teamai-cli 0.24.0 → 0.25.0-beta.1

package/dist/index.js

@@ -559,6 +559,7 @@ __export(types_exports, {
   getDataHome: () => getDataHome,
   getEnvBackupPath: () => getEnvBackupPath,
   getHooksSharing: () => getHooksSharing,
+  getInterventionSharing: () => getInterventionSharing,
   getKnowledgeDir: () => getKnowledgeDir,
   getManagedHooksPath: () => getManagedHooksPath,
   getMcpSharing: () => getMcpSharing,
@@ -590,11 +591,15 @@ __export(types_exports, {
   resolveHookScope: () => resolveHookScope,
   resolveLegacyProjectHookScope: () => resolveLegacyProjectHookScope,
   scopedToolPaths: () => scopedToolPaths,
-  totalTokens: () => totalTokens
+  totalTokens: () => totalTokens,
+  usesReportsBranch: () => usesReportsBranch
 });
 import { z } from "zod";
 import path3 from "path";
 import { createHash } from "crypto";
+function getInterventionSharing(config) {
+  return { correctionKeywords: config.sharing?.intervention?.correctionKeywords ?? [] };
+}
 function getHooksSharing(config) {
   const h = config.sharing?.hooks;
   return {
@@ -722,6 +727,9 @@ function scopedToolPaths(teamConfig, localConfig) {
 function isSelfMode(localConfig) {
   return localConfig.repo.kind === "self";
 }
+function usesReportsBranch(localConfig) {
+  return localConfig.repo.kind !== "http";
+}
 function getKnowledgeDir(localConfig) {
   return localConfig.repo.localPath;
 }
@@ -730,10 +738,13 @@ function getDataHome(localConfig) {
   return getTeamaiHome(localConfig.scope, localConfig.projectRoot);
 }
 function getReportsDir(localConfig) {
+  if (!usesReportsBranch(localConfig)) {
+    return localConfig.repo.localPath;
+  }
   if (isSelfMode(localConfig)) {
     return path3.join(localConfig.repo.localPath, REPORTS_WORKTREE_DIRNAME);
   }
-  return localConfig.repo.localPath;
+  return path3.join(path3.dirname(localConfig.repo.localPath), REPORTS_WORKTREE_DIRNAME);
 }
 function getTeamaiHome(scope, projectRoot) {
   if (scope === "project") {
@@ -872,6 +883,15 @@ var init_types = __esm({
         allowedCommands: z.array(z.string()).default([]),
         /** Allowed http/sse hosts (supports a leading `*.` wildcard). Empty = no restriction. */
         allowedHosts: z.array(z.string()).default([])
+      }).optional(),
+      // Optional (not .default) so existing TeamaiConfig literals stay valid; use
+      // getInterventionSharing() for the defaulted view.
+      intervention: z.object({
+        /** Extra course-correction keywords, merged with the built-in list
+         *  (CORRECTION_KEYWORDS). Teams add the words their members actually type,
+         *  e.g. Spanish "rehazlo" or "no era eso". Matched case-insensitively; a
+         *  keyword in a space-separated script must appear as a whole word. */
+        correctionKeywords: z.array(z.string()).default([])
       }).optional()
     });
     SourceConfigSchema = z.object({
@@ -948,6 +968,19 @@ var init_types = __esm({
           mcp: ".qoder/settings.json",
           mcpProject: ".qoder/settings.json"
         },
+        // Kiro: skills, steering (rules), and custom agents sync to .kiro/. Kiro CLI
+        // 2.x stores lifecycle hooks inside each .kiro/agents/*.json config. The
+        // Kiro agent renderer therefore embeds TeamAI's session-start dispatch as
+        // `hooks.agentSpawn`; there is no standalone `settings` hook surface.
+        // MCP uses the dedicated, mcpServers-only .kiro/settings/mcp.json:
+        // https://kiro.dev/docs/mcp/configuration/
+        kiro: {
+          skills: ".kiro/skills",
+          rules: ".kiro/steering",
+          agents: ".kiro/agents",
+          mcp: ".kiro/settings/mcp.json",
+          mcpProject: ".kiro/settings/mcp.json"
+        },
         // ZCode: user-level config lives at ~/.zcode/cli/config.json (a shared file
         // that also carries plugin state — reconcile must merge, never replace).
         // Hooks are Claude-shaped but nested under `hooks.events` and gated by
@@ -1009,6 +1042,8 @@ var init_types = __esm({
          *           Knowledge lives on main under <businessRepoRoot>/.teamai/;
          *           reports (members/sessions/votes/stats) live on the
          *           `teamai-reports` orphan branch. localPath = <businessRepoRoot>/.teamai.
+         * Independent git clones (`kind: 'git'` or omitted) use the same reports
+         * branch; the worktree sits beside the clone, not inside it.
          */
         kind: z.enum(["git", "http", "self"]).optional(),
         /** Base URL of the HTTP team repo (only when kind === 'http'). */
@@ -1212,9 +1247,178 @@ var init_types = __esm({
   }
 });
 
+// src/roles.ts
+var roles_exports = {};
+__export(roles_exports, {
+  activeRoleIds: () => activeRoleIds,
+  describeRoles: () => describeRoles,
+  findRole: () => findRole,
+  listRoleIds: () => listRoleIds,
+  loadRolesManifest: () => loadRolesManifest,
+  matchesRoles: () => matchesRoles,
+  resolveRoleResourceNamespaces: () => resolveRoleResourceNamespaces,
+  saveRolesManifest: () => saveRolesManifest,
+  warnUnknownRoleIds: () => warnUnknownRoleIds
+});
+import path4 from "path";
+import YAML from "yaml";
+import { z as z2 } from "zod";
+function validateManifestShape(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid roles manifest: expected an object");
+  }
+  const candidate = raw;
+  const roles = candidate.roles;
+  if (!Array.isArray(roles) || roles.length === 0) {
+    throw new Error("Invalid roles manifest: roles must be a non-empty array");
+  }
+  for (const role of roles) {
+    if (!role || typeof role !== "object") {
+      throw new Error("Invalid roles manifest: every role must be an object");
+    }
+    const resources = role.resources;
+    if (!resources || typeof resources !== "object" || Array.isArray(resources)) {
+      throw new Error(`Invalid roles manifest: role ${role.id ?? "<unknown>"} is missing resources`);
+    }
+    const ALLOWED_RESOURCE_KEYS = /* @__PURE__ */ new Set([...ROLE_RESOURCE_TYPES, "learnings"]);
+    for (const key of Object.keys(resources)) {
+      if (!ALLOWED_RESOURCE_KEYS.has(key)) {
+        throw new Error(`Invalid roles manifest: unknown resource type "${key}"`);
+      }
+    }
+  }
+  const manifest = RolesManifestSchema.parse(raw);
+  const ids = /* @__PURE__ */ new Set();
+  for (const role of manifest.roles) {
+    if (ids.has(role.id)) {
+      throw new Error(`Invalid roles manifest: duplicate role id "${role.id}"`);
+    }
+    ids.add(role.id);
+  }
+  return manifest;
+}
+async function loadRolesManifest(repoPath) {
+  const manifestPath = path4.join(repoPath, "manifest", "roles.yaml");
+  const content = await readFileSafe(manifestPath);
+  if (!content) {
+    throw new Error(`Roles manifest not found: ${manifestPath}`);
+  }
+  let raw;
+  try {
+    raw = YAML.parse(content);
+  } catch (error) {
+    throw new Error(`Invalid roles manifest YAML: ${error.message}`);
+  }
+  return validateManifestShape(raw);
+}
+async function saveRolesManifest(repoPath, manifest) {
+  validateManifestShape(manifest);
+  const manifestDir = path4.join(repoPath, "manifest");
+  const manifestPath = path4.join(manifestDir, "roles.yaml");
+  await ensureDir(manifestDir);
+  await writeFile(manifestPath, YAML.stringify(manifest));
+}
+function findRole(manifest, roleId) {
+  return manifest.roles.find((candidate) => candidate.id === roleId);
+}
+function listRoleIds(manifest) {
+  return manifest.roles.map((role) => role.id);
+}
+function describeRoles(roles) {
+  return roles.map((role) => role.description ? `${role.id}: ${role.description}` : `${role.id}`);
+}
+function getRoleOrThrow(manifest, roleId) {
+  const role = manifest.roles.find((candidate) => candidate.id === roleId);
+  if (!role) {
+    throw new Error(`Unknown role "${roleId}". Valid roles: ${listRoleIds(manifest).join(", ")}`);
+  }
+  return role;
+}
+function resolveRoleResourceNamespaces(input) {
+  const resolvedRoles = [
+    getRoleOrThrow(input.manifest, input.primaryRole),
+    ...input.additionalRoles.map((roleId) => getRoleOrThrow(input.manifest, roleId))
+  ];
+  const namespaces = {
+    knowledge: [],
+    skills: [],
+    // Roles never contribute learnings namespaces; only projects do. Kept empty
+    // so the shape matches project resolution for a clean union at the call site.
+    learnings: [],
+    agents: []
+  };
+  for (const type of ROLE_RESOURCE_TYPES) {
+    const seen = /* @__PURE__ */ new Set();
+    for (const role of resolvedRoles) {
+      for (const namespace of role.resources[type]) {
+        if (seen.has(namespace)) continue;
+        seen.add(namespace);
+        namespaces[type].push(namespace);
+      }
+    }
+  }
+  return namespaces;
+}
+function activeRoleIds(localConfig) {
+  if (!localConfig.primaryRole) return null;
+  return [.../* @__PURE__ */ new Set([localConfig.primaryRole, ...localConfig.additionalRoles ?? []])];
+}
+function matchesRoles(entryRoles, active) {
+  if (!entryRoles || active == null) return true;
+  return entryRoles.some((role) => active.includes(role));
+}
+async function warnUnknownRoleIds(repoPath, file, entries) {
+  if (!entries.some((entry) => entry.roles && entry.roles.length > 0)) return;
+  let known;
+  try {
+    known = new Set(listRoleIds(await loadRolesManifest(repoPath)));
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    for (const role of entry.roles ?? []) {
+      if (known.has(role) || reportedUnknownRoles.has(`${file}:${role}`)) continue;
+      reportedUnknownRoles.add(`${file}:${role}`);
+      log.warn(`roles: unknown role id "${role}" in ${file} ${entry.kind} "${entry.name}". Valid roles: ${[...known].join(", ")}`);
+    }
+  }
+}
+var ROLE_RESOURCE_TYPES, RoleResourceNamespacesSchema, RoleSchema, RolesManifestSchema, reportedUnknownRoles;
+var init_roles = __esm({
+  "src/roles.ts"() {
+    "use strict";
+    init_fs();
+    init_logger();
+    ROLE_RESOURCE_TYPES = ["knowledge", "skills", "agents"];
+    RoleResourceNamespacesSchema = z2.object({
+      knowledge: z2.array(z2.string().min(1)),
+      skills: z2.array(z2.string().min(1)),
+      // Optional: a role without `agents` receives root-level agents only, which
+      // is what every manifest written before this key existed already got.
+      agents: z2.array(z2.string().min(1)).default([]),
+      // learnings is accepted for backward compatibility but ignored at runtime.
+      // All learnings are shared flat across the entire team (no namespace isolation).
+      learnings: z2.array(z2.string()).optional()
+    });
+    RoleSchema = z2.object({
+      id: z2.string().min(1),
+      description: z2.string().default(""),
+      resources: RoleResourceNamespacesSchema
+    });
+    RolesManifestSchema = z2.object({
+      version: z2.number(),
+      roles: z2.array(RoleSchema).min(1),
+      // defaults.shareTarget was removed: learnings are flat, no namespace routing needed.
+      // Old manifests with a defaults block are still parseable (z.passthrough on object level).
+      defaults: z2.object({}).passthrough().optional()
+    });
+    reportedUnknownRoles = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/bundled-runtime.ts
 import fs2 from "fs";
-import path4 from "path";
+import path5 from "path";
 function compareSemver(a, b) {
   const aParts = a.split(".").map((s) => parseInt(s, 10) || 0);
   const bParts = b.split(".").map((s) => parseInt(s, 10) || 0);
@@ -1230,18 +1434,18 @@ function pickLatestVersion(versions) {
   return versions.reduce((best, v) => compareSemver(v, best) > 0 ? v : best, versions[0]);
 }
 function latestVersionDir(relDir) {
-  const versionsDir = path4.join(getUserHome(), relDir);
+  const versionsDir = path5.join(getUserHome(), relDir);
   try {
     const versions = fs2.readdirSync(versionsDir).filter((d) => !d.startsWith("."));
     const latest = pickLatestVersion(versions);
-    return latest ? path4.join(versionsDir, latest) : null;
+    return latest ? path5.join(versionsDir, latest) : null;
   } catch {
     return null;
   }
 }
 function resolveWorkbuddyNode() {
   const dir = latestVersionDir(WORKBUDDY_BUNDLED_NODE_DIR);
-  const nodeBin = dir && path4.join(dir, "bin", "node");
+  const nodeBin = dir && path5.join(dir, "bin", "node");
   return nodeBin && fs2.existsSync(nodeBin) ? nodeBin : null;
 }
 function resolveCodebuddyNode() {
@@ -1251,10 +1455,10 @@ function resolveCodebuddyNode() {
     for (const entry of entries) {
       if (!entry.startsWith(".codebuddy-server")) continue;
       try {
-        const binDir = path4.join(home, entry, "bin");
+        const binDir = path5.join(home, entry, "bin");
         const stableDirs = fs2.readdirSync(binDir).filter((d) => d.startsWith("stable-"));
         for (const stable of stableDirs) {
-          const nodeBin = path4.join(binDir, stable, "node");
+          const nodeBin = path5.join(binDir, stable, "node");
           if (fs2.existsSync(nodeBin)) return nodeBin;
         }
       } catch {
@@ -1270,8 +1474,8 @@ function resolveWorkbuddyShell() {
     if (process.platform === "win32") {
       const dir = latestVersionDir(WORKBUDDY_PORTABLE_GIT_DIR);
       if (dir) {
-        for (const rel of ["bin", path4.join("usr", "bin")]) {
-          const shBin = path4.join(dir, rel, "sh.exe");
+        for (const rel of ["bin", path5.join("usr", "bin")]) {
+          const shBin = path5.join(dir, rel, "sh.exe");
           if (fs2.existsSync(shBin)) {
             _wbShellCache = shBin;
             break;
@@ -1301,7 +1505,7 @@ var init_bundled_runtime = __esm({
 
 // src/builtin-hooks.ts
 import fs3 from "fs";
-import path5 from "path";
+import path6 from "path";
 import { fileURLToPath } from "url";
 function hasShell() {
   if (_hasShellCache === void 0) {
@@ -1316,8 +1520,8 @@ function hasShell() {
 function resolveTeamaiEntryScript() {
   try {
     const thisFile = fileURLToPath(import.meta.url);
-    const distDir = path5.dirname(thisFile);
-    const candidate = path5.join(distDir, "index.js");
+    const distDir = path6.dirname(thisFile);
+    const candidate = path6.join(distDir, "index.js");
     if (fs3.existsSync(candidate)) return candidate;
   } catch {
   }
@@ -1328,8 +1532,8 @@ function ensureTeamaiWrapper() {
   if (!entryScript) return null;
   const nodeBin = resolveWorkbuddyNode() ?? resolveCodebuddyNode() ?? process.argv[0];
   const home = getUserHome();
-  const binDir = path5.join(home, TEAMAI_BIN_DIR);
-  const wrapperPath = path5.join(binDir, WRAPPER_NAME);
+  const binDir = path6.join(home, TEAMAI_BIN_DIR);
+  const wrapperPath = path6.join(binDir, WRAPPER_NAME);
   const script = [
     "#!/bin/sh",
     `# Auto-generated by teamai \u2014 do not edit.`,
@@ -1383,7 +1587,7 @@ function getWrapperDispatchCommand(event, tool, matcher) {
   return `PATH="$HOME/${TEAMAI_BIN_DIR}:$PATH" teamai hook-dispatch ${event} --tool ${tool}${matcherArg} 2>/dev/null || true`;
 }
 function builtinHookDefs(tool) {
-  const withTimeout3 = tool === "cursor" || tool === "workbuddy" || tool === "codebuddy" || tool === "zcode";
+  const withTimeout3 = tool === "cursor" || tool === "workbuddy" || tool === "codebuddy";
   const buildCommand = tool === "zcode" ? getRawDispatchCommand : WRAPPER_TOOLS.has(tool) ? getWrapperDispatchCommand : getDispatchCommand;
   return BUILTIN_HOOK_SPECS.map((spec) => ({
     source: "builtin",
@@ -1427,7 +1631,7 @@ var init_builtin_hooks = __esm({
 });
 
 // src/resources/base.ts
-import path6 from "path";
+import path7 from "path";
 function toolInstallRoot(toolPath) {
   const segments = toolPath.split("/");
   if (segments[0] === ".config" && segments.length > 1) {
@@ -1451,7 +1655,7 @@ var init_base = __esm({
        */
       static async isToolInstalled(toolPath, baseDir) {
         const base = baseDir ?? getUserHome();
-        const toolRoot = path6.join(base, toolInstallRoot(toolPath));
+        const toolRoot = path7.join(base, toolInstallRoot(toolPath));
         return pathExists(toolRoot);
       }
       /**
@@ -1459,7 +1663,7 @@ var init_base = __esm({
        * Returns a Set of resource names that have been explicitly deleted.
        */
       async readTombstones(localConfig) {
-        const tombstonePath = path6.join(localConfig.repo.localPath, this.type, TOMBSTONE_FILE);
+        const tombstonePath = path7.join(localConfig.repo.localPath, this.type, TOMBSTONE_FILE);
         const content = await readFileSafe(tombstonePath);
         if (!content) return /* @__PURE__ */ new Set();
         return new Set(
@@ -1470,9 +1674,9 @@ var init_base = __esm({
        * Append a resource name to the tombstone file, deduplicating and sorting.
        */
       async addTombstone(name, localConfig) {
-        const dir = path6.join(localConfig.repo.localPath, this.type);
+        const dir = path7.join(localConfig.repo.localPath, this.type);
         await ensureDir(dir);
-        const tombstonePath = path6.join(dir, TOMBSTONE_FILE);
+        const tombstonePath = path7.join(dir, TOMBSTONE_FILE);
         const existing = await this.readTombstones(localConfig);
         existing.add(name);
         const sorted = [...existing].sort();
@@ -1495,17 +1699,17 @@ var init_base = __esm({
 });
 
