function normalizeProjectEntry(raw, fallbackPath) {
         return null;
     const folderPath = normalizeProjectPath(rawPath);
     const basename = path_1.default.basename(folderPath) || folderPath;
-    const team = Array.isArray(value.team) ? value.team.filter((entry) => typeof entry === 'string') : [];
     const rawId = typeof value.id === 'string' ? value.id.trim() : '';
+    // The employee roster is deliberately dropped here (not read, not persisted):
+    // it is derived from the bootstrap's hired personas at render time so it stays
+    // consistent across machines. Any `team` on incoming/legacy state is discarded.
     return {
         id: rawId || projectIdForPath(folderPath),
         name: typeof value.name === 'string' && value.name.length > 0 ? value.name : basename,
@@ -78,7 +80,6 @@ function normalizeProjectEntry(raw, fallbackPath) {
         outcome: typeof value.outcome === 'string' ? value.outcome : '',
         rules: typeof value.rules === 'string' ? value.rules : '',
         brief: typeof value.brief === 'string' ? value.brief : (typeof value.intent === 'string' ? value.intent : ''),
-        team,
         updatedAt: typeof value.updatedAt === 'string' ? value.updatedAt : undefined,
     };
 }

package/dist/src/ai-hub/server.js

@@ -1009,6 +1009,22 @@ function ensureDirectoryPath(projectPath) {
     }
     return resolved;
 }
+function normalizedDirectoryPath(projectPath) {
+    const resolved = path_1.default.resolve(projectPath);
+    return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+function sameDirectoryPath(left, right) {
+    return normalizedDirectoryPath(left) === normalizedDirectoryPath(right);
+}
+function deploymentProjectFilter(rawProjectPath, fallbackProjectPath) {
+    return ensureDirectoryPath(typeof rawProjectPath === 'string' && rawProjectPath.trim() ? rawProjectPath : fallbackProjectPath);
+}
+function deploymentBelongsToProject(deployment, projectPath, fallbackProjectPath) {
+    const deploymentProjectPath = typeof deployment.projectPath === 'string' && deployment.projectPath.trim()
+        ? deployment.projectPath
+        : fallbackProjectPath;
+    return sameDirectoryPath(deploymentProjectPath, projectPath);
+}
 // ---------------------------------------------------------------------------
 // Issue #512 (S3) — Hub bootstrap projection helpers.
 // ---------------------------------------------------------------------------
@@ -1835,12 +1851,9 @@ class AiHubServer {
         if (!resolvedJobId) {
             throw new Error('Choose a FRAIM job before starting a run, or start with /fraim <job-id>.');
         }
-        // #521: `display` is what the manager's conversation bubble shows — only their own
-        // words. The FRAIM invocation (`$fraim <job>`), the stub path, and the shared-
-        // browser / communication-style notes are system context for the AGENT, kept out
-        // of the bubble so the thread isn't cluttered with machinery. `message` (with all
-        // of it) is what the agent actually receives.
-        const display = (explicit?.remainder || instructions || '').trim();
+        // #696: `display` is the manager conversation bubble. Keep the full generated
+        // turn in `message`, but show only the host-specific FRAIM invocation.
+        const display = (0, manager_turns_1.fraimInvocationFor)(hostId, resolvedJobId) || (explicit?.remainder || instructions || '').trim();
         // #521: the shared-browser guidance is injected HERE, at the Hub layer — never
         // baked into the registry job/skill. It only appears when a shared browser is
         // available (env published at boot).
@@ -1869,13 +1882,12 @@ class AiHubServer {
         // as the target of the FRAIM invocation. The server picks the correct
         // invocation prefix ($fraim / /fraim) based on run.hostId — the UI never
         // passes raw invocation syntax.
-        const effectiveJobId = coachingJobId || run.jobId;
-        // #521: `display` = the manager's own words for the conversation bubble. When the
-        // manager typed nothing (a quick-coach button), fall back to the bare invocation
-        // so the bubble still shows what was triggered — but never the style note.
         const explicit = (0, manager_turns_1.extractExplicitFraimInvocation)(instructions);
+        const effectiveJobId = explicit?.jobId || coachingJobId || run.jobId;
+        // #696: the thread shows the invocation that the Hub sent, while the employee
+        // still receives the full manager turn plus the style note.
         const userText = (explicit?.remainder || instructions || '').trim();
-        const display = userText || (0, manager_turns_1.buildManagerMessage)(run.hostId, effectiveJobId, 'continue', '');
+        const display = (0, manager_turns_1.fraimInvocationFor)(run.hostId, effectiveJobId) || userText || (0, manager_turns_1.buildManagerMessage)(run.hostId, effectiveJobId, 'continue', '');
         return {
             message: (0, manager_turns_1.buildManagerMessage)(run.hostId, effectiveJobId, 'continue', instructions) + (0, manager_turns_1.buildCommunicationStyleNote)(),
             display,
@@ -2962,9 +2974,15 @@ class AiHubServer {
             this.scheduleDeployment(deployment);
             return res.status(201).json(deployment);
         });
-        // GET /api/ai-hub/schedules — list all scheduled deployments.
-        this.app.get('/api/ai-hub/schedules', (_req, res) => {
-            return res.json(this.deploymentStore.load().filter((d) => d.type === 'scheduled'));
+        // GET /api/ai-hub/schedules — list scheduled deployments for one project.
+        this.app.get('/api/ai-hub/schedules', (req, res) => {
+            try {
+                const projectPath = deploymentProjectFilter(req.query.projectPath, this.projectPath);
+                return res.json(this.deploymentStore.load().filter((d) => d.type === 'scheduled' && deploymentBelongsToProject(d, projectPath, this.projectPath)));
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
         });
         // DELETE /api/ai-hub/schedules/:id — remove a scheduled deployment.
         this.app.delete('/api/ai-hub/schedules/:id', (req, res) => {
@@ -2982,7 +3000,7 @@ class AiHubServer {
         // PUT /api/ai-hub/schedules/:id — update an existing scheduled deployment.
         this.app.put('/api/ai-hub/schedules/:id', (req, res) => {
             const { id } = req.params;
-            const { label, jobId, cronExpr, hostId, instructions, allowConcurrent } = req.body ?? {};
+            const { label, jobId, projectPath, cronExpr, hostId, instructions, allowConcurrent } = req.body ?? {};
             if (cronExpr !== undefined) {
                 // eslint-disable-next-line @typescript-eslint/no-var-requires
                 const cronLib = require('node-cron');
@@ -2990,6 +3008,14 @@ class AiHubServer {
                     return res.status(400).json({ error: 'Invalid cron expression.' });
                 }
             }
+            let resolvedProjectPath;
+            try {
+                if (projectPath !== undefined)
+                    resolvedProjectPath = ensureDirectoryPath(projectPath || this.projectPath);
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
             const validEmployees = VALID_EMPLOYEE_IDS;
             let updated = null;
             const ok = this.deploymentStore.update(id, (dep) => {
@@ -2997,6 +3023,8 @@ class AiHubServer {
                     dep.label = label;
                 if (jobId !== undefined)
                     dep.jobId = jobId;
+                if (resolvedProjectPath !== undefined)
+                    dep.projectPath = resolvedProjectPath;
                 if (cronExpr !== undefined)
                     dep.cronExpr = cronExpr;
                 if (hostId !== undefined && validEmployees.includes(hostId))
@@ -3043,12 +3071,18 @@ class AiHubServer {
             this.deploymentStore.create(deployment);
             return res.status(201).json({ ...deployment, inboundUrl: `${this.hubBase}/api/ai-hub/webhooks/${deployment.id}/inbound` });
         });
-        // GET /api/ai-hub/webhooks — list all webhook deployments.
-        this.app.get('/api/ai-hub/webhooks', (_req, res) => {
+        // GET /api/ai-hub/webhooks — list webhook deployments for one project.
+        this.app.get('/api/ai-hub/webhooks', (req, res) => {
             const hubBase = this.hubBase;
-            return res.json(this.deploymentStore.load()
-                .filter((d) => d.type === 'webhook')
-                .map((d) => ({ ...d, inboundUrl: `${hubBase}/api/ai-hub/webhooks/${d.id}/inbound` })));
+            try {
+                const projectPath = deploymentProjectFilter(req.query.projectPath, this.projectPath);
+                return res.json(this.deploymentStore.load()
+                    .filter((d) => d.type === 'webhook' && deploymentBelongsToProject(d, projectPath, this.projectPath))
+                    .map((d) => ({ ...d, inboundUrl: `${hubBase}/api/ai-hub/webhooks/${d.id}/inbound` })));
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
         });
         // DELETE /api/ai-hub/webhooks/:id — remove a webhook deployment.
         this.app.delete('/api/ai-hub/webhooks/:id', (req, res) => {
@@ -3060,7 +3094,15 @@ class AiHubServer {
         // PUT /api/ai-hub/webhooks/:id — update an existing webhook deployment.
         this.app.put('/api/ai-hub/webhooks/:id', (req, res) => {
             const { id } = req.params;
-            const { label, jobId, hostId, instructions, allowConcurrent } = req.body ?? {};
+            const { label, jobId, projectPath, hostId, instructions, allowConcurrent } = req.body ?? {};
+            let resolvedProjectPath;
+            try {
+                if (projectPath !== undefined)
+                    resolvedProjectPath = ensureDirectoryPath(projectPath || this.projectPath);
+            }
+            catch (err) {
+                return res.status(400).json({ error: err instanceof Error ? err.message : 'Invalid project path.' });
+            }
             const validEmployees = VALID_EMPLOYEE_IDS;
             let updated = null;
             const ok = this.deploymentStore.update(id, (dep) => {
@@ -3068,6 +3110,8 @@ class AiHubServer {
                     dep.label = label;
                 if (jobId !== undefined)
                     dep.jobId = jobId;
+                if (resolvedProjectPath !== undefined)
+                    dep.projectPath = resolvedProjectPath;
                 if (hostId !== undefined && validEmployees.includes(hostId))
                     dep.hostId = hostId;
                 if (instructions !== undefined)

