memorix 1.2.1 → 1.2.3

package/src/cli/commands/operator-shared.ts

@@ -3,16 +3,33 @@ import { getProjectDataDir } from '../../store/persistence.js';
 import { initObservations, prepareSearchIndex } from '../../memory/observations.js';
 import { initSessionStore } from '../../store/session-store.js';
 import { initTeamStore, type TeamStore } from '../../team/team-store.js';
-import type { ProjectInfo, ObservationType, ObservationStatus } from '../../types.js';
+import type {
+  ProjectInfo,
+  ObservationReader,
+  ObservationStatus,
+  ObservationType,
+  ObservationVisibility,
+} from '../../types.js';
+import { getCliInvocation } from '../invocation.js';
+import { resolveCliIdentity, type CliIdentity } from '../identity.js';
 
 export interface CliProjectContext {
   project: ProjectInfo;
   dataDir: string;
   teamStore: TeamStore;
+  reader: ObservationReader;
+  identity: CliIdentity | null;
+  identityWarning?: string;
 }
 
 export async function getCliProjectContext(options?: { searchIndex?: boolean; projectRoot?: string }): Promise<CliProjectContext> {
-  const detection = detectProjectWithDiagnostics(options?.projectRoot ?? process.cwd());
+  const invocation = getCliInvocation();
+  const detection = detectProjectWithDiagnostics(
+    options?.projectRoot
+      ?? invocation.projectRoot
+      ?? process.env.MEMORIX_PROJECT_ROOT
+      ?? process.cwd(),
+  );
   if (!detection.project) {
     const detail = detection.failure?.detail ?? 'No git repository found in the current directory.';
     throw new Error(detail);
@@ -20,6 +37,16 @@ export async function getCliProjectContext(options?: { searchIndex?: boolean; pr
 
   const project = detection.project;
   const dataDir = await getProjectDataDir(project.id);
+  try {
+    const { MaintenanceTargetStore } = await import('../../runtime/maintenance-targets.js');
+    new MaintenanceTargetStore(dataDir).register({
+      projectId: project.id,
+      projectRoot: project.rootPath,
+      dataDir,
+    });
+  } catch {
+    // CLI reads remain available even if optional background maintenance metadata fails.
+  }
   await initObservations(dataDir);
   await initSessionStore(dataDir);
   const teamStore = await initTeamStore(dataDir);
@@ -28,7 +55,21 @@ export async function getCliProjectContext(options?: { searchIndex?: boolean; pr
     await prepareSearchIndex();
   }
 
-  return { project, dataDir, teamStore };
+  const identity = await resolveCliIdentity({
+    project,
+    dataDir,
+    teamStore,
+    explicitActorId: invocation.actorId,
+  });
+
+  return {
+    project,
+    dataDir,
+    teamStore,
+    reader: identity.reader,
+    identity: identity.identity,
+    ...(identity.warning ? { identityWarning: identity.warning } : {}),
+  };
 }
 
