sprag-cli 3.70.0 → 3.71.0

package/src/team-ratchet.js

@@ -10,6 +10,8 @@
  *   Codex        <CODEX_HOME>/ratchet-team.md
  */
 
+import { envVar } from './env.js';
+import { CLI_ENTRY, detachedChildEnv, isDetachedChild } from './cli-entry.js';
 import * as childProcess from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -30,6 +32,7 @@ export { TEAM_RATCHET_IMPORT_RE, teamRatchetImportLine };
 
 export const TEAM_RATCHET_MARKER = '<!-- sprag:team-ratchet -->';
 const SYNC_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const IN_FLIGHT_MS = 2 * 60 * 1000;
 const TOKEN_RE = /^spt_[0-9a-f]{32}$/;
 
 export const teamStatePathFor = (dir = userDataDir()) => join(dir, 'team.json');
@@ -56,8 +59,50 @@ export function isJoined(state) {
 
 export function teamSyncDue(state, now = Date.now()) {
   if (!isJoined(state)) return false;
+  // Same rule as teamSyncDue in team-sync.js (a test pins the two together).
+  const attempt = Number(state.lastSyncAttemptAt);
+  if (Number.isFinite(attempt) && attempt > 0 && now - attempt >= 0 && now - attempt < IN_FLIGHT_MS) return false;
+  const failures = Number(state.syncFailures) || 0;
+  if (failures > 0) {
+    const delay = Math.min(15 * 60 * 1000 * 2 ** (failures - 1), 60 * 60 * 1000);
+    return !Number.isFinite(attempt) || attempt <= 0 || now - attempt >= delay;
+  }
   const at = Number(state.lastSyncAt);
-  return !Number.isFinite(at) || at <= 0 || now - at > SYNC_INTERVAL_MS;
+  return !Number.isFinite(at) || at <= 0 || now - at >= SYNC_INTERVAL_MS;
+}
+
+export const PROMPT_SYNC_INTERVAL_MS = 30 * 60 * 1000;
+export const RULES_PULL_INTERVAL_MS = 60 * 60 * 1000;
+const RULES_RETRY_MS = 15 * 60 * 1000;
+
+/**
+ * The rules-only pull (one small RPC, no ledger parsing) is due an hour after
+ * the last time rules arrived, by either kind of sync. It stays out of the way
+ * of the full sync: not while that one is in flight or backing off after a
+ * failure (its retry pulls the rules too), and not within 15 minutes of its own
+ * last attempt, which doubles as its in-flight guard and failure backoff.
+ */
+export function rulesPullDue(state, now = Date.now(), env = process.env) {
+  if (!isJoined(state) || state.pausedReported || teamSyncDisabled(env)) return false;
+  if ((Number(state.syncFailures) || 0) > 0) return false;
+  const attempt = Number(state.lastSyncAttemptAt);
+  if (Number.isFinite(attempt) && attempt > 0 && now - attempt >= 0 && now - attempt < IN_FLIGHT_MS) return false;
+  const tried = Number(state.lastRulesAttemptAt);
+  if (Number.isFinite(tried) && tried > 0 && now - tried >= 0 && now - tried < RULES_RETRY_MS) return false;
+  const last = Math.max(Number(state.lastRulesAt) || 0, Number(state.lastSyncAt) || 0);
+  return last <= 0 || now - last >= RULES_PULL_INTERVAL_MS;
+}
+
+/**
+ * Stat-free gate for the prompt uploader: joined, capture on (as last seen by a
+ * sync), uploads not switched off or reported paused, and the last prompt run is
+ * 30 minutes old. Reads nothing but the already-loaded team.json.
+ */
+export function promptSyncDue(state, now = Date.now(), env = process.env) {
+  if (!isJoined(state) || state.promptCapture !== true || state.pausedReported) return false;
+  if (teamSyncDisabled(env)) return false;
+  const at = Number(state.lastPromptSyncAt);
+  return !Number.isFinite(at) || at <= 0 || now - at >= PROMPT_SYNC_INTERVAL_MS;
 }
 
 export function autoJoinPending(state, env = process.env) {
@@ -65,7 +110,7 @@ export function autoJoinPending(state, env = process.env) {
 }
 
 export function teamSyncDisabled(env = process.env) {
-  return env.CTS_NO_TEAM_SYNC === '1';
+  return envVar('NO_TEAM_SYNC', env) === '1';
 }
 