package/dist/src/cli/distribution/marketplace-bundles.js

@@ -95,11 +95,6 @@ function asArray(value) {
 function stringValue(value) {
     return typeof value === 'string' && value.trim() ? value : null;
 }
-function readPackageVersion(repoRoot, result) {
-    const relPath = 'package.json';
-    const packageJson = readJsonObject(repoRoot, relPath, result);
-    return packageJson ? stringValue(packageJson.version) : null;
-}
 function requireHttpsUrl(value, relPath, field, result) {
     const url = stringValue(value);
     if (!url) {
@@ -202,7 +197,7 @@ function validateTargetMatrix(repoRoot, result) {
     const relPath = path_1.default.join(TARGET_ROOT, 'marketplace-targets.json');
     const targetMatrix = readJsonObject(repoRoot, relPath, result);
     if (!targetMatrix) {
-        return { remoteMcpUrl: null, oauthAuthorizationServer: null, productVersion: null, contactEmail: null };
+        return { remoteMcpUrl: null, oauthAuthorizationServer: null, contactEmail: null };
     }
     assertEqual(targetMatrix.schema, 'fraim-marketplace-targets-v1', relPath, 'schema', result);
     assertEqual(targetMatrix.issue, 674, relPath, 'issue', result);
@@ -214,10 +209,6 @@ function validateTargetMatrix(repoRoot, result) {
     if (!remoteMcp) {
         addIssue(result.errors, relPath, 'remoteMcp must be an object');
     }
-    const productVersion = product ? stringValue(product.packageVersion) : null;
-    if (!productVersion) {
-        addIssue(result.errors, relPath, 'product.packageVersion must be set');
-    }
     const contactEmail = product ? stringValue(product.contactEmail) : null;
     if (!contactEmail) {
         addIssue(result.errors, relPath, 'product.contactEmail must be set');
@@ -225,10 +216,6 @@ function validateTargetMatrix(repoRoot, result) {
     if (contactEmail && product) {
         assertEqual(product.support, contactEmail, relPath, 'product.support', result);
     }
-    const packageVersion = readPackageVersion(repoRoot, result);
-    if (productVersion && packageVersion) {
-        assertEqual(productVersion, packageVersion, relPath, 'product.packageVersion', result);
-    }
     const remoteMcpUrl = remoteMcp
         ? requireHttpsUrl(remoteMcp.url, relPath, 'remoteMcp.url', result)
         : null;
@@ -236,7 +223,7 @@ function validateTargetMatrix(repoRoot, result) {
         ? requireHttpsUrl(remoteMcp.oauthAuthorizationServer, relPath, 'remoteMcp.oauthAuthorizationServer', result)
         : null;
     validateTargetEntries(repoRoot, relPath, asArray(targetMatrix.targets), result);
-    return { remoteMcpUrl, oauthAuthorizationServer, productVersion, contactEmail };
+    return { remoteMcpUrl, oauthAuthorizationServer, contactEmail };
 }
 function validateOpenAiAssets(repoRoot, openAiRoot, result) {
     assertFile(repoRoot, path_1.default.join(openAiRoot, 'README.md'), result);
@@ -345,11 +332,13 @@ function validateCodexManifestInterface(repoRoot, pluginRoot, manifestRelPath, m
         assertRelativeAsset(repoRoot, pluginRoot, screenshot, manifestRelPath, `interface.screenshots[${index}]`, result);
     }
 }
-function validateCodexManifest(repoRoot, pluginRoot, manifest, manifestRelPath, productVersion, contactEmail, result) {
+function validateCodexManifest(repoRoot, pluginRoot, manifest, manifestRelPath, contactEmail, result) {
     if (!manifest)
         return;
     assertEqual(manifest.name, 'fraim', manifestRelPath, 'name', result);
-    assertEqual(manifest.version, productVersion, manifestRelPath, 'version', result);
+    if (!stringValue(manifest.version)) {
+        addIssue(result.errors, manifestRelPath, 'version must be a non-empty string');
+    }
     assertEqual(asObject(manifest.author)?.email, contactEmail, manifestRelPath, 'author.email', result);
     assertEqual(manifest.skills, './skills/', manifestRelPath, 'skills', result);
     assertEqual(manifest.mcpServers, './.mcp.json', manifestRelPath, 'mcpServers', result);
@@ -409,11 +398,11 @@ function validateCodexPackage(repoRoot, result, targetDetails) {
     const manifest = readJsonObject(repoRoot, manifestRelPath, result);
     const mcpConfig = readJsonObject(repoRoot, mcpRelPath, result);
     validateCodexMarketplace(marketplace, marketplaceRelPath, result);
-    validateCodexManifest(repoRoot, pluginRoot, manifest, manifestRelPath, targetDetails.productVersion, targetDetails.contactEmail, result);
+    validateCodexManifest(repoRoot, pluginRoot, manifest, manifestRelPath, targetDetails.contactEmail, result);
     validateCodexMcpConfig(mcpConfig, mcpRelPath, targetDetails.remoteMcpUrl, result);
     validateCodexSkill(repoRoot, skillRelPath, result);
 }
-function validateSimpleMarketplaceManifest(marketplace, marketplaceRelPath, expectedName, expectedSource, productVersion, contactEmail, result) {
+function validateSimpleMarketplaceManifest(marketplace, marketplaceRelPath, expectedName, expectedSource, contactEmail, result) {
     if (!marketplace)
         return;
     assertEqual(marketplace.name, expectedName, marketplaceRelPath, 'name', result);
@@ -433,7 +422,9 @@ function validateSimpleMarketplaceManifest(marketplace, marketplaceRelPath, expe