 export function emitResult<T>(data: T, text: string, asJson?: boolean): void {
@@ -108,3 +149,57 @@ export function coerceObservationStatus(input?: string): ObservationStatus {
   }
   return normalized;
 }
+
+export function coerceObservationVisibility(input?: string): ObservationVisibility {
+  const normalized = (input ?? 'project').trim().toLowerCase();
+  if (normalized === 'personal' || normalized === 'project' || normalized === 'team') {
+    return normalized;
+  }
+  throw new Error('visibility must be personal, project, or team');
+}
+
+/**
+ * Project scope is deliberately the default. Private and team-scoped records
+ * require an identity selected by the operator, so a plain shell does not
+ * accidentally gain access to another agent's work.
+ */
+export function resolveCliWriteScope(
+  context: Pick<CliProjectContext, 'identity' | 'reader'>,
+  visibilityInput?: string,
+): {
+  visibility: ObservationVisibility;
+  createdByAgentId?: string;
+  visibilityReader: ObservationReader;
+} {
+  const visibility = coerceObservationVisibility(visibilityInput);
+  if (visibility !== 'project' && !context.identity) {
+    throw new Error(
+      `visibility=${visibility} requires an active CLI identity. Run "memorix identity join --agent-type <agent>" or "memorix identity use --agent-id <id>" first.`,
+    );
+  }
+  if (visibility === 'team' && context.reader.isTeamMember !== true) {
+    throw new Error('team visibility requires an active coordination identity for this project.');
+  }
+
+  return {
+    visibility,
+    ...(context.identity ? { createdByAgentId: context.identity.agentId } : {}),
+    visibilityReader: context.reader,
+  };
+}
+
+/**
+ * Coordination commands can use the current CLI identity implicitly, while
+ * retaining explicit IDs for scripts and backwards-compatible invocations.
+ */
+export function resolveCliActorId(
+  explicitValue: unknown,
+  identity: CliIdentity | null,
+  field = 'agentId',
+): string | undefined {
+  const explicit = typeof explicitValue === 'string' ? explicitValue.trim() : '';
+  if (identity && explicit && explicit !== identity.agentId) {
+    throw new Error(`${field} does not match the active CLI identity. Use "memorix identity clear" before acting as a different agent.`);
+  }
+  return explicit || identity?.agentId;
+}

package/src/cli/commands/poll.ts

@@ -3,7 +3,8 @@ import { computePoll, computeWatermark } from '../../team/poll.js';
 import { getObservationStore } from '../../store/obs-store.js';
 import { getAllObservations } from '../../memory/observations.js';
 import { withFreshIndex } from '../../memory/freshness.js';
-import { emitError, emitResult, getCliProjectContext, shortId } from './operator-shared.js';
+import { filterReadableObservations } from '../../memory/visibility.js';
+import { emitError, emitResult, getCliProjectContext, resolveCliActorId, shortId } from './operator-shared.js';
 
 export default defineCommand({
   meta: {
@@ -19,22 +20,31 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project, teamStore } = await getCliProjectContext();
-      const agentId = args.agentId as string | undefined;
+      const { project, teamStore, identity, reader: activeReader } = await getCliProjectContext();
+      const agentId = resolveCliActorId(args.agentId, identity);
+      let reader = activeReader;
 
       let watermark = computeWatermark(0, 0, 0);
       if (agentId) {
         const agent = teamStore.getAgent(agentId);
-        if (!agent) {
+        if (!agent || agent.project_id !== project.id) {
           emitError(`Unknown agent "${agentId}"`, asJson);
           return;
         }
+        reader = {
+          projectId: project.id,
+          agentId,
+          isTeamMember: agent.status === 'active',
+        };
 
         const lastSeen = agent.last_seen_obs_generation;
         const currentGen = getObservationStore().getGeneration();
         const projectObs = await withFreshIndex(() =>
-          getAllObservations().filter(
-            (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+          filterReadableObservations(
+            getAllObservations().filter(
+              (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+            ),
+            reader,
           ),
         );
         watermark = computeWatermark(lastSeen, currentGen, projectObs.length);

package/src/cli/commands/reasoning.ts

@@ -1,7 +1,14 @@
 import { defineCommand } from 'citty';
 import { compactSearch } from '../../compact/engine.js';
 import { storeObservation } from '../../memory/observations.js';
-import { emitError, emitResult, getCliProjectContext, parseCsvList, parsePositiveInt } from './operator-shared.js';
+import {
+  emitError,
+  emitResult,
+  getCliProjectContext,
+  parseCsvList,
+  parsePositiveInt,
+  resolveCliWriteScope,
+} from './operator-shared.js';
 
 export default defineCommand({
   meta: {
@@ -20,6 +27,7 @@ export default defineCommand({
     files: { type: 'string', description: 'Comma-separated file list' },
     relatedCommits: { type: 'string', description: 'Comma-separated related commit hashes' },
     relatedEntities: { type: 'string', description: 'Comma-separated related entity names' },
+    visibility: { type: 'string', description: 'Reasoning visibility: project (default), personal, or team' },
     query: { type: 'string', description: 'Search query for reasoning traces' },
     limit: { type: 'string', description: 'Search result limit' },
     scope: { type: 'string', description: 'project or global scope for search' },
@@ -30,7 +38,7 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project } = await getCliProjectContext({ searchIndex: action === 'search' });
+      const { project, reader, identity } = await getCliProjectContext({ searchIndex: action === 'search' });
 
