ghostrail 0.18.0 → 0.20.0

package/dist/cli/commands.js

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { access, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile, readdir, rm, rmdir, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import process from "node:process";
@@ -10,24 +10,28 @@ import { createBoardServer, isLoopback, normalizeToken } from "../board/server.j
 import { DEFAULT_CLAUDE_PINS, buildProposal, writeProfile } from "../claude-profile/index.js";
 import { parseDuration } from "../config/duration.js";
 import { parseConfig, parseMergedConfig } from "../config/load.js";
-import { createDashboardServer, defaultStateDir } from "../dashboard/index.js";
+import { MERGE_TRIGGER_COMMENT, createDashboardServer, defaultStateDir, } from "../dashboard/index.js";
 import { hasFailure, renderDoctorJson, renderDoctorText, runDoctor, } from "../doctor/index.js";
 import { buildLoopDeps, buildRespondDeps, buildTriageDeps, repoGhRunner, resolveRepoSlug, } from "../factory/build.js";
 import { describeMigration, migrateLegacyStore, resolveWorkRepo, stateDirFor, } from "../factory/state.js";
 import { entryKey, findByPath, findForRepoResolving, replaceEntry, upsert, } from "../global/registry.js";
-import { canonicalRepoId, localRepoId } from "../global/repo-id.js";
+import { canonicalRepoId, localRepoId, repoKey } from "../global/repo-id.js";
 import { GlobalStore, resolveGlobalDir } from "../global/store.js";
+import { isTempPath } from "../global/tempdir.js";
 import { DEFAULT_FACTORY_IMAGE, dockerBuildArgs, dockerDir, parseImageFlags, } from "../image/build.js";
 import { extractPlaceholders, isClean, missingSignals, repoPathFor, } from "../init/drift.js";
+import { GREENROOM_POINTER_FILE, parseGreenroomPointer, resolveGreenroomDir, } from "../init/greenroom.js";
 import { mergeRegions, parseRegions, regionHashes } from "../init/regions.js";
-import { classify, hashContent, mergeManifest, readManifest, writeManifest, } from "../init/template.js";
+import { MANIFEST_FILE, classify, hashContent, mergeManifest, readManifest, writeManifest, } from "../init/template.js";
 import { FileLock } from "../lock/file-lock.js";
 import { concurrencyAdvice } from "../loop/advice.js";
 import { fileControl } from "../loop/control.js";
 import { readControl } from "../loop/control.js";
 import { runTick } from "../loop/engine.js";
+import { duePasses, } from "../loop/schedule.js";
 import { watchLoop } from "../loop/watch.js";
 import { GhHost, parseRepoSlug } from "../publish/gh.js";
+import { resolveIgnoredAuthors } from "../respond/authors.js";
 import { respondTick } from "../respond/respond.js";
 import { GLOBAL_SECRETS_FILE, appendPlaceholders, applyOverrides, launchEditor as defaultLaunchEditor, loadEnvOverrides, missingSecrets, readSecretsFile, redactSecrets, renderFile, resolveEditor, secretValuesOf, writeSecretsFile, } from "../secrets/index.js";
 import { DASHBOARD_UNIT, renderDashboardUnit, servicePath, stopTimeoutSeconds, systemdManager, unitName, } from "../service/index.js";
@@ -64,12 +68,49 @@ function makeLogger(streams, secrets) {
         warn: (message) => streams.err(`${redactSecrets(message, secrets)}\n`),
     };
 }
+/**
+ * The effective `ghostrail.toml` path for a repo: the repo's own file if it
+ * has one, else wherever its `.ghostrail-config` pointer file names, else
+ * undefined. Used for status/metadata reads that only ever look at the
+ * repo's default config, never an explicit `--config`.