         return;
     }
     assertEqual(fraimEntry.source, expectedSource, marketplaceRelPath, 'fraim.source', result);
-    assertEqual(fraimEntry.version, productVersion, marketplaceRelPath, 'fraim.version', result);
+    if (!stringValue(fraimEntry.version)) {
+        addIssue(result.errors, marketplaceRelPath, 'fraim.version must be a non-empty string');
+    }
     const author = asObject(fraimEntry.author);
     if (author) {
         assertEqual(author.email, contactEmail, marketplaceRelPath, 'fraim.author.email', result);
@@ -453,7 +444,9 @@ function validateMcpRegistryPackage(repoRoot, result, targetDetails) {
     if (!description || description.length > 100) {
         addIssue(result.errors, serverRelPath, 'description must be a non-empty string of at most 100 characters');
     }
-    assertEqual(serverJson.version, targetDetails.productVersion, serverRelPath, 'version', result);
+    if (!stringValue(serverJson.version)) {
+        addIssue(result.errors, serverRelPath, 'version must be a non-empty string');
+    }
     requireHttpsUrl(serverJson.websiteUrl, serverRelPath, 'websiteUrl', result);
     const repository = asObject(serverJson.repository);
     assertEqual(repository?.url, 'https://github.com/mathursrus/FRAIM', serverRelPath, 'repository.url', result);
@@ -484,11 +477,13 @@ function validateCursorPackage(repoRoot, result, targetDetails) {
     const mcpConfig = readJsonObject(repoRoot, mcpRelPath, result);
     assertFile(repoRoot, path_1.default.join(cursorRoot, 'README.md'), result);
     assertFile(repoRoot, path_1.default.join(pluginRoot, 'README.md'), result);
-    validateSimpleMarketplaceManifest(rootMarketplace, ROOT_CURSOR_MARKETPLACE_PATH, 'fraim-marketplace', 'marketplaces/fraim/cursor/plugins/fraim', targetDetails.productVersion, targetDetails.contactEmail, result);
-    validateSimpleMarketplaceManifest(targetMarketplace, targetMarketplaceRelPath, 'fraim-marketplace', 'plugins/fraim', targetDetails.productVersion, targetDetails.contactEmail, result);
+    validateSimpleMarketplaceManifest(rootMarketplace, ROOT_CURSOR_MARKETPLACE_PATH, 'fraim-marketplace', 'marketplaces/fraim/cursor/plugins/fraim', targetDetails.contactEmail, result);
+    validateSimpleMarketplaceManifest(targetMarketplace, targetMarketplaceRelPath, 'fraim-marketplace', 'plugins/fraim', targetDetails.contactEmail, result);
     if (manifest) {
         assertEqual(manifest.name, 'fraim', manifestRelPath, 'name', result);
-        assertEqual(manifest.version, targetDetails.productVersion, manifestRelPath, 'version', result);
+        if (!stringValue(manifest.version)) {
+            addIssue(result.errors, manifestRelPath, 'version must be a non-empty string');
+        }
         assertEqual(asObject(manifest.author)?.email, targetDetails.contactEmail, manifestRelPath, 'author.email', result);
         assertEqual(manifest.rules, 'rules/', manifestRelPath, 'rules', result);
         assertEqual(manifest.skills, 'skills/', manifestRelPath, 'skills', result);
@@ -532,10 +527,12 @@ function validateCopilotPackage(repoRoot, result, targetDetails) {
     const mcpConfig = readJsonObject(repoRoot, mcpRelPath, result);
     assertFile(repoRoot, path_1.default.join(vscodeRoot, 'README.md'), result);
     assertFile(repoRoot, path_1.default.join(pluginRoot, 'README.md'), result);
-    validateSimpleMarketplaceManifest(rootMarketplace, ROOT_COPILOT_MARKETPLACE_PATH, 'fraim-copilot-marketplace', 'marketplaces/fraim/vscode/plugins/fraim', targetDetails.productVersion, targetDetails.contactEmail, result);
+    validateSimpleMarketplaceManifest(rootMarketplace, ROOT_COPILOT_MARKETPLACE_PATH, 'fraim-copilot-marketplace', 'marketplaces/fraim/vscode/plugins/fraim', targetDetails.contactEmail, result);
     if (manifest) {
         assertEqual(manifest.name, 'fraim', manifestRelPath, 'name', result);
-        assertEqual(manifest.version, targetDetails.productVersion, manifestRelPath, 'version', result);
+        if (!stringValue(manifest.version)) {
+            addIssue(result.errors, manifestRelPath, 'version must be a non-empty string');
+        }
         assertEqual(asObject(manifest.author)?.email, targetDetails.contactEmail, manifestRelPath, 'author.email', result);
         assertEqual(manifest.skills, 'skills/', manifestRelPath, 'skills', result);
         assertEqual(manifest.commands, 'commands/', manifestRelPath, 'commands', result);
@@ -559,7 +556,9 @@ function validateGeminiPackage(repoRoot, result, targetDetails) {
     if (!manifest)
         return;
     assertEqual(manifest.name, 'fraim', manifestRelPath, 'name', result);
-    assertEqual(manifest.version, targetDetails.productVersion, manifestRelPath, 'version', result);
+    if (!stringValue(manifest.version)) {
+        addIssue(result.errors, manifestRelPath, 'version must be a non-empty string');
+    }
     assertEqual(manifest.contextFileName, 'GEMINI.md', manifestRelPath, 'contextFileName', result);
     const servers = asObject(manifest.mcpServers);
     const fraimServer = asObject(servers?.fraim);