       switch (action) {
         case 'store': {
@@ -63,6 +71,10 @@ export default defineCommand({
           if (risks.length > 0) {
             narrativeParts.push(`Risks: ${risks.join('; ')}`);
           }
+          const writeScope = resolveCliWriteScope(
+            { reader, identity },
+            args.visibility as string | undefined,
+          );
 
           const result = await storeObservation({
             entityName,
@@ -84,6 +96,7 @@ export default defineCommand({
             relatedEntities,
             projectId: project.id,
             source: 'manual',
+            ...writeScope,
           });
 
           emitResult(
@@ -108,6 +121,7 @@ export default defineCommand({
             type: 'reasoning',
             projectId: scope === 'global' ? undefined : project.id,
             status: 'active',
+            reader: scope === 'global' ? {} : reader,
           });
           emitResult(
             { project, scope, entries: result.entries },
@@ -121,7 +135,7 @@ export default defineCommand({
           console.log('Memorix Reasoning Commands');
           console.log('');
           console.log('Usage:');
-          console.log('  memorix reasoning store --entity auth --decision "Use SQLite" --rationale "..."');
+          console.log('  memorix reasoning store --entity auth --decision "Use SQLite" --rationale "..." [--visibility project|personal|team]');
           console.log('  memorix reasoning search --query "why sqlite" [--scope project|global --limit 10]');
       }
     } catch (error) {

package/src/cli/commands/retention.ts

@@ -1,6 +1,7 @@
 import { defineCommand } from 'citty';
 import { getAllObservations } from '../../memory/observations.js';
 import { archiveExpired, explainRetention, getArchiveCandidates, getRetentionSummary, getRetentionZone, rankByRelevance } from '../../memory/retention.js';
+import { filterReadableObservations } from '../../memory/visibility.js';
 import type { MemorixDocument } from '../../types.js';
 import { emitError, emitResult, getCliProjectContext } from './operator-shared.js';
 
@@ -24,6 +25,8 @@ function toDocument(obs: Awaited<ReturnType<typeof getAllObservations>>[number])
     source: obs.source ?? 'agent',
     sourceDetail: obs.sourceDetail ?? '',
     valueCategory: obs.valueCategory ?? '',
+    admissionState: obs.admissionState ?? '',
+    admissionReason: obs.admissionReason ?? '',
   };
 }
 
@@ -40,9 +43,11 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project, dataDir } = await getCliProjectContext();
-      const activeDocs = getAllObservations()
-        .filter((obs) => obs.projectId === project.id && (obs.status ?? 'active') === 'active')
+      const { project, dataDir, reader } = await getCliProjectContext();
+      const activeDocs = filterReadableObservations(
+        getAllObservations().filter((obs) => obs.projectId === project.id && (obs.status ?? 'active') === 'active'),
+        reader,
+      )
         .map(toDocument);
 
       switch (action) {
@@ -65,7 +70,7 @@ export default defineCommand({
         }
 
         case 'archive': {
-          const result = await archiveExpired(dataDir, undefined, undefined, project.id);
+          const result = await archiveExpired(dataDir, undefined, undefined, project.id, reader);
           emitResult(
             { project, result },
             result.archived === 0

package/src/cli/commands/serve-http.ts

@@ -24,6 +24,7 @@ import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { ObservationStore } from '../../store/obs-store.js';
 import { resolveToolProfile } from '../../server/tool-profile.js';
 import { scopeKnowledgeGraphToProject } from '../../memory/graph-scope.js';
+import { canManageObservation, filterReadableObservations } from '../../memory/visibility.js';
 
 export const DEFAULT_SESSION_TIMEOUT_MS = 30 * 60 * 1000;
 