+ */
+async function resolveConfigPath(repo) {
+    const local = join(repo, "ghostrail.toml");
+    if (await pathExists(local))
+        return local;
+    const pointerRaw = await readIfPresent(join(repo, GREENROOM_POINTER_FILE));
+    if (pointerRaw === undefined)
+        return undefined;
+    const pointer = parseGreenroomPointer(pointerRaw);
+    if (pointer === undefined)
+        return undefined;
+    const external = join(resolveGreenroomDir(repo, pointer), "ghostrail.toml");
+    return (await pathExists(external)) ? external : undefined;
+}
+/**
+ * The config path `flags` name: an explicit `--config` wins outright, and a
+ * relative default that resolves inside the repo is used as-is (the common
+ * case). Only the untouched default (`ghostrail.toml`, absent from the repo)
+ * falls through to `resolveConfigPath`'s `.ghostrail-config` lookup, so an
+ * explicit but wrong `--config` still fails exactly as it did before.
+ */
+async function configPathForFlags(flags) {
+    if (isAbsolute(flags.config))
+        return flags.config;
+    const local = join(flags.repo, flags.config);
+    if (flags.config === "ghostrail.toml" && !(await pathExists(local))) {
+        const resolved = await resolveConfigPath(flags.repo);
+        if (resolved !== undefined)
+            return resolved;
+    }
+    return local;
+}
 /**
  * Load the repo config layered over the global account settings, and resolve the
  * global store. Prints errors and returns undefined on failure.
  */
 async function loadConfig(flags, streams, env) {
-    const configPath = isAbsolute(flags.config) ? flags.config : join(flags.repo, flags.config);
+    const configPath = await configPathForFlags(flags);
     let repoToml;
     try {
         repoToml = await readFile(configPath, "utf8");
@@ -87,7 +128,16 @@ async function loadConfig(flags, streams, env) {
         }
         return undefined;
     }
-    return { config: parsed.value, globalStore };
+    // Only set when the config actually used lives outside the repo: the
+    // default (in-repo) case must read the agent's prompt from the provisioned
+    // workspace exactly as it always has.
+    const configDir = resolve(dirname(configPath));
+    const promptSourceDir = configDir === resolve(flags.repo) ? undefined : configDir;
+    return {
+        config: parsed.value,
+        globalStore,
+        ...(promptSourceDir === undefined ? {} : { promptSourceDir }),
+    };
 }
 /**
  * Load the global + repo secret files and apply them over `env` in place, with
@@ -120,7 +170,7 @@ async function prepareLoop(flags, streams, env) {
     const loaded = await loadConfig(flags, streams, env);
     if (loaded === undefined)
         return undefined;
-    const { config, globalStore } = loaded;
+    const { config, globalStore, promptSourceDir } = loaded;
     const linearApiKey = env.LINEAR_API_KEY;
     if (linearApiKey === undefined || linearApiKey.length === 0) {
         streams.err("LINEAR_API_KEY is not set\n");
@@ -139,18 +189,25 @@ async function prepareLoop(flags, streams, env) {
     // of one repo running overlapping ticks: while the store lived inside each
     // checkout they took different locks and nothing serialized them.
     const lock = new FileLock(join(state.dir, "lock"), config.guardrails.claimTtlMs);
-    const deps = buildLoopDeps(config, {
+    const ctx = {
         repoPath: flags.repo,
         ...(work.path === undefined ? {} : { workRepoPath: work.path }),
         stateDir: state.dir,
         linearApiKey,
         lock,
         globalStore,
+        selfLogins: resolveIgnoredAuthors({
+            sourceKind: config.source.kind,
+            ...(config.respond === undefined ? {} : { configured: config.respond.ignoreAuthors }),
+            ...(env.GHOSTRAIL_SELF_LOGINS === undefined ? {} : { env: env.GHOSTRAIL_SELF_LOGINS }),
+        }),
         ...(claudeProfileDir === undefined ? {} : { claudeProfileDir }),
+        ...(promptSourceDir === undefined ? {} : { promptSourceDir }),
         ...(repoSlug === undefined ? {} : { repoSlug }),
         logger: makeLogger(streams, secrets),
-    });
-    return { config, deps, secrets, stateDir: state.dir };
+    };
+    const deps = buildLoopDeps(config, ctx);
+    return { config, deps, secrets, stateDir: state.dir, ctx };
 }
 /** `ghostrail run`: drain eligible work once. */
 export async function cmdRun(argv, streams, env = process.env, cwd = process.cwd()) {
@@ -190,7 +247,47 @@ export function parseWatchFlags(argv) {
         ? { intervalMs, intervalLabel }
         : { intervalMs, intervalLabel, maxTicks };
 }
-/** `ghostrail watch`: run ticks on an interval until interrupted (no cron needed). */
+/**
+ * The passes this config can run under `watch`: the fix queue always, plus
+ * respond and triage when their sections are present. A section that fails to
+ * assemble (a triage source that isn't wired up yet, say) is reported once and
+ * left out, rather than throwing on every tick.