package/dist/src/fraim/db-service.js

@@ -74,6 +74,17 @@ function normalizeLabels(labels) {
 function escapeRegex(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+/**
+ * Ordering for persona entitlements, applied in memory. Azure Cosmos DB (Mongo API)
+ * rejects an order-by on these fields without a composite index, so the sort must not
+ * be pushed into the query. Mirrors the former `.sort({ personaKey: 1, hireMode: 1 })`.
+ */
+function comparePersonaEntitlements(a, b) {
+    const byKey = (a.personaKey || '').localeCompare(b.personaKey || '');
+    if (byKey !== 0)
+        return byKey;
+    return (a.hireMode || '').localeCompare(b.hireMode || '');
+}
 function buildLabelMatch(label) {
     return { labels: { $regex: `^${escapeRegex(label)}$`, $options: 'i' } };
 }
@@ -728,12 +739,21 @@ class FraimDbService {
         if (activeOnly) {
             query.status = 'active';
         }
-        return await this.personaEntitlementsCollection.find(query).sort({ personaKey: 1, hireMode: 1 }).toArray();
+        // Sort in memory, not in the query: Azure Cosmos DB (Mongo API) rejects an
+        // order-by on { personaKey, hireMode } with BadRequest 400 unless a matching
+        // composite index exists, and the initializeIndexes() attempt to create one
+        // is swallowed on Cosmos. A throw here bubbles up into getWorkspacePersonaState
+        // → the AI Hub silently falls back to ALL personas locked (no hired employees,
+        // empty manager team, empty project tree). Sorting client-side is index-free.
+        const rows = await this.personaEntitlementsCollection.find(query).toArray();
+        return rows.sort(comparePersonaEntitlements);
     }
     async listPersonaEntitlementsByStripeCustomerId(customerId) {
         if (!this.personaEntitlementsCollection)
             throw new Error('DB not connected');
-        return await this.personaEntitlementsCollection.find({ stripeCustomerId: customerId }).sort({ updatedAt: -1 }).toArray();
+        // In-memory sort — see getPersonaEntitlementsByWorkspaceId (Cosmos order-by).
+        const rows = await this.personaEntitlementsCollection.find({ stripeCustomerId: customerId }).toArray();
+        return rows.sort((a, b) => (b.updatedAt?.getTime() ?? 0) - (a.updatedAt?.getTime() ?? 0));
     }
     async getPersonaEntitlementsByUserId(userId, activeOnly = true) {
         if (!this.personaEntitlementsCollection)
@@ -742,7 +762,9 @@ class FraimDbService {
         if (activeOnly) {
             query.status = 'active';
         }
-        return await this.personaEntitlementsCollection.find(query).sort({ personaKey: 1, hireMode: 1 }).toArray();
+        // In-memory sort — see getPersonaEntitlementsByWorkspaceId (Cosmos order-by).
+        const rows = await this.personaEntitlementsCollection.find(query).toArray();
+        return rows.sort(comparePersonaEntitlements);
     }
     async upsertPersonaEntitlement(entitlement) {
         if (!this.personaEntitlementsCollection)