 // src/resources/hooks.ts
-import path7 from "path";
-import { z as z2 } from "zod";
-import YAML from "yaml";
+import path8 from "path";
+import { z as z3 } from "zod";
+import YAML2 from "yaml";
 function teamHooksYamlPath(repoPath) {
-  return path7.join(repoPath, "hooks", "hooks.yaml");
+  return path8.join(repoPath, "hooks", "hooks.yaml");
 }
 async function parseHooksYaml(repoPath) {
   const content = await readFileSafe(teamHooksYamlPath(repoPath));
   if (!content) return null;
   try {
-    return HooksYamlSchema.parse(YAML.parse(content));
+    return HooksYamlSchema.parse(YAML2.parse(content));
   } catch (e) {
     log.warn(`Invalid hooks.yaml format: ${e.message} \u2014 skipping team hooks this run`);
     return null;
@@ -1520,7 +1724,8 @@ function teamHookToDef(h) {
     command: h.command,
     timeout: h.timeout,
     description: `${TEAMAI_CUSTOM_HOOK_PREFIX}${h.id}] ${h.description}`,
-    tools: h.tools
+    tools: h.tools,
+    roles: h.roles
   };
 }
 async function parseTeamHooks(repoPath) {
@@ -1544,6 +1749,8 @@ async function resolveTeamHooks(teamConfig, repoPath, opts = {}) {
     if (defs.length > 0) log.warn(`Team hooks disabled (TEAMAI_HOOKS_DISABLED) \u2014 skipping ${defs.length} team hook(s)`);
     return { defs: [], builtin };
   }
+  await warnUnknownRoleIds(repoPath, "hooks.yaml", defs.map((d) => ({ kind: "hook", name: d.key, roles: d.roles })));
+  defs = defs.filter((d) => matchesRoles(d.roles, opts.activeRoles));
   if (sharing.requireTeamScripts) {
     const before = defs.length;
     defs = defs.filter((d) => isTeamScriptCommand(d.command));
@@ -1570,28 +1777,31 @@ var init_hooks = __esm({
     init_types();
     init_fs();
     init_logger();
-    TeamHookSchema = z2.object({
+    init_roles();
+    TeamHookSchema = z3.object({
       /** Unique id (marker + manifest index). */
-      id: z2.string().regex(/^[a-z0-9-]+$/),
+      id: z3.string().regex(/^[a-z0-9-]+$/),
       /** Written into the hook description. */
-      description: z2.string(),
+      description: z3.string(),
       /** Claude PascalCase event name. */
-      event: z2.string().min(1),
+      event: z3.string().min(1),
       /** Optional tool matcher (e.g. "Bash"). */
-      matcher: z2.string().optional(),
+      matcher: z3.string().optional(),
       /** Shell command to run. */
-      command: z2.string().min(1),
+      command: z3.string().min(1),
       /** Optional per-hook timeout in seconds. */
-      timeout: z2.number().optional(),
+      timeout: z3.number().optional(),
       /** Optional restriction to specific tools (default = all hook-capable tools). */
-      tools: z2.array(z2.string()).optional()
+      tools: z3.array(z3.string()).optional(),
+      /** Optional restriction to members holding one of these role ids (default = every member). */
+      roles: z3.array(z3.string()).optional()
     });
-    BuiltinOverrideSchema = z2.object({
-      disabled: z2.array(z2.string()).default([]),
-      overrides: z2.record(z2.string(), z2.object({ timeout: z2.number().optional() })).default({})
+    BuiltinOverrideSchema = z3.object({
+      disabled: z3.array(z3.string()).default([]),
+      overrides: z3.record(z3.string(), z3.object({ timeout: z3.number().optional() })).default({})
     }).default({ disabled: [], overrides: {} });
-    HooksYamlSchema = z2.object({
-      hooks: z2.array(TeamHookSchema).default([]),
+    HooksYamlSchema = z3.object({
+      hooks: z3.array(TeamHookSchema).default([]),
       builtin: BuiltinOverrideSchema
     });
     HooksHandler = class extends ResourceHandler {
@@ -1635,10 +1845,10 @@ __export(opencode_hooks_exports, {
   removeOpencodeHooks: () => removeOpencodeHooks,
   resolveOpencodePluginDir: () => resolveOpencodePluginDir
 });
-import path8 from "path";
+import path9 from "path";
 function resolveOpencodePluginDir(baseDir, scope) {
-  const configDir = scope === "project" ? ".opencode" : path8.join(".config", "opencode");
-  return path8.join(baseDir, configDir, OPENCODE_PLUGIN_DIR);
+  const configDir = scope === "project" ? ".opencode" : path9.join(".config", "opencode");
+  return path9.join(baseDir, configDir, OPENCODE_PLUGIN_DIR);
 }
 function buildPluginSource() {
   return `// ${TEAMAI_MARKER} hooks plugin \u2014 generated by teamai, do not edit by hand.
@@ -1720,20 +1930,20 @@ export const TeamaiHooks = async ({ $, directory, worktree }) => {
 async function injectOpencodeHooks(baseDir, scope) {
   const dir = resolveOpencodePluginDir(baseDir, scope);
   await ensureDir(dir);
-  const file = path8.join(dir, OPENCODE_HOOK_FILE);
+  const file = path9.join(dir, OPENCODE_HOOK_FILE);
   await writeFile(file, buildPluginSource());
   log.success(`Injected teamai OpenCode hook into ${file}`);
 }
 async function removeOpencodeHooks(baseDir, scope) {
   const dir = resolveOpencodePluginDir(baseDir, scope);
-  const file = path8.join(dir, OPENCODE_HOOK_FILE);
+  const file = path9.join(dir, OPENCODE_HOOK_FILE);
   if (await pathExists(file)) {
     await remove(file);
     log.success(`Removed teamai OpenCode hook from ${file}`);
   }
 }
 function assertSafeSlug(slug) {
-  if (!slug || slug.includes("/") || slug.includes("\\") || slug.includes("..") || path8.isAbsolute(slug)) {
+  if (!slug || slug.includes("/") || slug.includes("\\") || slug.includes("..") || path9.isAbsolute(slug)) {
     throw new Error(`Invalid agent-hook slug: ${slug}`);
   }
 }
@@ -1785,14 +1995,14 @@ async function applyOpencodeAgentHook(def) {
   }
   const dir = resolveOpencodePluginDir(def.baseDir, def.scope);
   await ensureDir(dir);
-  const file = path8.join(dir, `teamai-agent-${def.slug}.ts`);
+  const file = path9.join(dir, `teamai-agent-${def.slug}.ts`);
   await writeFile(file, buildAgentHookPluginSource(def.slug, ocEvent, def.command, def.matcher));
   log.success(`Installed OpenCode agent hook [${def.slug}] in ${file}`);
 }
 async function removeOpencodeAgentHook(opts) {
   assertSafeSlug(opts.slug);
   const dir = resolveOpencodePluginDir(opts.baseDir, opts.scope);
-  const file = path8.join(dir, `teamai-agent-${opts.slug}.ts`);
+  const file = path9.join(dir, `teamai-agent-${opts.slug}.ts`);
   if (await pathExists(file)) {
     await remove(file);
     log.success(`Removed OpenCode agent hook [${opts.slug}] from ${file}`);
@@ -1828,13 +2038,13 @@ __export(openclaw_hooks_exports, {
   resolveOpenClawHooksDir: () => resolveOpenClawHooksDir,
   resolveOpenclawWorkspaceDir: () => resolveOpenclawWorkspaceDir
 });
-import path9 from "path";
+import path10 from "path";
 function resolveOpenClawHooksDir(tool) {
   if (tool === "openclaw" && process.env.OPENCLAW_STATE_DIR) {
-    return path9.join(process.env.OPENCLAW_STATE_DIR, "hooks");
+    return path10.join(process.env.OPENCLAW_STATE_DIR, "hooks");
   }
   const home = getUserHome();
-  return path9.join(home, `.${tool}`, "hooks");
+  return path10.join(home, `.${tool}`, "hooks");
 }
 function buildHookMd(tool) {
   const events = Object.keys(EVENT_MAP);
@@ -1880,21 +2090,21 @@ async function injectOpenClawHooks(workspacePath, tool = "openclaw") {
     log.debug(`openclaw: skip hook injection for ${tool} \u2014 workspace dir not found`);
     return;
   }
-  const dir = path9.join(wsDir, "hooks", OPENCLAW_HOOK_DIR);
+  const dir = path10.join(wsDir, "hooks", OPENCLAW_HOOK_DIR);
   await ensureDir(dir);
-  await writeFile(path9.join(dir, "HOOK.md"), buildHookMd(tool));
-  await writeFile(path9.join(dir, "handler.ts"), buildHandlerTs(tool));
+  await writeFile(path10.join(dir, "HOOK.md"), buildHookMd(tool));
+  await writeFile(path10.join(dir, "handler.ts"), buildHandlerTs(tool));
   log.success(`Injected teamai OpenClaw hook into ${dir}`);
   await enableOpenClawInternalHooks(tool);
 }
 async function enableOpenClawInternalHooks(tool = "openclaw") {
   if (tool !== "openclaw") return;
   const stateDir = process.env.OPENCLAW_STATE_DIR;
-  if (!stateDir || !path9.isAbsolute(stateDir)) {
+  if (!stateDir || !path10.isAbsolute(stateDir)) {
     log.debug("openclaw: skip enabling internal hooks \u2014 OPENCLAW_STATE_DIR unset or not absolute");
     return;
   }
-  const cfgPath = path9.join(stateDir, "openclaw.json");
+  const cfgPath = path10.join(stateDir, "openclaw.json");
   try {
     const cfg = await readJson(cfgPath) ?? {};
     const hooksVal = cfg.hooks;
@@ -1915,13 +2125,13 @@ async function enableOpenClawInternalHooks(tool = "openclaw") {
   }
 }
 async function removeOpenClawHooks(hooksDir) {
-  const dir = path9.join(hooksDir, OPENCLAW_HOOK_DIR);
+  const dir = path10.join(hooksDir, OPENCLAW_HOOK_DIR);
   if (await pathExists(dir)) {
     await remove(dir);
     log.success(`Removed teamai OpenClaw hook from ${dir}`);
   }
   if (process.env.OPENCLAW_STATE_DIR) {
-    const altDir = path9.join(process.env.OPENCLAW_STATE_DIR, "hooks", OPENCLAW_HOOK_DIR);
+    const altDir = path10.join(process.env.OPENCLAW_STATE_DIR, "hooks", OPENCLAW_HOOK_DIR);
     if (altDir !== dir && await pathExists(altDir)) {
       await remove(altDir);
       log.success(`Removed teamai OpenClaw hook from ${altDir}`);
@@ -1970,16 +2180,16 @@ async function applyOpenClawAgentHook(def) {
   }
   const tool = def.tool ?? "openclaw";
   const hooksDir = resolveOpenClawHooksDir(tool);
-  const dir = path9.join(hooksDir, def.slug);
+  const dir = path10.join(hooksDir, def.slug);
   await ensureDir(dir);
-  await writeFile(path9.join(dir, "HOOK.md"), buildAgentHookMd(def.slug, openclawEvent));
-  await writeFile(path9.join(dir, "handler.ts"), buildAgentHandlerTs(def.command, def.timeout ?? 10));
+  await writeFile(path10.join(dir, "HOOK.md"), buildAgentHookMd(def.slug, openclawEvent));
+  await writeFile(path10.join(dir, "handler.ts"), buildAgentHandlerTs(def.command, def.timeout ?? 10));
   log.success(`Installed OpenClaw agent hook [${def.slug}] in ${dir}`);
 }
 async function removeOpenClawAgentHook(opts) {
   const tool = opts.tool ?? "openclaw";
   const hooksDir = resolveOpenClawHooksDir(tool);
-  const dir = path9.join(hooksDir, opts.slug);
+  const dir = path10.join(hooksDir, opts.slug);
   if (await pathExists(dir)) {
     await remove(dir);
     log.success(`Removed OpenClaw agent hook [${opts.slug}] from ${dir}`);
@@ -1989,8 +2199,8 @@ async function resolveOpenclawWorkspaceDir(workspacePath) {
   const candidates = [];
   if (workspacePath) candidates.push(workspacePath);
   const stateDir = process.env.OPENCLAW_STATE_DIR;
-  if (stateDir && path9.isAbsolute(stateDir)) {
-    const cfgRaw = await readFileSafe(path9.join(stateDir, "openclaw.json"));
+  if (stateDir && path10.isAbsolute(stateDir)) {
+    const cfgRaw = await readFileSafe(path10.join(stateDir, "openclaw.json"));
     if (cfgRaw) {
       try {
         const cfg = JSON.parse(cfgRaw);
@@ -2001,7 +2211,7 @@ async function resolveOpenclawWorkspaceDir(workspacePath) {
       }
     }
   }
-  candidates.push(path9.join(getUserHome(), ".openclaw", "workspace"));
+  candidates.push(path10.join(getUserHome(), ".openclaw", "workspace"));
   for (const candidate of candidates) {
     if (await pathExists(candidate)) {
       log.debug(`openclaw: resolved workspace dir to ${candidate}`);
@@ -2036,14 +2246,14 @@ var hermes_home_exports = {};
 __export(hermes_home_exports, {
   getHermesHome: () => getHermesHome
 });
-import path10 from "path";
+import path11 from "path";
 import { homedir } from "os";
 function getHermesHome() {
   const fromEnv = process.env.HERMES_HOME;
   if (fromEnv && fromEnv.trim() !== "") {
-    return path10.resolve(fromEnv);
+    return path11.resolve(fromEnv);
   }
-  return path10.join(homedir(), ".hermes");
+  return path11.join(homedir(), ".hermes");
 }
 var init_hermes_home = __esm({
   "src/hermes-home.ts"() {
@@ -2064,20 +2274,20 @@ __export(hermes_config_exports, {
   upsertHermesHook: () => upsertHermesHook,
   upsertSoulRules: () => upsertSoulRules
 });
-import YAML2 from "yaml";
-import path11 from "path";
+import YAML3 from "yaml";
+import path12 from "path";
 function getHermesConfigPath() {
-  return path11.join(getHermesHome(), "config.yaml");
+  return path12.join(getHermesHome(), "config.yaml");
 }
 function getHermesSoulPath() {
-  return path11.join(getHermesHome(), "SOUL.md");
+  return path12.join(getHermesHome(), "SOUL.md");
 }
 async function readConfigDoc() {
   const content = await readFileSafe(getHermesConfigPath());
-  if (!content || content.trim() === "") return new YAML2.Document({});
-  const doc = YAML2.parseDocument(content);
-  if (!doc.contents || !YAML2.isMap(doc.contents)) {
-    return new YAML2.Document({});
+  if (!content || content.trim() === "") return new YAML3.Document({});
+  const doc = YAML3.parseDocument(content);
+  if (!doc.contents || !YAML3.isMap(doc.contents)) {
+    return new YAML3.Document({});
   }
   return doc;
 }
@@ -2150,12 +2360,12 @@ async function removeSoulRules() {
   await upsertSoulRules("");
 }
 function getHermesAllowlistPath() {
-  return path11.join(getHermesHome(), "shell-hooks-allowlist.json");
+  return path12.join(getHermesHome(), "shell-hooks-allowlist.json");
 }
 async function upsertHermesHook(event, entry) {
   const doc = await readConfigDoc();
   const rawSeq = doc.getIn(["hooks", event]);
-  const currentJs = YAML2.isSeq(rawSeq) ? rawSeq.toJSON() : rawSeq;
+  const currentJs = YAML3.isSeq(rawSeq) ? rawSeq.toJSON() : rawSeq;
   const arr = Array.isArray(currentJs) ? currentJs : [];
   const untouched = arr.filter((e) => e && typeof e === "object" && e.command !== entry.command);
   const cleanEntry = { command: entry.command };
@@ -2169,7 +2379,7 @@ async function upsertHermesHook(event, entry) {
 async function removeHermesHookByCommand(command) {
   const doc = await readConfigDoc();
   const rawHooks = doc.getIn(["hooks"]);
-  const hooks = YAML2.isMap(rawHooks) ? rawHooks.toJSON() : null;
+  const hooks = YAML3.isMap(rawHooks) ? rawHooks.toJSON() : null;
   if (!hooks || typeof hooks !== "object") return;
   let changed = false;
   for (const event of Object.keys(hooks)) {
@@ -2186,7 +2396,7 @@ async function removeHermesHookByCommand(command) {
   }
   if (!changed) return;
   const remainingRaw = doc.getIn(["hooks"]);
-  const remaining = YAML2.isMap(remainingRaw) ? remainingRaw.toJSON() : null;
+  const remaining = YAML3.isMap(remainingRaw) ? remainingRaw.toJSON() : null;
   if (!remaining || Object.keys(remaining).length === 0) {
     doc.deleteIn(["hooks"]);
   }
@@ -2231,10 +2441,10 @@ __export(hermes_hooks_exports, {
   removeHermesAgentHook: () => removeHermesAgentHook,
   removeHermesHooks: () => removeHermesHooks
 });
-import path12 from "path";
+import path13 from "path";
 import { chmod } from "fs/promises";
 function getReportScriptPath() {
-  return path12.join(getHermesHome(), "hooks", "teamai-status-report.sh");
+  return path13.join(getHermesHome(), "hooks", "teamai-status-report.sh");
 }
 function buildReportScript() {
   return [
@@ -2246,7 +2456,7 @@ function buildReportScript() {
 }
 async function injectHermesHooks() {
   const scriptPath = getReportScriptPath();
-  await ensureDir(path12.dirname(scriptPath));
+  await ensureDir(path13.dirname(scriptPath));
   await writeFile(scriptPath, buildReportScript());
   try {
     await chmod(scriptPath, 493);
@@ -2321,7 +2531,7 @@ __export(hooks_exports, {
   removeHooks: () => removeHooks,
   sweepLegacyProjectHooks: () => sweepLegacyProjectHooks
 });
-import path13 from "path";
+import path14 from "path";
 import { realpathSync } from "fs";
 function detectFormat(tool) {
   if (CODEX_TOOLS.has(tool)) return "codex";
@@ -2354,7 +2564,7 @@ function canonicalProjectRoot(projectRoot) {
   try {
     return realpathSync.native(projectRoot);
   } catch {
-    return path13.resolve(projectRoot);
+    return path14.resolve(projectRoot);
   }
 }
 function gateTeamHookCommand(command, projectRoot) {
@@ -2414,16 +2624,31 @@ function toCodexEntry(def) {
   return entry;
 }
 function toZcodeEntry(def) {
-  const entry = {
+  const ZCODE_TIMEOUT_MS = {
+    SessionStart: 18e4,
+    Stop: 6e4,
+    PostToolUse: 3e4,
+    UserPromptSubmit: 6e4
+  };
+  const timeoutMs = def.timeout !== void 0 ? def.timeout * 1e3 : ZCODE_TIMEOUT_MS[def.event] ?? 6e4;
+  const entry = process.platform === "win32" ? {
+    // Windows must NOT spawn bare `bash`: CreateProcess resolves it to
+    // System32's WSL launcher before any PATH directory, and the WSL side
+    // has a different $HOME (no ~/.teamai state) and often no Node ≥ 20.
+    // cmd.exe is always present in System32 and resolves teamai from the
+    // Windows PATH (the npm shim is a .cmd, so a shell is required).
+    type: "process",
+    command: "cmd",
+    args: ["/c", def.command],
+    timeoutMs
+  } : {
     type: "process",
     command: "bash",
-    // Stored verbatim: the shell payload must equal `def.command` exactly so
-    // managed-entry detection and the managed-hooks manifest share one command
-    // representation (the same invariant the Codex format keeps). teamai
-    // hook-dispatch is silent and failure-tolerant on its success paths, so no
-    // shell redirection is layered on top of the payload.
+    // Stored verbatim: the shell payload must equal `def.command` exactly
+    // so managed-entry detection and the managed-hooks manifest share one
+    // command representation (the same invariant the Codex format keeps).
     args: ["-lc", def.command],
-    ...def.timeout !== void 0 ? { timeoutMs: def.timeout * 1e3 } : {}
+    timeoutMs
   };
   const group = { hooks: [entry] };
   if (def.matcher && def.matcher !== "*") group.matcher = def.matcher;
@@ -2431,7 +2656,7 @@ function toZcodeEntry(def) {
 }
 function zcodeEntryCommand(entry) {
   const hook = entry.hooks?.[0];
-  if (hook?.command === "bash" && hook.args?.[0] === "-lc") return hook.args[1] ?? "";
+  if (Array.isArray(hook?.args) && hook.args.length > 1) return hook.args[1] ?? "";
   return hook?.command ?? "";
 }
 function desiredEventOrder(defs, mapEvent) {
@@ -2465,7 +2690,7 @@ async function reconcileClaudeFormat(settingsPath, tool, teamDefs, opts, teamAct
     return true;
   };
   const expanded = expandHome(settingsPath);
-  await ensureDir(path13.dirname(expanded));
+  await ensureDir(path14.dirname(expanded));
   const settings = await readJson(expanded) ?? {};
   if (!settings.hooks) settings.hooks = {};
   let changed = false;
@@ -2497,7 +2722,7 @@ async function reconcileClaudeFormat(settingsPath, tool, teamDefs, opts, teamAct
 }
 async function reconcileCursorFormat(hooksPath, tool, teamDefs, opts, priorTeamCommands) {
   const expanded = expandHome(hooksPath);
-  await ensureDir(path13.dirname(expanded));
+  await ensureDir(path14.dirname(expanded));
   const hooksJson = await readJson(expanded) ?? { version: 1, hooks: {} };
   if (!hooksJson.version) hooksJson.version = 1;
   if (!hooksJson.hooks) hooksJson.hooks = {};
@@ -2545,7 +2770,7 @@ async function reconcileCursorFormat(hooksPath, tool, teamDefs, opts, priorTeamC
 }
 async function reconcileCodexFormat(hooksPath, tool, teamDefs, opts, priorTeamCommands) {
   const expanded = expandHome(hooksPath);
-  await ensureDir(path13.dirname(expanded));
+  await ensureDir(path14.dirname(expanded));
   const hooksJson = await readJson(expanded) ?? {};
   if (!hooksJson.hooks) hooksJson.hooks = {};
   const isManaged = (entry) => {
@@ -2575,10 +2800,15 @@ async function reconcileCodexFormat(hooksPath, tool, teamDefs, opts, priorTeamCo
 }
 async function reconcileZcodeFormat(settingsPath, tool, teamDefs, opts, priorTeamCommands) {
   const expanded = expandHome(settingsPath);
-  await ensureDir(path13.dirname(expanded));
+  await ensureDir(path14.dirname(expanded));
   const cfg = await readJson(expanded) ?? {};
   if (!cfg.hooks) cfg.hooks = {};
   let changed = false;
+  const unknownHookKeys = Object.keys(cfg.hooks).filter((k) => k !== "enabled" && k !== "events");
+  if (unknownHookKeys.length > 0) {
+    for (const k of unknownHookKeys) delete cfg.hooks[k];
+    changed = true;
+  }
   if (!opts.removeAll && cfg.hooks.enabled !== true) {
     cfg.hooks.enabled = true;
     changed = true;
@@ -2628,7 +2858,7 @@ function isAgentClaudeEntry(entry, slug) {
 async function applyAgentHook(settingsPath, tool, def) {
   const format = detectFormat(tool);
   const expanded = expandHome(settingsPath);
-  await ensureDir(path13.dirname(expanded));
+  await ensureDir(path14.dirname(expanded));
   const hookDef = {
     source: "team",
     key: def.slug,
@@ -2854,15 +3084,15 @@ async function hasTeamaiHooks(settingsPath, tool, manifestPath) {
 async function reconcileOpencodePlugin(baseDir, removeAll = false, installedBaseDir) {
   const home = getUserHome();
   const { injectOpencodeHooks: injectOpencodeHooks2, removeOpencodeHooks: removeOpencodeHooks2 } = await Promise.resolve().then(() => (init_opencode_hooks(), opencode_hooks_exports));
-  if (path13.resolve(baseDir) !== path13.resolve(home)) {
+  if (path14.resolve(baseDir) !== path14.resolve(home)) {
     await removeOpencodeHooks2(baseDir, "project");
   }
   if (removeAll) {
     await removeOpencodeHooks2(home, "user");
     return;
   }
-  const homeInstalled = await pathExists(path13.join(home, ".config", "opencode"));
-  const projectInstalled = installedBaseDir ? await pathExists(path13.join(installedBaseDir, ".opencode")) : false;
+  const homeInstalled = await pathExists(path14.join(home, ".config", "opencode"));
+  const projectInstalled = installedBaseDir ? await pathExists(path14.join(installedBaseDir, ".opencode")) : false;
   if (homeInstalled || projectInstalled) {
     await injectOpencodeHooks2(home, "user");
   }
@@ -2876,9 +3106,9 @@ async function injectHooksToAllTools(toolPaths, baseDir, filterAgents2) {
     if (filterAgents2 && !filterAgents2.includes(tool)) continue;
     if (skipped.has(tool)) continue;
     if (paths.settings) {
-      const toolRoot = path13.join(resolvedBaseDir, paths.settings.split("/")[0]);
+      const toolRoot = path14.join(resolvedBaseDir, paths.settings.split("/")[0]);
       if (!await pathExists(toolRoot)) continue;
-      const settingsPath = path13.join(resolvedBaseDir, paths.settings);
+      const settingsPath = path14.join(resolvedBaseDir, paths.settings);
       try {
         await injectHooks(settingsPath, tool);
       } catch (e) {
@@ -2941,10 +3171,10 @@ async function reconcileHooksToAllTools(toolPaths, baseDir, teamDefs, manifestPa
       continue;
     }
     if (!paths.settings) continue;
-    const toolRoot = path13.join(baseDir, paths.settings.split("/")[0]);
-    const installedRoot = opts.installedBaseDir ? path13.join(opts.installedBaseDir, paths.settings.split("/")[0]) : toolRoot;
+    const toolRoot = path14.join(baseDir, paths.settings.split("/")[0]);
+    const installedRoot = opts.installedBaseDir ? path14.join(opts.installedBaseDir, paths.settings.split("/")[0]) : toolRoot;
     if (!await pathExists(toolRoot) && !await pathExists(installedRoot)) continue;
-    const settingsPath = path13.join(baseDir, paths.settings);
+    const settingsPath = path14.join(baseDir, paths.settings);
     try {
       await reconcileHooks(settingsPath, tool, teamDefs, {
         manifestPath,
@@ -2960,7 +3190,7 @@ async function reconcileHooksToAllTools(toolPaths, baseDir, teamDefs, manifestPa
 async function hasInstalledCodexTrustGatedTool(toolPaths, baseDir) {
   for (const [tool, paths] of Object.entries(toolPaths)) {
     if (!isCodexTrustGatedTool(tool) || !paths.settings) continue;
-    const toolRoot = path13.join(baseDir, paths.settings.split("/")[0]);
+    const toolRoot = path14.join(baseDir, paths.settings.split("/")[0]);
     if (await pathExists(toolRoot)) return true;
   }
   return false;
@@ -2982,7 +3212,11 @@ async function sweepLegacyProjectHooks(toolPaths, localConfig) {
   }
 }
 async function reconcileTeamHooksForConfig(teamConfig, localConfig, opts = {}) {
-  const { defs: teamDefs, builtin } = opts.removeAll ? { defs: [], builtin: void 0 } : await resolveTeamHooks(teamConfig, localConfig.repo.localPath, { auto: opts.auto, silent: opts.silent });
+  const { defs: teamDefs, builtin } = opts.removeAll ? { defs: [], builtin: void 0 } : await resolveTeamHooks(teamConfig, localConfig.repo.localPath, {
+    auto: opts.auto,
+    silent: opts.silent,
+    activeRoles: activeRoleIds(localConfig)
+  });
   const { baseDir, manifestPath } = resolveHookScope(localConfig);
   let filterAgents2 = opts.filterAgents ?? localConfig.enabledAgents;
   const disabled = localConfig.disabledAgents;
@@ -3008,6 +3242,7 @@ var init_hooks2 = __esm({
     init_logger();
     init_types();
     init_types();
+    init_roles();
     init_builtin_hooks();
     init_hooks();
     init_home();
@@ -3248,7 +3483,7 @@ __export(builtin_rules_exports, {
   LEGACY_RULE_NAMES: () => LEGACY_RULE_NAMES,
   deployBuiltinRules: () => deployBuiltinRules
 });
-import path14 from "path";
+import path15 from "path";
 import fs4 from "fs/promises";
 async function deployBuiltinRules(teamConfig, localConfig, options) {
   const baseDir = localConfig ? resolveBaseDir(localConfig) : getUserHome();
@@ -3263,19 +3498,19 @@ async function deployBuiltinRules(teamConfig, localConfig, options) {
       continue;
     }
     if (localConfig && isAgentExcluded(localConfig, tool)) continue;
-    const rulesDir = path14.join(baseDir, toolPath.rules);
+    const rulesDir = path15.join(baseDir, toolPath.rules);
     if (!await pathExists(rulesDir)) continue;
     try {
       await ensureDir(rulesDir);
       const ext = ruleFileExtensionForTool(tool);
       for (const rule of builtinRules) {
-        const destFile = path14.join(rulesDir, `${rule.name}${ext}`);
+        const destFile = path15.join(rulesDir, `${rule.name}${ext}`);
         const content = usesCursorMdcRules(tool) ? teamRuleToCursorMdc(rule.content) : rule.content;
         await writeFile(destFile, content);
         log.debug(`Deployed built-in rule ${rule.name} \u2192 ${tool}`);
         if (ext !== ".md") {
           try {
-            await fs4.unlink(path14.join(rulesDir, `${rule.name}.md`));
+            await fs4.unlink(path15.join(rulesDir, `${rule.name}.md`));
             log.debug(`Removed legacy .md built-in rule ${rule.name} from ${tool}`);
           } catch {
           }
@@ -3283,7 +3518,7 @@ async function deployBuiltinRules(teamConfig, localConfig, options) {
       }
       for (const legacyName of LEGACY_RULE_NAMES) {
         for (const legacyExt of /* @__PURE__ */ new Set([ext, ".md"])) {
-          const legacyFile = path14.join(rulesDir, `${legacyName}${legacyExt}`);
+          const legacyFile = path15.join(rulesDir, `${legacyName}${legacyExt}`);
           try {
             await fs4.unlink(legacyFile);
             log.debug(`Removed legacy built-in rule ${legacyName} from ${tool}`);
@@ -3370,7 +3605,7 @@ teamai-recall subagent \u7684\u8FD4\u56DE\u91CC\u5DF2\u5217\u51FA\u672C\u6B21\u6
 });
 