@@ -558,7 +559,7 @@ export default defineCommand({
 
     async function loadDashboardObservations(dataDir: string) {
       const store = await getDashboardObservationStore(dataDir);
-      return store.loadAll();
+      return filterReadableObservations(await store.loadAll(), {});
     }
 
     async function loadDashboardProjectObservations(
@@ -567,7 +568,10 @@ export default defineCommand({
       status?: string,
     ) {
       const store = await getDashboardObservationStore(dataDir);
-      return store.loadByProject(projectId, status ? { status } : undefined);
+      return filterReadableObservations(
+        await store.loadByProject(projectId, status ? { status } : undefined),
+        { projectId },
+      );
     }
 
     // Resolve static directory (dist/dashboard/static)
@@ -1321,6 +1325,8 @@ export default defineCommand({
             sendJson({ error: 'Observation not found' }, 404);
           } else if ((matchObs as any).projectId !== delProjectId) {
             sendJson({ error: `Observation #${obsId} belongs to project "${(matchObs as any).projectId}", not "${delProjectId}"` }, 403);
+          } else if (!canManageObservation(matchObs, { projectId: delProjectId })) {
+            sendJson({ error: `Observation #${obsId} is not manageable from the unbound dashboard.` }, 403);
           } else {
             await store.remove(obsId);
             // Sync: clean up graph entity references

package/src/cli/commands/session.ts

@@ -5,6 +5,8 @@ import { computeWatermark } from '../../team/poll.js';
 import { withFreshIndex } from '../../memory/freshness.js';
 import { getAllObservations } from '../../memory/observations.js';
 import { getObservationStore } from '../../store/obs-store.js';
+import { filterReadableObservations } from '../../memory/visibility.js';
+import { saveCliIdentity } from '../identity.js';
 import { emitError, emitResult, getCliProjectContext, parsePositiveInt } from './operator-shared.js';
 
 export default defineCommand({
@@ -18,6 +20,7 @@ export default defineCommand({
     instanceId: { type: 'string', description: 'Stable instance identity across restarts' },
     projectRoot: { type: 'string', description: 'Absolute project root used to bind the session context' },
     joinTeam: { type: 'boolean', description: 'Explicitly join orchestration coordination state for this session' },
+    use: { type: 'boolean', description: 'Make the joined coordination identity active for later CLI commands' },
     role: { type: 'string', description: 'Explicit role override used only when --joinTeam is set' },
     sessionId: { type: 'string', description: 'Custom session ID (optional)' },
     summary: { type: 'string', description: 'Structured session summary for session end' },
@@ -29,17 +32,20 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project, dataDir, teamStore } = await getCliProjectContext({
+      const { project, dataDir, teamStore, reader } = await getCliProjectContext({
         projectRoot: args.projectRoot as string | undefined,
       });
 
       switch (action) {
         case 'start': {
-          const result = await startSession(dataDir, project.id, {
-            sessionId: args.sessionId as string | undefined,
-            agent: args.agent as string | undefined,
-          });
-
+          if (args.use && !args.joinTeam) {
+            emitError('use requires --joinTeam when starting a session.', asJson);
+            return;
+          }
+          if (args.use && !args.agent && !args.agentType) {
+            emitError('use requires --agent or --agentType so Memorix can activate a coordination identity.', asJson);
+            return;
+          }
           const shouldJoinTeam = !!args.joinTeam;
           let agentRecord: ReturnType<typeof teamStore.registerAgent> | null = null;
           let teamJoinNotice: string | null = null;
@@ -61,6 +67,29 @@ export default defineCommand({
             teamJoinNotice = 'Coordination join skipped: provide --agent or --agentType to create a coordination identity.';
           }
 