package/dist/src/routes/oauth-routes.js

@@ -4,6 +4,16 @@ exports.registerOAuthRoutes = registerOAuthRoutes;
 const cookie_service_1 = require("../services/cookie-service");
 const oauth_helpers_1 = require("../services/oauth-helpers");
 const audit_log_1 = require("../services/audit-log");
+const account_provisioning_1 = require("../services/account-provisioning");
+const rate_limit_1 = require("../middleware/rate-limit");
+function pickIntent(value) {
+    return value === 'signup' ? 'signup' : 'signin';
+}
+// Issue #691: intent=signup makes /start reachable as an account-creation path
+// (see completeSignIn below), the same sensitive business flow /api/request-access
+// already rate-limits. Apply the same limiter here, scoped to signup attempts only —
+// the pre-existing sign-in path (no intent) is left at its original, unlimited behavior.
+const signupRateLimiter = (0, rate_limit_1.sensitiveRateLimiter)();
 const GOOGLE_AUTH_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
 const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
@@ -75,13 +85,17 @@ function registerOAuthRoutes(app, deps) {
         NODE_ENV: process.env.NODE_ENV || '(not set)',
     });
     // Helper used by both providers to finalise authentication once we have a verified email.
-    async function completeSignIn(req, res, verifiedEmail, provider, surface, redirectTo) {
+    async function completeSignIn(req, res, params) {
+        const { verifiedEmail, provider, surface, redirectTo, intent } = params;
         const lower = verifiedEmail.toLowerCase();
         const apiKeyData = await dbService.getApiKeyByUserId(lower, false);
-        if (!apiKeyData) {
+        if (!apiKeyData && intent !== 'signup') {
             // Sign-in is NOT a sign-up. If the verified email doesn't already match a
             // FRAIM account, route the user to the sign-up flow. Account creation is
             // owned by /api/request-access, not by login. (Round-2 user feedback.)
+            // Issue #691: this only applies to the sign-in surface (intent !== 'signup').
+            // The dedicated signup surface uses intent='signup' to provision an account
+            // below instead of bouncing to no_account.
             await (0, audit_log_1.auditLog)('OAUTH_CALLBACK_SUCCESS', {
                 userId: lower,
                 provider,
@@ -92,6 +106,9 @@ function registerOAuthRoutes(app, deps) {
             (0, cookie_service_1.clearOAuthPendingCookie)(res);
             return res.redirect(`/auth/error.html?reason=no_account`);
         }
+        if (!apiKeyData && intent === 'signup') {
+            await (0, account_provisioning_1.ensureTrialApiKey)(dbService, lower);
+        }
         const sessionId = (0, oauth_helpers_1.generateSessionId)();
         await dbService.createAuthSession({
             sessionId,
@@ -106,13 +123,18 @@ function registerOAuthRoutes(app, deps) {
         (0, cookie_service_1.clearOAuthPendingCookie)(res);
         res.redirect(redirectTo);
     }
-    app.get('/api/auth/oauth/:provider/start', async (req, res) => {
+    app.get('/api/auth/oauth/:provider/start', (req, res, next) => {
+        if (pickIntent(req.query.intent) === 'signup')
+            return signupRateLimiter(req, res, next);
+        next();
+    }, async (req, res) => {
         const providerRaw = req.params.provider;
         const provider = typeof providerRaw === 'string' ? providerRaw : '';
         if (!(0, oauth_helpers_1.isSupportedProvider)(provider)) {
             return res.status(404).json({ error: 'unsupported_provider' });
         }
         const surface = (0, oauth_helpers_1.pickSurfaceOrDefault)(req.query.surface);
+        const intent = pickIntent(req.query.intent);
         const redirectTo = (0, oauth_helpers_1.safeRedirectPath)(req.query.redirect_to, (0, oauth_helpers_1.defaultRedirectForSurface)(surface));
         try {
             const codeVerifier = (0, oauth_helpers_1.generatePkceVerifier)();
@@ -122,6 +144,7 @@ function registerOAuthRoutes(app, deps) {
                 pendingId,
                 provider,
                 surface,
+                intent,
                 codeVerifier,
                 stateNonce,
                 redirectTo,
@@ -228,7 +251,13 @@ function registerOAuthRoutes(app, deps) {
                 await (0, audit_log_1.auditLog)('OAUTH_UNVERIFIED_EMAIL', { provider: 'google', outcome: 'failure' });
                 return res.redirect('/auth/error.html?reason=unverified_email');
             }
-            await completeSignIn(req, res, payload.email, 'google', pending.surface, pending.redirectTo);
+            await completeSignIn(req, res, {
+                verifiedEmail: payload.email,
+                provider: 'google',
+                surface: pending.surface,
+                redirectTo: pending.redirectTo,
+                intent: pickIntent(pending.intent),
+            });
         }
         catch (err) {
             console.error('[FRAIM AUTH] /api/auth/oauth/google/callback error:', err instanceof Error ? err.message : String(err));
@@ -315,7 +344,13 @@ function registerOAuthRoutes(app, deps) {
                 await (0, audit_log_1.auditLog)('OAUTH_UNVERIFIED_EMAIL', { provider: 'github', outcome: 'failure' });
                 return res.redirect('/auth/error.html?reason=unverified_email');
             }
-            await completeSignIn(req, res, verifiedEmail, 'github', pending.surface, pending.redirectTo);
+            await completeSignIn(req, res, {
+                verifiedEmail,
+                provider: 'github',
+                surface: pending.surface,
+                redirectTo: pending.redirectTo,
+                intent: pickIntent(pending.intent),
+            });
         }
         catch (err) {
             console.error('[FRAIM AUTH] /api/auth/oauth/github/callback error:', err instanceof Error ? err.message : String(err));