 export function teamRatchetPath({ agent = 'claude' } = {}) {
@@ -78,19 +123,34 @@ export function renderTeamRatchet(cache, { lang = 'en', agent = 'claude' } = {})
   if (!cache || !Array.isArray(cache.rules)) return null;
   const removed = new Set(Array.isArray(cache.removed) ? cache.removed : []);
   const live = cache.rules.filter((r) => r && typeof r.text === 'string' && r.text.trim() && !removed.has(r.id));
-  const ratchet = live.filter((r) => (r.scope || 'ratchet') !== 'model');
-  const model = live.filter((r) => r.scope === 'model');
-  if (!ratchet.length && !model.length) return null;
+  if (!live.length) return null;
+  // Rows from servers older than the org layer carry no level: they are team rules.
+  const org = live.filter((r) => r.level === 'org');
+  const team = live.filter((r) => r.level !== 'org');
+  const isModel = (r) => r.scope === 'model';
   const ko = lang === 'ko' && agent !== 'codex';
   const name = cache.teamName || '';
+  const orgName = cache.orgName || '';
+  const scopeLine = ko
+    ? (orgName ? `조직 "${orgName}" 과 팀 "${name}" 에서 승인한 룰입니다.` : `팀 "${name}" 이 승인한 룰입니다.`)
+    : (orgName ? `Rules approved for organization "${orgName}" and team "${name}".` : `Rules approved by team "${name}".`);
   const head = ko
-    ? `# 팀 래칫 룰 (sprag 관리)\n\n팀 "${name}" 이 승인한 룰입니다. sprag 가 세션 시작 때 통째로 다시 쓰므로 직접 고치지 마십시오. 목록: \`sprag team rules\``
-    : `# Team Ratchet Rules (managed by sprag)\n\nRules approved by team "${name}". sprag rewrites this file at session start, so do not edit it by hand. List: \`sprag team rules\``;
+    ? `# 팀 래칫 룰 (sprag 관리)\n\n${scopeLine} sprag 가 세션 시작 때 통째로 다시 쓰므로 직접 고치지 마십시오. 목록: \`sprag team rules\``
+    : `# Team Ratchet Rules (managed by sprag)\n\n${scopeLine} sprag rewrites this file at session start, so do not edit it by hand. List: \`sprag team rules\``;
+  const H = ko
+    ? { org: '조직 룰', orgModel: '조직 모델 룰', team: '팀 룰', teamModel: '팀 모델 룰' }
+    : { org: 'Organization rules', orgModel: 'Organization model rules', team: 'Team rules', teamModel: 'Team model rules' };
   const line = (r) => `- ${r.text.trim().replace(/\s*\n\s*/g, ' ')}`;
-  let out = `${TEAM_RATCHET_MARKER}\n${head}\n`;
-  if (ratchet.length) out += `\n## Rules\n\n${ratchet.map(line).join('\n')}\n`;
-  if (model.length) out += `\n## Model rules\n\n${model.map(line).join('\n')}\n`;
-  return out;
+  const section = (rows, title, modelTitle) => {
+    if (!rows.length) return '';
+    const plain = rows.filter((r) => !isModel(r));
+    const model = rows.filter(isModel);
+    let s = `\n## ${title}\n`;
+    if (plain.length) s += `\n${plain.map(line).join('\n')}\n`;
+    if (model.length) s += `\n### ${modelTitle}\n\n${model.map(line).join('\n')}\n`;
+    return s;
+  };
+  return `${TEAM_RATCHET_MARKER}\n${head}\n${section(org, H.org, H.orgModel)}${section(team, H.team, H.teamModel)}`;
 }
 
 function writeIfChanged(file, text) {
@@ -149,13 +209,26 @@ export function ensureTeamImport() {
 
 export function spawnTeamSyncIfDue({
   state = readTeamState(), now = Date.now(), env = process.env,
-  spawn = childProcess.spawn, argv = process.argv, execPath = process.execPath,
+  spawn = childProcess.spawn, cliPath = CLI_ENTRY, execPath = process.execPath,
 } = {}) {
-  if (teamSyncDisabled(env)) return false;
-  if (!autoJoinPending(state, env) && !teamSyncDue(state, now)) return false;
+  if (isDetachedChild(env)) return false;
+  // Switched off: spawn once more only to report the pause (team-sync.js).
+  // Switched back on after a reported pause: spawn now to report the resume.
+  // Otherwise the full sync when it is due, else the hourly rules-only pull.
+  let flags;
+  if (teamSyncDisabled(env)) {
+    if (!isJoined(state) || state.pausedReported) return false;
+    flags = ['--background'];
+  } else if (autoJoinPending(state, env) || teamSyncDue(state, now) || (isJoined(state) && state.pausedReported)) {
+    flags = ['--background'];
+  } else if (rulesPullDue(state, now, env)) {
+    flags = ['--background', '--rules-only'];
+  } else {
+    return false;
+  }
   try {
-    spawn(execPath, [argv[1], 'team', 'sync', '--background'],
-      { detached: true, stdio: 'ignore', windowsHide: true }).unref();
+    spawn(execPath, [cliPath, 'team', 'sync', ...flags],
+      { detached: true, stdio: 'ignore', windowsHide: true, env: detachedChildEnv(env) }).unref();
     return true;
   } catch (e) {
     debug('team-ratchet:spawn', e);
@@ -163,6 +236,33 @@ export function spawnTeamSyncIfDue({
   }
 }
 