+ */
+function schedulablePasses(setup, streams) {
+    const passes = {
+        fix: () => runTick(setup.deps, setup.config),
+    };
+    if (setup.config.respond !== undefined) {
+        const { deps, config: respondConfig } = buildRespondDeps(setup.config, setup.ctx);
+        passes.respond = () => respondTick(deps, respondConfig);
+    }
+    if (setup.config.triage !== undefined) {
+        try {
+            const deps = buildTriageDeps(setup.config, setup.ctx);
+            passes.triage = () => triageTick(deps, setup.config);
+        }
+        catch (error) {
+            streams.err(`not watching triage: ${error instanceof Error ? error.message : String(error)}\n`);
+        }
+    }
+    return passes;
+}
+/** The intervals for the passes that are actually wired up. */
+function intervalsOf(config, passes) {
+    const intervals = {};
+    if (passes.respond !== undefined && config.respond?.everyMs !== undefined) {
+        intervals.respond = config.respond.everyMs;
+    }
+    if (passes.triage !== undefined && config.triage?.everyMs !== undefined) {
+        intervals.triage = config.triage.everyMs;
+    }
+    return intervals;
+}
+/** The ", plus respond every 5m" tail of the watch banner. */
+function describeSchedule(passes) {
+    const extra = ["respond", "triage"].filter((pass) => passes[pass] !== undefined);
+    return extra.length === 0 ? "" : `, plus ${extra.join(" and ")}`;
+}
 export async function cmdWatch(argv, streams, env = process.env, cwd = process.cwd()) {
     const flags = parseCommandFlags(argv, { config: "ghostrail.toml", repo: cwd });
     const watch = parseWatchFlags(argv);
@@ -205,18 +302,44 @@ export async function cmdWatch(argv, streams, env = process.env, cwd = process.c
     const onSignal = () => controller.abort();
     process.once("SIGINT", onSignal);
     process.once("SIGTERM", onSignal);
-    streams.err(`watching every ${watch.intervalLabel}; press Ctrl-C to stop\n`);
+    const logger = makeLogger(streams, setup.secrets);
+    const passes = schedulablePasses(setup, streams);
+    streams.err(`watching every ${watch.intervalLabel}${describeSchedule(passes)}; press Ctrl-C to stop\n`);
     try {
         const controlDir = setup.stateDir;
+        // In memory, for the life of this process: a restart re-runs every pass
+        // once, which is what someone restarting a daemon expects to happen.
+        const lastRunAt = {};
         const ticks = await watchLoop({
             intervalMs: watch.intervalMs,
             signal: controller.signal,
-            logger: makeLogger(streams, setup.secrets),
+            logger,
             isEnabled: async () => (await readControl(controlDir)).enabled,
             ...(watch.maxTicks === undefined ? {} : { maxTicks: watch.maxTicks }),
             tick: async () => {
-                const result = await runTick(setup.deps, setup.config);
-                streams.out(`${redactSecrets(JSON.stringify(result, null, 2), setup.secrets)}\n`);
+                const due = duePasses({
+                    now: Date.now(),
+                    intervals: intervalsOf(setup.config, passes),
+                    lastRunAt,
+                });
+                for (const pass of due) {
+                    const run = passes[pass];
+                    if (run === undefined)
+                        continue;
+                    try {
+                        const result = await run();
+                        streams.out(`${pass}: ${redactSecrets(JSON.stringify(result, null, 2), setup.secrets)}\n`);
+                    }
+                    catch (error) {
+                        // One broken pass must not disable the other two, and must not
+                        // kill the loop. It still stamps lastRunAt below: a pass that
+                        // fails fast would otherwise retry on every base tick, which for
+                        // an agent-backed pass means spending money in a loop.