package/dist/src/services/account-provisioning.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureTrialApiKey = ensureTrialApiKey;
+const feature_flags_1 = require("../config/feature-flags");
+const TRIAL_DURATION_MS = 14 * 24 * 60 * 60 * 1000;
+/**
+ * Provision a 14-day trial FraimApiKey for `emailLower` if one does not already
+ * exist; otherwise return the existing key. Shared by the email+code signup
+ * flow (`AdminService.verifyRequestAccessCode`) and the OAuth signup-intent
+ * flow (`oauth-routes.ts`) so account creation has exactly one implementation.
+ * Issue #691.
+ */
+async function ensureTrialApiKey(dbService, emailLower) {
+    const existingKey = await dbService.getApiKeyByUserId(emailLower, false);
+    if (existingKey)
+        return existingKey.key;
+    const orgId = 'default';
+    const apiKey = dbService.generateApiKey(emailLower, orgId);
+    const trialExpiresAt = new Date(Date.now() + TRIAL_DURATION_MS);
+    await dbService.createApiKey({
+        key: apiKey,
+        userId: emailLower,
+        orgId,
+        tier: 'trial',
+        status: 'active',
+        expiresAt: trialExpiresAt,
+        stripeCustomerId: null,
+        stripeSubscriptionId: null,
+        currentPeriodEnd: null,
+        cancelAt: null,
+        suspendedAt: null,
+        suspensionReason: null,
+        lastUsedAt: null,
+        apiCallCount: 0,
+        personaSystemActive: (0, feature_flags_1.isPersonaEntitlementsEnabled)() || undefined
+    });
+    return apiKey;
+}

package/dist/src/services/admin-service.js

@@ -7,6 +7,7 @@ const email_service_1 = require("./email-service");
 const dashboard_access_1 = require("./dashboard-access");
 const feature_flags_1 = require("../config/feature-flags");
 const email_code_1 = require("./email-code");
+const account_provisioning_1 = require("./account-provisioning");
 class AdminService {
     constructor(dbService) {
         this.dbService = dbService;
@@ -130,8 +131,11 @@ class AdminService {
      */
     async requestAccess(body, req) {
         const { email, name, company, useCase } = body;
-        if (!email || !name || !company) {
-            throw new Error('Email, name, and company are required');
+        // Issue #691: signup is now email + verification code only. Name/company
+        // are optional lead-capture fields (createWebsiteSignup below already
+        // tolerates missing values); the trial key itself never required them.
+        if (!email) {
+            throw new Error('Email is required');
         }
         if (!(0, request_utils_1.validateEmail)(email))
             throw new Error('Invalid email address');
@@ -140,8 +144,8 @@ class AdminService {
             const { ip: ipAddress, userAgent } = (0, request_utils_1.getRequestMeta)(req);
             await this.dbService.createWebsiteSignup({
                 email: emailLower,
-                name: name.trim(),
-                company: company.trim(),
+                name: name?.trim() || '',
+                company: company?.trim() || '',
                 useCase: useCase?.trim(),
                 source: 'request-access',
                 timestamp: new Date(),
@@ -184,38 +188,8 @@ class AdminService {
         if (!verification) {
             return { success: false, error: 'Invalid or expired verification code' };
         }
-        const orgId = 'default';
-        const existingKey = await this.dbService.getApiKeyByUserId(emailLower, false);
-        let apiKey;
-        if (existingKey) {
-            apiKey = existingKey.key;
-            console.log('[FRAIM] verify_email_code existing_key_found', { userId: emailLower });
-        }
-        else {
-            apiKey = this.dbService.generateApiKey(emailLower, orgId);
-            const trialExpiresAt = new Date(Date.now() + 14 * 24 * 60 * 60 * 1000);
-            await this.dbService.createApiKey({
-                key: apiKey,
-                userId: emailLower,
-                orgId,
-                tier: 'trial',
-                status: 'active',
-                expiresAt: trialExpiresAt,
-                stripeCustomerId: null,
-                stripeSubscriptionId: null,
-                currentPeriodEnd: null,
-                cancelAt: null,
-                suspendedAt: null,
-                suspensionReason: null,
-                lastUsedAt: null,
-                apiCallCount: 0,
-                personaSystemActive: (0, feature_flags_1.isPersonaEntitlementsEnabled)() || undefined
-            });
-            console.log('[FRAIM] verify_email_code trial_key_created', {
-                userId: emailLower,
-                expiresAt: trialExpiresAt.toISOString()
-            });
-        }
+        const apiKey = await (0, account_provisioning_1.ensureTrialApiKey)(this.dbService, emailLower);
+        console.log('[FRAIM] verify_email_code key_resolved', { userId: emailLower });
         const access = await (0, dashboard_access_1.createDashboardAccessLink)(this.dbService, emailLower, apiKey);
         console.log('[FRAIM] verify_email_code verification_completed', { userId: emailLower });
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-framework",
-  "version": "2.0.183",
+  "version": "2.0.184",
   "description": "FRAIM: AI Workforce Infrastructure — the organizational capability that turns AI agents into an accountable workforce, their operators into capable AI managers, and executives into leaders with clear optics on AI proficiency.",
   "main": "index.js",
   "bin": {

package/public/ai-hub/script.js

@@ -668,10 +668,16 @@ function stripReviewHandoffBlocks(text) {
     .trim();
 }
 
-function stripHubInjectedPromptBlocks(text) {
+function stripHubInjectedNotes(text) {
   return String(text || '')
     .replace(/(?:^|\n)\s*\[How to talk to me\][\s\S]*?(?=\n\s*\[[^\]\n]+\]|\n\s*#{1,6}\s|\n\s*[-*]\s|\n{2,}|$)/gi, '\n')
-    .replace(/(?:^|\n)\s*(?:[$/]fraim)\s+[a-z0-9-]+(?:\s*\[[^\]\n]*\])?[^\n]*(?=\n|$)/gi, '\n')
+    .replace(/\n{3,}/g, '\n\n')
+    .trim();
+}
+
+function stripHubInjectedPromptBlocks(text) {
+  return stripHubInjectedNotes(text)
+    .replace(/(?:^|\n)\s*(?:[$/@]fraim)\s+[a-z0-9-]+(?:\s*\[[^\]\n]*\])?[^\n]*(?=\n|$)/gi, '\n')
     .replace(/\n{3,}/g, '\n\n')
     .trim();
 }
@@ -2628,8 +2634,8 @@ function closeTemplatePopover() {
 }
 