+          const contextReader = agentRecord
+            ? {
+                projectId: project.id,
+                agentId: agentRecord.agent_id,
+                isTeamMember: agentRecord.status === 'active',
+              }
+            : reader;
+          const result = await startSession(dataDir, project.id, {
+            sessionId: args.sessionId as string | undefined,
+            agent: args.agent as string | undefined,
+            reader: contextReader,
+          });
+
+          let identityActivated = false;
+          if (args.use && agentRecord) {
+            await saveCliIdentity(dataDir, {
+              agentId: agentRecord.agent_id,
+              projectId: project.id,
+              activatedAt: new Date().toISOString(),
+            });
+            identityActivated = true;
+          }
+
           let watermark = computeWatermark(0, 0, 0);
           let rescuedAgentIds: string[] = [];
           let availableTasks = 0;
@@ -70,8 +99,11 @@ export default defineCommand({
             const store = getObservationStore();
             const currentGen = store.getGeneration();
             const projectObs = await withFreshIndex(() =>
-              getAllObservations().filter(
-                (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+              filterReadableObservations(
+                getAllObservations().filter(
+                  (obs) => obs.projectId === project.id && (obs.writeGeneration ?? 0) > lastSeen,
+                ),
+                { projectId: project.id, agentId: agentRecord.agent_id, isTeamMember: agentRecord.status === 'active' },
               ),
             );
             watermark = computeWatermark(lastSeen, currentGen, projectObs.length);
@@ -97,6 +129,7 @@ export default defineCommand({
               joined: !!agentRecord,
               notice: teamJoinNotice,
             },
+            identityActivated,
             watermark,
             rescue: {
               staleAgents: rescuedAgentIds,
@@ -113,6 +146,7 @@ export default defineCommand({
             agentRecord
               ? `Agent: ${agentRecord.name} [${agentRecord.agent_type}] as ${agentRecord.role} (${agentRecord.agent_id})`
               : '',
+            identityActivated ? 'CLI identity activated for follow-up memory and coordination commands.' : '',
             !agentRecord ? 'Coordination identity: not joined (memory/session context only)' : '',
             teamJoinNotice ?? '',
             agentRecord && watermark.newObservationCount > 0
@@ -152,7 +186,7 @@ export default defineCommand({
         case 'context': {
           const limit = parsePositiveInt(args.limit as string | undefined, 3);
           const [context, sessions] = await Promise.all([
-            getSessionContext(dataDir, project.id, limit),
+            getSessionContext(dataDir, project.id, limit, reader),
             listSessions(dataDir, project.id),
           ]);
           const active = sessions.filter((session) => session.status === 'active').length;
@@ -173,7 +207,7 @@ export default defineCommand({
           console.log('Memorix Session Commands');
           console.log('');
           console.log('Usage:');
-          console.log('  memorix session start [--agent codex --agentType codex --instanceId abc] [--projectRoot <path>] [--joinTeam]');
+          console.log('  memorix session start [--agent codex --agentType codex --instanceId abc] [--projectRoot <path>] [--joinTeam --use]');
           console.log('  memorix session end --sessionId <id> [--summary "..."]');
           console.log('  memorix session context [--limit 3]');
           console.log('');

package/src/cli/commands/skills.ts

@@ -1,6 +1,7 @@
 import { defineCommand } from 'citty';
 import type { AgentTarget } from '../../types.js';
 import { getObservationStore } from '../../store/obs-store.js';
+import { filterReadableObservations, resolveObservationVisibility } from '../../memory/visibility.js';
 import { emitError, emitResult, getCliProjectContext } from './operator-shared.js';
 
 export default defineCommand({
@@ -19,7 +20,7 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project } = await getCliProjectContext();
+      const { project, reader } = await getCliProjectContext();
       const { SkillsEngine } = await import('../../skills/engine.js');
       const engine = new SkillsEngine(project.rootPath);
 
@@ -37,8 +38,10 @@ export default defineCommand({
         }
 
         case 'generate': {
-          const observations = (await getObservationStore().loadAll())
-            .filter((obs) => obs.projectId === project.id)
+          const observations = filterReadableObservations(
+            await getObservationStore().loadAll(),
+            reader,
+          ).filter((observation) => resolveObservationVisibility(observation) === 'project')
             .map((obs) => ({
               id: obs.id,
               entityName: obs.entityName,
@@ -82,8 +85,10 @@ export default defineCommand({
             return;
           }
 