+/**
+ * Called from the per-prompt hooks: one small team.json read, no network and no
+ * parsing here. When the ledger/rules sync is due (6 hours after the last success,
+ * or its failure backoff elapsed), start the detached `team sync --background`
+ * child; else, when only the prompt upload is due, start it in prompts-only
+ * mode; else, when only the hourly rules pull is due, start it in rules-only
+ * mode. Prints nothing.
+ */
+export function spawnTeamSyncOnPrompt({
+  state = readTeamState(), now = Date.now(), env = process.env,
+  spawn = childProcess.spawn, cliPath = CLI_ENTRY, execPath = process.execPath,
+} = {}) {
+  if (isDetachedChild(env) || teamSyncDisabled(env) || !isJoined(state)) return false;
+  let flags;
+  if (teamSyncDue(state, now)) flags = ['--background'];
+  else if (promptSyncDue(state, now, env)) flags = ['--background', '--prompts-only'];
+  else if (rulesPullDue(state, now, env)) flags = ['--background', '--rules-only'];
+  else return false;
+  try {
+    spawn(execPath, [cliPath, 'team', 'sync', ...flags], { detached: true, stdio: 'ignore', windowsHide: true, env: detachedChildEnv(env) }).unref();
+    return true;
+  } catch (e) {
+    debug('team-ratchet:spawn-prompt-hook', e);
+    return false;
+  }
+}
+
 export function autoJoinNoticeBlock(dir = userDataDir(), lang = userLanguage()) {
   const file = teamStatePathFor(dir);
   const state = readJson(file);

package/src/team-sync.js

@@ -9,26 +9,42 @@
  *
  * Files in the user data dir:
  *   team.json        membership state (mode 0600; holds the member key)
- *   team-rules.json  last pulled team rules
+ *   team-rules.json  last pulled rules (organization rules first, then team
+ *                    rules; each row carries level 'org' or 'team')
  *
- * Opt out of all network traffic with CTS_NO_TEAM_SYNC=1.
+ * Rules arrive with every full sync (6 hours) and with the rules-only pull
+ * (`team sync --rules-only`, at most hourly). Either kind rewrites the ratchet
+ * files right away, so a new session picks the rules up without waiting for
+ * the next session-start render.
+ *
+ * Opt out of all network traffic with SPRAG_NO_TEAM_SYNC=1.
  */
 
+import { envVar } from './env.js';
 import { readFileSync, existsSync, rmSync, chmodSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import { join } from 'node:path';
-import { userInfo } from 'node:os';
+import { userInfo, release as osRelease } from 'node:os';
 import { createRequire } from 'node:module';
 import { userDataDir } from './paths.js';
 import { writeStateFile } from './state-file.js';
 import { debug } from './debug.js';
 import { loadLedger, modelFamily, roundUsd } from './savings-ledger.js';
 import { sessionCost, pricedParts } from './claude-price.js';
+import { uploadPrompts, dropOffsets, promptOffsetsExist } from './team-prompts.js';
+import { rulesPullDue, syncTeamRatchet, ensureTeamImport } from './team-ratchet.js';
+import { codexUserDir } from './agent.js';
+
+export const PROMPT_SYNC_INTERVAL_MS = 30 * 60 * 1000;
 
 const require = createRequire(import.meta.url);
 
 export const TEAM_API_URL = 'https://hiycfjwswtkixyoqkznm.supabase.co';
 // Public anon key (role=anon). Access is gated by the RPCs, not by this value.
 export const TEAM_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImhpeWNmandzd3RraXh5b3Frem5tIiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTIyNTc4MzYsImV4cCI6MjEwNzgzMzgzNn0.gyYcvGD70CEX64aGV-dsmZgmmOBdvhJlzIpx9Qo2l3w';
+// Local testing only: SPRAG_TEAM_API_URL + SPRAG_TEAM_ANON_KEY point the client at a local stack.
+export const teamApiUrl = (env = process.env) => envVar('TEAM_API_URL', env) || TEAM_API_URL;
+export const teamAnonKey = (env = process.env) => envVar('TEAM_ANON_KEY', env) || TEAM_ANON_KEY;
 export const TEAM_SYNC_INTERVAL_MS = 6 * 60 * 60 * 1000;
 export const TEAM_STATE_VERSION = 1;
 