+                        logger.warn(`${pass} pass failed: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                    if (pass !== "fix")
+                        lastRunAt[pass] = Date.now();
+                }
             },
         });
         streams.err(`stopped after ${ticks} tick(s)\n`);
@@ -234,7 +357,7 @@ export async function cmdTriage(argv, streams, env = process.env, cwd = process.
     const loaded = await loadConfig(flags, streams, env);
     if (loaded === undefined)
         return 1;
-    const { config, globalStore } = loaded;
+    const { config, globalStore, promptSourceDir } = loaded;
     if (config.triage === undefined) {
         streams.err("no [triage] section in the config; add one to use `ghostrail triage`\n");
         return 1;
@@ -263,6 +386,7 @@ export async function cmdTriage(argv, streams, env = process.env, cwd = process.
         lock,
         globalStore,
         ...(claudeProfileDir === undefined ? {} : { claudeProfileDir }),
+        ...(promptSourceDir === undefined ? {} : { promptSourceDir }),
         logger: makeLogger(streams, secrets),
     });
     const result = await triageTick(deps, config);
@@ -276,12 +400,16 @@ export async function cmdRespond(argv, streams, env = process.env, cwd = process
     const loaded = await loadConfig(flags, streams, env);
     if (loaded === undefined)
         return 1;
-    const { config } = loaded;
+    const { config, promptSourceDir } = loaded;
     const linearApiKey = env.LINEAR_API_KEY ?? "";
-    const selfLogins = (env.GHOSTRAIL_SELF_LOGINS ?? "")
-        .split(",")
-        .map((login) => login.trim())
-        .filter((login) => login.length > 0);
+    // The union of the source kind's built-in bots, `[respond].ignore_authors`,
+    // and the environment variable. Without the built-ins, a Linear factory's
+    // linkback comment reads as human feedback on every open PR (TJ-1667).
+    const selfLogins = resolveIgnoredAuthors({
+        sourceKind: config.source.kind,
+        ...(config.respond === undefined ? {} : { configured: config.respond.ignoreAuthors }),
+        ...(env.GHOSTRAIL_SELF_LOGINS === undefined ? {} : { env: env.GHOSTRAIL_SELF_LOGINS }),
+    });
     const claudeProfileDir = await resolveClaudeProfile(env);
     const repoSlug = await resolveRepoSlug(config, flags.repo);
     // Respond's watermarks live with the rest of the repo's state, so a pass run
@@ -303,6 +431,7 @@ export async function cmdRespond(argv, streams, env = process.env, cwd = process
         lock: { acquire: async () => true, release: async () => { } },
         selfLogins,
         ...(claudeProfileDir === undefined ? {} : { claudeProfileDir }),
+        ...(promptSourceDir === undefined ? {} : { promptSourceDir }),
         ...(repoSlug === undefined ? {} : { repoSlug }),
         logger: makeLogger(streams, secrets),
     });
@@ -475,6 +604,12 @@ function dashboardDeps(env, manager) {
         // subprocess. A machine with no `gh` and no credentials still serves the
         // whole dashboard, with PR status reported as unavailable.
         prStatus: async (entry, prNumber) => new GhHost(repoGhRunner(entry.path), await slugFor(entry)).getPrStatus(prNumber),
+        // Posts the same trigger comment a human typing "resolve conflicts and
+        // merge" by hand would; the next respond pass does the actual work (see
+        // specs/dashboard-review-mode.spec.md). A machine with no `gh` and no
+        // credentials still serves the whole dashboard; the route just answers
+        // 503 rather than failing to start.
