studiograph 1.3.48-next.21 → 1.3.48-next.211

package/dist/cli/commands/sync.js

@@ -3,84 +3,42 @@
  *
  * Pull and push changes across the workspace:
  *   - the .studiograph config repo (if it has a git remote)
- *   - each entity collection that is a git repo with a remote
+ *   - each entity folder that is a git repo with a remote
  *
  * Works with both GitHub remotes and the embedded git server.
  */
 import { Command } from 'commander';
-import { log, outro, text, password as passwordPrompt } from '@clack/prompts';
+import { log, outro } from '@clack/prompts';
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { Workspace } from '../../core/workspace.js';
 import { AuthService } from '../../services/auth-service.js';
 import { ConnectorManager } from '../../mcp/connector-manager.js';
+import { buildConfigBundle } from '../../core/secrets/bundle.js';
 import { gitClone, gitPull, gitPush, gitPushWithCredentials, gitSetRemote, gitHasRemote } from '../../utils/git.js';
-async function resolveRemoteAuth(base, workspaceRoot, opts) {
-    // 1-2. Explicit API key or env var
-    const explicitKey = opts.apiKey || process.env.STUDIOGRAPH_API_KEY;
-    if (explicitKey) {
-        const key = explicitKey.trim();
-        return {
-            httpHeader: { 'Authorization': `Bearer ${key}` },
-            gitCredentials: { username: '_apikey_', password: key },
-        };
-    }
-    // 3. Explicit email/password or env vars
-    const email = opts.email || process.env.STUDIOGRAPH_EMAIL;
-    const password = opts.password || process.env.STUDIOGRAPH_PASSWORD;
-    if (email && password) {
-        const httpHeader = await loginForCookie(base, email, password);
-        return { httpHeader, gitCredentials: { username: email, password } };
-    }
-    // 4. Local auth-seed.json API key (workspace owner pushing to their own server)
-    const seedPath = join(workspaceRoot, '.studiograph', 'auth-seed.json');
-    if (existsSync(seedPath)) {
-        try {
-            const seed = JSON.parse(readFileSync(seedPath, 'utf-8'));
-            if (seed.apiKey) {
-                return {
-                    httpHeader: { 'Authorization': `Bearer ${seed.apiKey}` },
-                    gitCredentials: { username: '_apikey_', password: seed.apiKey },
-                };
-            }
-        }
-        catch { /* fall through */ }
-    }
-    // 5. Interactive prompts
-    if (!process.stdin.isTTY) {
-        throw new Error('No credentials provided and stdin is not a TTY. Use --api-key, --email + --password, or set STUDIOGRAPH_API_KEY.');
-    }
-    const emailPrompt = await text({ message: 'Admin email:', validate: (v) => v.includes('@') ? undefined : 'Enter a valid email' });
-    if (typeof emailPrompt === 'symbol') {
-        outro('Cancelled');
-        process.exit(0);
-    }
-    const passPrompt = await passwordPrompt({ message: 'Password:' });
-    if (typeof passPrompt === 'symbol') {
-        outro('Cancelled');
-        process.exit(0);
-    }
-    const emailStr = String(emailPrompt);
-    const passStr = String(passPrompt);
-    const httpHeader = await loginForCookie(base, emailStr, passStr);
-    return { httpHeader, gitCredentials: { username: emailStr, password: passStr } };
-}
-async function loginForCookie(base, email, password) {
-    const loginRes = await fetch(`${base}/api/auth/login`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email, password }),
-    });
-    if (!loginRes.ok) {
-        const body = await loginRes.json().catch(() => ({}));
-        throw new Error(`Login failed: ${body.error || loginRes.statusText}`);
-    }
-    const cookies = loginRes.headers.getSetCookie?.() ?? [];
-    const tokenCookie = cookies.find(c => c.startsWith('__sg_token='));
-    if (!tokenCookie) {
-        throw new Error('Login succeeded but no session cookie was returned');
-    }
-    return { 'Cookie': tokenCookie.split(';')[0] };
+import { getStudiographToken } from '../../core/user-config.js';
+// Owner-only admin escalation header for embedded-git operations. The server
+// lifts the personal-folder restriction only when the caller is the workspace
+// owner (access-control.ts: `includePrivate` is gated to owners and is a no-op
+// for everyone else). `pull`/`push` are owner-CLI commands, so we send it
+// unconditionally — non-owners get no extra access, and the owner can sync
+// other users' private folders during migrations / offboarding. Without it the
+// server returns 404 for any folder the caller doesn't personally own, even
+// the workspace owner. `studiograph clone` sends the same header for the
+// same reason, so clone/pull/push stay consistent.