@@ -55,15 +71,85 @@ export function saveTeamState(state, dir = userDataDir()) {
   }
 }
 
-export function teamSyncDisabled(env = process.env) { return env.CTS_NO_TEAM_SYNC === '1'; }
+export function teamSyncDisabled(env = process.env) { return envVar('NO_TEAM_SYNC', env) === '1'; }
 export function isJoined(state) { return !!(state && state.memberKey && !state.left); }
 
+/** Prompt uploads run on their own 30-minute timer, only while capture is on. */
+export function promptSyncDue(state, now = Date.now()) {
+  return isJoined(state) && state.promptCapture === true && !state.pausedReported
+    && (!state.lastPromptSyncAt || now - state.lastPromptSyncAt >= PROMPT_SYNC_INTERVAL_MS);
+}
+
+export const LEDGER_RETRY_BASE_MS = 15 * 60 * 1000;
+export const LEDGER_RETRY_MAX_MS = 60 * 60 * 1000;
+const IN_FLIGHT_MS = 2 * 60 * 1000;
+export const LEDGER_WINDOW_DAYS = 30;
+
+/** Retry delay after n consecutive failed ledger syncs: 15, 30, 60 minutes, then 60. */
+export function ledgerRetryDelayMs(failures) {
+  const n = Math.max(1, Math.floor(Number(failures) || 1));
+  return Math.min(LEDGER_RETRY_BASE_MS * 2 ** (n - 1), LEDGER_RETRY_MAX_MS);
+}
+
+/**
+ * The ledger/rules sync is due every 6 hours after the last SUCCESS, or, after a
+ * failure, when the backoff since the last attempt has elapsed. An attempt that
+ * began less than 2 minutes ago counts as in flight, so two hooks do not both spawn.
+ */
 export function teamSyncDue(state, now = Date.now()) {
-  return isJoined(state) && (!state.lastSyncAt || now - state.lastSyncAt >= TEAM_SYNC_INTERVAL_MS);
+  if (!isJoined(state)) return false;
+  const attempt = Number(state.lastSyncAttemptAt);
+  if (Number.isFinite(attempt) && attempt > 0 && now - attempt >= 0 && now - attempt < IN_FLIGHT_MS) return false;
+  const failures = Number(state.syncFailures) || 0;
+  if (failures > 0) return !Number.isFinite(attempt) || attempt <= 0 || now - attempt >= ledgerRetryDelayMs(failures);
+  return !state.lastSyncAt || now - state.lastSyncAt >= TEAM_SYNC_INTERVAL_MS;
+}
+
+/**
+ * Which local days a ledger sync uploads: from the day before the watermark (that
+ * day was still open when it was uploaded) through today, at most 30 days. With
+ * no watermark, the last 30 days.
+ */
+export function ledgerWindow(state, now = Date.now()) {
+  const today = new Date(now);
+  const earliest = new Date(today.getFullYear(), today.getMonth(), today.getDate() - (LEDGER_WINDOW_DAYS - 1));
+  let start = earliest;
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(String(state?.ledgerSyncedThrough || ''));
+  if (m) {
+    const from = new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3]) - 1);
+    if (from > earliest) start = from;
+  }
+  const startKey = dayKey(start.getTime());
+  // aggregateDaily cuts by time, so ask for a little more and filter by day below
+  const days = Math.ceil((now - start.getTime()) / 86400000) + 1;
+  return { startKey, days };
+}
+
+/**
+ * The preset bundle version this machine runs (0 for the bundled presets), so
+ * the /ops console can show how far a published version has rolled out. A
+ * server without the preset_version argument (before 20261018001400_presets)
+ * answers "Could not find the function"; the upload is then repeated without it.
+ */
+async function ledgerUpsert({ memberKey, rows, version, dir, fetch }) {
+  const params = { member_key: memberKey, rows, sprag_version: version || '' };
+  let presetVersion = null;
+  try {
+    const { presetSource } = await import('./presets-source.js');
+    const s = presetSource({ dir });
+    presetVersion = s.kind === 'remote' ? s.version : 0;
+  } catch (e) { debug('team-sync:preset-version', e); }
+  if (presetVersion == null) return rpc('ledger_upsert', params, { fetch });
+  try {
+    return await rpc('ledger_upsert', { ...params, preset_version: presetVersion }, { fetch });
+  } catch (e) {
+    if (!/preset_version|Could not find the function|PGRST202/i.test(String(e && e.message))) throw e;
+    return rpc('ledger_upsert', params, { fetch });
+  }
 }
 