 // src/utils/pre-push-sync.ts
-import path15 from "path";
+import path16 from "path";
 async function syncTeamUpdatesToLocal(teamConfig, localConfig, lastPullRev) {
   if (!lastPullRev) {
     log.debug("No lastPullRev \u2014 skipping pre-push sync");
@@ -3382,12 +3617,12 @@ async function syncTeamUpdatesToLocal(teamConfig, localConfig, lastPullRev) {
   await syncSkillsToLocal(teamConfig, localConfig, repoPath, baseDir, lastPullRev);
 }
 async function syncRulesToLocal(teamConfig, localConfig, repoPath, baseDir, lastPullRev) {
-  const teamRulesDir = path15.join(repoPath, "rules");
+  const teamRulesDir = path16.join(repoPath, "rules");
   if (!await pathExists(teamRulesDir)) return;
   for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
     if (!toolPath.rules) continue;
     if (!await ResourceHandler.isToolInstalled(toolPath.rules, baseDir)) continue;
-    const rulesDir = path15.join(baseDir, toolPath.rules);
+    const rulesDir = path16.join(baseDir, toolPath.rules);
     if (!await pathExists(rulesDir)) continue;
     const ext = ruleFileExtensionForTool(tool);
     const isMdcTool = usesCursorMdcRules(tool);
@@ -3396,9 +3631,9 @@ async function syncRulesToLocal(teamConfig, localConfig, repoPath, baseDir, last
       if (!file.endsWith(ext)) continue;
       const name = file.slice(0, -ext.length);
       if (EXCLUDED_RULE_NAMES.has(name)) continue;
-      const localFilePath = path15.join(rulesDir, file);
+      const localFilePath = path16.join(rulesDir, file);
       const teamRelPath = `rules/${name}.md`;
-      const teamFilePath = path15.join(teamRulesDir, `${name}.md`);
+      const teamFilePath = path16.join(teamRulesDir, `${name}.md`);
       if (!await pathExists(teamFilePath)) continue;
       if (isMdcTool) {
         const localRaw = await readFileSafe(localFilePath);
@@ -3424,19 +3659,19 @@ async function syncRulesToLocal(teamConfig, localConfig, repoPath, baseDir, last
   }
 }
 async function syncSkillsToLocal(teamConfig, localConfig, repoPath, baseDir, lastPullRev) {
-  const teamSkillsDir = path15.join(repoPath, "skills");
+  const teamSkillsDir = path16.join(repoPath, "skills");
   if (!await pathExists(teamSkillsDir)) return;
   const teamSkillPaths = /* @__PURE__ */ new Map();
   const topDirs = await listDirs(teamSkillsDir);
   for (const dir of topDirs) {
-    const dirPath = path15.join(teamSkillsDir, dir);
-    if (await pathExists(path15.join(dirPath, "SKILL.md"))) {
+    const dirPath = path16.join(teamSkillsDir, dir);
+    if (await pathExists(path16.join(dirPath, "SKILL.md"))) {
       teamSkillPaths.set(dir, dirPath);
     } else {
       const subDirs = await listDirs(dirPath);
       for (const subDir of subDirs) {
         if (!teamSkillPaths.has(subDir)) {
-          teamSkillPaths.set(subDir, path15.join(dirPath, subDir));
+          teamSkillPaths.set(subDir, path16.join(dirPath, subDir));
         }
       }
     }
@@ -3445,12 +3680,12 @@ async function syncSkillsToLocal(teamConfig, localConfig, repoPath, baseDir, las
   for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
     if (!toolPath.skills) continue;
     if (!await ResourceHandler.isToolInstalled(toolPath.skills, baseDir)) continue;
-    const skillsDir = path15.join(baseDir, toolPath.skills);
+    const skillsDir = path16.join(baseDir, toolPath.skills);
     if (!await pathExists(skillsDir)) continue;
     const localSkillNames = await listDirs(skillsDir);
     for (const skillName of localSkillNames) {
       if (!teamSkillPaths.has(skillName)) continue;
-      const localSkillDir = path15.join(skillsDir, skillName);
+      const localSkillDir = path16.join(skillsDir, skillName);
       const teamSkillDir = teamSkillPaths.get(skillName);
       if (await dirTeamSubsetEqual(localSkillDir, teamSkillDir, [CONTRIBUTORS_FILE3])) continue;
       const teamFiles = await listFilesRecursive(teamSkillDir);
@@ -3458,10 +3693,10 @@ async function syncSkillsToLocal(teamConfig, localConfig, repoPath, baseDir, las
       let anyDiffers = false;
       for (const file of teamFiles) {
         if (file === CONTRIBUTORS_FILE3) continue;
-        const localFile = path15.join(localSkillDir, file);
-        const teamFile = path15.join(teamSkillDir, file);
+        const localFile = path16.join(localSkillDir, file);
+        const teamFile = path16.join(teamSkillDir, file);
         if (!await pathExists(localFile)) {
-          const relFromRepo2 = path15.relative(repoPath, teamFile);
+          const relFromRepo2 = path16.relative(repoPath, teamFile);
           const oldContent2 = await getFileContentAtRev(repoPath, lastPullRev, relFromRepo2);
           if (oldContent2 === null) {
             anyDiffers = true;
@@ -3472,7 +3707,7 @@ async function syncSkillsToLocal(teamConfig, localConfig, repoPath, baseDir, las
         }
         if (await fileContentEqual(localFile, teamFile)) continue;
         anyDiffers = true;
-        const relFromRepo = path15.relative(repoPath, teamFile);
+        const relFromRepo = path16.relative(repoPath, teamFile);
         const oldContent = await getFileContentAtRev(repoPath, lastPullRev, relFromRepo);
         if (oldContent === null) {
           allMatchOld = false;
@@ -3604,12 +3839,12 @@ var init_rest_auth = __esm({
 import { execSync, spawnSync } from "child_process";
 import fs5 from "fs";
 import os2 from "os";
-import path16 from "path";
+import path17 from "path";
 function gfInstallDir() {
-  return path16.join(getTeamaiHomeDir(), "gf");
+  return path17.join(getTeamaiHomeDir(), "gf");
 }
 function gfBinPath() {
-  return path16.join(gfInstallDir(), "gf", "bin", "gf");
+  return path17.join(gfInstallDir(), "gf", "bin", "gf");
 }
 function shellQuote2(s) {
   return "'" + s.replace(/'/g, "'\\''") + "'";
@@ -3747,7 +3982,7 @@ function ensureAuthenticated() {
 }
 function gfGetOAuthToken() {
   try {
-    const netrcPath2 = path16.join(os2.homedir(), ".netrc");
+    const netrcPath2 = path17.join(os2.homedir(), ".netrc");
     if (!fs5.existsSync(netrcPath2)) return null;
     const content = fs5.readFileSync(netrcPath2, "utf-8");
     const match = content.match(
@@ -5599,7 +5834,7 @@ var init_repo_url4 = __esm({
 import { spawnSync as spawnSync5 } from "child_process";
 import fs6 from "fs";
 import os3 from "os";
-import path17 from "path";
+import path18 from "path";
 function gitcodeApiBase() {
   return GITCODE_API_BASE;
 }
@@ -5627,7 +5862,7 @@ function authHeaders3(token) {
   };
 }
 function netrcPath() {
-  return path17.join(os3.homedir(), ".netrc");
+  return path18.join(os3.homedir(), ".netrc");
 }
 function readNetrcToken() {
   try {
@@ -6113,12 +6348,13 @@ function buildRepoInfo5(owner, repo, remoteUrl) {
     projectId: encodeURIComponent(`${owner}/${repo}`)
   };
 }
-function parseGenericGitRepoInput(input) {
+function parseGenericGitRepoInputWithOptions(input, options = {}) {
   const trimmed = input.trim();
-  if (/^http:\/\//i.test(trimmed)) {
+  const allowExistingInsecureOrigin = options.allowExistingInsecureOrigin === true;
+  if (/^http:\/\//i.test(trimmed) && !allowExistingInsecureOrigin) {
     throw invalidRepoUrl("plain HTTP is not supported; use HTTPS or SSH");
   }
-  if (/^https:\/\//i.test(trimmed) || /^ssh:\/\//i.test(trimmed)) {
+  if (/^https?:\/\//i.test(trimmed) || /^ssh:\/\//i.test(trimmed)) {
     let parsed;
     try {
       parsed = new URL(trimmed);
@@ -6126,7 +6362,7 @@ function parseGenericGitRepoInput(input) {
       throw invalidRepoUrl();
     }
     const httpCredentials = /^https?:$/i.test(parsed.protocol) && (parsed.username || parsed.password);
-    if (!parsed.hostname || parsed.password || httpCredentials) {
+    if (!parsed.hostname || !allowExistingInsecureOrigin && (parsed.password || httpCredentials)) {
       throw new Error(
         "Invalid Git repo URL. Do not embed credentials in the URL; configure a Git credential helper or SSH key instead."
       );
@@ -6135,7 +6371,7 @@ function parseGenericGitRepoInput(input) {
       throw invalidRepoUrl("query strings and fragments are not supported");
     }
     const { owner, repo, fullPath } = parsePath(parsed.pathname);
-    const auth = parsed.username ? `${parsed.username}@` : "";
+    const auth = /^ssh:$/i.test(parsed.protocol) && parsed.username ? `${parsed.username}@` : "";
     const remoteUrl = `${parsed.protocol}//${auth}${parsed.host}/${fullPath}.git`;
     return buildRepoInfo5(owner, repo, remoteUrl);
   }
@@ -6152,6 +6388,12 @@ function parseGenericGitRepoInput(input) {
   }
   throw invalidRepoUrl();
 }
+function parseGenericGitRepoInput(input) {
+  return parseGenericGitRepoInputWithOptions(input);
+}
+function parseGenericGitExistingRemote(input) {
+  return parseGenericGitRepoInputWithOptions(input, { allowExistingInsecureOrigin: true });
+}
 var SUPPORTED_URL_HINT;
 var init_repo_url5 = __esm({
   "src/providers/git/repo-url.ts"() {
@@ -6527,17 +6769,17 @@ __export(builtin_skills_exports, {
   deployBuiltinSkills: () => deployBuiltinSkills
 });
 import fs7 from "fs";
-import path18 from "path";
+import path19 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import fse2 from "fs-extra";
 function getBuiltinSkillsDir() {
-  const distDir = path18.dirname(fileURLToPath2(import.meta.url));
-  return path18.join(distDir, "..", "skills");
+  const distDir = path19.dirname(fileURLToPath2(import.meta.url));
+  return path19.join(distDir, "..", "skills");
 }
 async function copyBuiltinSkillDir(srcDir, destDir) {
   await fse2.copy(srcDir, destDir, {
     overwrite: true,
-    filter: (srcPath) => !path18.basename(srcPath).startsWith(".")
+    filter: (srcPath) => !path19.basename(srcPath).startsWith(".")
   });
 }
 async function deployBuiltinSkills(teamConfig, localConfig, options) {
@@ -6559,7 +6801,7 @@ async function deployBuiltinSkills(teamConfig, localConfig, options) {
   const skillNames = [];
   for (const entry of entries) {
     if (options?.skipRecall && RECALL_DEPENDENT_SKILLS.has(entry)) continue;
-    const skillMd = path18.join(builtinDir, entry, "SKILL.md");
+    const skillMd = path19.join(builtinDir, entry, "SKILL.md");
     if (await pathExists(skillMd)) {
       skillNames.push(entry);
     }
@@ -6575,7 +6817,7 @@ async function deployBuiltinSkills(teamConfig, localConfig, options) {
     }
     if (localConfig && isAgentExcluded(localConfig, tool)) continue;
     for (const skillName of skillNames) {
-      const srcDir = path18.join(builtinDir, skillName);
+      const srcDir = path19.join(builtinDir, skillName);
       const destDir = await resolveSkillDestination(tool, toolPath.skills, baseDir, skillName, srcDir);
       try {
         await copyBuiltinSkillDir(srcDir, destDir);
@@ -6603,142 +6845,6 @@ var init_builtin_skills = __esm({
   }
 });
 
-// src/roles.ts
-var roles_exports = {};
-__export(roles_exports, {
-  describeRoles: () => describeRoles,
-  findRole: () => findRole,
-  listRoleIds: () => listRoleIds,
-  loadRolesManifest: () => loadRolesManifest,
-  resolveRoleResourceNamespaces: () => resolveRoleResourceNamespaces,
-  saveRolesManifest: () => saveRolesManifest
-});
-import path19 from "path";
-import YAML3 from "yaml";
-import { z as z3 } from "zod";
-function validateManifestShape(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error("Invalid roles manifest: expected an object");
-  }
-  const candidate = raw;
-  const roles = candidate.roles;
-  if (!Array.isArray(roles) || roles.length === 0) {
-    throw new Error("Invalid roles manifest: roles must be a non-empty array");
-  }
-  for (const role of roles) {
-    if (!role || typeof role !== "object") {
-      throw new Error("Invalid roles manifest: every role must be an object");
-    }
-    const resources = role.resources;
-    if (!resources || typeof resources !== "object" || Array.isArray(resources)) {
-      throw new Error(`Invalid roles manifest: role ${role.id ?? "<unknown>"} is missing resources`);
-    }
-    const ALLOWED_RESOURCE_KEYS = /* @__PURE__ */ new Set([...ROLE_RESOURCE_TYPES, "learnings"]);
-    for (const key of Object.keys(resources)) {
-      if (!ALLOWED_RESOURCE_KEYS.has(key)) {
-        throw new Error(`Invalid roles manifest: unknown resource type "${key}"`);
-      }
-    }
-  }
-  const manifest = RolesManifestSchema.parse(raw);
-  const ids = /* @__PURE__ */ new Set();
-  for (const role of manifest.roles) {
-    if (ids.has(role.id)) {
-      throw new Error(`Invalid roles manifest: duplicate role id "${role.id}"`);
-    }
-    ids.add(role.id);
-  }
-  return manifest;
-}
-async function loadRolesManifest(repoPath) {
-  const manifestPath = path19.join(repoPath, "manifest", "roles.yaml");
-  const content = await readFileSafe(manifestPath);
-  if (!content) {
-    throw new Error(`Roles manifest not found: ${manifestPath}`);
-  }
-  let raw;
-  try {
-    raw = YAML3.parse(content);
-  } catch (error) {
-    throw new Error(`Invalid roles manifest YAML: ${error.message}`);
-  }
-  return validateManifestShape(raw);
-}
-async function saveRolesManifest(repoPath, manifest) {
-  validateManifestShape(manifest);
-  const manifestDir = path19.join(repoPath, "manifest");
-  const manifestPath = path19.join(manifestDir, "roles.yaml");
-  await ensureDir(manifestDir);
-  await writeFile(manifestPath, YAML3.stringify(manifest));
-}
-function findRole(manifest, roleId) {
-  return manifest.roles.find((candidate) => candidate.id === roleId);
-}
-function listRoleIds(manifest) {
-  return manifest.roles.map((role) => role.id);
-}
-function describeRoles(roles) {
-  return roles.map((role) => role.description ? `${role.id}: ${role.description}` : `${role.id}`);
-}
-function getRoleOrThrow(manifest, roleId) {
-  const role = manifest.roles.find((candidate) => candidate.id === roleId);
-  if (!role) {
-    throw new Error(`Unknown role "${roleId}". Valid roles: ${listRoleIds(manifest).join(", ")}`);
-  }
-  return role;
-}
-function resolveRoleResourceNamespaces(input) {
-  const resolvedRoles = [
-    getRoleOrThrow(input.manifest, input.primaryRole),
-    ...input.additionalRoles.map((roleId) => getRoleOrThrow(input.manifest, roleId))
-  ];
-  const namespaces = {
-    knowledge: [],
-    skills: [],
-    // Roles never contribute learnings namespaces; only projects do. Kept empty
-    // so the shape matches project resolution for a clean union at the call site.
-    learnings: []
-  };
-  for (const type of ROLE_RESOURCE_TYPES) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const role of resolvedRoles) {
-      for (const namespace of role.resources[type]) {
-        if (seen.has(namespace)) continue;
-        seen.add(namespace);
-        namespaces[type].push(namespace);
-      }
-    }
-  }
-  return namespaces;
-}
-var ROLE_RESOURCE_TYPES, RoleResourceNamespacesSchema, RoleSchema, RolesManifestSchema;
-var init_roles = __esm({
-  "src/roles.ts"() {
-    "use strict";
-    init_fs();
-    ROLE_RESOURCE_TYPES = ["knowledge", "skills"];
-    RoleResourceNamespacesSchema = z3.object({
-      knowledge: z3.array(z3.string().min(1)),
-      skills: z3.array(z3.string().min(1)),
-      // learnings is accepted for backward compatibility but ignored at runtime.
-      // All learnings are shared flat across the entire team (no namespace isolation).
-      learnings: z3.array(z3.string()).optional()
-    });
-    RoleSchema = z3.object({
-      id: z3.string().min(1),
-      description: z3.string().default(""),
-      resources: RoleResourceNamespacesSchema
-    });
-    RolesManifestSchema = z3.object({
-      version: z3.number(),
-      roles: z3.array(RoleSchema).min(1),
-      // defaults.shareTarget was removed: learnings are flat, no namespace routing needed.
-      // Old manifests with a defaults block are still parseable (z.passthrough on object level).
-      defaults: z3.object({}).passthrough().optional()
-    });
-  }
-});
-
 // src/utils/path-safety.ts
 var path_safety_exports = {};
 __export(path_safety_exports, {
@@ -7487,10 +7593,20 @@ async function countInterventions(transcriptPath) {
   const { interrupt, toolReject, toolError } = await scanTranscriptStop(transcriptPath);
   return { interrupt, toolReject, toolError };
 }
-function isCorrectionPrompt(text) {
+function wordBoundaryPattern(keyword) {
+  const escaped = keyword.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u");
+}
+function containsKeyword(lower, keyword) {
+  const k = keyword.trim().normalize("NFC").toLowerCase();
+  if (!k) return false;
+  if (UNSPACED_SCRIPT_RE.test(k)) return lower.includes(k);
+  return wordBoundaryPattern(k).test(lower);
+}
+function isCorrectionPrompt(text, extraKeywords = []) {
   if (!text) return false;
-  const lower = text.toLowerCase();
-  return CORRECTION_KEYWORDS.some((k) => lower.includes(k));
+  const lower = text.normalize("NFC").toLowerCase();
+  return [...CORRECTION_KEYWORDS, ...extraKeywords].some((k) => containsKeyword(lower, k));
 }
 function mapEventType(hookEventName) {
   switch (hookEventName) {
@@ -7511,7 +7627,7 @@ function mapEventType(hookEventName) {
       return null;
   }
 }
-async function parseHookEvent(raw, tool) {
+async function parseHookEvent(raw, tool, options) {
   if (!raw.trim()) return null;
   let hookData;
   try {
@@ -7550,6 +7666,7 @@ async function parseHookEvent(raw, tool) {
   }
   if (eventType === "prompt_submit" && typeof hookData.prompt === "string") {
     event.promptSummary = hookData.prompt.slice(0, 200);
+    event.correction = isCorrectionPrompt(hookData.prompt, options?.correctionKeywords);
   }
   if (eventType === "stop" && typeof hookData.transcript_path === "string") {
     event.transcriptPath = hookData.transcript_path;
@@ -7856,7 +7973,8 @@ function aggregateSessionMetrics(events) {
       const stopAt = lastStopAt.get(event.sessionId);
       if (stopAt !== void 0) {
         const gap = new Date(event.timestamp).getTime() - stopAt;
-        if (gap >= 0 && gap <= CORRECTION_WINDOW_MS && isCorrectionPrompt(event.promptSummary)) {
+        const isCorrection = event.correction ?? isCorrectionPrompt(event.promptSummary);
+        if (gap >= 0 && gap <= CORRECTION_WINDOW_MS && isCorrection) {
           m.correction++;
         }
         lastStopAt.delete(event.sessionId);
@@ -7918,7 +8036,7 @@ async function dashboardReport(toolArg) {
   compactEvents().catch(() => {
   });
 }
-var TRANSCRIPT_TAIL_BYTES, STOPPED_OUTPUT_MAX_CHARS, CODEX_USAGE_TAIL_BYTES, CODEX_USAGE_MAX_ATTEMPTS, CODEX_USAGE_RETRY_MS, CODEBUDDY_USAGE_MAX_ATTEMPTS, CODEBUDDY_USAGE_RETRY_MS, CODEBUDDY_BLOB_MAX_COUNT, CODEBUDDY_REJECT_MARKER;
+var TRANSCRIPT_TAIL_BYTES, STOPPED_OUTPUT_MAX_CHARS, CODEX_USAGE_TAIL_BYTES, CODEX_USAGE_MAX_ATTEMPTS, CODEX_USAGE_RETRY_MS, CODEBUDDY_USAGE_MAX_ATTEMPTS, CODEBUDDY_USAGE_RETRY_MS, CODEBUDDY_BLOB_MAX_COUNT, CODEBUDDY_REJECT_MARKER, UNSPACED_SCRIPT_RE;
 var init_dashboard_collector = __esm({
   "src/dashboard-collector.ts"() {
     "use strict";
@@ -7941,23 +8059,77 @@ var init_dashboard_collector = __esm({
     CODEBUDDY_USAGE_RETRY_MS = 250;
     CODEBUDDY_BLOB_MAX_COUNT = 2e3;
     CODEBUDDY_REJECT_MARKER = "User rejected this command";
+    UNSPACED_SCRIPT_RE = /[\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}]/u;
+  }
+});
+
+// src/utils/exec.ts
+import spawn from "cross-spawn";
+async function probeBinary(binary, args = ["--version"], executor = execCommand) {
+  try {
+    const result = await executor(binary, args, { timeoutMs: 5e3 });
+    if (result.code !== 0) return "";
+    return (result.stdout || result.stderr).trim();
+  } catch {
+    return "";
+  }
+}
+function formatCommand(command, args) {
+  const quote = (value) => /^[a-zA-Z0-9_./:@=+-]+$/.test(value) ? value : JSON.stringify(value);
+  return [command, ...args.map(quote)].join(" ");
+}
+var execCommand;
+var init_exec = __esm({
+  "src/utils/exec.ts"() {
+    "use strict";
+    execCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
+      const child = spawn(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: false
+      });
+      let stdout = "";
+      let stderr = "";
+      let settled = false;
+      const timeoutMs = options.timeoutMs ?? 12e4;
+      const finish = (callback) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        callback();
+      };
+      child.stdout?.on("data", (chunk) => {
+        const text = chunk.toString();
+        stdout += text;
+        if (options.stream) process.stdout.write(text);
+      });
+      child.stderr?.on("data", (chunk) => {
+        const text = chunk.toString();
+        stderr += text;
+        if (options.stream) process.stderr.write(text);
+      });
+      const timer = setTimeout(() => {
+        child.kill();
+        finish(() => reject(new Error(
+          `Command timed out after ${timeoutMs}ms: ${command} ${args.join(" ")}`
+        )));
+      }, timeoutMs);
+      child.on("error", (error) => finish(() => reject(error)));
+      child.on("close", (code) => finish(() => resolve({
+        stdout,
+        stderr,
+        code: code ?? 1
+      })));
+    });
   }
 });
 
 // src/agent-version.ts
-import { execFile } from "child_process";
 import { readFile } from "fs/promises";
 import path22 from "path";
 async function execVersion(bin, args = ["--version"]) {
-  return new Promise((resolve) => {
-    execFile(bin, args, { timeout: 5e3 }, (err, stdout) => {
-      if (err) {
-        resolve("");
-        return;
-      }
-      resolve(stdout.trim());
-    });
-  });
+  return probeBinary(bin, args);
 }
 async function readPlistVersion(appPath) {
   const plistPath = path22.join(appPath, "Contents", "Info.plist");
@@ -8031,6 +8203,7 @@ var init_agent_version = __esm({
   "src/agent-version.ts"() {
     "use strict";
     init_logger();
+    init_exec();
     VERSION_CACHE = /* @__PURE__ */ new Map();
     CODEBUDDY_IDE_PATHS = [
       "/Applications/CodeBuddy.app",
@@ -8297,7 +8470,7 @@ var CLAUDE_TOOLS, CURSOR_TOOLS2, CODEX_TOOLS2, BUDDY_TOOLS, OPENCODE_TOOLS, MCP_
 var init_mcp_format = __esm({
   "src/resources/mcp-format.ts"() {
     "use strict";
-    CLAUDE_TOOLS = /* @__PURE__ */ new Set(["claude", "claude-internal", "tclaude", "qoder", "zcode"]);
+    CLAUDE_TOOLS = /* @__PURE__ */ new Set(["claude", "claude-internal", "tclaude", "qoder", "kiro", "zcode"]);
     CURSOR_TOOLS2 = /* @__PURE__ */ new Set(["cursor"]);
     CODEX_TOOLS2 = /* @__PURE__ */ new Set(["codex", "codex-internal", "tcodex"]);
     BUDDY_TOOLS = /* @__PURE__ */ new Set(["codebuddy", "workbuddy"]);
@@ -8354,7 +8527,8 @@ function teamMcpToDef(s) {
     env: s.env,
     timeout: s.timeout,
     requires: s.requires,
-    tools: s.tools
+    tools: s.tools,
+    roles: s.roles
   };
 }
 async function parseTeamMcpServers(repoPath) {
@@ -8380,7 +8554,8 @@ var init_mcp = __esm({
       env: z4.record(z4.string(), z4.string()).optional(),
       timeout: z4.number().int().positive().optional(),
       requires: z4.array(z4.string()).optional(),
-      tools: z4.array(z4.string()).optional()
+      tools: z4.array(z4.string()).optional(),
+      roles: z4.array(z4.string()).optional()
     }).refine((s) => s.transport === "stdio" ? !!s.command : true, {
       message: "stdio transport requires `command`"
     }).refine((s) => s.transport === "stdio" ? true : !!s.url, {
@@ -8703,6 +8878,14 @@ async function reconcileMcpForConfig(teamConfig, localConfig, options = {}) {
     return { changes, wrote };
   }
   const excluded = new Set(localConfig.excludedSkills ?? []);
+  const activeRoles = activeRoleIds(localConfig);
+  if (!removeAll) {
+    await warnUnknownRoleIds(
+      localConfig.repo.localPath,
+      "mcp.yaml",
+      teamDefs.map((def) => ({ kind: "server", name: def.name, roles: def.roles }))
+    );
+  }
   const targets = await resolveMcpTargets(teamConfig, localConfig);
   if (targets.length === 0) return { changes, wrote };
   const dataHome = getDataHome(localConfig);
@@ -8726,6 +8909,7 @@ async function reconcileMcpForConfig(teamConfig, localConfig, options = {}) {
     const desired = /* @__PURE__ */ new Map();
     for (const raw of teamDefs) {
       if (raw.tools && !raw.tools.includes(target.tool)) continue;
+      if (!matchesRoles(raw.roles, activeRoles)) continue;
       if (excluded.has(raw.name)) {
         changes.push({ tool: target.tool, server: raw.name, action: "skipped", reason: "excluded by user" });
         continue;
@@ -8878,6 +9062,7 @@ var init_mcp_reconcile = __esm({
     init_types();
     init_mcp_format();
     init_mcp();
+    init_roles();
     init_fs();
     init_logger();
     init_mcp_manifest();
@@ -9179,7 +9364,7 @@ __export(local_agent_exports, {
 import fs14 from "fs";
 import os7 from "os";
 import path28 from "path";
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import fse4 from "fs-extra";
 function modelAgentKind(tool) {
@@ -11418,7 +11603,7 @@ var init_local_agent = __esm({
     init_types();
     init_home();
     init_git2();
-    execFileAsync = promisify(execFile2);
+    execFileAsync = promisify(execFile);
     LOCAL_AGENT_DIR = "local-agent";
     CONFIG_FILE = "config.json";
     MANIFEST_FILE = "manifest.json";
@@ -12315,6 +12500,7 @@ var init_skills = __esm({
         await this.addTombstone(name, localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.skills) continue;
+          if (isAgentExcluded(localConfig, tool)) continue;
           let skillDir;
           if (tool === "openclaw") {
             const wsDir = await resolveOpenclawWorkspaceDir();
@@ -12571,6 +12757,7 @@ var init_rules = __esm({
         await this.addTombstone(name, localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.rules) continue;
+          if (isAgentExcluded(localConfig, tool)) continue;
           const extensions = /* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"]);
           for (const extension of extensions) {
             const filePath = path32.join(baseDir, toolPath.rules, `${name}${extension}`);
@@ -12612,6 +12799,7 @@ var init_rules = __esm({
         const baseDir = resolveBaseDir(localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.rules) continue;
+          if (isAgentExcluded(localConfig, tool)) continue;
           if (!await ResourceHandler.isToolInstalled(toolPath.rules, baseDir)) continue;
           const destDir = path32.join(baseDir, toolPath.rules);
           if (!await pathExists(destDir)) continue;
@@ -12815,9 +13003,9 @@ var init_env = __esm({
         }
         const envYamlPath = path34.join(localConfig.repo.localPath, "env", "env.yaml");
         if (!await pathExists(envYamlPath)) return [];
-        const { execFile: execFile5 } = await import("child_process");
+        const { execFile: execFile4 } = await import("child_process");
         const { promisify: promisify4 } = await import("util");
-        const execFileAsync4 = promisify4(execFile5);
+        const execFileAsync4 = promisify4(execFile4);
         try {
           await execFileAsync4("git", ["diff", "--exit-code", "env/env.yaml"], {
             cwd: localConfig.repo.localPath
@@ -12985,12 +13173,20 @@ import path35 from "path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import matter3 from "gray-matter";
 import { stringify as stringifyToml, parse as parseToml } from "smol-toml";
+function agentStemFromFilename(filename) {
+  for (const ext of AGENT_FILE_EXTENSIONS) {
+    if (filename.endsWith(ext)) return filename.slice(0, -ext.length);
+  }
+  return null;
+}
 function agentFileExtensionForTool(tool) {
   switch (tool) {
     case "codex":
     case "codex-internal":
     case "tcodex":
       return ".toml";
+    case "kiro":
+      return ".json";
     default:
       return ".md";
   }
@@ -13051,6 +13247,35 @@ function renderForJoycode(spec) {
     content: renderMarkdownAgent(spec, spec.tool_extras?.["joycode"])
   };
 }
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isManagedKiroSessionHook(value) {
+  return isRecord(value) && typeof value["command"] === "string" && value["command"].includes("teamai hook-dispatch session-start --tool kiro");
+}
+function renderForKiro(spec) {
+  const extras = { ...spec.tool_extras?.["kiro"] ?? {} };
+  const existingHooks = isRecord(extras["hooks"]) ? { ...extras["hooks"] } : {};
+  const existingAgentSpawn = Array.isArray(existingHooks["agentSpawn"]) ? existingHooks["agentSpawn"].filter((entry) => !isManagedKiroSessionHook(entry)) : [];
+  existingHooks["agentSpawn"] = [
+    ...existingAgentSpawn,
+    { command: KIRO_SESSION_START_COMMAND }
+  ];
+  extras["hooks"] = existingHooks;
+  const json = {
+    name: spec.name,
+    description: spec.description,
+    prompt: spec.instructions
+  };
+  if (spec.model !== void 0) json["model"] = spec.model;
+  if (spec.tools !== void 0 && spec.tools.length > 0) json["tools"] = spec.tools;
+  Object.assign(json, extras);
+  return {
+    ext: agentFileExtensionForTool("kiro"),
+    content: `${JSON.stringify(json, null, 2)}
+`
+  };
+}
 function renderForCodex(spec) {
   return {
     ext: agentFileExtensionForTool("codex"),
@@ -13178,6 +13403,43 @@ function reverseFromJoycode(filePath, content) {
   }
   return { ok: true, spec };
 }
+function reverseFromKiro(filePath, content) {
+  let parsed;
+  try {
+    const raw = JSON.parse(content);
+    if (!isRecord(raw)) return { ok: false, reason: "agent config must be a JSON object" };
+    parsed = raw;
+  } catch (err) {
+    return { ok: false, reason: `parse error: ${err.message}` };
+  }
+  const name = parsed["name"] ?? path35.basename(filePath, ".json");
+  if (!name) return { ok: false, reason: "missing field name" };
+  if (!parsed["description"]) return { ok: false, reason: "missing field description" };
+  if (!parsed["prompt"]) return { ok: false, reason: "missing field prompt" };
+  const extras = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!COMMON_KIRO_FIELDS.has(key)) extras[key] = value;
+  }
+  if (isRecord(extras["hooks"])) {
+    const hooks = { ...extras["hooks"] };
+    if (Array.isArray(hooks["agentSpawn"])) {
+      const remaining = hooks["agentSpawn"].filter((entry) => !isManagedKiroSessionHook(entry));
+      if (remaining.length > 0) hooks["agentSpawn"] = remaining;
+      else delete hooks["agentSpawn"];
+    }
+    if (Object.keys(hooks).length > 0) extras["hooks"] = hooks;
+    else delete extras["hooks"];
+  }
+  const spec = {
+    name,
+    description: parsed["description"],
+    instructions: parsed["prompt"]
+  };
+  if (parsed["model"] !== void 0) spec.model = parsed["model"];
+  if (parsed["tools"] !== void 0) spec.tools = parsed["tools"];
+  if (Object.keys(extras).length > 0) spec.tool_extras = { kiro: extras };
+  return { ok: true, spec };
+}
 function reverseFromCodex(filePath, content) {
   let parsed;
   try {
@@ -13326,16 +13588,19 @@ function renderForTool(spec, tool) {
       return renderForJoycode(spec);
     case "qoder":
       return renderForClaude(spec);
+    case "kiro":
+      return renderForKiro(spec);
     case "zcode":
       return renderForClaude(spec);
     case "opencode":
       return renderForOpencode(spec);
   }
 }
-var ALL_SUPPORTED_TOOLS, COMMON_CLAUDE_FIELDS, COMMON_CURSOR_FIELDS, COMMON_CODEX_FIELDS, COMMON_OPENCODE_FIELDS, MERGE_COMMON_FIELDS;
+var ALL_SUPPORTED_TOOLS, AGENT_FILE_EXTENSIONS, KIRO_SESSION_START_COMMAND, COMMON_CLAUDE_FIELDS, COMMON_CURSOR_FIELDS, COMMON_CODEX_FIELDS, COMMON_KIRO_FIELDS, COMMON_OPENCODE_FIELDS, MERGE_COMMON_FIELDS;
 var init_agent_format = __esm({
   "src/resources/agent-format.ts"() {
     "use strict";
+    init_builtin_hooks();
     ALL_SUPPORTED_TOOLS = [
       "claude",
       "claude-internal",
@@ -13347,12 +13612,16 @@ var init_agent_format = __esm({
       "cursor",
       "joycode",
       "qoder",
+      "kiro",
       "zcode",
       "opencode"
     ];
+    AGENT_FILE_EXTENSIONS = [".md", ".toml", ".json"];
+    KIRO_SESSION_START_COMMAND = getDispatchCommand("session-start", "kiro");
     COMMON_CLAUDE_FIELDS = /* @__PURE__ */ new Set(["name", "description", "model", "tools"]);
     COMMON_CURSOR_FIELDS = /* @__PURE__ */ new Set(["agent_id", "description", "model", "tools"]);
     COMMON_CODEX_FIELDS = /* @__PURE__ */ new Set(["name", "description", "developer_instructions", "model"]);
+    COMMON_KIRO_FIELDS = /* @__PURE__ */ new Set(["name", "description", "prompt", "model", "tools"]);
     COMMON_OPENCODE_FIELDS = /* @__PURE__ */ new Set(["description", "model"]);
     MERGE_COMMON_FIELDS = [
       "name",
@@ -13385,8 +13654,7 @@ async function removeStaleAgentSiblings(targetAgentsDir, stem, targetExt) {
     return;
   }
   for (const file of files) {
-    const base = file.replace(/\.(md|toml)$/, "");
-    if (base !== stem) continue;
+    if (agentStemFromFilename(file) !== stem) continue;
     if (file === `${stem}${targetExt}`) continue;
     try {
       await remove(path36.join(targetAgentsDir, file));
@@ -13469,10 +13737,267 @@ var init_builtin_agents = __esm({
   }
 });
 