+const OWNER_INCLUDE_PRIVATE_HEADERS = ['X-Studiograph-Include-Private: 1'];
+function resolveRemoteAuth(base, opts) {
+    const token = opts.token?.trim() || process.env.STUDIOGRAPH_TOKEN?.trim() || getStudiographToken(base);
+    if (!token) {
+        throw new Error(`No API token for ${base}. Run \`studiograph admin token issue ${base}\` to mint one, or pass --token / STUDIOGRAPH_TOKEN.`);
+    }
+    return {
+        // Both the main API middleware (server/index.ts) and the git-http handler
+        // (routes/git-http.ts authenticateBasic) accept Bearer + Basic with an
+        // sg_ token, so one token → one set of headers, no dual-format gymnastics.
+        httpHeader: { Authorization: `Bearer ${token}` },
+        gitCredentials: { username: '_token_', password: token },
+    };
 }
 async function getRepoEntries(workspace, workspaceRoot) {
     const entries = [];
@@ -91,8 +49,15 @@ async function getRepoEntries(workspace, workspaceRoot) {
     }
     const config = await workspace.loadConfig();
     for (const repo of config.repos) {
-        if (repo.private)
-            continue; // private repos are local-only
+        // Personal folders are excluded ONLY on this fallback path, which pushes
+        // to whatever git remote was manually wired up — typically a third-party
+        // host (GitHub, etc.) with no Studiograph permission layer to gate
+        // access. Pushing a personal folder there would leak private content to
+        // an ungated remote. The Studiograph-server paths (pull/pushRemoteData,
+        // the server-aware push) DO sync personal folders, because git-http
+        // gates them by owner.
+        if (repo.personal)
+            continue;
         const repoPath = join(workspaceRoot, repo.path);
         if (!isGitRepo(repoPath) || !gitHasRemote(repoPath))
             continue;
@@ -119,11 +84,10 @@ async function pullRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
     const base = remoteUrl.replace(/\/+$/, '');
     const workspaceRoot = workspace.getWorkspacePath();
     const sgDir = join(workspaceRoot, '.studiograph');
-    // Resolve authentication (API key, email+password, env vars, or interactive prompts)
+    // Resolve authentication — sg_ token only (Phase C5).
     let auth;
     try {
-        log.info('Authenticating...');
-        auth = await resolveRemoteAuth(base, workspaceRoot, authOpts);
+        auth = resolveRemoteAuth(base, authOpts);
     }
     catch (err) {
         outro(err.message);
@@ -138,20 +102,29 @@ async function pullRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
         });
         if (bundleRes.ok) {
             const bundle = await bundleRes.json();
-            // 1. Auth seed
+            // 1. Auth seed — remote is authoritative for pull, so overwrite any
+            // local-shadow rows (e.g. post-clone setup-wizard credentials that
+            // would otherwise shadow the real production password_hash).
             writeFileSync(join(sgDir, 'auth-seed.json'), JSON.stringify(bundle.authSeed, null, 2), 'utf-8');
-            const authService = new AuthService(sgDir);
-            authService.applySeed();
+            // AuthService appends `.studiograph` to the path it's given —
+            // pass workspace root, not `sgDir`, or we end up with
+            // `.studiograph/.studiograph/auth.db` (disjoint from the running server).
+            const authService = new AuthService(workspaceRoot);
+            authService.applySeed({ mode: 'overwrite' });
             authService.close();
             log.success(`Team: ${bundle.authSeed.users.length} user${bundle.authSeed.users.length === 1 ? '' : 's'}`);
-            // 2. Workspace config — merge: keep local-only fields (server_url), update shared fields
+            // 2. Workspace config — merge: keep local-only fields (server_url), update shared fields.
+            //
+            // Phase 9b: route through `workspace.writeConfig()` so this CLI
+            // pull path shares the same schema validator + dual-write seam as
+            // every other writer.
             if (bundle.workspace) {
                 const local = await workspace.loadConfig().catch(() => ({}));
                 const merged = { ...local, ...bundle.workspace };
                 if (local.server_url)
                     merged.server_url = local.server_url;
-                writeFileSync(join(sgDir, 'workspace.json'), JSON.stringify(merged, null, 2), 'utf-8');
-                log.success(`Workspace config: ${bundle.workspace.repos?.length ?? 0} collection${(bundle.workspace.repos?.length ?? 0) === 1 ? '' : 's'}`);
+                workspace.writeConfig(merged);
+                log.success(`Workspace config: ${bundle.workspace.repos?.length ?? 0} folder${(bundle.workspace.repos?.length ?? 0) === 1 ? '' : 's'}`);
             }
             // 3. ABOUT.md
             if (bundle.about !== null && bundle.about !== undefined) {
@@ -168,12 +141,15 @@ async function pullRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
                 }
                 log.success(`Sources: ${sourceNames.join(', ')}`);
             }
-            // 5. Connectors (sanitized — no secrets)
+            // 5. Connectors (sanitized — no secrets).