 function applyTemplateInvocation(managerJobId) {
-  // The invocation prefix ($fraim / /fraim) is an implementation detail that
-  // the server adds based on the active employee — the user should never see it.
+  // The server adds the invocation prefix based on the active employee. Keep
+  // that syntax out of the editable textarea; the thread shows it after send.
   // Store the job ID as a pending coaching job. The #coach-note shows a
   // human-readable label; the textarea gets editable context the user can amend.
   // When the user clicks Send, continueRun sends { coachingJobId, instructions }.
@@ -2638,7 +2644,7 @@ function applyTemplateInvocation(managerJobId) {
   // for sessions that stored raw invocation text before this change).
   const textarea = els['coach-text'];
   textarea.value = textarea.value
-    .replace(/(?:^|\n|\s)[/$]fraim\s+[a-z0-9-]+(?:\s|$)/ig, ' ')
+    .replace(/(?:^|\n|\s)[$/@]fraim\s+[a-z0-9-]+(?:\s|$)/ig, ' ')
     .replace(/\s+/g, ' ')
     .trim();
   textarea.focus();
@@ -2677,17 +2683,20 @@ function stripStubReference(text) {
 }
 
 function surfaceText(role, text, conv) {
-  const raw = stripHubInjectedPromptBlocks(stripStubReference(text));
+  const withoutStub = stripStubReference(text);
+  const raw = role === 'manager'
+    ? stripHubInjectedNotes(withoutStub)
+    : stripHubInjectedPromptBlocks(withoutStub);
   if (!raw) return '';
 
   if (role === 'manager') {
-    const invocationOnly = raw.match(/^(?:[$/]fraim)\s+([a-z0-9-]+)\s*$/i);
+    const invocationOnly = raw.match(/^(?:[$/@]fraim)\s+([a-z0-9-]+)\s*$/i);
     if (invocationOnly) return raw;
     const slugPattern = '[a-z0-9]+(?:-[a-z0-9]+)+';
-    const invocationWithSlug = new RegExp(`^(?:[$/]fraim)\\s+(${slugPattern})\\s*`, 'i');
+    const invocationWithSlug = new RegExp(`^(?:[$/@]fraim)\\s+(${slugPattern})\\s*`, 'i');
     return raw
       .replace(invocationWithSlug, '')
-      .replace(/^(?:[$/]fraim)\s*/i, '')
+      .replace(/^(?:[$/@]fraim)\s*/i, '')
       .trim();
   }
 
@@ -4640,9 +4649,9 @@ function deriveTitle(jobTitle, instructions) {
   const trimmedJob = (jobTitle || '').trim();
   const raw = (instructions || '').trim();
   // Capture FRAIM job slug before stripping (e.g. "/fraim pricing-strategy-definition" → "pricing-strategy-definition")
-  const fraimSlugMatch = raw.match(/^[/$]fraim\s+([a-z0-9][a-z0-9-]*)(?:\s|$)/i);
+  const fraimSlugMatch = raw.match(/^[$/@]fraim\s+([a-z0-9][a-z0-9-]*)(?:\s|$)/i);
   const stripped = raw
-    .replace(/^[/$]fraim(?:\s+[a-z0-9-]+)?\s*/i, '')
+    .replace(/^[$/@]fraim(?:\s+[a-z0-9-]+)?\s*/i, '')
     .replace(/\s+/g, ' ')
     .trim();
   const words = stripped.split(' ').filter(Boolean).slice(0, 6);
@@ -6004,7 +6013,7 @@ const tf = {
   area: 'projects',          // company | manager | projects | brain
   projectView: 'overview',   // overview | workspace
   activeProjectId: null,
-  projects: [],              // [{ id, name, intent, brief, team:[personaKey] }]
+  projects: [],              // [{ id, name, intent, brief }] — roster derived from hired personas, not stored
   assignments: {},           // { [projectId]: [{ id, employeeKey, jobName, jobId }] }
   npStep: 1,
   npSelectedEmployees: [],
@@ -6026,6 +6035,12 @@ function tfPersonas() { return (state.bootstrap && state.bootstrap.personas) ||
 function tfHiredPersonas() { return tfPersonas().filter((p) => p.status === 'hired'); }
 function tfAvailablePersonas() { return tfPersonas().filter((p) => p.status !== 'hired'); }
 function tfPersonaByKey(key) { return tfPersonas().find((p) => p.key === key) || null; }
+// A project's employee roster is derived from the hired personas in the bootstrap
+// (DB-authoritative), NOT from per-machine local state. With the legacy-workspace
+// bypass every user sees the full employee catalog, and the roster is identical on
+// every machine the user signs in from. Deliberately not persisted to disk /
+// localStorage — see AiHubProjectListEntry in src/ai-hub/types.ts.
+function tfProjectTeamKeys() { return tfHiredPersonas().map((p) => p.key); }
 