-// src/resources/agents.ts
+// src/projects.ts
+var projects_exports = {};
+__export(projects_exports, {
+  describeProjects: () => describeProjects,
+  findProject: () => findProject,
+  isSafeNamespaceSegment: () => isSafeNamespaceSegment,
+  listProjectIds: () => listProjectIds,
+  loadProjectsManifest: () => loadProjectsManifest,
+  mergeNamespaces: () => mergeNamespaces,
+  resolveActiveLearningsNamespaces: () => resolveActiveLearningsNamespaces,
+  resolveProjectResourceNamespaces: () => resolveProjectResourceNamespaces,
+  saveProjectsManifest: () => saveProjectsManifest
+});
 import path37 from "path";
+import YAML8 from "yaml";
+import { z as z6 } from "zod";
+function isSafeNamespaceSegment(seg) {
+  return SAFE_ID.test(seg) && seg !== "." && seg !== "..";
+}
+function validateManifestShape2(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid projects manifest: expected an object");
+  }
+  const candidate = raw;
+  const projects = candidate.projects;
+  if (projects !== void 0 && !Array.isArray(projects)) {
+    throw new Error("Invalid projects manifest: projects must be an array");
+  }
+  for (const project of projects ?? []) {
+    if (!project || typeof project !== "object") {
+      throw new Error("Invalid projects manifest: every project must be an object");
+    }
+    const resources = project.resources;
+    if (resources !== void 0 && (typeof resources !== "object" || Array.isArray(resources))) {
+      throw new Error(`Invalid projects manifest: project ${project.id ?? "<unknown>"} has invalid resources`);
+    }
+    if (resources) {
+      const ALLOWED_RESOURCE_KEYS = new Set(PROJECT_RESOURCE_TYPES);
+      for (const key of Object.keys(resources)) {
+        if (!ALLOWED_RESOURCE_KEYS.has(key)) {
+          throw new Error(`Invalid projects manifest: unknown resource type "${key}"`);
+        }
+      }
+    }
+  }
+  const manifest = ProjectsManifestSchema.parse(raw);
+  const ids = /* @__PURE__ */ new Set();
+  for (const project of manifest.projects) {
+    if (ids.has(project.id)) {
+      throw new Error(`Invalid projects manifest: duplicate project id "${project.id}"`);
+    }
+    ids.add(project.id);
+  }
+  return manifest;
+}
+async function loadProjectsManifest(repoPath) {
+  const manifestPath = path37.join(repoPath, "manifest", "projects.yaml");
+  const content = await readFileSafe(manifestPath);
+  if (!content) {
+    return null;
+  }
+  let raw;
+  try {
+    raw = YAML8.parse(content);
+  } catch (error) {
+    throw new Error(`Invalid projects manifest YAML: ${error.message}`);
+  }
+  return validateManifestShape2(raw);
+}
+async function saveProjectsManifest(repoPath, manifest) {
+  validateManifestShape2(manifest);
+  const manifestDir = path37.join(repoPath, "manifest");
+  const manifestPath = path37.join(manifestDir, "projects.yaml");
+  await ensureDir(manifestDir);
+  await writeFile(manifestPath, YAML8.stringify(manifest));
+}
+function findProject(manifest, projectId) {
+  return manifest.projects.find((candidate) => candidate.id === projectId);
+}
+function listProjectIds(manifest) {
+  return manifest.projects.map((project) => project.id);
+}
+function describeProjects(projects) {
+  return projects.map((project) => {
+    const label = project.name || project.id;
+    return project.description ? `${label}: ${project.description}` : label;
+  });
+}
+function getProjectOrThrow(manifest, projectId) {
+  const project = findProject(manifest, projectId);
+  if (!project) {
+    throw new Error(`Unknown project "${projectId}". Valid projects: ${listProjectIds(manifest).join(", ")}`);
+  }
+  return project;
+}
+function resolveProjectResourceNamespaces(input) {
+  const resolved = input.activeProjects.map((id) => getProjectOrThrow(input.manifest, id));
+  const namespaces = {
+    knowledge: [],
+    skills: [],
+    learnings: [],
+    agents: []
+  };
+  for (const type of PROJECT_RESOURCE_TYPES) {
+    const seen = /* @__PURE__ */ new Set();
+    for (const project of resolved) {
+      for (const namespace of project.resources[type]) {
+        if (seen.has(namespace)) continue;
+        seen.add(namespace);
+        namespaces[type].push(namespace);
+      }
+    }
+  }
+  return namespaces;
+}
+async function resolveActiveLearningsNamespaces(repoPath, activeProjects) {
+  if (activeProjects.length === 0) return [];
+  const manifest = await loadProjectsManifest(repoPath);
+  if (!manifest) return [];
+  try {
+    return resolveProjectResourceNamespaces({ manifest, activeProjects }).learnings;
+  } catch {
+    return [];
+  }
+}
+function mergeNamespaces(roleNamespaces, projectNamespaces) {
+  const dedupe = (a, b) => {
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const ns of [...a, ...b]) {
+      if (seen.has(ns)) continue;
+      seen.add(ns);
+      out.push(ns);
+    }
+    return out;
+  };
+  return {
+    knowledge: dedupe(roleNamespaces.knowledge, projectNamespaces.knowledge),
+    skills: dedupe(roleNamespaces.skills, projectNamespaces.skills),
+    // Roles never contribute learnings; this is effectively the project set.
+    learnings: dedupe(roleNamespaces.learnings, projectNamespaces.learnings),
+    agents: dedupe(roleNamespaces.agents, projectNamespaces.agents)
+  };
+}
+var PROJECT_RESOURCE_TYPES, ProjectResourceNamespacesSchema, SAFE_ID, ProjectSchema, ProjectsManifestSchema;
+var init_projects = __esm({
+  "src/projects.ts"() {
+    "use strict";
+    init_fs();
+    PROJECT_RESOURCE_TYPES = ["knowledge", "skills", "learnings", "agents"];
+    ProjectResourceNamespacesSchema = z6.object({
+      knowledge: z6.array(z6.string().min(1)).default([]),
+      skills: z6.array(z6.string().min(1)).default([]),
+      learnings: z6.array(z6.string().min(1)).default([]),
+      agents: z6.array(z6.string().min(1)).default([])
+    });
+    SAFE_ID = /^[A-Za-z0-9._-]+$/;
+    ProjectSchema = z6.object({
+      id: z6.string().min(1).refine((v) => isSafeNamespaceSegment(v), {
+        message: "project id must be a single path segment (letters, digits, '.', '_', '-'; no '/', '\\\\', or '..')"
+      }),
+      name: z6.string().default(""),
+      description: z6.string().default(""),
+      resources: ProjectResourceNamespacesSchema
+    });
+    ProjectsManifestSchema = z6.object({
+      version: z6.number(),
+      // Unlike roles (`.min(1)`), a repo may define zero projects — a team without
+      // project partitioning simply has no projects.yaml, and an empty list is valid.
+      projects: z6.array(ProjectSchema).default([])
+    });
+  }
+});
+
+// src/resource-namespaces.ts
+async function resolveResourceNamespaces(localConfig) {
+  const activeProjects = localConfig.projects ?? [];
+  const primaryRole = localConfig.primaryRole;
+  const hasRole = !!primaryRole;
+  const hasProjects = activeProjects.length > 0;
+  const projectsManifest = await loadProjectsManifest(localConfig.repo.localPath);
+  const teamHasProjects = !!projectsManifest && projectsManifest.projects.length > 0;
+  if (!hasRole && !hasProjects && !teamHasProjects) return null;
+  let roleNamespaces = { knowledge: [], skills: [], learnings: [], agents: [] };
+  let allRoleSkillNamespaces = /* @__PURE__ */ new Set();
+  if (primaryRole) {
+    let rolesManifest;
+    try {
+      rolesManifest = await loadRolesManifest(localConfig.repo.localPath);
+    } catch {
+      log.warn("Could not load roles manifest. Skipping role-based filtering.");
+      rolesManifest = null;
+    }
+    if (rolesManifest) {
+      try {
+        roleNamespaces = resolveRoleResourceNamespaces({
+          manifest: rolesManifest,
+          primaryRole,
+          additionalRoles: localConfig.additionalRoles ?? []
+        });
+        allRoleSkillNamespaces = new Set(rolesManifest.roles.flatMap((role) => role.resources.skills));
+      } catch {
+        log.warn(`Role "${localConfig.primaryRole}" not found in manifest. Falling back to unfiltered sync.`);
+        log.warn("Run `teamai roles set <role>` to pick a valid role.");
+        if (!hasProjects && !teamHasProjects) return null;
+      }
+    } else if (!hasProjects && !teamHasProjects) {
+      return null;
+    }
+  }
+  let projectNamespaces = { knowledge: [], skills: [], learnings: [], agents: [] };
+  let allProjectSkillNamespaces = /* @__PURE__ */ new Set();
+  if (projectsManifest) {
+    allProjectSkillNamespaces = new Set(projectsManifest.projects.flatMap((p) => p.resources.skills));
+    if (hasProjects) {
+      try {
+        projectNamespaces = resolveProjectResourceNamespaces({
+          manifest: projectsManifest,
+          activeProjects
+        });
+      } catch (e) {
+        log.warn(`${e instanceof Error ? e.message : String(e)} Falling back to role-only filtering.`);
+      }
+    }
+  } else if (hasProjects) {
+    log.warn("Active projects configured but no projects manifest found. Skipping project-based filtering.");
+  }
+  const activeNamespaces = mergeNamespaces(roleNamespaces, projectNamespaces);
+  const allSkillNamespaces = /* @__PURE__ */ new Set([...allRoleSkillNamespaces, ...allProjectSkillNamespaces]);
+  return { activeNamespaces, allSkillNamespaces };
+}
+var init_resource_namespaces = __esm({
+  "src/resource-namespaces.ts"() {
+    "use strict";
+    init_roles();
+    init_projects();
+    init_logger();
+  }
+});
+
+// src/resources/agents.ts
+import path38 from "path";
 import { isDeepStrictEqual } from "util";
 import { parse as parseYaml2 } from "yaml";
+async function listTeamAgentDirs(teamAgentsDir) {
+  const dirs = [{ dir: teamAgentsDir }];
+  for (const namespace of await listDirs(teamAgentsDir)) {
+    if (isSafeNamespaceSegment(namespace)) dirs.push({ dir: path38.join(teamAgentsDir, namespace), namespace });
+  }
+  return dirs;
+}
+async function findTeamAgentFiles(teamAgentsDir, stem) {
+  const found = [];
+  for (const { dir, namespace } of await listTeamAgentDirs(teamAgentsDir)) {
+    for (const ext of [".yaml", ".md"]) {
+      const candidate = path38.join(dir, `${stem}${ext}`);
+      if (await pathExists(candidate)) found.push({ path: candidate, ext, ...namespace ? { namespace } : {} });
+    }
+  }
+  return found;
+}
 function mergeCanonicalEdits(canonical, perTool) {
   const merged = { ...canonical };
   const extras = { ...canonical.tool_extras };
@@ -13514,10 +14039,12 @@ function mergeCanonicalEdits(canonical, perTool) {
   else delete merged.tool_extras;
   return { ok: true, spec: merged };
 }
-function getAgentStem(filename) {
-  if (filename.endsWith(".md")) return filename.slice(0, -3);
-  if (filename.endsWith(".toml")) return filename.slice(0, -5);
-  return null;
+async function removeStaleAgentSiblings2(agentsDir, stem, targetExt) {
+  for (const file of await listFiles(agentsDir)) {
+    if (agentStemFromFilename(file) !== stem || file === `${stem}${targetExt}`) continue;
+    await remove(path38.join(agentsDir, file));
+    log.debug(`Removed stale agent sibling ${file} for ${stem}`);
+  }
 }
 function isKnownTool(tool) {
   return ALL_SUPPORTED_TOOLS.includes(tool);
@@ -13529,7 +14056,7 @@ async function agentContentEqual(tool, localPath, teamPath) {
   const canonicalContent = await readFileSafe(teamPath);
   const localContent = await readFileSafe(localPath);
   if (canonicalContent === null || localContent === null) return false;
-  const parsed = parseAgentYaml(canonicalContent, path37.basename(teamPath));
+  const parsed = parseAgentYaml(canonicalContent, path38.basename(teamPath));
   if (!parsed.ok) return false;
   return localContent === renderForTool(parsed.spec, tool).content;
 }
@@ -13551,13 +14078,15 @@ function reverseByTool(tool, filePath, content) {
       return reverseFromJoycode(filePath, content);
     case "qoder":
       return reverseFromClaude(filePath, content);
+    case "kiro":
+      return reverseFromKiro(filePath, content);
     case "zcode":
       return reverseFromClaude(filePath, content);
     case "opencode":
       return reverseFromOpencode(filePath, content);
   }
 }
-var AgentsHandler;
+var AgentsHandler, LEGACY_MD_TOOLS;
 var init_agents = __esm({
   "src/resources/agents.ts"() {
     "use strict";
@@ -13566,6 +14095,9 @@ var init_agents = __esm({
     init_logger();
     init_types();
     init_builtin_agents();
+    init_resource_namespaces();
+    init_projects();
+    init_path_safety();
     init_agent_format();
     AgentsHandler = class extends ResourceHandler {
       type = "agents";
@@ -13577,50 +14109,53 @@ var init_agents = __esm({
        * Built-in CLI agents are excluded from push.
        */
       async scanLocalForPush(teamConfig, localConfig) {
-        const teamAgentsDir = path37.join(localConfig.repo.localPath, "agents");
+        const teamAgentsDir = path38.join(localConfig.repo.localPath, "agents");
         const tombstones = await this.readTombstones(localConfig);
         const baseDir = resolveBaseDir(localConfig);
         const directItems = [];
         const directStems = /* @__PURE__ */ new Set();
         if (isSelfMode(localConfig) && localConfig.projectRoot) {
-          const activeAgentsDir = path37.join(localConfig.projectRoot, ".teamai", "agents");
+          const activeAgentsDir = path38.join(localConfig.projectRoot, ".teamai", "agents");
           if (await pathExists(activeAgentsDir)) {
-            for (const file of await listFiles(activeAgentsDir)) {
-              const isYaml = file.endsWith(".yaml");
-              const isMd = file.endsWith(".md");
-              if (!isYaml && !isMd) continue;
-              const stem = file.replace(/\.(yaml|md)$/, "");
-              if (tombstones.has(stem)) continue;
-              if (BUILTIN_AGENT_NAMES.has(stem)) continue;
-              const activePath = path37.join(activeAgentsDir, file);
-              const basePath = path37.join(teamAgentsDir, file);
-              const baseExists = await pathExists(basePath);
-              if (baseExists && await fileContentEqual(activePath, basePath)) continue;
-              directItems.push({
-                name: stem,
-                type: "agents",
-                sourcePath: activePath,
-                relativePath: `agents/${file}`,
-                status: baseExists ? "modified" : "new",
-                legacy: isMd
-              });
-              directStems.add(stem);
+            for (const { dir, namespace } of await listTeamAgentDirs(activeAgentsDir)) {
+              const relDir = namespace ? `agents/${namespace}` : "agents";
+              for (const file of await listFiles(dir)) {
+                const isYaml = file.endsWith(".yaml");
+                const isMd = file.endsWith(".md");
+                if (!isYaml && !isMd) continue;
+                const stem = file.replace(/\.(yaml|md)$/, "");
+                if (tombstones.has(stem)) continue;
+                if (BUILTIN_AGENT_NAMES.has(stem)) continue;
+                const activePath = path38.join(dir, file);
+                const basePath = path38.join(localConfig.repo.localPath, relDir, file);
+                const baseExists = await pathExists(basePath);
+                if (baseExists && await fileContentEqual(activePath, basePath)) continue;
+                directItems.push({
+                  name: stem,
+                  type: "agents",
+                  sourcePath: activePath,
+                  relativePath: `${relDir}/${file}`,
+                  status: baseExists ? "modified" : "new",
+                  legacy: isMd
+                });
+                directStems.add(stem);
+              }
             }
           }
         }
         const grouped = /* @__PURE__ */ new Map();
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.agents) continue;
-          const agentsDir = path37.join(baseDir, toolPath.agents);
+          const agentsDir = path38.join(baseDir, toolPath.agents);
           if (!await pathExists(agentsDir)) continue;
           const files = await listFiles(agentsDir);
           for (const file of files) {
-            const stem = getAgentStem(file);
+            const stem = agentStemFromFilename(file);
             if (stem === null) continue;
             if (tombstones.has(stem)) continue;
             if (BUILTIN_AGENT_NAMES.has(stem)) continue;
             if (directStems.has(stem)) continue;
-            const filePath = path37.join(agentsDir, file);
+            const filePath = path38.join(agentsDir, file);
             let toolGroup = grouped.get(stem);
             if (!toolGroup) {
               toolGroup = /* @__PURE__ */ new Map();
@@ -13632,11 +14167,41 @@ var init_agents = __esm({
           }
         }
         const items = [...directItems];
+        const resolved = await resolveResourceNamespaces(localConfig);
+        const activeNamespaces = resolved?.activeNamespaces.agents ?? null;
         for (const [stem, toolFiles] of grouped) {
-          const teamYamlPath = path37.join(teamAgentsDir, `${stem}.yaml`);
-          const teamMdPath = path37.join(teamAgentsDir, `${stem}.md`);
-          const hasTeamYaml = await pathExists(teamYamlPath);
-          const hasTeamMd = await pathExists(teamMdPath);
+          const sources = await findTeamAgentFiles(teamAgentsDir, stem);
+          const candidates = sources.filter(
+            (file) => activeNamespaces === null || !file.namespace || activeNamespaces.includes(file.namespace)
+          );
+          if (candidates.length > 1) {
+            items.push({
+              name: stem,
+              type: "agents",
+              sourcePath: teamAgentsDir,
+              relativePath: `agents/${stem}.yaml`,
+              status: "modified",
+              skipReason: `Ambiguous agent "${stem}": multiple active sources (${candidates.map((file) => file.path).join(", ")}). Give active agents unique names before pushing.`
+            });
+            continue;
+          }
+          if (sources.length > 0 && candidates.length === 0) {
+            items.push({
+              name: stem,
+              type: "agents",
+              sourcePath: teamAgentsDir,
+              relativePath: `agents/${stem}.yaml`,
+              status: "modified",
+              skipReason: `Agent "${stem}" has no active source. Activate its role or project before pushing local edits.`
+            });
+            continue;
+          }
+          const located = candidates[0];
+          const teamYamlPath = located?.ext === ".yaml" ? located.path : path38.join(teamAgentsDir, `${stem}.yaml`);
+          const teamMdPath = located?.ext === ".md" ? located.path : path38.join(teamAgentsDir, `${stem}.md`);
+          const hasTeamYaml = located?.ext === ".yaml";
+          const hasTeamMd = located?.ext === ".md";
+          const teamDir = located?.namespace ? `agents/${located.namespace}` : "agents";
           let canonicalSpec;
           if (hasTeamYaml) {
             const raw = await readFileSafe(teamYamlPath);
@@ -13646,7 +14211,7 @@ var init_agents = __esm({
                 name: stem,
                 type: "agents",
                 sourcePath: teamYamlPath,
-                relativePath: `agents/${stem}.yaml`,
+                relativePath: `${teamDir}/${stem}.yaml`,
                 status: "modified",
                 skipReason: "cannot read or parse canonical agent YAML"
               });
@@ -13724,7 +14289,7 @@ var init_agents = __esm({
                 name: stem,
                 type: "agents",
                 sourcePath: bestPath,
-                relativePath: `agents/${stem}.yaml`,
+                relativePath: `${teamDir}/${stem}.yaml`,
                 status: status2,
                 mergedSpec: mergeResult.spec
               });
@@ -13735,7 +14300,7 @@ var init_agents = __esm({
             name: stem,
             type: "agents",
             sourcePath: bestPath,
-            relativePath: `agents/${stem}.md`,
+            relativePath: `${teamDir}/${stem}.md`,
             status: status2,
             skipReason
           });
@@ -13746,32 +14311,33 @@ var init_agents = __esm({
        * Scan team repo `agents/` for files to pull.
        * Recognizes both *.yaml (new) and *.md (legacy).
        * Hidden files (tombstones) are filtered out by listFiles.
+       *
+       * Root-level files are shared with everyone. One level of subdirectories
+       * (`agents/<namespace>/`) carries role/project-scoped agents, the same
+       * convention `rules/<namespace>/` uses; pull filters them by the active
+       * `agents` namespaces. Deeper nesting is not scanned.
        */
       async scanTeamForPull(_teamConfig, localConfig) {
-        const agentsDir = path37.join(localConfig.repo.localPath, "agents");
+        const agentsDir = path38.join(localConfig.repo.localPath, "agents");
         if (!await pathExists(agentsDir)) return [];
-        const files = await listFiles(agentsDir);
         const items = [];
-        for (const file of files) {
-          if (file.endsWith(".yaml")) {
-            const stem = file.replace(/\.yaml$/, "");
+        const scanDir = async (dir, namespace) => {
+          const prefix = namespace ? `agents/${namespace}` : "agents";
+          for (const file of await listFiles(dir)) {
+            const legacy = file.endsWith(".md");
+            if (!legacy && !file.endsWith(".yaml")) continue;
             items.push({
-              name: stem,
+              name: file.replace(/\.(yaml|md)$/, ""),
               type: "agents",
-              sourcePath: path37.join(agentsDir, file),
-              relativePath: `agents/${file}`,
-              legacy: false
-            });
-          } else if (file.endsWith(".md")) {
-            const stem = file.replace(/\.md$/, "");
-            items.push({
-              name: stem,
-              type: "agents",
-              sourcePath: path37.join(agentsDir, file),
-              relativePath: `agents/${file}`,
-              legacy: true
+              sourcePath: path38.join(dir, file),
+              relativePath: `${prefix}/${file}`,
+              legacy,
+              ...namespace ? { namespace } : {}
             });
           }
+        };
+        for (const { dir, namespace } of await listTeamAgentDirs(agentsDir)) {
+          await scanDir(dir, namespace);
         }
         return items;
       }
@@ -13784,22 +14350,27 @@ var init_agents = __esm({
       async pushItem(item, _teamConfig, localConfig) {
         const agentItem = item;
         if (agentItem.skipReason) {
-          log.warn(`[agents] \u8DF3\u8FC7 ${item.name}: ${agentItem.skipReason}`);
-          log.warn("  \u5EFA\u8BAE\u4FEE\u6539\u540E\u91CD\u65B0 push \u8BE5 subagent");
+          log.warn(`[agents] Skipped ${item.name}: ${agentItem.skipReason}`);
           return;
         }
+        const teamDir = path38.resolve(localConfig.repo.localPath, path38.dirname(item.relativePath));
+        assertWithinRoot(
+          path38.join(localConfig.repo.localPath, "agents"),
+          teamDir,
+          `Invalid agent destination outside team repo agents directory: ${item.relativePath}`
+        );
         if (agentItem.mergedSpec) {
-          const dest2 = path37.join(localConfig.repo.localPath, "agents", `${item.name}.yaml`);
-          await ensureDir(path37.dirname(dest2));
+          const dest2 = path38.join(teamDir, `${item.name}.yaml`);
+          await ensureDir(path38.dirname(dest2));
           const yamlContent = serializeAgentYaml(agentItem.mergedSpec);
           await writeFile(dest2, yamlContent);
           log.debug(`Wrote agent ${item.name} \u2192 team repo (YAML format)`);
           return;
         }
         const ext = item.sourcePath.endsWith(".yaml") ? ".yaml" : ".md";
-        const dest = path37.join(localConfig.repo.localPath, "agents", `${item.name}${ext}`);
+        const dest = path38.join(teamDir, `${item.name}${ext}`);
         if (item.sourcePath !== dest) {
-          await ensureDir(path37.dirname(dest));
+          await ensureDir(path38.dirname(dest));
           await copyFile(item.sourcePath, dest);
         }
         log.debug(`Copied agent ${item.name} \u2192 team repo (${ext} verbatim)`);
@@ -13843,11 +14414,12 @@ var init_agents = __esm({
             continue;
           }
           if (isAgentExcluded(localConfig, tool)) continue;
-          const destDir = path37.join(baseDir, toolPath.agents);
+          const destDir = path38.join(baseDir, toolPath.agents);
           try {
             await ensureDir(destDir);
             const { ext, content: rendered } = renderForTool(spec, tool);
-            const dest = path37.join(destDir, `${item.name}${ext}`);
+            await removeStaleAgentSiblings2(destDir, item.name, ext);
+            const dest = path38.join(destDir, `${item.name}${ext}`);
             await writeFile(dest, rendered);
             log.debug(`Rendered agent ${item.name} \u2192 ${tool} (${ext})`);
           } catch (e) {
@@ -13863,19 +14435,17 @@ var init_agents = __esm({
       async removeItem(name, teamConfig, localConfig) {
         const removed = [];
         const baseDir = resolveBaseDir(localConfig);
-        const teamAgentsDir = path37.join(localConfig.repo.localPath, "agents");
-        for (const ext of [".yaml", ".md"]) {
-          const teamFile = path37.join(teamAgentsDir, `${name}${ext}`);
-          if (await pathExists(teamFile)) {
-            await remove(teamFile);
-            removed.push(teamFile);
-          }
+        const teamAgentsDir = path38.join(localConfig.repo.localPath, "agents");
+        for (const located of await findTeamAgentFiles(teamAgentsDir, name)) {
+          await remove(located.path);
+          removed.push(located.path);
         }
         await this.addTombstone(name, localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.agents) continue;
-          for (const ext of [".md", ".toml"]) {
-            const filePath = path37.join(baseDir, toolPath.agents, `${name}${ext}`);
+          if (isAgentExcluded(localConfig, tool)) continue;
+          for (const ext of AGENT_FILE_EXTENSIONS) {
+            const filePath = path38.join(baseDir, toolPath.agents, `${name}${ext}`);
             if (await pathExists(filePath)) {
               await remove(filePath);
               removed.push(filePath);
@@ -13885,14 +14455,69 @@ var init_agents = __esm({
         }
         return removed;
       }
+      /**
+       * Revocation pass for role/project scoping. Removes the deployed copies of
+       * every agent whose namespace is no longer active, on every installed tool.
+       *
+       * Data-safety gate, same as inactive skills: a file is deleted only when it
+       * is byte-equal to what pull would render from the team source. A local edit
+       * is kept and reported so nothing unpushed is lost. Root-level agents and
+       * agents still deployed to the same tool destination never qualify.
+       */
+      async cleanupInactiveNamespaces(teamConfig, localConfig, activeNamespaces) {
+        const items = await this.scanTeamForPull(teamConfig, localConfig);
+        const isActive = (item) => !item.namespace || activeNamespaces.includes(item.namespace);
+        const active = items.filter(isActive);
+        const inactive = items.filter((item) => !isActive(item) && !BUILTIN_AGENT_NAMES.has(item.name));
+        if (inactive.length === 0) return;
+        const baseDir = resolveBaseDir(localConfig);
+        for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
+          if (!toolPath.agents || !isKnownTool(tool) || isAgentExcluded(localConfig, tool)) continue;
+          if (!await ResourceHandler.isToolInstalled(toolPath.agents, baseDir)) continue;
+          const destDir = path38.join(baseDir, toolPath.agents);
+          const activeDestinations = /* @__PURE__ */ new Set();
+          for (const item of active) {
+            const rendered = await this.renderedForTool(item, tool);
+            if (rendered) activeDestinations.add(`${item.name}${rendered.ext}`);
+          }
+          for (const item of inactive) {
+            const expected = await this.renderedForTool(item, tool);
+            if (!expected || activeDestinations.has(`${item.name}${expected.ext}`)) continue;
+            const deployed = path38.join(destDir, `${item.name}${expected.ext}`);
+            const current = await readFileSafe(deployed);
+            if (current === null) continue;
+            if (current !== expected.content) {
+              log.warn(`[${localConfig.scope}] Kept agent "${item.name}" (${tool}): it differs from the team source ${item.relativePath}. Back it up, then delete it manually.`);
+              continue;
+            }
+            await remove(deployed);
+            log.debug(`[${localConfig.scope}] Removed inactive role-scoped agent ${item.name} from ${tool}`);
+          }
+        }
+      }
+      /**
+       * What `pullItem` writes for this agent on this tool, or null when the tool
+       * is not a target (legacy `.md` only reaches LEGACY_MD_TOOLS, a YAML spec
+       * honours `targets`, an unparsable spec is skipped like pull skips it).
+       */
+      async renderedForTool(item, tool) {
+        const content = await readFileSafe(item.sourcePath);
+        if (content === null) return null;
+        if (item.legacy) {
+          return LEGACY_MD_TOOLS.has(tool) ? { ext: ".md", content } : null;
+        }
+        const parsed = parseAgentYaml(content, `${item.name}.yaml`);
+        if (!parsed.ok) return null;
+        if (parsed.spec.targets && !parsed.spec.targets.includes(tool)) return null;
+        return renderForTool(parsed.spec, tool);
+      }
       // ─── Private helpers ──────────────────────────────────────────────────────
       /**
        * Legacy pull: copies .md as-is to Claude-compatible tools, including JoyCode.
        */
       async pullLegacyMd(item, teamConfig, baseDir, localConfig) {
-        const legacyTools = /* @__PURE__ */ new Set(["claude", "claude-internal", "tclaude", "codebuddy", "joycode"]);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
-          if (!legacyTools.has(tool)) continue;
+          if (!LEGACY_MD_TOOLS.has(tool)) continue;
           if (!toolPath.agents) {
             log.debug(`Skipping legacy agent sync for ${tool}: no agents path configured`);
             continue;
@@ -13902,10 +14527,10 @@ var init_agents = __esm({
             continue;
           }
           if (isAgentExcluded(localConfig, tool)) continue;
-          const destDir = path37.join(baseDir, toolPath.agents);
+          const destDir = path38.join(baseDir, toolPath.agents);
           try {
             await ensureDir(destDir);
-            const dest = path37.join(destDir, `${item.name}.md`);
+            const dest = path38.join(destDir, `${item.name}.md`);
             await copyFile(item.sourcePath, dest);
             log.debug(`Synced legacy agent ${item.name} \u2192 ${tool}`);
           } catch (e) {
@@ -13914,6 +14539,7 @@ var init_agents = __esm({
         }
       }
     };
+    LEGACY_MD_TOOLS = /* @__PURE__ */ new Set(["claude", "claude-internal", "tclaude", "codebuddy", "joycode"]);
   }
 });
 