+            //
+            // Phase 9b: route through `ConnectorManager.saveWorkspaceConfig` so
+            // every connector save runs the same schema validator + stripSecrets
+            // pass. The bundle is already sanitized server-side; the re-strip
+            // is idempotent and preserves the single-seam invariant.
             if (bundle.connectors && bundle.connectors.length > 0) {
-                const connectorsDir = join(sgDir, 'connectors');
-                mkdirSync(connectorsDir, { recursive: true });
                 for (const conn of bundle.connectors) {
-                    writeFileSync(join(connectorsDir, `${conn.name}.json`), JSON.stringify(conn, null, 2), 'utf-8');
+                    ConnectorManager.saveWorkspaceConfig(conn, workspaceRoot);
                 }
                 log.success(`Connectors: ${bundle.connectors.map(c => c.name).join(', ')}`);
             }
@@ -200,8 +176,9 @@ async function pullRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
             }
             const seed = await seedRes.json();
             writeFileSync(join(sgDir, 'auth-seed.json'), JSON.stringify(seed, null, 2), 'utf-8');
-            const authService = new AuthService(sgDir);
-            authService.applySeed();
+            // AuthService appends `.studiograph` — pass workspace root, not `sgDir`.
+            const authService = new AuthService(workspaceRoot);
+            authService.applySeed({ mode: 'overwrite' });
             authService.close();
             outro(`Pulled ${seed.users.length} user${seed.users.length === 1 ? '' : 's'} from ${base}`);
         }
@@ -212,13 +189,21 @@ async function pullRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
         }
     }
     catch (err) {
+        // Phase 9c: surface SchemaViolationError with its redaction-safe
+        // message (field path + classification, no values). The error class
+        // is detected by name to avoid pulling the schemas module into the
+        // CLI bundle import graph just for an instanceof check.
+        if (err?.name === 'SchemaViolationError' || err?.code === 'schema_violation') {
+            outro(`Schema violation:\n${err.message}`);
+            process.exit(1);
+        }
         outro(`Failed: ${err.message}`);
         process.exit(1);
     }
 }
 // ─── Remote data pull (git-based) ───────────────────────────────────────────
-// Clones or pulls each collection from the remote's embedded git HTTP server
-// (/git/:repo). Uses git's native conflict detection — diverged collections
+// Clones or pulls each folder from the remote's embedded git HTTP server
+// (/git/:repo). Uses git's native conflict detection — diverged folders
 // are reported, not silently overwritten.
 async function pullRemoteData(base, auth, workspaceRoot) {
     // Reload config — it was just updated by pullRemoteConfig
@@ -226,8 +211,6 @@ async function pullRemoteData(base, auth, workspaceRoot) {
     const config = await workspace.loadConfig();
     let cloned = 0, updated = 0, upToDate = 0, diverged = 0, errors = 0;
     for (const repo of config.repos) {
-        if (repo.private)
-            continue; // private collections don't sync
         const repoPath = join(workspaceRoot, repo.path);
         const remoteUrl = `${base}/git/${repo.name}`;
         // Clone if missing
@@ -236,7 +219,7 @@ async function pullRemoteData(base, auth, workspaceRoot) {
                 if (existsSync(repoPath))
                     rmSync(repoPath, { recursive: true, force: true });
                 mkdirSync(repoPath, { recursive: true });
-                gitClone(remoteUrl, repoPath, { silent: true, credentials: auth.gitCredentials });
+                gitClone(remoteUrl, repoPath, { silent: true, credentials: auth.gitCredentials, extraHeaders: OWNER_INCLUDE_PRIVATE_HEADERS });
                 log.success(`${repo.name}: cloned`);
                 cloned++;
             }
@@ -252,7 +235,7 @@ async function pullRemoteData(base, auth, workspaceRoot) {
         }
         catch { /* non-fatal */ }
         try {
-            const result = gitPull(repoPath, { credentials: auth.gitCredentials });
+            const result = gitPull(repoPath, { credentials: auth.gitCredentials, extraHeaders: OWNER_INCLUDE_PRIVATE_HEADERS });
             if (result === 'updated') {
                 log.success(`${repo.name}: updated`);
                 updated++;
@@ -273,42 +256,55 @@ async function pullRemoteData(base, auth, workspaceRoot) {
     }
     log.info(`Data: ${cloned} cloned, ${updated} updated, ${upToDate} up to date${diverged ? `, ${diverged} diverged` : ''}${errors ? `, ${errors} failed` : ''}`);
     if (diverged) {
-        throw new Error('One or more collections diverged — resolve conflicts and retry');
+        throw new Error('One or more folders diverged — resolve conflicts and retry');
     }
     if (errors) {
-        throw new Error('One or more collections failed to pull');
+        throw new Error('One or more folders failed to pull');
     }
 }
 // ─── Remote data push (git-based) ───────────────────────────────────────────
-// Pushes each local collection to the remote's embedded git HTTP server.
+// Pushes each local folder to the remote's embedded git HTTP server.