 // ---------------------------------------------------------------------------
 // Persistence (projects + assignments, mirrors the conversation model)
@@ -6056,7 +6071,8 @@ function tfNormalizeProject(raw, fallbackPath) {
     outcome: raw.outcome || '',
     rules: raw.rules || '',
     brief: raw.brief || raw.intent || '',
-    team: Array.isArray(raw.team) ? raw.team.filter((key) => typeof key === 'string') : [],
+    // Roster is derived from hired personas at render time (tfProjectTeamKeys),
+    // never stored per machine. Any legacy `team` on stored state is dropped.
     updatedAt: raw.updatedAt || undefined,
   };
 }
@@ -6086,9 +6102,6 @@ function tfMergeProjects(projects) {
     const existing = merged.get(key);
     if (existing) {
       const next = { ...existing, ...normalized, folderPath: normalized.folderPath || existing.folderPath };
-      if ((!Array.isArray(normalized.team) || normalized.team.length === 0) && Array.isArray(existing.team) && existing.team.length > 0) {
-        next.team = existing.team;
-      }
       merged.set(key, next);
     } else {
       merged.set(key, normalized);
@@ -6110,7 +6123,6 @@ function tfEnsureCurrentProject() {
     id: tfProjectIdForPath(state.projectPath),
     name: friendlyProjectShortName(state.projectPath),
     folderPath: state.projectPath,
-    team: tfHiredPersonas().map((p) => p.key),
   }, state.projectPath);
   tfMergeProjects([current]);
   const resolved = tfProjectForPath(state.projectPath);
@@ -6411,7 +6423,7 @@ function tfRenderOverview() {
     const team = document.createElement('div');
     team.className = 'proj-team';
     const assigned = tfProjectAssignments(proj.id);
-    const empKeys = Array.from(new Set([...(proj.team || []), ...assigned.map((a) => a.employeeKey).filter(Boolean)]));
+    const empKeys = Array.from(new Set([...tfProjectTeamKeys(), ...assigned.map((a) => a.employeeKey).filter(Boolean)]));
     empKeys.slice(0, 6).forEach((key, i) => {
       const persona = tfPersonaByKey(key);
       const av = tfAvatarFor(persona ? persona.displayName : key, i);
@@ -6713,17 +6725,16 @@ function tfRenderTree() {
   const projectId = tf.activeProjectId;
   const assigned = tfProjectAssignments(projectId);
   const project = tf.projects.find((p) => p.id === projectId);
-  const onProject = (project && project.team) || [];
+  const onProject = tfProjectTeamKeys();
   // Issue #540 R8: include personas on the manager's team so delegate buttons
   // appear in the workspace tree even when the persona hasn't been assigned yet.
   const managerTeamPersonaKeys = (state.bootstrap?.managerTeam || []).map((e) => e.personaKey);
   const empKeys = Array.from(new Set([...onProject, ...assigned.map((a) => a.employeeKey).filter(Boolean), ...managerTeamPersonaKeys]))
-    // #538 follow-up: reconcile against real entitlements. The localStorage
-    // project.team can hold members who are no longer hired (or were seeded
-    // before an entitlement change), which made un-hired personas like swen
-    // appear in a workspace where only beza/pam are actually hired. Drop any
-    // key that resolves to a known persona that is NOT hired; keep hired
-    // personas and genuinely custom employees (no persona record).
+    // #538 follow-up: reconcile against real entitlements. `assigned` job records
+    // and manager-team keys can reference personas that are no longer hired; drop
+    // any key that resolves to a known persona that is NOT hired. Keep hired
+    // personas and genuinely custom employees (no persona record). onProject is
+    // already hired-only (tfProjectTeamKeys), so this is a no-op for it.
     .filter((key) => { const p = tfPersonaByKey(key); return !p || p.status === 'hired'; });
   const managerTeamKeySet = new Set(managerTeamPersonaKeys);
 
@@ -6991,9 +7002,12 @@ async function loadDeployments() {
   const list = document.getElementById('proj-deployments-list');
   if (!list) return;
   try {
+    const params = new URLSearchParams();
+    if (state.projectPath) params.set('projectPath', state.projectPath);
+    const suffix = params.toString() ? '?' + params.toString() : '';
     const [schResp, whResp] = await Promise.all([
-      fetch('/api/ai-hub/schedules'),
-      fetch('/api/ai-hub/webhooks'),
+      fetch('/api/ai-hub/schedules' + suffix),
+      fetch('/api/ai-hub/webhooks' + suffix),
     ]);
     const schedules = schResp.ok ? await schResp.json() : [];
     const webhooks = whResp.ok ? await whResp.json() : [];
@@ -7333,7 +7347,7 @@ async function saveScheduleDeployment() {
     const resp = await fetch(url, {
       method,
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ label, jobId, hostId, cronExpr, instructions: instructions || undefined }),
+      body: JSON.stringify({ label, jobId, projectPath: state.projectPath || undefined, hostId, cronExpr, instructions: instructions || undefined }),
     });
     if (!resp.ok) { const e = await resp.json().catch(() => ({})); errEl.textContent = e.error || (isEdit ? 'Failed to update assignment.' : 'Failed to create assignment.'); errEl.hidden = false; return; }
     _editingDepId = null;
@@ -7356,7 +7370,7 @@ async function saveWebhookDeployment() {
     const resp = await fetch(url, {
       method,
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ label, jobId, hostId, instructions: instructions || undefined }),
+      body: JSON.stringify({ label, jobId, projectPath: state.projectPath || undefined, hostId, instructions: instructions || undefined }),
     });
     if (!resp.ok) { const e = await resp.json().catch(() => ({})); errEl.textContent = e.error || (isEdit ? 'Failed to update assignment.' : 'Failed to create assignment.'); errEl.hidden = false; return; }
     if (!isEdit) {
@@ -9200,7 +9214,7 @@ async function tfCreateProject() {
     intent && `Project intent: ${intent}`,
     val('np-outcome') && `Success looks like: ${val('np-outcome')}`,
     val('np-rules') && `Rules & guardrails: ${val('np-rules')}`,
-    `Team: ${(project.team || []).join(', ') || 'no employees assigned yet'}`,
+    `Team: ${tfProjectTeamKeys().join(', ') || 'no employees assigned yet'}`,
   ].filter(Boolean).join('\n\n');
 
   if (onboardingContext) {
@@ -9386,10 +9400,9 @@ function tfAssignJobToEmployee(employeeKey, job) {
   if (!projectId) { tfCloseAssignJob(); return; }
   if (!tf.assignments[projectId]) tf.assignments[projectId] = [];
   tf.assignments[projectId].push({ id: 'a-' + Date.now(), employeeKey, jobName: job.title || job.id, jobId: job.id });
-  const proj = tf.projects.find((p) => p.id === projectId);
-  if (proj) { proj.team = proj.team || []; if (!proj.team.includes(employeeKey)) proj.team.push(employeeKey); }
+  // No longer mutate a stored project.team: the roster is derived from hired
+  // personas (tfProjectTeamKeys) and every employee is always available.
   tfPersistAssignments();
-  tfPersistProjects();
   tfCloseAssignJob();
   tfRenderTree();
   tfRenderProjectTabs();
@@ -9408,7 +9421,7 @@ function tfOpenAddEmp(preselectKey) {
   const sub = document.getElementById('ae-sub');
   if (!modal || !body) return;
   body.innerHTML = '';
-  const onProject = (tf.projects.find((p) => p.id === tf.activeProjectId) || {}).team || [];
+  const onProject = tfProjectTeamKeys();
   const onProjectPersonas = onProject.map(tfPersonaByKey).filter(Boolean);
   if (onProjectPersonas.length) {
     const label = document.createElement('div');