+        mergeTrigger: async (entry, prNumber) => new GhHost(repoGhRunner(entry.path), await slugFor(entry)).postComment(prNumber, MERGE_TRIGGER_COMMENT),
         readRegistry: () => store.readRegistry(),
         writeRegistry: (entries) => store.writeRegistry(entries),
         health: ghostrailHealth,
@@ -559,7 +694,7 @@ export async function cmdArtifacts(argv, streams, env = process.env) {
 export async function ghostrailHealth(path) {
     if (!(await pathExists(path)))
         return "missing";
-    return (await pathExists(join(path, "ghostrail.toml"))) ? "ok" : "no config";
+    return (await resolveConfigPath(path)) !== undefined ? "ok" : "no config";
 }
 /** `ghostrail ls`: the ghostrails this account knows about. */
 export async function cmdLs(_argv, streams, env = process.env) {
@@ -596,7 +731,8 @@ function ghostrailExecPath() {
 }
 /** A ghostrail's configured agent timeout, for the unit's stop timeout. */
 async function agentTimeoutMs(repo) {
-    const raw = await readIfPresent(join(repo, "ghostrail.toml"));
+    const configPath = await resolveConfigPath(repo);
+    const raw = configPath === undefined ? undefined : await readIfPresent(configPath);
     if (raw !== undefined) {
         const parsed = parseConfig(raw);
         if (parsed.ok)
@@ -849,7 +985,7 @@ export async function cmdStart(argv, streams, env = process.env, ask = askOnTerm
             }
         }
     }
-    streams.out("\n`watch` ticks the fix queue only; `respond` and `triage` still need their own schedule\n");
+    streams.out("\n`watch` ticks the fix queue every interval, plus respond and triage on their own (`[respond].every`, `[triage].every`)\n");
     return failed ? 1 : 0;
 }
 /** `ghostrail stop`: take ghostrails down without changing what should run. */
@@ -1041,7 +1177,8 @@ function globalStoreFor(env) {
 }
 /** A ghostrail's display name: `[factory].name`, else the directory. */
 async function ghostrailName(repo) {
-    const raw = await readIfPresent(join(repo, "ghostrail.toml"));
+    const configPath = await resolveConfigPath(repo);
+    const raw = configPath === undefined ? undefined : await readIfPresent(configPath);
     if (raw !== undefined) {
         const parsed = parseConfig(raw);
         if (parsed.ok && parsed.value.factory.name.length > 0)
@@ -1088,7 +1225,10 @@ async function resolveRepoId(path) {
  * the checkout's origin.
  */
 async function configAt(repo) {
-    const raw = await readIfPresent(join(repo, "ghostrail.toml"));
+    const configPath = await resolveConfigPath(repo);
+    if (configPath === undefined)
+        return undefined;
+    const raw = await readIfPresent(configPath);
     if (raw === undefined)
         return undefined;
     const parsed = parseConfig(raw);
@@ -1101,10 +1241,18 @@ async function prepareState(repo, config, env, streams) {
         streams.err(`${note}\n`);
     return { dir: state.dir, repoId: state.repoId };
 }
-async function registerGhostrail(repo, env, streams) {
+async function registerGhostrail(repo, env, streams, forceRegister = false) {
     const store = globalStoreFor(env);
     const path = resolve(repo);
     try {
+        if (!forceRegister && (await isTempPath(path, env))) {
+            // `watch` defaults to true and, for a repo with no remote, `path` is the
+            // identity: registering here would switch on a service unit pointed at a
+            // directory that is going to vanish. Scaffolding still happened; only the
+            // registry write is skipped, and said plainly rather than silently.
+            streams.out(`not registered: ${path} looks like a temp directory\n  run \`ghostrail init <template> --register\` to register it anyway\n`);
+            return;
+        }
         const entries = await store.readRegistry();
         if (entries === undefined) {
             streams.err(`note: ${store.registryPath()} could not be parsed, so this ghostrail was not registered\n`);
@@ -1185,7 +1333,7 @@ async function promptPathsAt(configPath) {
  * the template gained, which is what every hand port consisted of before
  * regions existed, and the skill places them in the repo's own wording.