 // Uses git's native conflict detection — rejected pushes require a pull first.
 async function pushRemoteData(base, auth, workspace, workspaceRoot) {
     const config = await workspace.loadConfig();
     let pushed = 0, nothingToPush = 0, created = 0, rejected = 0, errors = 0;
     for (const repo of config.repos) {
-        if (repo.private)
-            continue; // private collections don't sync to a remote we don't control
         const repoPath = join(workspaceRoot, repo.path);
         if (!existsSync(join(repoPath, '.git'))) {
             log.warn(`${repo.name}: not a git repo — skipping`);
             continue;
         }
         try {
-            // Ensure collection exists on remote (idempotent; 409 means it already exists)
-            const status = await ensureServerCollection(base, repo.name, !!repo.private, auth.httpHeader);
-            if (status === 'created') {
-                log.info(`${repo.name}: created on server`);
-                created++;
+            // Ensure folder exists on remote (idempotent; 409 means it already exists).
+            // Skip for personal folders: they're auto-provisioned server-side on login
+            // (auth-api.ts#ensurePrivateFolder), and the POST /api/repos shared-folder
+            // path rejects reserved `entries-<id>` names. Detect by flag OR name
+            // pattern: clone now preserves `personal` (see clone.ts), so the flag is
+            // authoritative for freshly-cloned workspaces — the name-pattern check is
+            // a fallback for workspaces cloned before that fix landed. Mirrors the
+            // server-aware push below.
+            const skipServerFolderEnsure = !!repo.personal || /^entries-\d+$/.test(repo.name);
+            if (!skipServerFolderEnsure) {
+                const status = await ensureServerFolder(base, repo.name, !!repo.personal, auth.httpHeader);
+                if (status === 'created') {
+                    log.info(`${repo.name}: created on server`);
+                    created++;
+                }
             }
             // Point origin at the remote's git server
             gitSetRemote(repoPath, `${base}/git/${repo.name}`);
-            // Push with credentials
-            const result = gitPushWithCredentials(repoPath, auth.gitCredentials);
+            // Push with credentials + owner escalation (so the owner can push to
+            // any folder, including other users' private ones, during a migration).
+            const result = gitPushWithCredentials(repoPath, auth.gitCredentials, { extraHeaders: OWNER_INCLUDE_PRIVATE_HEADERS });
             if (result === 'rejected') {
-                log.warn(`${repo.name}: push rejected — run \`studiograph pull --remote ${base} --data\` first`);
+                log.warn(`${repo.name}: push rejected — run \`studiograph pull --server ${base} --data\` first`);
                 rejected++;
                 continue;
             }
+            if (result === 'not-found') {
+                log.warn(`${repo.name}: skipped — folder does not exist on the server (stale local clone; safe to remove locally)`);
+                continue;
+            }
             if (result === 'pushed') {
                 log.success(`${repo.name}: pushed`);
                 pushed++;
@@ -324,27 +320,29 @@ async function pushRemoteData(base, auth, workspace, workspaceRoot) {
     }
     log.info(`Data: ${pushed} pushed${created ? `, ${created} created` : ''}, ${nothingToPush} unchanged${rejected ? `, ${rejected} rejected` : ''}${errors ? `, ${errors} failed` : ''}`);
     if (rejected) {
-        throw new Error('One or more collections were rejected — pull and retry');
+        throw new Error('One or more folders were rejected — pull and retry');
     }
     if (errors) {
-        throw new Error('One or more collections failed to push');
+        throw new Error('One or more folders failed to push');
     }
 }
 // ─── pull ─────────────────────────────────────────────────────────────────────
 export const pullCommand = new Command('pull')
     .description('Pull latest changes from remote across the workspace')
-    .option('--remote <url>', 'Pull config from a remote Studiograph server')
-    .option('--data', 'Also pull workspace collection data (markdown files) from the remote server')
-    .option('--api-key <key>', 'Use Bearer API key instead of email/password (non-interactive)')
-    .option('--email <email>', 'Admin email for non-interactive auth (also reads STUDIOGRAPH_EMAIL)')
-    .option('--password <password>', 'Admin password for non-interactive auth (also reads STUDIOGRAPH_PASSWORD)')
+    .option('--server <url>', 'Pull config from a remote Studiograph server')
+    // `--remote` is a hidden alias kept for one release; remove in the next.
+    // See cli-owner-audit §C5. Owner CLI is now the only caller, but scripts
+    // and muscle memory may still reach for the old name.