 export async function rpc(fn, params, {
-  fetch = globalThis.fetch, timeoutMs = 8000, url = TEAM_API_URL, key = TEAM_ANON_KEY,
+  fetch = globalThis.fetch, timeoutMs = 8000, url = teamApiUrl(), key = teamAnonKey(),
 } = {}) {
   const ctl = new AbortController();
   const timer = setTimeout(() => ctl.abort(), timeoutMs);
@@ -95,7 +181,7 @@ export async function rpc(fn, params, {
  * as rpc(). Errors carry the server's own message. The access token only ever
  * lives in memory: it is never written to disk or printed.
  */
-async function apiJson(path, { body, accessToken, label, fetch = globalThis.fetch, timeoutMs = 8000, url = TEAM_API_URL, key = TEAM_ANON_KEY, prefer } = {}) {
+async function apiJson(path, { body, accessToken, label, fetch = globalThis.fetch, timeoutMs = 8000, url = teamApiUrl(), key = teamAnonKey(), prefer } = {}) {
   const ctl = new AbortController();
   const timer = setTimeout(() => ctl.abort(), timeoutMs);
   try {
@@ -130,16 +216,36 @@ export async function verifySignInCode({ email, code, fetch } = {}) {
   return { accessToken: r.access_token, userId: r.user.id };
 }
 
-/** Insert a team owned by the signed-in user (RLS allows the owner insert). */
-export async function createTeam({ name, accessToken, userId, fetch } = {}) {
-  const r = await apiJson('/rest/v1/teams', {
-    body: { name, owner_uid: userId }, accessToken, prefer: 'return=representation', label: 'create team', fetch,
+/**
+ * Create a team through the team_create RPC as the signed-in user. A null orgId
+ * makes the server open a new organization named after the team; otherwise the
+ * caller must be an owner or admin of that organization. userId is accepted for
+ * call-site compatibility; the server derives the owner from the session.
+ */
+export async function createTeam({ name, accessToken, userId, orgId = null, fetch } = {}) {
+  void userId;
+  const r = await apiJson('/rest/v1/rpc/team_create', {
+    body: { p_name: name, p_org_id: orgId || null }, accessToken, label: 'create team', fetch,
   });
   const row = Array.isArray(r) ? r[0] : r;
   if (!row || !row.invite_token) throw new Error('create team: no invite token returned');
-  return { id: row.id, name: row.name, inviteToken: row.invite_token, plan: row.plan };
+  return {
+    id: row.id, name: row.name, inviteToken: row.invite_token, plan: row.plan,
+    orgId: row.org_id || null, orgName: row.org_name || null,
+  };
 }
 
+/** Typed error for the server's 'seat limit reached' refusal (code SEAT_LIMIT). */
+export class SeatLimitError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'SeatLimitError';
+    this.code = 'SEAT_LIMIT';
+  }
+}
+
+export const isSeatLimitError = (e) => !!e && (e.code === 'SEAT_LIMIT' || /seat limit reached/i.test(String(e.message || '')));
+
 /** Local calendar day, same key as stats.js. */
 function dayKey(ms) {
   const d = new Date(ms);
@@ -224,14 +330,73 @@ export async function aggregateDaily({ now = Date.now(), dir = userDataDir(), da
     }));
 }
 