  */
-async function applyTemplateUpdate(template, srcDir, repo, streams, env) {
+async function applyTemplateUpdate(template, srcDir, repo, streams, env, register) {
     const manifest = await readManifest(repo);
     const rels = await scaffoldFiles(srcDir);
     const templatePrompts = (await promptPathsAt(join(srcDir, "ghostrail.toml"))) ?? {};
@@ -1310,7 +1458,7 @@ async function applyTemplateUpdate(template, srcDir, repo, streams, env) {
     if (Object.keys(written).length > 0 || Object.keys(writtenRegions).length > 0) {
         await writeManifest(repo, mergeManifest(manifest, template, VERSION, written, writtenRegions));
     }
-    await registerGhostrail(repo, env, streams);
+    await registerGhostrail(repo, env, streams, register);
     streams.out("\n");
     if (took > 0)
         streams.out(`took ${took} file(s) you had not edited\n`);
@@ -1325,12 +1473,47 @@ async function applyTemplateUpdate(template, srcDir, repo, streams, env) {
     return 0;
 }
 /**
- * `ghostrail init <template> [--repo <path>] [--force|--diff|--update]`: scaffold
- * `ghostrail.toml` and `prompts/` from a quickstart template. Safe for a fresh OR
- * an existing repo: existing files are left untouched (skipped) unless `--force`
- * is given. `--diff` reports drift instead of writing anything, and `--update`
- * takes the template changes this repo never edited while naming what a
- * customized file is missing.
+ * Where `--greenroom` scaffolds when no path is given: `<global config
+ * dir>/greenroom/<repo key>`, the same identity-derived key `stateDirFor`
+ * already uses, so a bare `--greenroom` needs no path and a second run on a
+ * machine that already knows this repo lands in the same place.
+ */
+async function defaultGreenroomDir(repo, env) {
+    const globalDir = resolveGlobalDir({ GHOSTRAIL_HOME: env.GHOSTRAIL_HOME, XDG_CONFIG_HOME: env.XDG_CONFIG_HOME }, homedir());
+    const repoId = await resolveRepoId(repo);
+    return join(globalDir, "greenroom", repoKey(repoId));
+}
+/**
+ * Remove a repo's own copy of a plain `init`'s scaffold, now superseded by a
+ * greenroom directory: the scaffolded files themselves, the provenance
+ * manifest, and a `prompts/` directory only if scaffolding left it empty
+ * (something else living there is left alone).
+ */
+async function removeLocalScaffold(repo, rels) {
+    for (const rel of rels) {
+        await rm(join(repo, rel), { force: true });
+    }
+    await rm(join(repo, MANIFEST_FILE), { force: true });
+    try {
+        await rmdir(join(repo, "prompts"));
+    }
+    catch {
+        // Non-empty, or never existed: leave it exactly as it is.
+    }
+}
+/**
+ * `ghostrail init <template> [--repo <path>] [--force|--diff|--update|--greenroom [<path>]] [--register]`:
+ * scaffold `ghostrail.toml` and `prompts/` from a quickstart template. Safe for
+ * a fresh OR an existing repo: existing files are left untouched (skipped)
+ * unless `--force` is given. `--diff` reports drift instead of writing
+ * anything, `--update` takes the template changes this repo never edited while
+ * naming what a customized file is missing, and `--greenroom` scaffolds into a
+ * directory outside the repo instead of into it (see
+ * specs/greenroom-compatibility.spec.md), converting an existing plain `init`
+ * in place when the repo already has one.
+ *
+ * Registration is skipped, not just the write, when the target looks like a
+ * temp directory (TJ-1654); `--register` registers it anyway.
  */
 export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.env) {
     let template;
@@ -1338,6 +1521,9 @@ export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.
     let force = false;
     let diff = false;
     let update = false;
+    let register = false;
+    let greenroom = false;
+    let greenroomPath;
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         const next = argv[i + 1];
@@ -1354,12 +1540,22 @@ export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.