-          const observations = (await getObservationStore().loadAll())
-            .filter((obs) => obs.projectId === project.id)
+          const observations = filterReadableObservations(
+            await getObservationStore().loadAll(),
+            reader,
+          ).filter((observation) => resolveObservationVisibility(observation) === 'project')
             .map((obs) => ({
               id: obs.id,
               entityName: obs.entityName,

package/src/cli/commands/status.ts

@@ -39,8 +39,8 @@ export default defineCommand({
       const { initObservationStore, getObservationStore } = await import('../../store/obs-store.js');
       await initObservationStore(dataDir);
       const store = getObservationStore();
-      const data = await store.loadAll() as Array<{ projectId?: string; status?: string }>;
-      const projectObs = data.filter(o => o.projectId === project.id);
+      const { filterReadableObservations } = await import('../../memory/visibility.js');
+      const projectObs = filterReadableObservations(await store.loadAll(), { projectId: project.id });
       obsCount = projectObs.length;
       activeCount = projectObs.filter(o => (o.status ?? 'active') === 'active').length;
     } catch { /* ignore */ }
@@ -165,7 +165,8 @@ export default defineCommand({
       const { initObservationStore, getObservationStore } = await import('../../store/obs-store.js');
       await initObservationStore(dataDir);
       const store = getObservationStore();
-      const allObs = await store.loadAll() as Array<{ source?: string; type?: string }>;
+      const { filterReadableObservations } = await import('../../memory/visibility.js');
+      const allObs = filterReadableObservations(await store.loadAll(), { projectId: project.id });
       const gitCount = allObs.filter(o => o.source === 'git').length;
       const reasoningCount = allObs.filter(o => o.type === 'reasoning').length;
       if (gitCount > 0 || reasoningCount > 0) {

package/src/cli/commands/task.ts

@@ -1,5 +1,13 @@
 import { defineCommand } from 'citty';
-import { emitError, emitResult, getCliProjectContext, parseCsvList, parseOptionalJsonObject, shortId } from './operator-shared.js';
+import {
+  emitError,
+  emitResult,
+  getCliProjectContext,
+  parseCsvList,
+  parseOptionalJsonObject,
+  resolveCliActorId,
+  shortId,
+} from './operator-shared.js';
 
 export default defineCommand({
   meta: {
@@ -24,7 +32,8 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project, teamStore } = await getCliProjectContext();
+      const { project, teamStore, identity } = await getCliProjectContext();
+      const agentId = resolveCliActorId(args.agentId, identity);
 
       switch (action) {
         case 'create': {
@@ -51,7 +60,7 @@ export default defineCommand({
             description: args.description as string,
             deps: parseCsvList(args.deps as string | undefined),
             metadata,
-            createdBy: args.agentId as string | undefined,
+            createdBy: agentId,
             requiredRole: args.requiredRole as string | undefined,
             preferredRole: args.preferredRole as string | undefined,
           });
@@ -65,11 +74,11 @@ export default defineCommand({
         }
 
         case 'claim': {
-          if (!args.taskId || !args.agentId) {
-            emitError('taskId and agentId are required for "memorix task claim"', asJson);
+          if (!args.taskId || !agentId) {
+            emitError('taskId and an active CLI identity or agentId are required for "memorix task claim"', asJson);
             return;
           }
-          const result = teamStore.claimTask(args.taskId as string, args.agentId as string);
+          const result = teamStore.claimTask(args.taskId as string, agentId);
           if (!result.success) {
             emitError(result.reason ?? 'Unable to claim task', asJson);
             return;
@@ -83,11 +92,11 @@ export default defineCommand({
         }
 
         case 'complete': {
-          if (!args.taskId || !args.agentId || !args.result) {
-            emitError('taskId, agentId, and result are required for "memorix task complete"', asJson);
+          if (!args.taskId || !agentId || !args.result) {
+            emitError('taskId, result, and an active CLI identity or agentId are required for "memorix task complete"', asJson);
             return;
           }
-          const result = teamStore.completeTask(args.taskId as string, args.agentId as string, args.result as string);
+          const result = teamStore.completeTask(args.taskId as string, agentId, args.result as string);
           if (!result.success) {
             emitError(result.reason ?? 'Unable to complete task', asJson);
             return;
@@ -101,11 +110,11 @@ export default defineCommand({
         }
 