+    .option('--remote <url>', 'Deprecated alias for --server (removed in the next release)', undefined)
+    .option('--data', 'Also pull workspace folder data (markdown files) from the remote server')
+    .option('--token <token>', 'sg_ API token (also reads STUDIOGRAPH_TOKEN; mint via `studiograph admin token issue <url>`)')
     .action(async (opts) => {
-    if (opts.remote) {
-        return pullRemoteConfig(opts.remote, opts.data, {
-            apiKey: opts.apiKey,
-            email: opts.email,
-            password: opts.password,
-        });
+    const flagServer = opts.server ?? opts.remote;
+    if (opts.remote && !opts.server) {
+        log.warn('`--remote` is deprecated, use `--server` instead.');
+    }
+    if (flagServer) {
+        return pullRemoteConfig(flagServer, opts.data, { token: opts.token });
     }
     const workspace = new Workspace();
     if (!workspace.isWorkspace()) {
@@ -370,13 +368,21 @@ export const pullCommand = new Command('pull')
             else if (result === 'up-to-date') {
                 log.info('.studiograph: already up to date');
             }
+            else {
+                // Diverged / any other non-clean state — surface it the same way
+                // the folder loop does so the user actually sees the problem
+                // instead of walking into a silent no-op.
+                log.warn('.studiograph: diverged — has local commits not on the server');
+                logManualGuidance(configPath);
+                hasConflict = true;
+            }
         }
         catch (error) {
             log.error(`.studiograph: ${error instanceof Error ? error.message : 'Unknown error'}`);
             hasError = true;
         }
     }
-    // ── Step 2: reload config — picks up any new collections added server-side ─
+    // ── Step 2: reload config — picks up any new folders added server-side ─
     // Must use a fresh Workspace instance — loadConfig() caches this.config on
     // first call, so the original instance would return stale data after the pull.
     const freshWorkspace = new Workspace(workspaceRoot);
@@ -387,13 +393,12 @@ export const pullCommand = new Command('pull')
         freshWorkspace.writeConfig(config);
     }
     const serverUrl = (config.server_url ?? savedServerUrl)?.replace(/\/+$/, '');
-    // ── Step 3: pull or clone each collection ────────────────────────────────
+    // ── Step 3: pull or clone each folder ────────────────────────────────
     // Resolve git credentials for the embedded server:
     //   1. Stored JWT from `studiograph join` — per-user access control (preferred)
-    //   2. API key from auth-seed.json — admin access (fallback for workspace owners)
+    //   2. Stored personal API token from ~/.studiograph/user.json
     let serverGitCredentials;
     if (serverUrl) {
-        // Try stored JWT first (saved by studiograph join)
         const serverAuthPath = join(workspaceRoot, '.studiograph', 'server-auth.json');
         if (existsSync(serverAuthPath)) {
             try {
@@ -404,29 +409,20 @@ export const pullCommand = new Command('pull')
             }
             catch { /* non-fatal */ }
         }
-        // Fall back to API key (used by workspace owners who set up with `studiograph serve`)
         if (!serverGitCredentials) {
-            try {
-                const seedPath = join(workspaceRoot, '.studiograph', 'auth-seed.json');
-                if (existsSync(seedPath)) {
-                    const seed = JSON.parse(readFileSync(seedPath, 'utf-8'));
-                    const apiKey = seed.apiKey;
-                    if (apiKey)
-                        serverGitCredentials = { username: '_apikey_', password: apiKey };
-                }
+            const storedToken = getStudiographToken(serverUrl);
+            if (storedToken) {
+                serverGitCredentials = { username: '_token_', password: storedToken };
             }
-            catch { /* non-fatal */ }
         }
     }
     for (const repo of config.repos) {
-        if (repo.private)
-            continue;
         const repoPath = join(workspaceRoot, repo.path);
-        // New collection — directory missing or exists but isn't a git repo (e.g. failed clone)
+        // New folder — directory missing or exists but isn't a git repo (e.g. failed clone)
         if (!isGitRepo(repoPath)) {
             const cloneUrl = serverUrl ? `${serverUrl}/git/${repo.name}` : null;
             if (!cloneUrl) {
-                log.warn(`${repo.name}: new collection has no remote — skipping`);
+                log.warn(`${repo.name}: new folder has no remote — skipping`);
                 continue;
             }
             try {
@@ -436,7 +432,11 @@ export const pullCommand = new Command('pull')
                 if (existsSync(repoPath))
                     rmSync(repoPath, { recursive: true, force: true });
                 mkdirSync(repoPath, { recursive: true });
-                gitClone(cloneUrl, repoPath, { silent: true, credentials: serverGitCredentials });
+                gitClone(cloneUrl, repoPath, {
+                    silent: true,
+                    credentials: serverGitCredentials,
+                    extraHeaders: OWNER_INCLUDE_PRIVATE_HEADERS,
+                });
                 log.success(`${repo.name}: cloned`);
             }
             catch (error) {
@@ -445,11 +445,14 @@ export const pullCommand = new Command('pull')
             }
             continue;
         }
-        // Existing collection — pull if it has a remote
+        // Existing folder — pull if it has a remote
         if (!isGitRepo(repoPath) || !gitHasRemote(repoPath))
             continue;
         try {
-            const result = gitPull(repoPath, { credentials: serverGitCredentials });
+            const result = gitPull(repoPath, {
+                credentials: serverGitCredentials,
+                extraHeaders: OWNER_INCLUDE_PRIVATE_HEADERS,
+            });
             if (result === 'updated') {
                 log.success(`${repo.name}: updated`);
             }
@@ -467,12 +470,15 @@ export const pullCommand = new Command('pull')
             hasError = true;
         }
     }
-    // Apply auth seed if it was updated by pulling .studiograph
+    // Apply auth seed if it was updated by pulling .studiograph.