         else if (arg === "--update") {
             update = true;
         }
+        else if (arg === "--register") {
+            register = true;
+        }
+        else if (arg === "--greenroom") {
+            greenroom = true;
+            if (next !== undefined && !next.startsWith("-")) {
+                greenroomPath = next;
+                i++;
+            }
+        }
         else if (arg !== undefined && !arg.startsWith("-")) {
             template ??= arg;
         }
     }
     if (template === undefined || !TEMPLATES.includes(template)) {
-        streams.err(`usage: ghostrail init <template> [--repo <path>] [--force|--diff|--update]\ntemplates: ${TEMPLATES.join(", ")}\n`);
+        streams.err(`usage: ghostrail init <template> [--repo <path>] [--force|--diff|--update|--greenroom [<path>]] [--register]\ntemplates: ${TEMPLATES.join(", ")}\n`);
         return 1;
     }
     if (diff && force) {
@@ -1372,10 +1568,17 @@ export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.
         streams.err("init: --update cannot be combined with --force or --diff\n");
         return 1;
     }
+    if (greenroom && (update || diff)) {
+        // --update and --diff both compare against the template this CLI ships;
+        // where the resulting files land is an orthogonal question, and combining
+        // them is refused rather than guessing an order.
+        streams.err("init: --greenroom cannot be combined with --update or --diff\n");
+        return 1;
+    }
     const srcDir = join(templatesDir(), template);
     if (update) {
         try {
-            return await applyTemplateUpdate(template, srcDir, repo, streams, env);
+            return await applyTemplateUpdate(template, srcDir, repo, streams, env, register);
         }
         catch (error) {
             streams.err(`init --update failed: ${error instanceof Error ? error.message : String(error)}\n`);
@@ -1391,6 +1594,9 @@ export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.
             return 1;
         }
     }
+    const configRoot = greenroom
+        ? resolve(greenroomPath ?? (await defaultGreenroomDir(repo, env)))
+        : repo;
     const written = [];
     const skipped = [];
     // Baselines for the files this run actually wrote. A skipped file gets no
@@ -1412,11 +1618,12 @@ export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.
             return;
         regionBaselines[key] = regionHashes(parsed.regions);
     };
+    const rels = await scaffoldFiles(srcDir);
     try {
-        const existing = await readManifest(repo);
-        for (const rel of await scaffoldFiles(srcDir)) {
+        const existing = await readManifest(configRoot);
+        for (const rel of rels) {
             const key = manifestKey(rel);
-            const to = join(repo, rel);
+            const to = join(configRoot, rel);
             const content = await readFile(join(srcDir, rel), "utf8");
             const templateHash = hashContent(content);
             if (!force && (await pathExists(to))) {
@@ -1440,18 +1647,29 @@ export async function cmdInit(argv, streams, cwd = process.cwd(), env = process.
             baselines[key] = templateHash;
             recordRegions(key, content);
         }
-        await writeManifest(repo, mergeManifest(existing, template, VERSION, baselines, regionBaselines));
+        await writeManifest(configRoot, mergeManifest(existing, template, VERSION, baselines, regionBaselines));
     }
     catch (error) {
         streams.err(`init failed: ${error instanceof Error ? error.message : String(error)}\n`);
         return 1;
     }
-    streams.out(`initialized ${template} in ${repo}: wrote ${written.length} file(s)`);
+    streams.out(`initialized ${template} in ${configRoot}: wrote ${written.length} file(s)`);
     if (skipped.length > 0) {
         streams.out(`, kept ${skipped.length} existing (${skipped.join(", ")}; use --force to overwrite)`);
     }
     streams.out("\n");
-    await registerGhostrail(repo, env, streams);
+    if (greenroom) {
+        // A repo set up before switching to a greenroom (or by a plain `init`
+        // moments ago) has its own copies now superseded by configRoot: this is
+        // the "switch to it later" path, distinguished from "from the start" only
+        // by whether there was anything here to remove.
+        await removeLocalScaffold(repo, rels);
+        await writeFile(join(repo, GREENROOM_POINTER_FILE), `${configRoot}\n`, "utf8");
+        streams.out(`wrote ${join(repo, GREENROOM_POINTER_FILE)}, pointing at ${configRoot}\n`);
+        streams.out("this repo's config and prompts now live outside it; keep that pointer file out of\n" +
+            "version control (it is host-specific), the same as .ghostrail.env\n");
+    }
+    await registerGhostrail(repo, env, streams, register);
     streams.out(await initNextStepsHint(env, cwd));
     return 0;
 }