         case 'fail': {
-          if (!args.taskId || !args.agentId || !args.result) {
-            emitError('taskId, agentId, and result are required for "memorix task fail"', asJson);
+          if (!args.taskId || !agentId || !args.result) {
+            emitError('taskId, result, and an active CLI identity or agentId are required for "memorix task fail"', asJson);
             return;
           }
-          const result = teamStore.failTask(args.taskId as string, args.agentId as string, args.result as string);
+          const result = teamStore.failTask(args.taskId as string, agentId, args.result as string);
           if (!result.success) {
             emitError(result.reason ?? 'Unable to fail task', asJson);
             return;
@@ -119,11 +128,11 @@ export default defineCommand({
         }
 
         case 'release': {
-          if (!args.taskId || !args.agentId) {
-            emitError('taskId and agentId are required for "memorix task release"', asJson);
+          if (!args.taskId || !agentId) {
+            emitError('taskId and an active CLI identity or agentId are required for "memorix task release"', asJson);
             return;
           }
-          const result = teamStore.releaseTask(args.taskId as string, args.agentId as string);
+          const result = teamStore.releaseTask(args.taskId as string, agentId);
           if (!result.success) {
             emitError(result.reason ?? 'Unable to release task', asJson);
             return;
@@ -138,8 +147,8 @@ export default defineCommand({
 
         case 'list': {
           const tasks =
-            args.available && args.agentId
-              ? teamStore.listTasksForAgent(project.id, args.agentId as string)
+            args.available && agentId
+              ? teamStore.listTasksForAgent(project.id, agentId)
               : teamStore.listTasks(
                   project.id,
                   args.available

package/src/cli/commands/team.ts

@@ -1,6 +1,7 @@
 import { defineCommand } from 'citty';
 import { AGENT_TYPE_ROLE_MAP } from '../../team/team-store.js';
-import { emitError, emitResult, getCliProjectContext, parseCsvList, parsePositiveInt, shortId } from './operator-shared.js';
+import { clearCliIdentity } from '../identity.js';
+import { emitError, emitResult, getCliProjectContext, parseCsvList, parsePositiveInt, resolveCliActorId, shortId } from './operator-shared.js';
 
 export default defineCommand({
   meta: {
@@ -27,7 +28,8 @@ export default defineCommand({
     const asJson = !!args.json;
 
     try {
-      const { project, teamStore } = await getCliProjectContext();
+      const { project, dataDir, teamStore, identity } = await getCliProjectContext();
+      const selectedAgentId = resolveCliActorId(args.agentId, identity);
 
       switch (action) {
         case 'join': {
@@ -53,20 +55,22 @@ export default defineCommand({
         }
 
         case 'leave': {
-          const agentId = args.agentId as string | undefined;
-          if (!agentId) {
-            emitError('agentId is required for "memorix team leave"', asJson);
+          if (!selectedAgentId) {
+            emitError('an active CLI identity or agentId is required for "memorix team leave"', asJson);
             return;
           }
-          const left = teamStore.leaveAgent(agentId);
-          const releasedLocks = teamStore.releaseAllLocks(agentId);
-          const releasedTasks = teamStore.releaseTasksByAgent(agentId);
+          const left = teamStore.leaveAgent(selectedAgentId);
+          const releasedLocks = teamStore.releaseAllLocks(selectedAgentId);
+          const releasedTasks = teamStore.releaseTasksByAgent(selectedAgentId);
           if (!left) {
-            emitError(`Agent "${agentId}" not found`, asJson);
+            emitError(`Agent "${selectedAgentId}" not found`, asJson);
             return;
           }
+          if (identity?.agentId === selectedAgentId) {
+            await clearCliIdentity(dataDir);
+          }
           emitResult(
-            { project, agentId, releasedLocks, releasedTasks },
+            { project, agentId: selectedAgentId, releasedLocks, releasedTasks },
             `Left team: released ${releasedLocks} lock(s), ${releasedTasks} task(s)`,
             asJson,
           );