@@ -13979,11 +14605,11 @@ __export(update_exports, {
   resolveRegistryForPackage: () => resolveRegistryForPackage,
   update: () => update
 });
-import { execFile as execFile3 } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 import { randomUUID as randomUUID2 } from "crypto";
 import fs16 from "fs";
-import path38 from "path";
+import path39 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import fse7 from "fs-extra";
 function resolveRegistryForPackage(pkgName) {
@@ -13993,15 +14619,15 @@ function resolveRegistryForPackage(pkgName) {
   return PUBLIC_REGISTRY;
 }
 function resolveNpmCommand() {
-  const nodeDir = path38.dirname(process.execPath);
+  const nodeDir = path39.dirname(process.execPath);
   const candidates = [
     // Bundled runtimes: npm installed flat next to node.exe.
-    path38.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
+    path39.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
     // POSIX layout rooted at the node dir itself.
-    path38.join(nodeDir, "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    path39.join(nodeDir, "lib", "node_modules", "npm", "bin", "npm-cli.js"),
     // Canonical POSIX install (official tarball, Homebrew, nvm): node lives in
     // <prefix>/bin with npm at <prefix>/lib/node_modules — one level up.
-    path38.join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+    path39.join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
   ];
   for (const c of candidates) {
     if (fs16.existsSync(c)) return { cmd: process.execPath, args: [c] };
@@ -14010,16 +14636,16 @@ function resolveNpmCommand() {
   return { cmd: "npm", args: [] };
 }
 function prefixFromEntryPath(entry, posix) {
-  const marker = `${path38.sep}node_modules${path38.sep}`;
+  const marker = `${path39.sep}node_modules${path39.sep}`;
   const idx = entry.lastIndexOf(marker);
   if (idx <= 0) return null;
   const root = entry.slice(0, idx);
   const pkgDir = getCurrentPackageName();
-  if (posix && path38.basename(root) === "lib") {
-    const prefix = path38.dirname(root);
-    return fs16.existsSync(path38.join(prefix, "lib", "node_modules", pkgDir)) ? { prefix, global: true } : null;
+  if (posix && path39.basename(root) === "lib") {
+    const prefix = path39.dirname(root);
+    return fs16.existsSync(path39.join(prefix, "lib", "node_modules", pkgDir)) ? { prefix, global: true } : null;
   }
-  return fs16.existsSync(path38.join(root, "node_modules", pkgDir)) ? { prefix: root, global: !posix } : null;
+  return fs16.existsSync(path39.join(root, "node_modules", pkgDir)) ? { prefix: root, global: !posix } : null;
 }
 function resolveInstallPrefix() {
   return prefixFromEntryPath(fileURLToPath4(import.meta.url), process.platform !== "win32");
@@ -14032,7 +14658,7 @@ async function fetchLatestVersion(registry, timeout = VERSION_CHECK_TIMEOUT) {
     const { stdout } = await execFileAsync2(
       npm.cmd,
       [...npm.args, "view", pkgName, "version", `--registry=${resolvedRegistry}`],
-      { timeout, encoding: "utf-8" }
+      { timeout, encoding: "utf-8", windowsHide: true }
     );
     const version2 = stdout.trim();
     if (!version2) return null;
@@ -14144,7 +14770,7 @@ async function acquireLock(lockPath) {
     owner
   });
   try {
-    await ensureDir(path38.dirname(resolved));
+    await ensureDir(path39.dirname(resolved));
   } catch {
     return false;
   }
@@ -14266,19 +14892,19 @@ async function doUpdate() {
         ...target ? [`--prefix=${target.prefix}`] : [],
         `--registry=${registry}`
       ],
-      { timeout: INSTALL_TIMEOUT }
+      { timeout: INSTALL_TIMEOUT, windowsHide: true }
     );
     log.success(`Updated teamai to v${result.latest}`);
     const entry = resolveTeamaiEntryScript();
     if (entry) {
       try {
         const installed = JSON.parse(fs16.readFileSync(
-          path38.join(path38.dirname(path38.dirname(entry)), "package.json"),
+          path39.join(path39.dirname(path39.dirname(entry)), "package.json"),
           "utf-8"
         ));
         if (installed.version !== result.latest) {
           log.warn(
-            `The running install at ${path38.dirname(path38.dirname(entry))} is still v${installed.version ?? "unknown"} (expected v${result.latest}) \u2014 it may need a manual update.`
+            `The running install at ${path39.dirname(path39.dirname(entry))} is still v${installed.version ?? "unknown"} (expected v${result.latest}) \u2014 it may need a manual update.`
           );
         }
       } catch {
@@ -14287,7 +14913,8 @@ async function doUpdate() {
     try {
       const refresh = entry ? { cmd: process.execPath, args: [entry, "hooks", "inject", "--silent"] } : { cmd: "teamai", args: ["hooks", "inject", "--silent"] };
       await execFileAsync2(refresh.cmd, refresh.args, {
-        timeout: 15e3
+        timeout: 15e3,
+        windowsHide: true
       });
       log.success("Refreshed hooks with new version");
     } catch (e) {
@@ -14331,7 +14958,7 @@ var init_update = __esm({
     init_types();
     init_prompt();
     init_package_info();
-    execFileAsync2 = promisify2(execFile3);
+    execFileAsync2 = promisify2(execFile2);
     PUBLIC_REGISTRY = "https://registry.npmjs.org";
     TNPM_REGISTRY = "http://r.tnpm.oa.com";
     VERSION_CHECK_TIMEOUT = 5e3;
@@ -14346,9 +14973,9 @@ var marketplace_exports = {};
 __export(marketplace_exports, {
   refreshMarketplace: () => refreshMarketplace
 });
-import path39 from "path";
+import path40 from "path";
 async function extractSkillDescription2(skillDir) {
-  const skillMdPath = path39.join(skillDir, SKILL_MD2);
+  const skillMdPath = path40.join(skillDir, SKILL_MD2);
   const content = await readFileSafe(skillMdPath);
   if (!content) return "";
   const { data } = parseFrontmatter(content);
@@ -14357,7 +14984,7 @@ async function extractSkillDescription2(skillDir) {
   return String(desc).replace(/\s+/g, " ").trim();
 }
 async function refreshMarketplace(repoPath) {
-  const marketplacePath = path39.join(repoPath, MARKETPLACE_PATH);
+  const marketplacePath = path40.join(repoPath, MARKETPLACE_PATH);
   if (!await pathExists(marketplacePath)) {
     return false;
   }
@@ -14371,11 +14998,11 @@ async function refreshMarketplace(repoPath) {
     return false;
   }
   if (!Array.isArray(marketplace.plugins)) return false;
-  const skillsDir = path39.join(repoPath, "skills");
+  const skillsDir = path40.join(repoPath, "skills");
   const currentSkills = /* @__PURE__ */ new Set();
   const dirs = await listDirs(skillsDir);
   for (const dir of dirs) {
-    const hasSkillMd = await pathExists(path39.join(skillsDir, dir, SKILL_MD2));
+    const hasSkillMd = await pathExists(path40.join(skillsDir, dir, SKILL_MD2));
     if (hasSkillMd) {
       currentSkills.add(dir);
     }
@@ -14394,7 +15021,7 @@ async function refreshMarketplace(repoPath) {
   for (const skillName of currentSkills) {
     const existing = existingPlugins.get(skillName);
     if (existing) {
-      const desc = await extractSkillDescription2(path39.join(skillsDir, skillName));
+      const desc = await extractSkillDescription2(path40.join(skillsDir, skillName));
       if (desc && desc !== existing.description) {
         existing.description = desc;
         changed = true;
@@ -14402,7 +15029,7 @@ async function refreshMarketplace(repoPath) {
       updatedPlugins.push(existing);
       existingPlugins.delete(skillName);
     } else {
-      const desc = await extractSkillDescription2(path39.join(skillsDir, skillName));
+      const desc = await extractSkillDescription2(path40.join(skillsDir, skillName));
       updatedPlugins.push({
         name: skillName,
         source: `./skills/${skillName}`,
@@ -14439,177 +15066,6 @@ var init_marketplace = __esm({
   }
 });
 