+// Device info: OS name, OS version and CPU architecture. Nothing that names the
+// machine (no hostname, username or path) is read or sent.
+const DARWIN_TO_MACOS = { 20: '11', 21: '12', 22: '13', 23: '14', 24: '15', 25: '26' };
+
+export function deviceInfo({
+  platform = process.platform, arch = process.arch, release = osRelease(),
+  exec = (cmd, args) => execFileSync(cmd, args, { timeout: 2000, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }),
+  readText = (f) => readFileSync(f, 'utf8'),
+} = {}) {
+  let os = String(platform);
+  let osVersion = String(release || '');
+  try {
+    if (platform === 'darwin') {
+      os = 'macOS';
+      let v = '';
+      try { v = String(exec('sw_vers', ['-productVersion'])).trim(); } catch (e) { debug('team-sync', e); }
+      osVersion = v || DARWIN_TO_MACOS[parseInt(release, 10)] || osVersion;
+    } else if (platform === 'win32') {
+      os = 'Windows';
+      const build = parseInt(String(release).split('.')[2], 10);
+      osVersion = build >= 22000 ? '11' : '10';
+    } else if (platform === 'linux') {
+      os = 'Linux';
+      try {
+        const text = readText('/etc/os-release');
+        const get = (k) => (text.match(new RegExp(`^${k}=(.*)$`, 'm')) || [])[1]?.trim().replace(/^"|"$/g, '');
+        // NAME + VERSION_ID ("Ubuntu", "24.04"): the dashboard prints them
+        // side by side, and PRETTY_NAME already carries the version.
+        const name = get('NAME') || get('PRETTY_NAME');
+        if (name) { os = name; osVersion = get('VERSION_ID') || osVersion; }
+      } catch (e) { debug('team-sync', e); }
+    }
+  } catch (e) { debug('team-sync', e); }
+  return { os: os.slice(0, 40), os_version: osVersion.slice(0, 40), arch: String(arch).slice(0, 40) };
+}
+
+// Reports device info once after a join and again only when it changes. Fails
+// soft: the next sync retries. Never runs while uploads are switched off.
+export async function reportDeviceInfo({ state, dir = userDataDir(), fetch, env = process.env } = {}) {
+  if (teamSyncDisabled(env) || !isJoined(state)) return state;
+  const info = deviceInfo();
+  if (state.deviceInfo && JSON.stringify(state.deviceInfo) === JSON.stringify(info)) return state;
+  try {
+    await rpc('member_set_info', { member_key: state.memberKey, ...info }, { fetch });
+    const next = { ...state, deviceInfo: info };
+    saveTeamState(next, dir);
+    return next;
+  } catch (e) {
+    debug('team-sync', e);
+    return state;
+  }
+}
+
 export async function joinTeam({
-  token, displayName, agent = 'claude', autoJoined = false, fetch, dir = userDataDir(), version, now = Date.now(),
+  token, displayName, agent = 'claude', autoJoined = false, fetch, dir = userDataDir(), version, now = Date.now(), env = process.env,
 } = {}) {
   if (!TOKEN_RE.test(String(token || ''))) throw new Error('invalid invite token (expected spt_ + 32 hex characters)');
   const name = String(displayName || '').trim() || 'member';
-  const r = await rpc('team_join', {
-    invite_token: token, display_name: name, agent, sprag_version: version || '', auto_joined: !!autoJoined,
-  }, { fetch });
+  let r;
+  try {
+    r = await rpc('team_join', {
+      invite_token: token, display_name: name, agent, sprag_version: version || '', auto_joined: !!autoJoined,
+    }, { fetch });
+  } catch (e) {
+    if (isSeatLimitError(e)) throw new SeatLimitError(e.message);
+    throw e;
+  }
   if (!r || !r.member_key) throw new Error('team_join: no member key returned');
   const state = {
     version: TEAM_STATE_VERSION,
@@ -240,6 +405,10 @@ export async function joinTeam({
     memberId: r.member_id,
     memberKey: r.member_key,
     plan: r.plan,
+    orgId: r.org_id || null,
+    orgName: r.org_name || null,
+    seatsUsed: Number.isFinite(r.seats_used) ? r.seats_used : null,
+    seatLimit: Number.isFinite(r.seat_limit) ? r.seat_limit : null,
     promptCapture: !!r.prompt_capture,
     displayName: name,
     agent,
@@ -250,7 +419,7 @@ export async function joinTeam({
     lastSyncRows: 0,
   };
   saveTeamState(state, dir);
-  return state;
+  return reportDeviceInfo({ state, dir, fetch, env });
 }
 
 export async function leaveTeam({ fetch, dir = userDataDir(), now = Date.now() } = {}) {
@@ -267,38 +436,167 @@ export async function leaveTeam({ fetch, dir = userDataDir(), now = Date.now() }
   return next;
 }
 