+    // Overwrite mode: the seed file just came from the remote config repo
+    // and is authoritative over any local-shadow rows.
     const seedPath = join(workspaceRoot, '.studiograph', 'auth-seed.json');
     if (existsSync(seedPath)) {
         try {
-            const authService = new AuthService(join(workspaceRoot, '.studiograph'));
-            authService.applySeed();
+            // AuthService appends `.studiograph` — pass workspace root.
+            const authService = new AuthService(workspaceRoot);
+            authService.applySeed({ mode: 'overwrite' });
             authService.close();
         }
         catch {
@@ -484,7 +490,7 @@ export const pullCommand = new Command('pull')
         process.exit(1);
     }
     else if (hasError) {
-        outro('❌ Pull failed for one or more collections.');
+        outro('❌ Pull failed for one or more folders.');
         process.exit(1);
     }
 });
@@ -499,11 +505,10 @@ async function pushRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
     const base = remoteUrl.replace(/\/+$/, '');
     const workspaceRoot = workspace.getWorkspacePath();
     const sgDir = join(workspaceRoot, '.studiograph');
-    // Resolve authentication (API key, email+password, env vars, or interactive prompts)
+    // Resolve authentication — sg_ token only (Phase C5).
     let auth;
     try {
-        log.info('Authenticating...');
-        auth = await resolveRemoteAuth(base, workspaceRoot, authOpts);
+        auth = resolveRemoteAuth(base, authOpts);
     }
     catch (err) {
         outro(err.message);
@@ -538,7 +543,18 @@ async function pushRemoteConfig(remoteUrl, includeData = false, authOpts = {}) {
     }
     // Connectors (workspace-level, already sanitized)
     const connectors = ConnectorManager.loadWorkspaceConfigs(workspaceRoot);
-    const bundle = { workspace: config, about, authSeed, sources, connectors };
+    // Phase 3: route the bundle through the same sanitizer the server's
+    // GET /api/config/bundle endpoint uses. CLI push and server export now
+    // produce byte-identical output for the same workspace state — bootstrap
+    // class fields (jwtSecret, deprecated apiKey) drop here so the POST
+    // endpoint's strict-reject doesn't bounce older client builds.
+    const bundle = buildConfigBundle({
+        workspace: config,
+        about,
+        authSeed: (authSeed ?? { users: [] }),
+        sources,
+        connectors: connectors,
+    });
     // Push to remote
     log.info('Pushing config...');
     try {
@@ -594,7 +610,7 @@ async function serverFetch(serverUrl, path, authHeader) {
     }
     return res.json();
 }
-async function ensureServerCollection(serverUrl, repoName, isPrivate, authHeader) {
+async function ensureServerFolder(serverUrl, repoName, isPersonal, authHeader) {
     const headers = { 'Content-Type': 'application/json' };
     if (typeof authHeader === 'string') {
         headers['Authorization'] = authHeader;
@@ -605,31 +621,30 @@ async function ensureServerCollection(serverUrl, repoName, isPrivate, authHeader
     const res = await fetch(`${serverUrl}/api/repos`, {
         method: 'POST',
         headers,
-        body: JSON.stringify({ name: repoName, ...(isPrivate ? { private: true } : {}) }),
+        body: JSON.stringify({ name: repoName, ...(isPersonal ? { personal: true } : {}) }),
     });
     if (res.ok)
         return 'created';
     if (res.status === 409)
         return 'exists'; // already exists
     const body = await res.json().catch(() => ({}));
-    throw new Error(body.error || `Failed to create collection "${repoName}": ${res.statusText}`);
+    throw new Error(body.error || `Failed to create folder "${repoName}": ${res.statusText}`);
 }
 // ─── push ─────────────────────────────────────────────────────────────────────
 export const pushCommand = new Command('push')
     .description('Push local commits to remote across the workspace')
-    .argument('[collection]', 'Push a specific collection (default: all)')
-    .option('--remote <url>', 'Push config to a remote Studiograph server')
-    .option('--data', 'Also push workspace collection data (markdown files) to the remote server')
-    .option('--api-key <key>', 'Use Bearer API key instead of email/password (non-interactive)')
-    .option('--email <email>', 'Admin email for non-interactive auth (also reads STUDIOGRAPH_EMAIL)')
-    .option('--password <password>', 'Admin password for non-interactive auth (also reads STUDIOGRAPH_PASSWORD)')
-    .action(async (collection, opts) => {
-    if (opts.remote) {
-        return pushRemoteConfig(opts.remote, opts.data, {
-            apiKey: opts.apiKey,
-            email: opts.email,
-            password: opts.password,
-        });
+    .argument('[folder]', 'Push a specific folder (default: all)')
+    .option('--server <url>', 'Push config to a remote Studiograph server')
+    .option('--remote <url>', 'Deprecated alias for --server (removed in the next release)', undefined)
+    .option('--data', 'Also push workspace folder data (markdown files) to the remote server')
+    .option('--token <token>', 'sg_ API token (also reads STUDIOGRAPH_TOKEN; mint via `studiograph admin token issue <url>`)')