-// src/projects.ts
-var projects_exports = {};
-__export(projects_exports, {
-  describeProjects: () => describeProjects,
-  findProject: () => findProject,
-  isSafeNamespaceSegment: () => isSafeNamespaceSegment,
-  listProjectIds: () => listProjectIds,
-  loadProjectsManifest: () => loadProjectsManifest,
-  mergeNamespaces: () => mergeNamespaces,
-  resolveActiveLearningsNamespaces: () => resolveActiveLearningsNamespaces,
-  resolveProjectResourceNamespaces: () => resolveProjectResourceNamespaces,
-  saveProjectsManifest: () => saveProjectsManifest
-});
-import path40 from "path";
-import YAML8 from "yaml";
-import { z as z6 } from "zod";
-function isSafeNamespaceSegment(seg) {
-  return SAFE_ID.test(seg) && seg !== "." && seg !== "..";
-}
-function validateManifestShape2(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error("Invalid projects manifest: expected an object");
-  }
-  const candidate = raw;
-  const projects = candidate.projects;
-  if (projects !== void 0 && !Array.isArray(projects)) {
-    throw new Error("Invalid projects manifest: projects must be an array");
-  }
-  for (const project of projects ?? []) {
-    if (!project || typeof project !== "object") {
-      throw new Error("Invalid projects manifest: every project must be an object");
-    }
-    const resources = project.resources;
-    if (resources !== void 0 && (typeof resources !== "object" || Array.isArray(resources))) {
-      throw new Error(`Invalid projects manifest: project ${project.id ?? "<unknown>"} has invalid resources`);
-    }
-    if (resources) {
-      const ALLOWED_RESOURCE_KEYS = new Set(PROJECT_RESOURCE_TYPES);
-      for (const key of Object.keys(resources)) {
-        if (!ALLOWED_RESOURCE_KEYS.has(key)) {
-          throw new Error(`Invalid projects manifest: unknown resource type "${key}"`);
-        }
-      }
-    }
-  }
-  const manifest = ProjectsManifestSchema.parse(raw);
-  const ids = /* @__PURE__ */ new Set();
-  for (const project of manifest.projects) {
-    if (ids.has(project.id)) {
-      throw new Error(`Invalid projects manifest: duplicate project id "${project.id}"`);
-    }
-    ids.add(project.id);
-  }
-  return manifest;
-}
-async function loadProjectsManifest(repoPath) {
-  const manifestPath = path40.join(repoPath, "manifest", "projects.yaml");
-  const content = await readFileSafe(manifestPath);
-  if (!content) {
-    return null;
-  }
-  let raw;
-  try {
-    raw = YAML8.parse(content);
-  } catch (error) {
-    throw new Error(`Invalid projects manifest YAML: ${error.message}`);
-  }
-  return validateManifestShape2(raw);
-}
-async function saveProjectsManifest(repoPath, manifest) {
-  validateManifestShape2(manifest);
-  const manifestDir = path40.join(repoPath, "manifest");
-  const manifestPath = path40.join(manifestDir, "projects.yaml");
-  await ensureDir(manifestDir);
-  await writeFile(manifestPath, YAML8.stringify(manifest));
-}
-function findProject(manifest, projectId) {
-  return manifest.projects.find((candidate) => candidate.id === projectId);
-}
-function listProjectIds(manifest) {
-  return manifest.projects.map((project) => project.id);
-}
-function describeProjects(projects) {
-  return projects.map((project) => {
-    const label = project.name || project.id;
-    return project.description ? `${label}: ${project.description}` : label;
-  });
-}
-function getProjectOrThrow(manifest, projectId) {
-  const project = findProject(manifest, projectId);
-  if (!project) {
-    throw new Error(`Unknown project "${projectId}". Valid projects: ${listProjectIds(manifest).join(", ")}`);
-  }
-  return project;
-}
-function resolveProjectResourceNamespaces(input) {
-  const resolved = input.activeProjects.map((id) => getProjectOrThrow(input.manifest, id));
-  const namespaces = {
-    knowledge: [],
-    skills: [],
-    learnings: []
-  };
-  for (const type of PROJECT_RESOURCE_TYPES) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const project of resolved) {
-      for (const namespace of project.resources[type]) {
-        if (seen.has(namespace)) continue;
-        seen.add(namespace);
-        namespaces[type].push(namespace);
-      }
-    }
-  }
-  return namespaces;
-}
-async function resolveActiveLearningsNamespaces(repoPath, activeProjects) {
-  if (activeProjects.length === 0) return [];
-  const manifest = await loadProjectsManifest(repoPath);
-  if (!manifest) return [];
-  try {
-    return resolveProjectResourceNamespaces({ manifest, activeProjects }).learnings;
-  } catch {
-    return [];
-  }
-}
-function mergeNamespaces(roleNamespaces, projectNamespaces) {
-  const dedupe = (a, b) => {
-    const seen = /* @__PURE__ */ new Set();
-    const out = [];
-    for (const ns of [...a, ...b]) {
-      if (seen.has(ns)) continue;
-      seen.add(ns);
-      out.push(ns);
-    }
-    return out;
-  };
-  return {
-    knowledge: dedupe(roleNamespaces.knowledge, projectNamespaces.knowledge),
-    skills: dedupe(roleNamespaces.skills, projectNamespaces.skills),
-    // Roles never contribute learnings; this is effectively the project set.
-    learnings: dedupe(roleNamespaces.learnings, projectNamespaces.learnings)
-  };
-}
-var PROJECT_RESOURCE_TYPES, ProjectResourceNamespacesSchema, SAFE_ID, ProjectSchema, ProjectsManifestSchema;
-var init_projects = __esm({
-  "src/projects.ts"() {
-    "use strict";
-    init_fs();
-    PROJECT_RESOURCE_TYPES = ["knowledge", "skills", "learnings"];
-    ProjectResourceNamespacesSchema = z6.object({
-      knowledge: z6.array(z6.string().min(1)).default([]),
-      skills: z6.array(z6.string().min(1)).default([]),
-      learnings: z6.array(z6.string().min(1)).default([])
-    });
-    SAFE_ID = /^[A-Za-z0-9._-]+$/;
-    ProjectSchema = z6.object({
-      id: z6.string().min(1).refine((v) => isSafeNamespaceSegment(v), {
-        message: "project id must be a single path segment (letters, digits, '.', '_', '-'; no '/', '\\\\', or '..')"
-      }),
-      name: z6.string().default(""),
-      description: z6.string().default(""),
-      resources: ProjectResourceNamespacesSchema
-    });
-    ProjectsManifestSchema = z6.object({
-      version: z6.number(),
-      // Unlike roles (`.min(1)`), a repo may define zero projects — a team without
-      // project partitioning simply has no projects.yaml, and an empty list is valid.
-      projects: z6.array(ProjectSchema).default([])
-    });
-  }
-});
-
 // src/pkg/types.ts
 import { z as z7 } from "zod";
 var PackageScopeSchema, NpmSpecSchema, ClaudeMarketplaceSchema, ClaudePluginSpecSchema, ClaudeEcosystemSchema, PackageSetSchema, PackageManifestSchema, NpmLockEntrySchema, ClaudeMarketplaceLockSchema, ClaudePluginLockSchema, PackageLockSchema;
@@ -14861,6 +15317,7 @@ __export(reports_branch_exports, {
   ensureReportsDir: () => ensureReportsDir,
   ensureReportsWorktree: () => ensureReportsWorktree,
   refreshReportsWorktree: () => refreshReportsWorktree,
+  updateReports: () => updateReports,
   withKnowledgeWorktree: () => withKnowledgeWorktree
 });
 import path42 from "path";
@@ -14868,8 +15325,17 @@ import fse8 from "fs-extra";
 function businessRoot(localConfig) {
   return localConfig.repo.businessRepoRoot ?? path42.dirname(localConfig.repo.localPath);
 }
+function reportsGitRoot(localConfig) {
+  if (isSelfMode(localConfig)) {
+    return businessRoot(localConfig);
+  }
+  return localConfig.repo.localPath;
+}
 function reportsWorktreePath(localConfig) {
-  return path42.join(localConfig.repo.localPath, REPORTS_WORKTREE_DIRNAME);
+  return getReportsDir(localConfig);
+}
+function reportsLockPath(localConfig) {
+  return path42.join(path42.dirname(getReportsDir(localConfig)), REPORTS_LOCK_FILENAME);
 }
 async function remoteBranchExists2(repoRoot) {
   const git = createGit2(repoRoot);
@@ -14881,10 +15347,22 @@ async function remoteBranchExists2(repoRoot) {
   }
 }
 async function ensureReportsWorktree(localConfig, options = {}) {
+  if (!usesReportsBranch(localConfig)) {
+    return getReportsDir(localConfig);
+  }
   const wt = reportsWorktreePath(localConfig);
-  const repoRoot = businessRoot(localConfig);
+  const repoRoot = reportsGitRoot(localConfig);
+  if (!isSelfMode(localConfig) && !await isDedicatedRepoRoot(repoRoot)) {
+    throw new Error(
+      `Refusing to create a reports worktree: ${repoRoot} is not a dedicated team-repo clone root`
+    );
+  }
   if (await isGitRepo(wt)) {
-    return wt;
+    try {
+      await createGit2(wt).revparse(["--is-inside-work-tree"]);
+      return wt;
+    } catch {
+    }
   }
   if (await pathExists(wt)) {
     await fse8.remove(wt);
@@ -14907,14 +15385,19 @@ async function ensureReportsWorktree(localConfig, options = {}) {
       await git.raw(["worktree", "add", wt, "--track", "-b", REPORTS_BRANCH, `origin/${REPORTS_BRANCH}`]);
     }
   } else {
-    await createOrphanWorktree(repoRoot, wt);
-    await writeWorktreeGitignore(wt);
-    const wtGit = createGit2(wt);
-    await wtGit.add([".gitignore"]);
-    await commitSkippingHooks(wtGit, "[teamai] Initialize reports branch");
+    const branches = await git.branchLocal();
+    if (branches.all.includes(REPORTS_BRANCH)) {
+      await git.raw(["worktree", "add", wt, REPORTS_BRANCH]);
+    } else {
+      await createOrphanWorktree(repoRoot, wt);
+      await writeWorktreeGitignore(wt);
+      const wtGit = createGit2(wt);
+      await wtGit.add([".gitignore"]);
+      await commitSkippingHooks(wtGit, "[teamai] Initialize reports branch");
+    }
     if (options.pushIfCreated !== false) {
       try {
-        await wtGit.push(["-u", "origin", REPORTS_BRANCH]);
+        await createGit2(wt).push(["-u", "origin", REPORTS_BRANCH]);
       } catch (e) {
         log.debug(`[reports] initial push skipped: ${e.message}`);
       }
@@ -14958,45 +15441,48 @@ async function writeWorktreeGitignore(wt) {
   ].join("\n");
   await writeFile(path42.join(wt, ".gitignore"), content);
 }
-async function commitAndPushReports(localConfig, message, files) {
-  const lockPath = path42.join(localConfig.repo.localPath, REPORTS_LOCK_FILENAME);
-  const locked = await acquireLock(lockPath);
-  if (!locked) {
-    log.debug("[reports] another reports write is in progress; skipping");
+async function commitAndPushReportsAt(wt, message, files, options = {}) {
+  const git = createGit2(wt);
+  await git.add(files);
+  const status2 = await git.status();
+  if (status2.staged.length === 0 && !options.pushIfUnchanged) {
+    log.debug("[reports] nothing to commit");
     return false;
   }
-  try {
-    const wt = await ensureReportsWorktree(localConfig);
-    const git = createGit2(wt);
-    await git.add(files);
-    const status2 = await git.status();
-    if (status2.staged.length === 0) {
-      log.debug("[reports] nothing to commit");
-      return false;
-    }
-    await commitSkippingHooks(git, message);
-    for (let attempt = 1; attempt <= MAX_PUSH_RETRIES; attempt++) {
+  if (status2.staged.length > 0) await commitSkippingHooks(git, message);
+  for (let attempt = 1; attempt <= MAX_PUSH_RETRIES; attempt++) {
+    try {
+      await git.push(["origin", REPORTS_BRANCH]);
+      return true;
+    } catch (pushErr) {
+      if (attempt === MAX_PUSH_RETRIES) {
+        log.debug(`[reports] push failed after ${attempt} attempts: ${pushErr.message}`);
+        return false;
+      }
       try {
-        await git.push(["origin", REPORTS_BRANCH]);
-        return true;
-      } catch (pushErr) {
-        if (attempt === MAX_PUSH_RETRIES) {
-          log.debug(`[reports] push failed after ${attempt} attempts: ${pushErr.message}`);
-          return false;
-        }
+        await git.fetch(["origin", REPORTS_BRANCH]);
+        await git.rebase([`origin/${REPORTS_BRANCH}`]);
+      } catch (rebaseErr) {
+        log.debug(`[reports] rebase failed, retrying: ${rebaseErr.message}`);
         try {
-          await git.fetch(["origin", REPORTS_BRANCH]);
-          await git.rebase([`origin/${REPORTS_BRANCH}`]);
-        } catch (rebaseErr) {
-          log.debug(`[reports] rebase failed, retrying: ${rebaseErr.message}`);
-          try {
-            await git.rebase(["--abort"]);
-          } catch {
-          }
+          await git.rebase(["--abort"]);
+        } catch {
         }
       }
     }
+  }
+  return false;
+}
+async function commitAndPushReports(localConfig, message, files, options = {}) {
+  const lockPath = reportsLockPath(localConfig);
+  const locked = await acquireLock(lockPath);
+  if (!locked) {
+    log.debug("[reports] another reports write is in progress; skipping");
     return false;
+  }
+  try {
+    const wt = await ensureReportsWorktree(localConfig);
+    return await commitAndPushReportsAt(wt, message, files, options);
   } catch (e) {
     log.debug(`[reports] commitAndPushReports failed (non-blocking): ${e.message}`);
     return false;
@@ -15004,18 +15490,167 @@ async function commitAndPushReports(localConfig, message, files) {
     await releaseLock(lockPath);
   }
 }
+async function updateReports(localConfig, write, options = {}) {
+  if (!usesReportsBranch(localConfig)) {
+    throw new Error("updateReports requires a repo that stores reports on the teamai-reports branch");
+  }
+  const lockPath = reportsLockPath(localConfig);
+  if (!await acquireLock(lockPath)) {
+    log.debug("[reports] another reports write is in progress; skipping");
+    return false;
+  }
+  try {
+    const wt = await ensureReportsWorktree(localConfig);
+    try {
+      await syncReportsWorktree(wt);
+    } catch (e) {
+      log.debug(`[reports] sync before write failed, writing onto the local copy: ${e.message}`);
+    }
+    const change = await write(wt);
+    if (!change || change.files.length === 0) {
+      return false;
+    }
+    return await commitAndPushReportsAt(wt, change.message, change.files, options);
+  } catch (e) {
+    log.debug(`[reports] updateReports failed (non-blocking): ${e.message}`);
+    return false;
+  } finally {
+    await releaseLock(lockPath);
+  }
+}
+async function gitPathExists(git, gitPath) {
+  try {
+    const resolved = (await git.raw(["rev-parse", "--git-path", gitPath])).trim();
+    return resolved.length > 0 && await pathExists(resolved);
+  } catch {
+    return false;
+  }
+}
+async function rebaseInProgress(git) {
+  return await gitPathExists(git, "rebase-merge") || await gitPathExists(git, "rebase-apply");
+}
+async function restoreConflictedFiles(git) {
+  let conflicted = [];
+  try {
+    conflicted = (await git.status()).conflicted ?? [];
+  } catch {
+    return;
+  }
+  if (conflicted.length === 0) {
+    return;
+  }
+  if (await rebaseInProgress(git)) {
+    return;
+  }
+  try {
+    await git.raw(["checkout", "--theirs", "--", ...conflicted]);
+    await git.raw(["add", "--", ...conflicted]);
+    await git.raw(["reset", "HEAD", "--", ...conflicted]);
+    log.debug("[reports] restored uncommitted report files after a stash-apply conflict; using the local copy");
+  } catch (e) {
+    log.debug(`[reports] could not restore stash-apply conflicts: ${e.message}`);
+    try {
+      await git.raw(["reset", "--hard", "HEAD"]);
+    } catch {
+    }
+  }
+}
+async function snapshotDirtyTree(git) {
+  try {
+    const sha = (await git.raw(["stash", "create"])).trim();
+    return sha.length > 0 ? sha : null;
+  } catch {
+    return null;
+  }
+}
+async function applyDirtySnapshot(git, sha) {
+  try {
+    await git.raw(["stash", "apply", sha]);
+  } catch {
+  }
+  await restoreConflictedFiles(git);
+}
+async function syncReportsWorktree(wt) {
+  const git = createGit2(wt);
+  const upstream = `origin/${REPORTS_BRANCH}`;
+  try {
+    await git.fetch(["origin", REPORTS_BRANCH]);
+  } catch (e) {
+    log.debug(`[reports] fetch failed, using the local copy: ${e.message}`);
+    return;
+  }
+  await restoreConflictedFiles(git);
+  const dirty = !(await git.status()).isClean();
+  const ahead = Number.parseInt((await git.raw(["rev-list", "--count", `${upstream}..HEAD`])).trim(), 10);
+  let carried = null;
+  if (dirty && ahead > 0) {
+    carried = await snapshotDirtyTree(git);
+    if (!carried) {
+      log.debug("[reports] uncommitted report files block the refresh; using the local copy");
+      return;
+    }
+    try {
+      await git.raw(["reset", "--hard", "HEAD"]);
+    } catch (e) {
+      log.debug(`[reports] could not clear the worktree for rebase; using the local copy: ${e.message}`);
+      await applyDirtySnapshot(git, carried);
+      return;
+    }
+  }
+  try {
+    if (ahead > 0) {
+      await git.rebase([upstream]);
+    } else {
+      await git.raw(["merge", "--ff-only", upstream]);
+    }
+  } catch (e) {
+    if (ahead > 0) {
+      try {
+        await git.rebase(["--abort"]);
+      } catch {
+      }
+    }
+    if (carried) {
+      await applyDirtySnapshot(git, carried);
+      log.debug(`[reports] uncommitted report files block the refresh; using the local copy: ${e.message}`);
+      return;
+    }
+    if (dirty) {
+      log.debug(`[reports] uncommitted report files block the refresh; using the local copy: ${e.message}`);
+      return;
+    }
+    log.debug(`[reports] dropping ${ahead} unpushed report commit(s) that conflict with ${upstream}: ${e.message}`);
+    await git.raw(["reset", "--hard", upstream]);
+    return;
+  }
+  if (carried) {
+    await applyDirtySnapshot(git, carried);
+  }
+}
 async function refreshReportsWorktree(localConfig, options = {}) {
+  if (!usesReportsBranch(localConfig)) {
+    return;
+  }
+  const lockPath = reportsLockPath(localConfig);
+  let locked = false;
   try {
+    locked = await acquireLock(lockPath);
     const wt = await ensureReportsWorktree(localConfig, options);
-    const git = createGit2(wt);
-    await git.fetch(["origin", REPORTS_BRANCH]);
-    await git.raw(["reset", "--hard", `origin/${REPORTS_BRANCH}`]);
+    if (!locked) {
+      log.debug("[reports] a reports write is in progress; reading the local copy");
+      return;
+    }
+    await syncReportsWorktree(wt);
   } catch (e) {
     log.debug(`[reports] refresh skipped: ${e.message}`);
+  } finally {
+    if (locked) {
+      await releaseLock(lockPath);
+    }
   }
 }
 async function ensureReportsDir(localConfig) {
-  if (localConfig.repo.kind === "self") {
+  if (usesReportsBranch(localConfig)) {
     return ensureReportsWorktree(localConfig);
   }
   return getReportsDir(localConfig);
@@ -15139,10 +15774,11 @@ async function listMembers(options) {
   const projectConfig = await detectProjectConfig();
   const localConfig = projectConfig ?? (await requireInit()).localConfig;
   let repoPath;
-  if (localConfig.repo.kind === "self") {
+  const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+  if (usesReportsBranch2(localConfig)) {
     const { ensureReportsWorktree: ensureReportsWorktree2, refreshReportsWorktree: refreshReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-    await refreshReportsWorktree2(localConfig);
-    repoPath = await ensureReportsWorktree2(localConfig);
+    await refreshReportsWorktree2(localConfig, { pushIfCreated: false });
+    repoPath = await ensureReportsWorktree2(localConfig, { pushIfCreated: false });
   } else {
     repoPath = localConfig.repo.localPath;
     await pullRepo(repoPath);
@@ -15346,6 +15982,7 @@ var init_known_agents = __esm({
 // src/init.ts
 var init_exports = {};
 __export(init_exports, {
+  ALL_PROJECTS_SELECTOR: () => ALL_PROJECTS_SELECTOR,
   buildSelfModeGitignore: () => buildSelfModeGitignore,
   init: () => init,
   initHttp: () => initHttp,
@@ -15353,6 +15990,7 @@ __export(init_exports, {
   migrateSelfModeGitignore: () => migrateSelfModeGitignore,
   migrateSelfModeGitignoreContent: () => migrateSelfModeGitignoreContent,
   promptForSelfModeAgents: () => promptForSelfModeAgents,
+  resolveActiveProjects: () => resolveActiveProjects,
   resolveInheritUserScope: () => resolveInheritUserScope,
   resolveInitRepo: () => resolveInitRepo,
   resolveInitScope: () => resolveInitScope,
@@ -15423,6 +16061,10 @@ async function promptForRoleProfile(repoPath, roleFlag) {
     resourceProfileVersion: manifest.version
   };
 }
+function dedupeIds(ids) {
+  const seen = /* @__PURE__ */ new Set();
+  return ids.filter((id) => seen.has(id) ? false : (seen.add(id), true));
+}
 async function resolveActiveProjects(repoPath, projectFlag) {
   const requested = (projectFlag ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   if (requested.length === 0) {
@@ -15434,7 +16076,27 @@ async function resolveActiveProjects(repoPath, projectFlag) {
       `--project given but no projects manifest (manifest/projects.yaml) exists in the team repo.`
     );
   }
-  const validIds = new Set(listProjectIds(manifest));
+  const declared = listProjectIds(manifest);
+  if (requested.includes(ALL_PROJECTS_SELECTOR)) {
+    if (requested.length > 1) {
+      throw new Error(
+        `--project "${ALL_PROJECTS_SELECTOR}" already covers every declared project; drop the other ids (got: ${requested.join(", ")}).`
+      );
+    }
+    if (declared.length === 0) {
+      log.warn(
+        `--project "${ALL_PROJECTS_SELECTOR}" was given but manifest/projects.yaml declares no projects; nothing was activated.`
+      );
+      return { projects: [] };
+    }
+    if (declared.includes(ALL_PROJECTS_SELECTOR)) {
+      log.warn(
+        `manifest/projects.yaml declares a project with the id "${ALL_PROJECTS_SELECTOR}", which is the reserved --project selector: every project is activated (that one included). To activate only it, run \`teamai projects set ${ALL_PROJECTS_SELECTOR}\`.`
+      );
+    }
+    return { projects: declared };
+  }
+  const validIds = new Set(declared);
   for (const id of requested) {
     if (!validIds.has(id)) {
       throw new Error(
@@ -15442,9 +16104,7 @@ async function resolveActiveProjects(repoPath, projectFlag) {
       );
     }
   }
-  const seen = /* @__PURE__ */ new Set();
-  const projects = requested.filter((id) => seen.has(id) ? false : (seen.add(id), true));
-  return { projects };
+  return { projects: dedupeIds(requested) };
 }
 function resolveInitScope(rawScope, cwd, homeDir) {
   const cwdResolved = resolveRealPath(cwd);
@@ -15834,12 +16494,12 @@ async function initSelfRepo(options) {
     return;
   }
   const provider = getProvider(providerName);
-  log.debug(`Detected provider: ${providerName} (from ${remoteUrl})`);
+  log.debug(`Detected provider: ${providerName} (from ${redactGitCredentials(remoteUrl)})`);
   let repoInfo;
   try {
-    repoInfo = provider.parseRepoInput(remoteUrl);
+    repoInfo = providerName === "git" ? parseGenericGitExistingRemote(remoteUrl) : provider.parseRepoInput(remoteUrl);
   } catch (e) {
-    log.error(`Could not parse the business repo remote "${remoteUrl}": ${e.message}`);
+    log.error(`Could not parse the business repo remote "${redactGitCredentials(remoteUrl)}": ${e.message}`);
     process.exit(1);
     return;
   }
@@ -15962,20 +16622,28 @@ async function initSelfRepo(options) {
   }
   if (!options.dryRun) {
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(localConfig);
-      const memberDir = path45.join(wt, "members");
-      await ensureDir(memberDir);
-      const memberPath = path45.join(memberDir, `${username}.yaml`);
-      const isNewSelfMember = !await pathExists(memberPath);
-      const existingSelfMember = await getMemberConfig(wt, username);
-      const { config: selfMemberConfig, changed: selfMemberChanged } = mergeMemberConfig(existingSelfMember, {
-        username,
-        projects: localConfig.projects
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      let isNewSelfMember = false;
+      let selfMemberChanged = false;
+      const pushed = await updateReports2(localConfig, async (wt) => {
+        const memberDir = path45.join(wt, "members");
+        await ensureDir(memberDir);
+        const memberPath = path45.join(memberDir, `${username}.yaml`);
+        isNewSelfMember = !await pathExists(memberPath);
+        const existingSelfMember = await getMemberConfig(wt, username);
+        const merged = mergeMemberConfig(existingSelfMember, {
+          username,
+          projects: localConfig.projects
+        });
+        selfMemberChanged = merged.changed;
+        if (!merged.changed) return null;
+        await writeFile(memberPath, YAML11.stringify(merged.config));
+        return {
+          files: ["members/"],
+          message: isNewSelfMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`
+        };
       });
       if (selfMemberChanged) {
-        await writeFile(memberPath, YAML11.stringify(selfMemberConfig));
-        const pushed = await commitAndPushReports2(localConfig, isNewSelfMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`, ["members/"]);
         if (pushed) {
           log.success(isNewSelfMember ? "Member registered on the teamai-reports branch" : "Member roster updated on the teamai-reports branch");
         } else {
@@ -16150,6 +16818,17 @@ async function init(options) {
         }
       } else {
         log.info(`Repo already exists at ${localPath}, using existing clone`);
+        try {
+          const pullResult = await pullRepoFastForward(localPath);
+          if (pullResult !== "already up to date") {
+            log.info(`Refreshed existing clone (${pullResult})`);
+          }
+        } catch (e) {
+          log.error(
+            `Failed to refresh existing clone at ${localPath}: ${e.message}. The local clone was left unchanged. Fix network/auth or resolve divergence (commit/stash local edits), or remove ${localPath} manually to start fresh.`
+          );
+          process.exit(1);
+        }
       }
     } else {
       log.warn(`Existing ${localPath} is not a git repository, re-cloning`);
@@ -16242,6 +16921,7 @@ async function init(options) {
   const emailDomain = provider.getDefaultEmailDomain() ?? void 0;
   await configureGitUser(localPath, username, username, void 0, emailDomain);
   const teamConfig = await loadTeamConfig(localPath);
+  const createdSkeleton = !teamConfig;
   if (!teamConfig) {
     log.warn("teamai.yaml not found in repo. Creating default config...");
     const defaultConfig = YAML11.stringify({
@@ -16271,33 +16951,67 @@ async function init(options) {
     log.error(error.message);
     process.exit(1);
   }
-  const memberPath = path45.join(localPath, "members", `${username}.yaml`);
-  const isNewMember = !await pathExists(memberPath);
-  const existingMember = await getMemberConfig(localPath, username);
-  const { config: memberConfig, changed: memberChanged } = mergeMemberConfig(existingMember, {
+  const reportsConfig = {
+    repo: { localPath, remote: repoInfo.httpsUrl },
     username,
-    projects: resolvedProjects
-  });
-  if (memberChanged) {
-    await writeFile(memberPath, YAML11.stringify(memberConfig));
-    log.success(isNewMember ? `Registered as team member: ${username}` : `Updated member roster: ${username}${memberConfig.projects ? ` (projects: ${memberConfig.projects.join(", ")})` : ""}`);
-    if (!options.dryRun) {
-      try {
-        await pushRepoDirectly(localPath, isNewMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`, [
-          "members/",
-          "teamai.yaml",
-          "skills/.gitkeep",
-          "rules/.gitkeep",
-          "docs/.gitkeep",
-          "env/.gitkeep"
-        ]);
-        log.success("Member registration pushed to team repo");
-      } catch (e) {
-        log.warn(`Push failed (you can push manually later): ${e.message}`);
+    scope,
+    projectRoot,
+    additionalRoles: []
+  };
+  if (createdSkeleton && !options.dryRun) {
+    try {
+      await pushRepoDirectly(localPath, "[teamai] Initialize team repo skeleton", [
+        "teamai.yaml",
+        "skills/.gitkeep",
+        "rules/.gitkeep",
+        "docs/.gitkeep",
+        "env/.gitkeep",
+        "members/.gitkeep"
+      ]);
+    } catch (e) {
+      log.warn(`Push failed (you can push manually later): ${e.message}`);
+    }
+  }
+  let isNewMember = true;
+  if (!options.dryRun) {
+    try {
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      let memberChanged = false;
+      let memberProjects;
+      const pushed = await updateReports2(reportsConfig, async (wt) => {
+        const memberDir = path45.join(wt, "members");
+        await ensureDir(memberDir);
+        const memberPath = path45.join(memberDir, `${username}.yaml`);
+        isNewMember = !await pathExists(memberPath);
+        const existingMember = await getMemberConfig(wt, username);
+        const merged = mergeMemberConfig(existingMember, {
+          username,
+          projects: resolvedProjects
+        });
+        memberChanged = merged.changed;
+        memberProjects = merged.config.projects;
+        if (!merged.changed) return null;
+        await writeFile(memberPath, YAML11.stringify(merged.config));
+        return {
+          files: ["members/"],
+          message: isNewMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`
+        };
+      });
+      if (memberChanged) {
+        log.success(isNewMember ? `Registered as team member: ${username}` : `Updated member roster: ${username}${memberProjects ? ` (projects: ${memberProjects.join(", ")})` : ""}`);
+        if (pushed) {
+          log.success(isNewMember ? "Member registered on the teamai-reports branch" : "Member roster updated on the teamai-reports branch");
+        } else {
+          log.warn("Member registration could not be pushed (no write access?). You are still set up locally.");
+        }
+      } else if (!isNewMember) {
+        log.info(`Member ${username} already registered`);
       }
+    } catch (e) {
+      log.warn(`Member registration skipped (non-blocking): ${e.message}`);
     }
   } else {
-    log.info(`Member ${username} already registered`);
+    log.info(`[dry-run] Would register member ${username} on the teamai-reports branch`);
   }
   const currentConfig = await loadTeamConfig(localPath);
   const hasReviewers = currentConfig?.reviewers && currentConfig.reviewers.length > 0;
@@ -16417,6 +17131,7 @@ async function init(options) {
   log.info("Run `teamai status` to check current config.");
   closePrompt();
 }
+var ALL_PROJECTS_SELECTOR;
 var init_init = __esm({
   "src/init.ts"() {
     "use strict";
@@ -16425,6 +17140,7 @@ var init_init = __esm({
     init_git2();
     init_git2();
     init_providers();
+    init_repo_url5();
     init_fs();
     init_logger();
     init_types();
@@ -16434,6 +17150,7 @@ var init_init = __esm({
     init_members();
     init_prompt();
     init_known_agents();
+    ALL_PROJECTS_SELECTOR = "all";
   }
 });
 
@@ -16756,13 +17473,19 @@ async function pushCore(localConfig, teamConfig, options, initialPendingTeamConf
     }
   } : teamConfig;
   const pushableTypes = ["skills", "rules", "env", "agents"];
-  const allItems = [];
+  const fullScan = [];
   for (const type of pushableTypes) {
     const handler = getHandler(type);
     const items = await handler.scanLocalForPush(scanTeamConfig, localConfig);
-    allItems.push(...items);
+    fullScan.push(...items);
   }
-  const fullScan = [...allItems];
+  const allItems = fullScan.filter((item) => {
+    if (item.type === "agents" && "skipReason" in item && typeof item.skipReason === "string" && item.skipReason) {
+      log.warn(`[agents] Skipped ${item.name}: ${item.skipReason}`);
+      return false;
+    }
+    return true;
+  });
   spin.stop();
   if (options.skill) {
     const skillBasename = path46.basename(
@@ -17148,6 +17871,7 @@ __export(git_exports, {
   listWorktrees: () => listWorktrees,
   normalizeRepoUrlForCompare: () => normalizeRepoUrlForCompare,
   pullRepo: () => pullRepo,
+  pullRepoFastForward: () => pullRepoFastForward,
   pushLearningToOrigin: () => pushLearningToOrigin,
   pushRepoBranch: () => pushRepoBranch,
   pushRepoDirectly: () => pushRepoDirectly,
@@ -17286,6 +18010,14 @@ async function pullRepo(localPath) {
     return "reset to origin (diverged)";
   }
 }
+async function pullRepoFastForward(localPath) {
+  const git = createGit2(localPath);
+  const result = await git.pull(["--ff-only"]);
+  if (result.summary.changes === 0 && result.summary.insertions === 0 && result.summary.deletions === 0) {
+    return "already up to date";
+  }
+  return `${result.summary.changes} file(s) changed`;
+}
 async function getDefaultBranch(localPath) {
   const cached = defaultBranchCache.get(localPath);
   if (cached) return cached;
@@ -17861,19 +18593,19 @@ async function bootstrapSelfRepo(dir, opts) {
       log.debug(`[bootstrap] hook injection failed (non-blocking): ${e.message}`);
     }
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(localConfig);
-      const memberDir = path49.join(wt, "members");
-      await ensureDir(memberDir);
-      const memberPath = path49.join(memberDir, `${username}.yaml`);
-      if (!await pathExists(memberPath)) {
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      await updateReports2(localConfig, async (wt) => {
+        const memberDir = path49.join(wt, "members");
+        await ensureDir(memberDir);
+        const memberPath = path49.join(memberDir, `${username}.yaml`);
+        if (await pathExists(memberPath)) return null;
         await writeFile(memberPath, YAML14.stringify({
           username,
           displayName: username,
           registeredAt: (/* @__PURE__ */ new Date()).toISOString()
         }));
-        await commitAndPushReports2(localConfig, `[teamai] Register member: ${username}`, ["members/"]);
-      }
+        return { files: ["members/"], message: `[teamai] Register member: ${username}` };
+      });
     } catch (e) {
       log.debug(`[bootstrap] member registration skipped (non-blocking): ${e.message}`);
     }
@@ -18141,68 +18873,6 @@ var init_config = __esm({
   }
 });
 