+/**
+ * Pull the approved rules and write team-rules.json. Rows are kept as the
+ * server sends them, `level` included. Returns the RPC body and the rule rows.
+ */
+async function pullRules({ memberKey, dir, fetch, now }) {
+  const r = (await rpc('team_rules_get', { member_key: memberKey }, { fetch })) || {};
+  const rules = Array.isArray(r.rules) ? r.rules : [];
+  writeStateFile(teamRulesCachePath(dir), JSON.stringify({
+    version: 1, fetchedAt: now, teamId: r.team_id, teamName: r.team_name, orgId: r.org_id || null, orgName: r.org_name || null,
+    plan: r.plan, promptCapture: !!r.prompt_capture, rules, removed: Array.isArray(r.removed) ? r.removed : [],
+  }, null, 2) + '\n');
+  return { r, rules };
+}
+
+/** State fields a rules pull refreshes. */
+function withRulesMeta(state, r, now) {
+  const next = { ...state, lastRulesAt: now };
+  if (r.team_name) next.teamName = r.team_name;
+  if (r.plan) next.plan = r.plan;
+  if (r.org_name) next.orgName = r.org_name;
+  if (r.prompt_capture !== undefined) next.promptCapture = !!r.prompt_capture;
+  delete next.lastRulesError;
+  return next;
+}
+
+/**
+ * Re-render the ratchet files from the fresh cache, for Claude Code and, when
+ * its home exists, Codex, and keep the CLAUDE.md import in step. Fails soft:
+ * the session-start hook renders them again anyway.
+ */
+export function refreshTeamRatchetFiles({ dir = userDataDir() } = {}) {
+  const out = {};
+  for (const agent of ['claude', 'codex']) {
+    if (agent === 'codex' && !existsSync(codexUserDir())) continue;
+    try { out[agent] = syncTeamRatchet({ agent, dir }); } catch (e) { debug('team-sync:ratchet', e); }
+  }
+  try { ensureTeamImport(); } catch (e) { debug('team-sync:import', e); }
+  return out;
+}
+
 export async function syncTeam({
-  now = Date.now(), dir = userDataDir(), fetch, force = false, env = process.env, version, sessions,
+  now = Date.now(), dir = userDataDir(), fetch, force = false, env = process.env, version, sessions, promptsOnly = false, rulesOnly = false,
 } = {}) {
-  if (teamSyncDisabled(env)) return { skipped: 'disabled' };
-  const state = loadTeamState(dir);
+  let state = loadTeamState(dir);
+  // The switch stops every usage upload. A joined machine still tells the
+  // server once that it paused (no usage data), so the organization sees a
+  // paused seat instead of a machine that went quiet.
+  if (teamSyncDisabled(env)) {
+    if (!isJoined(state) || state.pausedReported) return { skipped: 'disabled' };
+    try {
+      await rpc('member_set_sync', { member_key: state.memberKey, paused: true }, { fetch });
+      saveTeamState({ ...state, pausedReported: true }, dir);
+      return { skipped: 'disabled', reported: 'paused' };
+    } catch (e) {
+      debug('team-sync', e);
+      return { skipped: 'disabled', error: e.message };
+    }
+  }
   if (state.left) return { skipped: 'left' };
   if (!isJoined(state)) return { skipped: 'not-joined' };
-  if (!force && !teamSyncDue(state, now)) return { skipped: 'not-due' };
+  let resumed = false;
+  if (state.pausedReported) {
+    try {
+      await rpc('member_set_sync', { member_key: state.memberKey, paused: false }, { fetch });
+      state = { ...state };
+      delete state.pausedReported;
+      saveTeamState(state, dir);
+      force = true;
+      resumed = true;
+    } catch (e) {
+      debug('team-sync', e);
+    }
+  }
+  // Rules only: one small RPC, no ledger and no prompts, and lastSyncAt stays
+  // put. A resume falls through to the full sync instead.
+  if (rulesOnly && !resumed) {
+    if (!force && !rulesPullDue(state, now, env)) return { skipped: 'not-due' };
+    state = { ...state, lastRulesAttemptAt: now };
+    try { saveTeamState(state, dir); } catch (e) { debug('team-sync', e); }
+    try {
+      const { r, rules } = await pullRules({ memberKey: state.memberKey, dir, fetch, now });
+      saveTeamState(withRulesMeta(loadTeamState(dir), r, now), dir);
+      refreshTeamRatchetFiles({ dir });
+      return { uploaded: 0, rules: rules.length, rulesOnly: true };
+    } catch (e) {
+      debug('team-sync', e);
+      try { saveTeamState({ ...loadTeamState(dir), lastRulesError: e.message }, dir); } catch (e2) { debug('team-sync', e2); }
+      return { error: e.message };
+    }
+  }
+  // Prompts have their own 30-minute timer and are cheap (bytes past the stored
+  // offsets); the ledger re-parses 30 days of sessions and keeps its 6 hours.
+  if (promptsOnly || (!force && !teamSyncDue(state, now))) {
+    if (!force && !promptSyncDue(state, now)) return { skipped: 'not-due' };
+    if (!state.promptCapture) return { skipped: 'not-due' };
+    // claim the slot first so a second hook in the same minute finds nothing due
+    state = { ...state, lastPromptSyncAt: now };
+    saveTeamState(state, dir);
+    const prompts = await syncPrompts({ state, dir, fetch, now });
+    return { uploaded: 0, rules: 0, prompts: prompts ?? 0, promptsOnly: true };
+  }
+  // Claim the attempt first: a second hook within two minutes sees it in flight.
+  state = { ...state, lastSyncAttemptAt: now };
+  try { saveTeamState(state, dir); } catch (e) { debug('team-sync', e); }
+  state = await reportDeviceInfo({ state, dir, fetch, env });
   try {
-    const rows = (await aggregateDaily({ now, dir, sessions })).slice(-MAX_ROWS);
-    await rpc('ledger_upsert', { member_key: state.memberKey, rows, sprag_version: version || '' }, { fetch });
-    const r = (await rpc('team_rules_get', { member_key: state.memberKey }, { fetch })) || {};
-    const rules = Array.isArray(r.rules) ? r.rules : [];
-    writeStateFile(teamRulesCachePath(dir), JSON.stringify({
-      version: 1, fetchedAt: now, teamId: r.team_id, teamName: r.team_name, plan: r.plan,
-      promptCapture: !!r.prompt_capture, rules, removed: Array.isArray(r.removed) ? r.removed : [],
-    }, null, 2) + '\n');
-    const next = { ...state, lastSyncAt: now, lastSyncRows: rows.length };
-    if (r.team_name) next.teamName = r.team_name;
-    if (r.plan) next.plan = r.plan;
-    if (r.prompt_capture !== undefined) next.promptCapture = !!r.prompt_capture;
+    const win = ledgerWindow(state, now);
+    const rows = (await aggregateDaily({ now, dir, sessions, days: win.days }))
+      .filter((r) => r.day >= win.startKey).slice(-MAX_ROWS);
+    await ledgerUpsert({ memberKey: state.memberKey, rows, version, dir, fetch });
+    const { r, rules } = await pullRules({ memberKey: state.memberKey, dir, fetch, now });
+    const next = withRulesMeta({ ...state, lastSyncAt: now, lastSyncAttemptAt: now, lastSyncRows: rows.length, ledgerSyncedThrough: dayKey(now) }, r, now);
+    delete next.syncFailures;
     delete next.lastError;
     saveTeamState(next, dir);
-    return { uploaded: rows.length, rules: rules.length };
+    refreshTeamRatchetFiles({ dir });
+    const prompts = await syncPrompts({ state: next, dir, fetch, now });
+    return { uploaded: rows.length, rules: rules.length, ...(prompts !== null ? { prompts } : {}) };
   } catch (e) {
     debug('team-sync', e);
-    // Stamp lastSyncAt too, so an offline machine backs off for the interval.
-    try { saveTeamState({ ...state, lastSyncAt: now, lastError: e.message }, dir); } catch (e2) { debug('team-sync', e2); }
+    // lastSyncAt stays the last SUCCESS and the watermark does not move, so the
+    // next success re-sends every missed day. Retry after 15, 30, 60 minutes.
+    try {
+      saveTeamState({ ...state, lastSyncAttemptAt: now, syncFailures: (Number(state.syncFailures) || 0) + 1, lastError: e.message }, dir);
+    } catch (e2) { debug('team-sync', e2); }
     return { error: e.message };
   }
 }
 