+    .action(async (folder, opts) => {
+    const flagServer = opts.server ?? opts.remote;
+    if (opts.remote && !opts.server) {
+        log.warn('`--remote` is deprecated, use `--server` instead.');
+    }
+    if (flagServer) {
+        return pushRemoteConfig(flagServer, opts.data, { token: opts.token });
     }
     const workspace = new Workspace();
     if (!workspace.isWorkspace()) {
@@ -640,78 +655,47 @@ export const pushCommand = new Command('push')
     const workspaceRoot = workspace.getWorkspacePath();
     const config = await workspace.loadConfig();
     const serverUrl = config.server_url?.replace(/\/+$/, '');
-    // Build list of repos to push
-    let repos = config.repos.filter(r => !r.private || serverUrl); // include private only when pushing to server
-    if (collection) {
-        const match = repos.find(r => r.name === collection);
+    // Push every folder — shared and personal alike. Personal folders are
+    // per-user, but git-http (canAccessFolder → hasRepoAccess) gates by
+    // owner so only the owner ever succeeds; the owner CLI sends the
+    // include-private escalation, so the owner can push any of them.
+    // Server-side, personal folders are auto-provisioned on login by
+    // auth-api.ts#ensurePrivateFolder, so the per-folder ensureServerFolder()
+    // call is skipped for them below (the createSharedFolder path would
+    // reject `entries-<number>` as a reserved name even though the folder
+    // already exists).
+    let repos = config.repos;
+    if (folder) {
+        const match = repos.find(r => r.name === folder);
         if (!match) {
-            log.error(`Collection "${collection}" not found in workspace.`);
+            log.error(`Folder "${folder}" not found in workspace.`);
             process.exit(1);
             return;
         }
         repos = [match];
     }
-    // Server-aware push: workspace has a server_url (set by `studiograph join`)
+    // Server-aware push: workspace has a `server_url` (set by `studiograph clone`).
     if (serverUrl) {
-        // Resolve credentials: JWT (per-user) → API key (admin) → prompt
-        let authHeader;
-        let gitCredentials;
-        // 1. Stored JWT from `studiograph join` (per-user access control)
-        const pushServerAuthPath = join(workspaceRoot, '.studiograph', 'server-auth.json');
+        // sg_ token only. resolveRemoteAuth handles the "no token" error.
+        let auth;
         try {
-            if (existsSync(pushServerAuthPath)) {
-                const sa = JSON.parse(readFileSync(pushServerAuthPath, 'utf-8'));
-                if (sa.email && sa.jwtToken) {
-                    authHeader = makeBasicAuth(sa.email, sa.jwtToken);
-                    gitCredentials = { username: sa.email, password: sa.jwtToken };
-                }
-            }
-        }
-        catch { /* non-fatal */ }
-        // 2. API key fallback (workspace owners who set up with `studiograph serve`)
-        if (!authHeader) {
-            try {
-                const seedPathPush = join(workspaceRoot, '.studiograph', 'auth-seed.json');
-                if (existsSync(seedPathPush)) {
-                    const seed = JSON.parse(readFileSync(seedPathPush, 'utf-8'));
-                    const pushApiKey = seed.apiKey;
-                    if (pushApiKey) {
-                        authHeader = makeBasicAuth('_apikey_', pushApiKey);
-                        gitCredentials = { username: '_apikey_', password: pushApiKey };
-                    }
-                }
-            }
-            catch { /* non-fatal */ }
-        }
-        // 3. Interactive credential prompt as last resort
-        if (!authHeader) {
-            const email = await text({ message: 'Email:', validate: (v) => v.includes('@') ? undefined : 'Enter a valid email' });
-            if (typeof email === 'symbol') {
-                outro('Cancelled');
-                process.exit(0);
-                return;
-            }
-            const pass = await passwordPrompt({ message: 'Password:' });
-            if (typeof pass === 'symbol') {
-                outro('Cancelled');
-                process.exit(0);
-                return;
-            }
-            authHeader = makeBasicAuth(String(email), String(pass));
-            gitCredentials = { username: String(email), password: String(pass) };
+            auth = resolveRemoteAuth(serverUrl, { token: undefined });
         }
-        // All three branches above either set credentials or exit — this is a safety guard
-        if (!authHeader || !gitCredentials) {
-            outro('Could not resolve credentials');
+        catch (err) {
+            outro(err.message);
             process.exit(1);
             return;
         }
-        // Validate credentials
+        const authHeader = auth.httpHeader.Authorization;
+        const gitCredentials = auth.gitCredentials;
+        // Cheap probe — surfaces a 401/expired token before we touch git
+        // (which would otherwise fail with a less useful "askpass auth
+        // failed" message). One round-trip, idempotent.