-// src/utils/exec.ts
-import spawn from "cross-spawn";
-async function probeBinary(binary, args = ["--version"], executor = execCommand) {
-  try {
-    const result = await executor(binary, args, { timeoutMs: 5e3 });
-    if (result.code !== 0) return "";
-    return (result.stdout || result.stderr).trim();
-  } catch {
-    return "";
-  }
-}
-function formatCommand(command, args) {
-  const quote = (value) => /^[a-zA-Z0-9_./:@=+-]+$/.test(value) ? value : JSON.stringify(value);
-  return [command, ...args.map(quote)].join(" ");
-}
-var execCommand;
-var init_exec = __esm({
-  "src/utils/exec.ts"() {
-    "use strict";
-    execCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
-      const child = spawn(command, args, {
-        cwd: options.cwd,
-        env: options.env,
-        stdio: ["ignore", "pipe", "pipe"],
-        shell: false
-      });
-      let stdout = "";
-      let stderr = "";
-      let settled = false;
-      const timeoutMs = options.timeoutMs ?? 12e4;
-      const finish = (callback) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        callback();
-      };
-      child.stdout?.on("data", (chunk) => {
-        const text = chunk.toString();
-        stdout += text;
-        if (options.stream) process.stdout.write(text);
-      });
-      child.stderr?.on("data", (chunk) => {
-        const text = chunk.toString();
-        stderr += text;
-        if (options.stream) process.stderr.write(text);
-      });
-      const timer = setTimeout(() => {
-        child.kill();
-        finish(() => reject(new Error(
-          `Command timed out after ${timeoutMs}ms: ${command} ${args.join(" ")}`
-        )));
-      }, timeoutMs);
-      child.on("error", (error) => finish(() => reject(error)));
-      child.on("close", (code) => finish(() => resolve({
-        stdout,
-        stderr,
-        code: code ?? 1
-      })));
-    });
-  }
-});
-
 // src/pkg/adapters/base.ts
 var PackageAdapter;
 var init_base2 = __esm({
@@ -19208,9 +19878,9 @@ async function verifyStaging(legacyDir, staging) {
       throw new Error("migration verify: team-repo/.git missing after copy (clone would be broken)");
     }
     try {
-      const { execFile: execFile5 } = await import("child_process");
+      const { execFile: execFile4 } = await import("child_process");
       const { promisify: promisify4 } = await import("util");
-      await promisify4(execFile5)("git", ["rev-parse", "HEAD"], { cwd: stagedRepo });
+      await promisify4(execFile4)("git", ["rev-parse", "HEAD"], { cwd: stagedRepo });
     } catch (e) {
       throw new Error(
         `migration verify: the staged team-repo clone is not a usable git repository (${e.message})`
@@ -19595,6 +20265,7 @@ var init_tokenizer = __esm({
 // src/votes.ts
 var votes_exports = {};
 __export(votes_exports, {
+  hasPendingVoteDeltas: () => hasPendingVoteDeltas,
   incrementRecalled: () => incrementRecalled,
   incrementUpvoted: () => incrementUpvoted,
   loadUserVotes: () => loadUserVotes,
@@ -19700,9 +20371,19 @@ function mergeDeltas(local, remote) {
         votes[docId].last_upvoted_at = localEntry.last_upvoted_at;
       }
     }
+    if (votes[docId].recalled_count === 0) {
+      votes[docId].last_recalled_at = "";
+    }
+    if (votes[docId].upvoted_count === 0) {
+      delete votes[docId].last_upvoted_at;
+    }
   }
   return { version: 2, votes, deltas: {} };
 }
+async function hasPendingVoteDeltas(localVotesDir, username) {
+  const local = await loadUserVotes(path57.join(localVotesDir, `${username}.yaml`));
+  return Object.keys(local.deltas).length > 0;
+}
 async function syncVotesToTeam(repoPath, username, localVotesDir) {
   const localVotePath = path57.join(localVotesDir, `${username}.yaml`);
   const remoteVotePath = path57.join(repoPath, "votes", `${username}.yaml`);
@@ -19739,11 +20420,16 @@ async function recallFeedback(opts) {
       return;
     }
     const existingDelta = data.deltas[opts.negative] ?? { recalled_delta: 0, upvoted_delta: 0 };
+    const decrementedCount = entry.upvoted_count - 1;
+    const updatedEntry = { ...entry, upvoted_count: decrementedCount };
+    if (decrementedCount === 0) {
+      delete updatedEntry.last_upvoted_at;
+    }
     const updated = {
       ...data,
       votes: {
         ...data.votes,
-        [opts.negative]: { ...entry, upvoted_count: entry.upvoted_count - 1 }
+        [opts.negative]: updatedEntry
       },
       deltas: {
         ...data.deltas,
@@ -21473,10 +22159,11 @@ async function generateDigest(options) {
     const localConfig = projectConfig ?? (await requireInit()).localConfig;
     const repoPath = localConfig.repo.localPath;
     let reportsRoot = repoPath;
-    if (localConfig.repo.kind === "self") {
+    const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+    if (usesReportsBranch2(localConfig)) {
       const { ensureReportsWorktree: ensureReportsWorktree2, refreshReportsWorktree: refreshReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      await refreshReportsWorktree2(localConfig);
-      reportsRoot = await ensureReportsWorktree2(localConfig);
+      await refreshReportsWorktree2(localConfig, { pushIfCreated: false });
+      reportsRoot = await ensureReportsWorktree2(localConfig, { pushIfCreated: false });
     }
     const teamStats = await loadTeamStats(reportsRoot);
     if (teamStats.length === 0) {
@@ -21629,9 +22316,10 @@ async function loadReportedStats() {
     const config = await detectProjectConfig() ?? await loadLocalConfig();
     if (!config) return null;
     let statsRoot = config.repo.localPath;
-    if (config.repo.kind === "self") {
+    const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+    if (usesReportsBranch2(config)) {
       const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      statsRoot = await ensureReportsWorktree2(config);
+      statsRoot = await ensureReportsWorktree2(config, { pushIfCreated: false });
     }
     const statsPath = path62.join(statsRoot, "stats", `${config.username}.yaml`);
     const content = await readFileSafe(statsPath);
@@ -22105,8 +22793,9 @@ function filterEventsByScope(events, opts) {
   return events;
 }
 async function reportUsageToTeam(repoPath, username, options) {
-  const selfConfig = options?.selfConfig;
-  const selfMode = selfConfig?.repo.kind === "self";
+  const reportsConfig = options?.selfConfig;
+  const useReportsBranch = !!reportsConfig && usesReportsBranch(reportsConfig);
+  let restoreStats;
   try {
     const events = await readUsageEvents();
     const filesToPush = [];
@@ -22135,20 +22824,77 @@ async function reportUsageToTeam(repoPath, username, options) {
     const hasInterventions = hasInterventionDelta(interventionDelta);
     const hasPromptTokens = hasPromptTokenDelta(promptTokenDelta);
     const hasDaily = hasDailyDelta(dailyDelta);
-    let writeRoot = repoPath;
-    if (selfMode && selfConfig) {
-      const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      writeRoot = await ensureReportsWorktree2(selfConfig);
+    const hasStats = hasUsage || hasInterventions || hasPromptTokens || hasDaily;
+    const commitMsg = hasUsage ? `[teamai] Update usage stats for ${username}` : hasInterventions || hasPromptTokens || hasDaily ? `[teamai] Update session stats for ${username}` : `[teamai] Update votes for ${username}`;
+    const writeReportFiles = async (writeRoot) => {
+      if (hasStats) {
+        const statsDir = path64.join(writeRoot, "stats");
+        await ensureDir(statsDir);
+        const statsPath = path64.join(statsDir, `${username}.yaml`);
+        const existing = await readExistingStats(statsPath);
+        if (useReportsBranch) {
+          const previousContent = await readFileSafe(statsPath);
+          restoreStats = () => writeFile(statsPath, previousContent ?? "");
+        }
+        const newStats = hasUsage ? aggregateUsage(events) : [];
+        const merged = mergeStats(existing, username, newStats);
+        if (hasInterventions) {
+          merged.interventions = mergeInterventionStats(existing?.interventions, interventionDelta);
+        }
+        if (hasPromptTokens) {
+          const pt = mergePromptTokenStats(existing?.prompts, existing?.tokens, promptTokenDelta);
+          merged.prompts = pt.prompts;
+          merged.tokens = pt.tokens;
+        }
+        if (hasDaily) {
+          merged.daily = mergeDailyStats(existing?.daily, dailyDelta);
+        }
+        await writeFile(statsPath, YAML21.stringify(merged));
+        filesToPush.push(`stats/${username}.yaml`);
+      }
+      try {
+        if (await pathExists(getUserVotesDir())) {
+          const { syncVotesToTeam: syncVotesToTeam2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
+          const synced = await syncVotesToTeam2(writeRoot, username, getUserVotesDir());
+          if (synced) {
+            filesToPush.push(`votes/${username}.yaml`);
+          }
+        }
+      } catch (e) {
+        log.error(`Vote staging skipped: ${e.message}`);
+      }
+    };
+    if (useReportsBranch && reportsConfig) {
+      let hasVotes = false;
+      if (!hasStats && await pathExists(getUserVotesDir())) {
+        const { hasPendingVoteDeltas: hasPendingVoteDeltas2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
+        hasVotes = await hasPendingVoteDeltas2(getUserVotesDir(), username);
+      }
+      if (!hasStats && !hasVotes) {
+        log.debug("No usage events or votes to report");
+        return true;
+      }
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      const pushed = await updateReports2(reportsConfig, async (wt) => {
+        filesToPush.length = 0;
+        await writeReportFiles(wt);
+        return filesToPush.length > 0 ? { files: [...filesToPush], message: commitMsg } : null;
+      }, { pushIfUnchanged: true });
+      if (!pushed) {
+        log.debug("Auto-report push was not confirmed; keeping local report data");
+        await restoreStats?.();
+        return false;
+      }
     } else {
       const git = createGit2(repoPath);
       if (!await isDedicatedRepoRoot(repoPath)) {
         log.debug(`Skipping report: ${repoPath} is not a dedicated team-repo root (safety guard)`);
-        return;
+        return false;
       }
       const { isImportInProgress: isImportInProgress2 } = await Promise.resolve().then(() => (init_import_lock(), import_lock_exports));
       if (await isImportInProgress2(repoPath)) {
         log.debug(`Skipping report: import in progress for ${repoPath} (would reset uncommitted artifacts)`);
-        return;
+        return false;
       }
       const yamlPath = path64.join(repoPath, "teamai.yaml");
       const workingContent = await readFileSafe(yamlPath);
@@ -22162,58 +22908,14 @@ async function reportUsageToTeam(repoPath, username, options) {
           await writeFile(yamlPath, pendingTeamConfig);
         }
       }
-    }
-    if (hasUsage || hasInterventions || hasPromptTokens || hasDaily) {
-      const statsDir = path64.join(writeRoot, "stats");
-      await ensureDir(statsDir);
-      const statsPath = path64.join(statsDir, `${username}.yaml`);
-      const existing = await readExistingStats(statsPath);
-      const newStats = hasUsage ? aggregateUsage(events) : [];
-      const merged = mergeStats(existing, username, newStats);
-      if (hasInterventions) {
-        merged.interventions = mergeInterventionStats(existing?.interventions, interventionDelta);
-      }
-      if (hasPromptTokens) {
-        const pt = mergePromptTokenStats(existing?.prompts, existing?.tokens, promptTokenDelta);
-        merged.prompts = pt.prompts;
-        merged.tokens = pt.tokens;
-      }
-      if (hasDaily) {
-        merged.daily = mergeDailyStats(existing?.daily, dailyDelta);
-      }
-      await writeFile(statsPath, YAML21.stringify(merged));
-      filesToPush.push(`stats/${username}.yaml`);
-    }
-    try {
-      if (await pathExists(getUserVotesDir())) {
-        const { syncVotesToTeam: syncVotesToTeam2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
-        const synced = await syncVotesToTeam2(writeRoot, username, getUserVotesDir());
-        if (synced) {
-          filesToPush.push(`votes/${username}.yaml`);
-        }
+      await writeReportFiles(repoPath);
+      if (filesToPush.length === 0) {
+        log.debug("No usage events or votes to report");
+        return true;
       }
-    } catch (e) {
-      log.error(`Vote staging skipped: ${e.message}`);
-    }
-    if (filesToPush.length === 0) {
-      log.debug("No usage events or votes to report");
-      return;
-    }
-    const commitMsg = hasUsage ? `[teamai] Update usage stats for ${username}` : hasInterventions || hasPromptTokens || hasDaily ? `[teamai] Update session stats for ${username}` : `[teamai] Update votes for ${username}`;
-    if (selfMode && selfConfig) {
-      const { commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      await withTimeout(
-        commitAndPushReports2(selfConfig, commitMsg, filesToPush),
-        5e3,
-        "Auto-report timeout (5s)"
-      );
-    } else {
-      await withTimeout(
-        pushRepoDirectly(repoPath, commitMsg, filesToPush),
-        5e3,
-        "Auto-report timeout (5s)"
-      );
+      await pushRepoDirectly(repoPath, commitMsg, filesToPush);
     }
+    restoreStats = void 0;
     if (hasUsage && !options?.skipTruncate) {
       await truncateUsageAfterReport(events.length);
       log.debug(`Reported ${events.length} usage events to team repo`);
@@ -22238,8 +22940,15 @@ async function reportUsageToTeam(repoPath, username, options) {
     if (!hasUsage && !hasInterventions && !hasPromptTokens && !hasDaily) {
       log.debug("Pushed pending votes to team repo");
     }
+    return true;
   } catch (e) {
+    try {
+      await restoreStats?.();
+    } catch (restoreError) {
+      log.error(`Could not restore report stats after failure: ${restoreError.message}`);
+    }
     log.error(`Auto-report skipped: ${e.message}`);
+    return false;
   }
 }
 var init_team_push = __esm({
@@ -22249,7 +22958,6 @@ var init_team_push = __esm({
     init_stats();
     init_dashboard_collector();
     init_git2();
-    init_async();
     init_fs();
     init_logger();
     init_types();
@@ -22427,6 +23135,7 @@ __export(pull_exports, {
   compileClaudemd: () => compileClaudemd,
   compileCulture: () => compileCulture,
   compileRecallRulesBlock: () => compileRecallRulesBlock,
+  filterAgentsByNamespaces: () => filterAgentsByNamespaces,
   filterRulesByKnowledgeNamespaces: () => filterRulesByKnowledgeNamespaces,
   injectRecallBlockIntoTools: () => injectRecallBlockIntoTools,
   pull: () => pull,
@@ -22504,58 +23213,9 @@ async function usageReportDisabled(repoPath) {
   return (await loadTeamConfig(repoPath))?.usageReport === false;
 }
 async function buildRolePullContext(localConfig) {
-  const activeProjects = localConfig.projects ?? [];
-  const hasRole = !!localConfig.primaryRole;
-  const hasProjects = activeProjects.length > 0;
-  const projectsManifest = await loadProjectsManifest(localConfig.repo.localPath);
-  const teamHasProjects = !!projectsManifest && projectsManifest.projects.length > 0;
-  if (!hasRole && !hasProjects && !teamHasProjects) return null;
-  let roleNamespaces = { knowledge: [], skills: [], learnings: [] };
-  let allRoleSkillNamespaces = /* @__PURE__ */ new Set();
-  if (hasRole) {
-    let rolesManifest;
-    try {
-      rolesManifest = await loadRolesManifest(localConfig.repo.localPath);
-    } catch {
-      log.warn("Could not load roles manifest. Skipping role-based filtering.");
-      rolesManifest = null;
-    }
-    if (rolesManifest) {
-      try {
-        roleNamespaces = resolveRoleResourceNamespaces({
-          manifest: rolesManifest,
-          primaryRole: localConfig.primaryRole,
-          additionalRoles: localConfig.additionalRoles ?? []
-        });
-        allRoleSkillNamespaces = new Set(rolesManifest.roles.flatMap((role) => role.resources.skills));
-      } catch {
-        log.warn(`Role "${localConfig.primaryRole}" not found in manifest. Falling back to unfiltered sync.`);
-        log.warn("Run `teamai roles set <role>` to pick a valid role.");
-        if (!hasProjects && !teamHasProjects) return null;
-      }
-    } else if (!hasProjects && !teamHasProjects) {
-      return null;
-    }
-  }
-  let projectNamespaces = { knowledge: [], skills: [], learnings: [] };
-  let allProjectSkillNamespaces = /* @__PURE__ */ new Set();
-  if (projectsManifest) {
-    allProjectSkillNamespaces = new Set(projectsManifest.projects.flatMap((p) => p.resources.skills));
-    if (hasProjects) {
-      try {
-        projectNamespaces = resolveProjectResourceNamespaces({
-          manifest: projectsManifest,
-          activeProjects
-        });
-      } catch (e) {
-        log.warn(`${e.message} Falling back to role-only filtering.`);
-      }
-    }
-  } else if (hasProjects) {
-    log.warn("Active projects configured but no projects manifest found. Skipping project-based filtering.");
-  }
-  const activeNamespaces = mergeNamespaces(roleNamespaces, projectNamespaces);
-  const allSkillNamespaces = /* @__PURE__ */ new Set([...allRoleSkillNamespaces, ...allProjectSkillNamespaces]);
+  const resolved = await resolveResourceNamespaces(localConfig);
+  if (!resolved) return null;
+  const { activeNamespaces, allSkillNamespaces } = resolved;
   const inactiveSkillNamespaces = [...allSkillNamespaces].filter((namespace) => !activeNamespaces.skills.includes(namespace));
   const activeSkillNames = /* @__PURE__ */ new Set();
   const inactiveSkillNames = /* @__PURE__ */ new Set();
@@ -22588,6 +23248,20 @@ function filterRulesByKnowledgeNamespaces(rules, knowledgeNamespaces) {
     return knowledgeNamespaces.includes(namespace);
   });
 }
+function filterAgentsByNamespaces(agents, agentNamespaces) {
+  const kept = agentNamespaces ? agents.filter((agent) => !agent.namespace || agentNamespaces.includes(agent.namespace)) : agents;
+  const seen = /* @__PURE__ */ new Map();
+  for (const agent of kept) {
+    const existing = seen.get(agent.name);
+    if (existing) {
+      throw new Error(
+        `Duplicate agent "${agent.name}" found in active namespaces "${existing.namespace ?? "(root)"}" and "${agent.namespace ?? "(root)"}"`
+      );
+    }
+    seen.set(agent.name, agent);
+  }
+  return kept;
+}
 async function scanRoleAwareSkills(localConfig, namespaces) {
   const items = /* @__PURE__ */ new Map();
   for (const namespace of namespaces.skills) {
@@ -22689,15 +23363,46 @@ async function getInstalledResourceTargets(teamConfig, localConfig) {
   }
   return targets.sort();
 }
+function tombstoneExtensions(type, tool) {
+  if (type === "rules") return [.../* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"])];
+  if (type === "agents") return AGENT_FILE_EXTENSIONS;
+  return [""];
+}
+async function cleanupTombstonedResources(freshConfig, localConfig, scopeLabel) {
+  const tombstoneTypes = [
+    { type: "rules", toolPathField: "rules" },
+    { type: "skills", toolPathField: "skills" },
+    { type: "agents", toolPathField: "agents" }
+  ];
+  const baseDir = resolveBaseDir(localConfig);
+  for (const { type, toolPathField } of tombstoneTypes) {
+    const handler = getHandler(type);
+    const tombstones = await handler.readTombstones(localConfig);
+    if (tombstones.size === 0) continue;
+    for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
+      const dir = toolPath[toolPathField];
+      if (!dir) continue;
+      if (!await ResourceHandler.isToolInstalled(dir, baseDir)) continue;
+      if (isAgentExcluded(localConfig, tool)) continue;
+      for (const name of tombstones) {
+        for (const extension of tombstoneExtensions(type, tool)) {
+          const localPath = path66.join(baseDir, dir, `${name}${extension}`);
+          if (!await pathExists(localPath)) continue;
+          if (type === "skills" && await hasVcsMetadataRecursive(localPath)) {
+            log.warn(`[${scopeLabel}] Kept tombstoned skill "${name}" (${tool}): it has local VCS metadata (.git) that may hold unpushed history. Back it up, then delete it manually.`);
+            continue;
+          }
+          await remove(localPath);
+          log.debug(`[${scopeLabel}] Cleaned up tombstoned ${type} ${name} from ${dir}`);
+        }
+      }
+    }
+  }
+}
 async function pullForScope(localConfig, options, policy = {}) {
   const scopeLabel = localConfig.scope;
   const revisionField = policy.revisionField ?? "lastPullRev";
   const targetsField = revisionField === "lastPullRev" ? "lastPullTargets" : "lastInheritedPullTargets";
-  const teamConfig = await loadTeamConfig(localConfig.repo.localPath);
-  if (!teamConfig) {
-    log.warn(`[${scopeLabel}] Team config (teamai.yaml) not found. Skipping.`);
-    return;
-  }
   const pullSpin = spinner(`[${scopeLabel}] Pulling team repo...`).start();
   let currentRev = null;
   let reportingOnly = false;
@@ -22714,39 +23419,40 @@ async function pullForScope(localConfig, options, policy = {}) {
     pullSpin.fail(`[${scopeLabel}] Pull failed: ${e.message}`);
     return;
   }
+  const freshConfig = await loadTeamConfig(localConfig.repo.localPath);
+  if (!freshConfig) {
+    log.warn(`[${scopeLabel}] Team config (teamai.yaml) not found. Skipping.`);
+    return;
+  }
   let currentTargets = null;
   if (!options.force && !options.dryRun && !submodulesChanged) {
     try {
       const state = await loadStateForScope(localConfig);
       if (currentRev && state[revisionField] && state[revisionField] === currentRev) {
-        currentTargets = await getInstalledResourceTargets(teamConfig, localConfig);
+        currentTargets = await getInstalledResourceTargets(freshConfig, localConfig);
         const previousTargets = state[targetsField];
         const syncedTargets = new Set(previousTargets ?? []);
         const targetSetMatches = previousTargets !== void 0 && previousTargets.length === currentTargets.length && currentTargets.every((target) => syncedTargets.has(target));
         if (targetSetMatches) {
           log.success(`[${scopeLabel}] Already synced at ${currentRev}, skipping`);
-          if (!options.dryRun) {
-            const cfg = await loadTeamConfig(localConfig.repo.localPath);
-            if (cfg) {
-              const skipRecall = !isRecallEnabled(localConfig, cfg);
-              try {
-                const { deployBuiltinAgents: deployBuiltinAgents2 } = await Promise.resolve().then(() => (init_builtin_agents(), builtin_agents_exports));
-                await deployBuiltinAgents2(cfg, localConfig, { skipRecall });
-              } catch {
-              }
-              try {
-                const { deployBuiltinRules: deployBuiltinRules2 } = await Promise.resolve().then(() => (init_builtin_rules(), builtin_rules_exports));
-                await deployBuiltinRules2(cfg, localConfig, { skipRecall });
-              } catch {
-              }
-              try {
-                const { deployBuiltinSkills: deployBuiltinSkills2 } = await Promise.resolve().then(() => (init_builtin_skills(), builtin_skills_exports));
-                await deployBuiltinSkills2(cfg, localConfig, { reportingOnly, skipRecall });
-              } catch {
-              }
-              await injectRecallBlockIntoTools(cfg, localConfig, scopeLabel);
-            }
+          const skipRecall = !isRecallEnabled(localConfig, freshConfig);
+          try {
+            const { deployBuiltinAgents: deployBuiltinAgents2 } = await Promise.resolve().then(() => (init_builtin_agents(), builtin_agents_exports));
+            await deployBuiltinAgents2(freshConfig, localConfig, { skipRecall });
+          } catch {
+          }
+          try {
+            const { deployBuiltinRules: deployBuiltinRules2 } = await Promise.resolve().then(() => (init_builtin_rules(), builtin_rules_exports));
+            await deployBuiltinRules2(freshConfig, localConfig, { skipRecall });
+          } catch {
+          }
+          try {
+            const { deployBuiltinSkills: deployBuiltinSkills2 } = await Promise.resolve().then(() => (init_builtin_skills(), builtin_skills_exports));
+            await deployBuiltinSkills2(freshConfig, localConfig, { reportingOnly, skipRecall });
+          } catch {
           }
+          await injectRecallBlockIntoTools(freshConfig, localConfig, scopeLabel);
+          await cleanupTombstonedResources(freshConfig, localConfig, scopeLabel);
           return;
         }
         log.debug(`[${scopeLabel}] Repo unchanged; resource target set changed, syncing`);
@@ -22755,11 +23461,6 @@ async function pullForScope(localConfig, options, policy = {}) {
       log.debug(`[${scopeLabel}] Rev check failed, proceeding with full sync`);
     }
   }
-  const freshConfig = await loadTeamConfig(localConfig.repo.localPath);
-  if (!freshConfig) {
-    log.warn(`[${scopeLabel}] Team config disappeared after pull. Skipping.`);
-    return;
-  }
   let roleContext = null;
   try {
     roleContext = await buildRolePullContext(localConfig);
@@ -22824,6 +23525,11 @@ async function pullForScope(localConfig, options, policy = {}) {
       desiredSkillNames = new Set(items.map((i) => i.name));
       knownRepoSkillNames = new Set(allTeamSkills.map((i) => i.name));
       knownRepoSkillSources = new Map(allTeamSkills.map((i) => [i.name, i.sourcePath]));
+    } else if (type === "agents") {
+      items = filterAgentsByNamespaces(
+        await handler.scanTeamForPull(freshConfig, localConfig),
+        roleContext ? roleContext.activeNamespaces.agents : null
+      );
     } else {
       items = await handler.scanTeamForPull(freshConfig, localConfig);
     }
@@ -22882,37 +23588,7 @@ async function pullForScope(localConfig, options, policy = {}) {
     totalSynced += items.length;
   }
   if (!options.dryRun) {
-    const tombstoneTypes = [
-      { type: "rules", ext: ".md", toolPathField: "rules" },
-      { type: "skills", toolPathField: "skills" },
-      { type: "agents", ext: ".md", toolPathField: "agents" }
-    ];
-    const baseDir = resolveBaseDir(localConfig);
-    for (const { type, ext, toolPathField } of tombstoneTypes) {
-      const handler = getHandler(type);
-      const tombstones = await handler.readTombstones(localConfig);
-      if (tombstones.size === 0) continue;
-      for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
-        const dir = toolPath[toolPathField];
-        if (!dir) continue;
-        if (!await ResourceHandler.isToolInstalled(dir, baseDir)) continue;
-        if (isAgentExcluded(localConfig, tool)) continue;
-        const extensions = type === "rules" ? [.../* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"])] : [ext];
-        for (const name of tombstones) {
-          for (const extension of extensions) {
-            const localPath = path66.join(baseDir, dir, extension ? `${name}${extension}` : name);
-            if (await pathExists(localPath)) {
-              if (type === "skills" && await hasVcsMetadataRecursive(localPath)) {
-                log.warn(`[${scopeLabel}] Kept tombstoned skill "${name}" (${tool}): it has local VCS metadata (.git) that may hold unpushed history. Back it up, then delete it manually.`);
-                continue;
-              }
-              await remove(localPath);
-              log.debug(`[${scopeLabel}] Cleaned up tombstoned ${type} ${name} from ${dir}`);
-            }
-          }
-        }
-      }
-    }
+    await cleanupTombstonedResources(freshConfig, localConfig, scopeLabel);
     if (roleContext) {
       await cleanupInactiveNamespaceSkills(
         freshConfig,
@@ -22921,6 +23597,11 @@ async function pullForScope(localConfig, options, policy = {}) {
         roleContext.inactiveSkillNames,
         roleContext.inactiveSkillSources
       );
+      await getHandler("agents").cleanupInactiveNamespaces(
+        freshConfig,
+        localConfig,
+        roleContext.activeNamespaces.agents
+      );
     }
   }
   if (!options.dryRun && desiredSkillNames && knownRepoSkillNames) {
@@ -22962,21 +23643,29 @@ async function pullForScope(localConfig, options, policy = {}) {
   if (totalSynced === 0) {
     log.info(`[${scopeLabel}] No resources to sync`);
   }
+  let reportsReadRoot;
+  const resolveReportsReadRoot = () => {
+    reportsReadRoot ??= (async () => {
+      if (!usesReportsBranch(localConfig)) return localConfig.repo.localPath;
+      try {
+        const { ensureReportsWorktree: ensureReportsWorktree2, refreshReportsWorktree: refreshReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+        await refreshReportsWorktree2(localConfig, { pushIfCreated: false });
+        return await ensureReportsWorktree2(localConfig, { pushIfCreated: false });
+      } catch (e) {
+        log.debug(`reports worktree unavailable: ${e.message}`);
+        return void 0;
+      }
+    })();
+    return reportsReadRoot;
+  };
   if (!options.dryRun) {
     try {
       const learningsRepoDir = path66.join(localConfig.repo.localPath, "learnings");
       const docsRepoDir = path66.join(localConfig.repo.localPath, "docs");
       const rulesRepoDir = path66.join(localConfig.repo.localPath, "rules");
       const skillsRepoDir = path66.join(localConfig.repo.localPath, "skills");
-      let votesDir = path66.join(localConfig.repo.localPath, "votes");
-      if (localConfig.repo.kind === "self") {
-        try {
-          const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-          votesDir = path66.join(await ensureReportsWorktree2(localConfig), "votes");
-        } catch (e) {
-          log.debug(`[self] reports worktree for votes unavailable: ${e.message}`);
-        }
-      }
+      const reportsRoot = await resolveReportsReadRoot();
+      const votesDir = reportsRoot ? path66.join(reportsRoot, "votes") : void 0;
       const activeLearningsNamespaces = roleContext?.activeNamespaces.learnings ?? [];
       const countLearnings = async (baseDir) => {
         let n = (await listFiles(baseDir)).filter((f) => f.endsWith(".md")).length;
@@ -23010,7 +23699,7 @@ async function pullForScope(localConfig, options, policy = {}) {
       const repoCodebaseDir = path66.join(localConfig.repo.localPath, "docs", "team-codebase");
       const effectiveCodebaseDir = await pathExists(repoCodebaseDir) ? repoCodebaseDir : void 0;
       if (hasAnySource || effectiveCodebaseDir) {
-        const votesExist = await pathExists(votesDir);
+        const votesExist = votesDir ? await pathExists(votesDir) : false;
         const teamaiHome = getDataHome(localConfig);
         const indexPath = path66.join(teamaiHome, "search-index.json");
         const { buildIndex: buildIndex2 } = await Promise.resolve().then(() => (init_search_index(), search_index_exports));
@@ -23156,16 +23845,9 @@ async function pullForScope(localConfig, options, policy = {}) {
       const YAML25 = (await import("yaml")).default;
       const { listFiles: listFiles2, readFileSafe: readFileSafe5 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
       const { getRecommendations: getRecommendations2, displayRecommendations: displayRecommendations2 } = await Promise.resolve().then(() => (init_skill_recommend(), skill_recommend_exports));
-      let statsDir = path66.join(localConfig.repo.localPath, "stats");
-      if (localConfig.repo.kind === "self") {
-        try {
-          const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-          statsDir = path66.join(await ensureReportsWorktree2(localConfig), "stats");
-        } catch (e) {
-          log.debug(`[self] reports worktree for stats unavailable: ${e.message}`);
-        }
-      }
-      const files = await listFiles2(statsDir);
+      const reportsRoot = await resolveReportsReadRoot();
+      const statsDir = reportsRoot ? path66.join(reportsRoot, "stats") : void 0;
+      const files = statsDir ? await listFiles2(statsDir) : [];
       const teamStats = [];
       for (const file of files) {
         if (!file.endsWith(".yaml")) continue;
@@ -23394,6 +24076,7 @@ async function pull(options) {
   const needsHookMigration = await legacyHooksNeedReinject().catch(() => false);
   const contended = /* @__PURE__ */ new Set();
   const heldLocks = /* @__PURE__ */ new Map();
+  let usageReport;
   const lockScope = async (config) => {
     if (config.repo.kind === "http") return true;
     const lock = path66.join(getDataHome(config), SYNC_LOCK_FILENAME);
@@ -23469,49 +24152,62 @@ async function pull(options) {
     await reconcileHooksAllScopes(reconcileUser, reconcileProject, options);
     await reconcileMcpAllScopes(reconcileUser, reconcileProject, options);
     await reconcileCoAuthorAllScopes(reconcileUser, reconcileProject, options);
-    if (!options.dryRun) {
-      try {
-        const { reportUsageToTeam: reportUsageToTeam2 } = await Promise.resolve().then(() => (init_team_push(), team_push_exports));
-        const { truncateUsageAfterReport: truncateUsageAfterReport2, readUsageEvents: readUsageEvents2 } = await Promise.resolve().then(() => (init_usage_tracker(), usage_tracker_exports));
-        const targets = [];
-        if (reconcileProject && reconcileProject.repo.kind !== "http" && !await usageReportDisabled(reconcileProject.repo.localPath)) {
-          targets.push({
-            repoPath: reconcileProject.repo.localPath,
-            username: reconcileProject.username,
-            opts: {
-              skipTruncate: true,
-              projectRoot: reconcileProject.projectRoot,
-              // Self mode routes stats/votes to the teamai-reports orphan branch.
-              ...reconcileProject.repo.kind === "self" ? { selfConfig: reconcileProject } : {}
-            }
-          });
-        }
-        if (reconcileUser && reconcileUser.repo.kind !== "http" && !await usageReportDisabled(reconcileUser.repo.localPath)) {
-          targets.push({
-            repoPath: reconcileUser.repo.localPath,
-            username: reconcileUser.username,
-            opts: {
-              skipTruncate: true,
-              excludeProjectRoots: projectConfig?.projectRoot ? [projectConfig.projectRoot] : [],
-              // Self mode routes stats/votes to the teamai-reports orphan branch —
-              // never reset/pull the business repo working tree.
-              ...reconcileUser.repo.kind === "self" ? { selfConfig: reconcileUser } : {}
+    if (!options.dryRun && !pendingUsageReport) {
+      pendingUsageReport = (async () => {
+        try {
+          const { reportUsageToTeam: reportUsageToTeam2 } = await Promise.resolve().then(() => (init_team_push(), team_push_exports));
+          const { truncateUsageAfterReport: truncateUsageAfterReport2, readUsageEvents: readUsageEvents2 } = await Promise.resolve().then(() => (init_usage_tracker(), usage_tracker_exports));
+          const targets = [];
+          if (reconcileProject && reconcileProject.repo.kind !== "http" && !await usageReportDisabled(reconcileProject.repo.localPath)) {
+            targets.push({
+              repoPath: reconcileProject.repo.localPath,
+              username: reconcileProject.username,
+              opts: {
+                skipTruncate: true,
+                projectRoot: reconcileProject.projectRoot,
+                // Non-HTTP repos route stats/votes to the teamai-reports orphan branch.
+                selfConfig: reconcileProject
+              }
+            });
+          }
+          if (reconcileUser && reconcileUser.repo.kind !== "http" && !await usageReportDisabled(reconcileUser.repo.localPath)) {
+            targets.push({
+              repoPath: reconcileUser.repo.localPath,
+              username: reconcileUser.username,
+              opts: {
+                skipTruncate: true,
+                excludeProjectRoots: projectConfig?.projectRoot ? [projectConfig.projectRoot] : [],
+                // Non-HTTP repos route stats/votes to the teamai-reports orphan branch —
+                // never reset/pull the default branch (or, in self mode, the business tree).
+                selfConfig: reconcileUser
+              }
+            });
+          }
+          const eventCount = (await readUsageEvents2()).length;
+          let allReported = true;
+          for (const t of targets) {
+            try {
+              const reported = await reportUsageToTeam2(t.repoPath, t.username, t.opts);
+              if (!reported) allReported = false;
+            } catch (e) {
+              allReported = false;
+              log.error(`Auto-report to ${t.repoPath} skipped: ${e.message}`);
             }
-          });
-        }
-        const eventCount = (await readUsageEvents2()).length;
-        for (const t of targets) {
-          try {
-            await reportUsageToTeam2(t.repoPath, t.username, t.opts);
-          } catch (e) {
-            log.error(`Auto-report to ${t.repoPath} skipped: ${e.message}`);
           }
+          if (allReported && eventCount > 0 && targets.length > 0) {
+            await truncateUsageAfterReport2(eventCount);
+          }
+        } catch (e) {
+          log.debug(`Auto-report skipped: ${e.message}`);
         }
-        if (eventCount > 0 && targets.length > 0) {
-          await truncateUsageAfterReport2(eventCount);
-        }
+      })().finally(() => {
+        pendingUsageReport = void 0;
+      });
+      usageReport = pendingUsageReport;
+      try {
+        await withTimeout(pendingUsageReport, 5e3, "Auto-report is still running after 5s");
       } catch (e) {
-        log.debug(`Auto-report skipped: ${e.message}`);
+        log.debug(e.message);
       }
     }
     const sourceConfig = reconcileProject ?? reconcileUser;
@@ -23524,8 +24220,15 @@ async function pull(options) {
       }
     }
   } finally {
-    for (const lock of heldLocks.values()) {
-      await releaseLock(lock);
+    const releaseSyncLocks = async () => {
+      for (const lock of heldLocks.values()) await releaseLock(lock);
+    };
+    if (usageReport && usageReport === pendingUsageReport) {
+      void usageReport.then(releaseSyncLocks, releaseSyncLocks).catch((e) => {
+        log.error(`Could not release report sync locks: ${e.message}`);
+      });
+    } else {
+      await releaseSyncLocks();
     }
   }
 }
@@ -23600,7 +24303,7 @@ async function reconcileCoAuthorAllScopes(userConfig, projectConfig, options) {
     }
   }
 }
-var CONTRIBUTORS_FILE2;
+var pendingUsageReport, CONTRIBUTORS_FILE2;
 var init_pull = __esm({
   "src/pull.ts"() {
     "use strict";
@@ -23613,14 +24316,15 @@ var init_pull = __esm({
     init_resources();
     init_base();
     init_rule_format();
+    init_agent_format();
     init_tags();
     init_builtin_skills();
     init_types();
-    init_roles();
-    init_projects();
+    init_resource_namespaces();
     init_home();
     init_update();
     init_learnings_mirror();
+    init_async();
     CONTRIBUTORS_FILE2 = "CONTRIBUTORS";
   }
 });
@@ -24476,17 +25180,24 @@ async function doctor(options) {
   log.info("Running diagnostics...\n");
   const projectConfig = await detectProjectConfig();
   const localConfig = projectConfig ?? await loadLocalConfig();
-  const scope = localConfig?.scope ?? "user";
-  const configPathLabel = projectConfig ? `${projectConfig.projectRoot}/.teamai/config.yaml` : "~/.teamai/config.yaml";
-  console.log(`  Scope: ${scope}${scope === "project" && localConfig?.projectRoot ? ` (${localConfig.projectRoot})` : ""}
-`);
-  let teamConfig = null;
-  if (localConfig) {
-    teamConfig = await loadTeamConfig(localConfig.repo.localPath);
+  if (!localConfig) {
+    console.log("  Scope: not initialized\n");
+    console.log("  \u2716 TeamAI is not initialized");
+    console.log("    \u2192 Run `teamai init <repo-url>` in a project, or add `--scope user` for all projects");
+    console.log("");
+    log.warn("Initialization is required before diagnostics can run.");
+    return false;
   }
-  const toolPaths = teamConfig?.toolPaths ?? TeamaiConfigSchema.shape.toolPaths.parse(void 0);
-  const providerName = teamConfig?.provider ?? "tgit";
-  const baseDir = localConfig ? resolveHookScope(localConfig).baseDir : getUserHome();
+  const scope = localConfig.scope ?? "user";
+  const scopeLabel = `${scope}${scope === "project" && localConfig.projectRoot ? ` (${localConfig.projectRoot})` : ""}`;
+  console.log(`  Scope: ${scopeLabel}
+`);
+  const teamConfig = await loadTeamConfig(localConfig.repo.localPath);
+  const toolPaths = teamConfig ? Object.fromEntries(
+    Object.entries(scopedToolPaths(teamConfig, localConfig)).filter(([tool]) => !isAgentExcluded(localConfig, tool))
+  ) : {};
+  const providerName = teamConfig?.provider;
+  const baseDir = resolveHookScope(localConfig).baseDir;
   const checks = [];
   if (providerName === "tgit") {
     const { isGfInstalled: isGfInstalled2, gfIsAuthenticated: gfIsAuthenticated2 } = await Promise.resolve().then(() => (init_tgit(), tgit_exports));
@@ -24532,23 +25243,14 @@ async function doctor(options) {
     });
   }
   checks.push(
-    {
-      name: `Local config exists (${configPathLabel})`,
-      check: async () => localConfig !== null,
-      fix: "Run `teamai init` to initialize"
-    },
     {
       name: "Team repo exists locally",
-      check: async () => {
-        if (!localConfig) return false;
-        return pathExists(localConfig.repo.localPath);
-      },
+      check: async () => pathExists(localConfig.repo.localPath),
       fix: "Run `teamai init` to clone the team repo"
     },
     {
       name: "Team config (teamai.yaml) is valid",
       check: async () => {
-        if (!localConfig) return false;
         const config = await loadTeamConfig(localConfig.repo.localPath);
         return config !== null;
       },
@@ -24559,7 +25261,6 @@ async function doctor(options) {
       name: "Env variables injected in shell profile",
       check: async () => {
         if (teamConfig?.sharing?.env?.injectShellProfile === false) return true;
-        if (!localConfig) return true;
         const envYamlPath = path70.join(localConfig.repo.localPath, "env", "env.yaml");
         if (!await pathExists(envYamlPath)) return true;
         const home = getUserHome();
@@ -24588,13 +25289,11 @@ async function doctor(options) {
       allPassed = false;
     }
   }
-  if (localConfig) {
-    const { pkgDoctorReport: pkgDoctorReport2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
-    const packageReport = await pkgDoctorReport2(localConfig, process.cwd());
-    if (packageReport) {
-      for (const line of packageReport.lines) console.log(line);
-      if (!packageReport.allPassed) allPassed = false;
-    }
+  const { pkgDoctorReport: pkgDoctorReport2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+  const packageReport = await pkgDoctorReport2(localConfig, process.cwd());
+  if (packageReport) {
+    for (const line of packageReport.lines) console.log(line);
+    if (!packageReport.allPassed) allPassed = false;
   }
   if (await hasInstalledCodexHooks(toolPaths, baseDir)) {
     console.log("");
@@ -24606,6 +25305,7 @@ async function doctor(options) {
   } else {
     log.warn("Some checks failed. See suggestions above.");
   }
+  return allPassed;
 }
 var init_doctor = __esm({
   "src/doctor.ts"() {
@@ -24730,7 +25430,8 @@ async function rolesInit(options) {
       description,
       resources: {
         knowledge: namespaces,
-        skills: namespaces
+        skills: namespaces,
+        agents: namespaces
       }
     });
     log.success(`Added role: ${id} (namespaces: ${namespaces.join(", ")})`);
@@ -24874,7 +25575,8 @@ async function rolesAdd(roleId, options) {
       description: options.description ?? "",
       resources: {
         knowledge: namespaces,
-        skills: namespaces
+        skills: namespaces,
+        agents: namespaces
       }
     };
     const updatedManifest = {
@@ -24988,7 +25690,8 @@ async function rolesUpdate(roleId, options) {
       description: hasDesc ? options.description : existingRole.description,
       resources: {
         knowledge: updatedNamespaces,
-        skills: updatedNamespaces
+        skills: updatedNamespaces,
+        agents: updatedNamespaces
       }
     };
     const updatedManifest = {
@@ -25120,21 +25823,22 @@ async function projectsSet(ids, _options) {
 }
 async function projectsMembers(projectId, _options) {
   const { localConfig } = await autoDetectInit();
-  let repoPath;
-  if (localConfig.repo.kind === "self") {
+  const knowledgePath = localConfig.repo.localPath;
+  let membersRoot = knowledgePath;
+  const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+  if (usesReportsBranch2(localConfig)) {
     const { ensureReportsWorktree: ensureReportsWorktree2, refreshReportsWorktree: refreshReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-    await refreshReportsWorktree2(localConfig);
-    repoPath = await ensureReportsWorktree2(localConfig);
+    await refreshReportsWorktree2(localConfig, { pushIfCreated: false });
+    membersRoot = await ensureReportsWorktree2(localConfig, { pushIfCreated: false });
   } else {
-    repoPath = localConfig.repo.localPath;
-    await pullRepo(repoPath).catch(() => {
+    await pullRepo(knowledgePath).catch(() => {
     });
   }
-  const manifest = await loadProjectsManifest(repoPath);
+  const manifest = await loadProjectsManifest(knowledgePath);
   if (manifest && !listProjectIds(manifest).includes(projectId)) {
     log.warn(`Project "${projectId}" is not defined in manifest/projects.yaml.`);
   }
-  const membersDir = path72.join(repoPath, "members");
+  const membersDir = path72.join(membersRoot, "members");
   const files = (await listFiles(membersDir)).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
   const members = [];
   for (const file of files) {
@@ -25410,10 +26114,13 @@ async function collectTeamRuleNames(repoPath) {
 async function collectTeamAgentNames(repoPath) {
   const teamAgentsDir = path74.join(repoPath, "agents");
   if (!await pathExists(teamAgentsDir)) return /* @__PURE__ */ new Set();
-  const files = await listFiles(teamAgentsDir);
-  return new Set(
-    files.filter((file) => file.endsWith(".yaml") || file.endsWith(".md")).map((file) => path74.basename(file).replace(/\.(yaml|md)$/, ""))
-  );
+  const names = /* @__PURE__ */ new Set();
+  for (const { dir } of await listTeamAgentDirs(teamAgentsDir)) {
+    for (const file of await listFiles(dir)) {
+      if (file.endsWith(".yaml") || file.endsWith(".md")) names.add(file.replace(/\.(yaml|md)$/, ""));
+    }
+  }
+  return names;
 }
 function isEmptyHooksResidue(parsed) {
   if (parsed == null || !("hooks" in parsed) || typeof parsed.hooks !== "object" || parsed.hooks == null) return false;
@@ -25513,8 +26220,8 @@ async function discoverToolResources(tool, toolPath, baseDir, teamSkillNames, te
     const agentsDir = path74.join(baseDir, toolPath.agents);
     if (await pathExists(agentsDir)) {
       for (const file of await listFiles(agentsDir)) {
-        if (!file.endsWith(".md") && !file.endsWith(".toml")) continue;
-        const name = path74.basename(file).replace(/\.(md|toml)$/, "");
+        const name = agentStemFromFilename(path74.basename(file));
+        if (name === null) continue;
         if (!teamAgentNames.has(name) && !BUILTIN_AGENT_NAMES.has(name)) continue;
         res.agentFiles.push(path74.join(agentsDir, file));
       }
@@ -25992,6 +26699,8 @@ var init_uninstall = __esm({
     init_types();
     init_builtin_rules();
     init_rule_format();
+    init_agent_format();
+    init_agents();
     init_builtin_agents();
     init_builtin_skills();
     init_fs();
@@ -26209,7 +26918,8 @@ async function hooksList(_options) {
     for (const d of teamDefs) {
       const matcher = d.matcher ? ` [${d.matcher}]` : "";
       const tools = d.tools && d.tools.length > 0 ? d.tools.join(",") : "all";
-      console.log(`  [${d.key}] ${d.event}${matcher}  \u2192  ${d.command}  (tools: ${tools})`);
+      const roles = d.roles ? `, roles: ${d.roles.length > 0 ? d.roles.join(",") : "nobody"}` : "";
+      console.log(`  [${d.key}] ${d.event}${matcher}  \u2192  ${d.command}  (tools: ${tools}${roles})`);
     }
   }
   console.log("");
@@ -26269,6 +26979,7 @@ async function mcpList(_options) {
     console.log(`  ${s.name}  [${s.transport}]`);
     if (s.description) console.log(`    ${s.description}`);
     console.log(`    endpoint: ${endpoint}`);
+    if (s.roles) console.log(`    roles:    ${s.roles.length > 0 ? s.roles.join(", ") : "nobody"}`);
     const needed = referencedVars(s);
     if (needed.length > 0) {
       const missing = needed.filter((v) => !vars[v]);
@@ -26539,23 +27250,28 @@ async function saveSession(options) {
     log.info(`[dry-run] Would push session summary to sessions/${username}/${monthKey(summary)}.md`);
     return;
   }
-  if (localConfig.repo.kind === "self") {
+  if (usesReportsBranch(localConfig)) {
     const spin2 = spinner("Pushing session summary to team...").start();
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(localConfig);
-      const teamDir2 = path79.join(wt, "sessions", username);
-      const written = await appendMonthlyLog(teamDir2, summary, { includePrompt: options.includePrompt });
-      if (!written) {
-        spin2.info("Session already present in the team log \u2014 nothing to push.");
-        return;
-      }
-      const rel = path79.relative(wt, written);
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      let rel;
+      let ran = false;
       const pushed = await withTimeout(
-        commitAndPushReports2(localConfig, commitMsg, [rel]),
+        updateReports2(localConfig, async (wt) => {
+          ran = true;
+          const teamDir2 = path79.join(wt, "sessions", username);
+          const written = await appendMonthlyLog(teamDir2, summary, { includePrompt: options.includePrompt });
+          if (!written) return null;
+          rel = path79.relative(wt, written);
+          return { files: [rel], message: commitMsg };
+        }),
         1e4,
         "Push timeout (10s)"
       );
+      if (ran && !rel) {
+        spin2.info("Session already present in the team log \u2014 nothing to push.");
+        return;
+      }
       if (pushed) spin2.succeed(`Pushed: ${rel}`);
       else spin2.info("Nothing new to push.");
     } catch (e) {
@@ -28670,9 +29386,10 @@ async function resolveVizRoot(opts) {
   }
   const config = await detectProjectConfig() ?? await loadLocalConfig();
   if (config?.repo?.localPath) {
-    if (config.repo.kind === "self") {
+    const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+    if (usesReportsBranch2(config)) {
       const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      await ensureReportsWorktree2(config);
+      await ensureReportsWorktree2(config, { pushIfCreated: false });
     }
     const knowledgeRoot = getKnowledgeDir(config);
     const reportsRoot = getReportsDir(config);
@@ -30439,6 +31156,17 @@ var init_mr_hint = __esm({
 