+/**
+ * Prompt upload step of a sync. Capture off: forget the offsets so a later
+ * switch-on starts at the end of every file. Capture on: upload what is new.
+ * Fails soft; a problem here never marks the whole sync as failed.
+ */
+async function syncPrompts({ state, dir, fetch, now = Date.now() }) {
+  try {
+    if (!state.promptCapture) {
+      if (promptOffsetsExist(dir)) dropOffsets(dir);
+      return null;
+    }
+    const put = (params) => rpc('prompt_chunk_put', { member_key: state.memberKey, ...params }, { fetch, timeoutMs: 30000 });
+    const r = await uploadPrompts({ put, dir });
+    const fresh = loadTeamState(dir);
+    if (r.off) {
+      dropOffsets(dir);
+      saveTeamState({ ...fresh, promptCapture: false }, dir);
+      return null;
+    }
+    const patch = { lastPromptSyncAt: now };
+    if (r.uploaded > 0) {
+      Object.assign(patch, { lastPromptUploadAt: Date.now(), lastPromptCount: r.uploaded,
+        promptsUploadedTotal: (fresh.promptsUploadedTotal || 0) + r.uploaded });
+    }
+    saveTeamState({ ...fresh, ...patch }, dir);
+    return r.uploaded;
+  } catch (e) {
+    debug('team-sync', e);
+    return null;
+  }
+}
+
 export async function autoJoin({ env = process.env, fetch, dir = userDataDir(), version, now = Date.now() } = {}) {
   const token = env.SPRAG_TEAM_TOKEN;
   if (!token || !TOKEN_RE.test(token)) return null;
@@ -309,8 +607,9 @@ export async function autoJoin({ env = process.env, fetch, dir = userDataDir(),
   let name = 'member';
   try { name = userInfo().username || 'member'; } catch { /* no passwd entry */ }
   try {
-    return await joinTeam({ token, displayName: name, autoJoined: true, fetch, dir, version, now });
+    return await joinTeam({ token, displayName: name, autoJoined: true, fetch, dir, version, now, env });
   } catch (e) {
+    // SeatLimitError (code SEAT_LIMIT) lands here too: auto-join stays silent and retries next session.
     debug('team-sync', e);
     return null;
   }