         try {
             await serverFetch(serverUrl, '/api/workspace', authHeader);
         }
         catch (err) {
-            outro(`Authentication failed: ${err.message}`);
+            outro(`Authentication failed (${err.message}). Run \`studiograph admin token issue ${serverUrl}\` to mint a fresh token.`);
             process.exit(1);
             return;
         }
@@ -722,21 +706,43 @@ export const pushCommand = new Command('push')
                 log.warn(`${repo.name}: not a git repo, skipping`);
                 continue;
             }
+            // Personal folders skip the /api/repos POST. Detection has TWO
+            // sources: the `personal` flag (clone now preserves it — see
+            // clone.ts) and the reserved name pattern as a fallback for
+            // workspaces cloned before that fix, whose workspace.json carries a
+            // thin repo record without the flag. Anything matching
+            // `entries-<digit>` is owned by the user with that id and was
+            // auto-provisioned server-side via auth-api.ts#ensurePrivateFolder
+            // on login. The /api/repos path goes through createSharedFolder
+            // which rejects this exact pattern; the git push that follows
+            // hits git-http directly where canAccessFolder gates by owner.
+            const isPersonalByPattern = /^entries-\d+$/.test(repo.name);
+            const skipServerFolderEnsure = !!repo.personal || isPersonalByPattern;
             try {
-                // Ensure collection exists on server
-                const status = await ensureServerCollection(serverUrl, repo.name, !!repo.private, authHeader);
-                if (status === 'created') {
-                    log.info(`${repo.name}: created on server`);
+                if (!skipServerFolderEnsure) {
+                    const status = await ensureServerFolder(serverUrl, repo.name, false, authHeader);
+                    if (status === 'created') {
+                        log.info(`${repo.name}: created on server`);
+                    }
                 }
                 // Set origin to server git URL
                 gitSetRemote(repoPath, `${serverUrl}/git/${repo.name}`);
-                // Push with credentials
-                let result = gitPushWithCredentials(repoPath, gitCredentials);
+                // Push with the resolved sg_ token plus the owner escalation header.
+                // The server gates personal/solo folders to their owner-of-record —
+                // even the workspace owner gets a 404 without this header (the
+                // `includePrivate` flag is owner-only server-side, a no-op for
+                // everyone else). Required so the owner can push other users' private
+                // folders during migrations. Consistent with `studiograph clone`.
+                let result = gitPushWithCredentials(repoPath, gitCredentials, { extraHeaders: OWNER_INCLUDE_PRIVATE_HEADERS });
                 if (result === 'rejected') {
                     log.warn(`${repo.name}: push rejected — run \`studiograph pull\` first`);
                     hasError = true;
                     continue;
                 }
+                if (result === 'not-found') {
+                    log.warn(`${repo.name}: skipped — folder does not exist on the server (stale local clone; safe to remove locally)`);
+                    continue;
+                }
                 if (result === 'pushed') {
                     log.success(`${repo.name}: pushed`);
                 }
@@ -758,12 +764,12 @@ export const pushCommand = new Command('push')
     // Fallback: plain git push for repos that already have remotes
     const entries = await getRepoEntries(workspace, workspaceRoot);
     if (entries.length === 0) {
-        log.info('No collections with remotes to push to. Use `studiograph join` to connect to a server.');
+        log.info('No folders with remotes to push to. Use `studiograph clone <url>` to connect to a server.');
         return;
     }
     let hasError = false;
     for (const entry of entries) {
-        if (collection && entry.name !== collection)
+        if (folder && entry.name !== folder)
             continue;
         try {
             let result = gitPush(entry.path);
@@ -772,6 +778,10 @@ export const pushCommand = new Command('push')
                 hasError = true;
                 continue;
             }
+            if (result === 'not-found') {
+                log.warn(`${entry.name}: skipped — folder does not exist on the remote (stale local clone; safe to remove locally)`);
+                continue;
+            }
             if (result === 'pushed') {
                 log.success(`${entry.name}: pushed`);
             }
@@ -785,7 +795,7 @@ export const pushCommand = new Command('push')
         }
     }
     if (hasError) {
-        outro('Push failed for one or more collections.');
+        outro('Push failed for one or more folders.');
         process.exit(1);
     }
 });