 // src/hook-handlers.ts
 import path92 from "path";
+async function teamCorrectionKeywords(stdin) {
+  if (typeof stdin.prompt !== "string") return [];
+  try {
+    const { autoDetectInit: autoDetectInit2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+    const { getInterventionSharing: getInterventionSharing2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+    const { teamConfig } = await autoDetectInit2();
+    return getInterventionSharing2(teamConfig).correctionKeywords;
+  } catch {
+    return [];
+  }
+}
 async function contributeHintAllowed() {
   const { isContributeHintEnabled: isContributeHintEnabled2 } = await Promise.resolve().then(() => (init_types(), types_exports));
   try {
@@ -30539,7 +31267,7 @@ var init_hook_handlers = __esm({
       async execute(stdin, tool) {
         const { parseHookEvent: parseHookEvent2, appendEvent: appendEvent2, compactEvents: compactEvents2 } = await Promise.resolve().then(() => (init_dashboard_collector(), dashboard_collector_exports));
         const raw = JSON.stringify(stdin);
-        const event = await parseHookEvent2(raw, tool);
+        const event = await parseHookEvent2(raw, tool, { correctionKeywords: await teamCorrectionKeywords(stdin) });
         if (event) {
           await appendEvent2(event);
           compactEvents2().catch(() => {
@@ -30664,13 +31392,16 @@ var init_hook_handlers = __esm({
           if (verifiedDocIds.length > 0) {
             await incrementUpvoted2(votePath, verifiedDocIds);
           }
-          if (localConfig.repo.kind === "self") {
+          const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+          if (usesReportsBranch2(localConfig)) {
             try {
-              const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-              const wt = await ensureReportsWorktree2(localConfig);
-              const synced = await syncVotesToTeam2(wt, localConfig.username, votesDir);
-              if (synced) {
-                await commitAndPushReports2(localConfig, `[teamai] Update votes for ${localConfig.username}`, [`votes/${localConfig.username}.yaml`]);
+              const { hasPendingVoteDeltas: hasPendingVoteDeltas2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
+              if (await hasPendingVoteDeltas2(votesDir, localConfig.username)) {
+                const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+                await updateReports2(localConfig, async (wt) => await syncVotesToTeam2(wt, localConfig.username, votesDir) ? {
+                  files: [`votes/${localConfig.username}.yaml`],
+                  message: `[teamai] Update votes for ${localConfig.username}`
+                } : null);
               }
             } catch {
             }
@@ -30767,7 +31498,8 @@ var init_hook_handlers = __esm({
 // src/hook-dispatch-cli.ts
 var hook_dispatch_cli_exports = {};
 __export(hook_dispatch_cli_exports, {
-  hookDispatchCli: () => hookDispatchCli
+  hookDispatchCli: () => hookDispatchCli,
+  parseStdin: () => parseStdin
 });
 import { spawn as spawn3 } from "child_process";
 async function readStdin4() {
@@ -30828,10 +31560,15 @@ function parseStdin(raw, event) {
     try {
       stdin = JSON.parse(raw);
     } catch {
-      log.debug(`hook-dispatch: failed to parse STDIN JSON for event=${event}`);
-      return null;
+      const preview = raw.length > 160 ? `${raw.slice(0, 80)}...${raw.slice(-80)}` : raw;
+      log.debug(
+        `hook-dispatch: failed to parse STDIN JSON for event=${event} (len=${raw.length}, body=${JSON.stringify(preview)})`
+      );
     }
   }
+  if (!stdin || typeof stdin !== "object" || Array.isArray(stdin)) {
+    stdin = {};
+  }
   if (!stdin.hook_event_name) {
     const EVENT_MAP2 = {
       "session-start": "SessionStart",
@@ -30857,7 +31594,6 @@ async function hookDispatchCli(event, tool, matcher, bgOnly = false) {
   try {
     const raw = await readStdin4();
     const stdin = parseStdin(raw, event);
-    if (stdin === null) return;
     const { loadLocalConfig: loadLocalConfig4, detectProjectConfig: detectProjectConfig2 } = await Promise.resolve().then(() => (init_config(), config_exports));
     const cwd = resolveHookCwd(stdin);
     if (cwd) {
@@ -30925,7 +31661,8 @@ async function rebuildIndexAfterContribute(localConfig) {
   const docsRepoDir = path93.join(repoPath, "docs");
   const rulesRepoDir = path93.join(repoPath, "rules");
   const skillsRepoDir = path93.join(repoPath, "skills");
-  const votesDir = path93.join(repoPath, "votes");
+  const { getReportsDir: getReportsDir2 } = await Promise.resolve().then(() => (init_types(), types_exports));
+  const votesDir = path93.join(getReportsDir2(localConfig), "votes");
   let effectiveLearningsDir;
   const activeLearningsNamespaces = await resolveActiveLearningsNamespaces(
     repoPath,
@@ -31075,7 +31812,7 @@ async function contributeSelf(localConfig, content, options) {
         let votesDir;
         try {
           const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-          const candidate = path93.join(await ensureReportsWorktree2(localConfig), "votes");
+          const candidate = path93.join(await ensureReportsWorktree2(localConfig, { pushIfCreated: false }), "votes");
           if (await pathExists3(candidate)) votesDir = candidate;
         } catch {
         }
@@ -34384,7 +35121,7 @@ var init_codebase = __esm({
 
 // src/wiki-engine/code-knowledge/code-collector.ts
 import { createHash as createHash5 } from "crypto";
-import { execFile as execFile4 } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { readFile as readFile6, readdir as readdir2, stat as stat2 } from "fs/promises";
 import path105 from "path";
 import { promisify as promisify3 } from "util";
@@ -34540,7 +35277,7 @@ var init_code_collector = __esm({
   "src/wiki-engine/code-knowledge/code-collector.ts"() {
     "use strict";
     init_wiki_protocol();
-    execFileAsync3 = promisify3(execFile4);
+    execFileAsync3 = promisify3(execFile3);
     KEY_FILE_PATTERNS = {
       go: [/main\.go$/, /cmd\/.*\.go$/, /handler.*\.go$/, /server\.go$/, /router\.go$/],
       python: [/main\.py$/, /app\.py$/, /server\.py$/, /routes?\.py$/, /models?\.py$/],
@@ -42412,7 +43149,7 @@ var init_extract_mr = __esm({
 // src/maintenance/paths.ts
 import path130 from "path";
 async function resolveMaintenancePaths(localConfig) {
-  if (isSelfMode(localConfig)) {
+  if (usesReportsBranch(localConfig)) {
     const { refreshReportsWorktree: refreshReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
     await refreshReportsWorktree2(localConfig, { pushIfCreated: false });
   }
@@ -42509,7 +43246,7 @@ program.name("teamai").description("TeamAI \u2014 Make Every Team AI Native").ve
     process.exit(1);
   }
 });
-program.command("init").description("Initialize teamai (configure Git provider, clone repo, register member)").argument("[repo]", 'Team repo (owner/repo or full URL). Pass "." for single-repo mode (the current git repo is the team repo).').option("--repo <repo>", "Team repo (alias of the positional argument)").option("--http <url>", "Git-free HTTP team repo (read-only consumer; only needs an API key)").option("--self", "Single-repo mode: the current git repo is the team repo (equivalent to `teamai init .`). Knowledge lives on main under .teamai/; reports go to the teamai-reports orphan branch.").option("--token <key>", "API key for HTTP team repo / status reporting (stored 0600, never committed). Also reads TEAMAI_API_TOKEN.").option("--scope <scope>", "Install scope: project (default, <cwd>/.teamai + <cwd>/.claude) or user (~/.teamai + ~/.claude)").option("--inherit-user-scope", "In project scope, also sync safe user-scope resources and search its knowledge").option("--no-inherit-user-scope", "Disable user-scope inheritance for this project").option("--role <id>", "Primary role ID (e.g. hai_dev) for non-interactive setup").option("--project <ids>", "Active logical project(s) from manifest/projects.yaml (comma-separated); scopes which project resources and learnings this directory syncs").option("--agent <name>", "AI tools to set up (e.g. claude, codex, cursor, codebuddy, workbuddy, dsh). Repeatable or comma-separated. In single-repo mode, selects which tool dirs to create; omit for an interactive picker. Additive on repeated runs.", (val, acc) => acc.concat(val), []).option("--force", "Overwrite existing config without confirmation").action(async (repoArg, cmdOpts) => {
+program.command("init").description("Initialize teamai (configure Git provider, clone repo, register member)").argument("[repo]", 'Team repo (owner/repo or full URL). Pass "." for single-repo mode (the current git repo is the team repo).').option("--repo <repo>", "Team repo (alias of the positional argument)").option("--http <url>", "Git-free HTTP team repo (read-only consumer; only needs an API key)").option("--self", "Single-repo mode: the current git repo is the team repo (equivalent to `teamai init .`). Knowledge lives on main under .teamai/; reports go to the teamai-reports orphan branch.").option("--token <key>", "API key for HTTP team repo / status reporting (stored 0600, never committed). Also reads TEAMAI_API_TOKEN.").option("--scope <scope>", "Install scope: project (default, <cwd>/.teamai + <cwd>/.claude) or user (~/.teamai + ~/.claude)").option("--inherit-user-scope", "In project scope, also sync safe user-scope resources and search its knowledge").option("--no-inherit-user-scope", "Disable user-scope inheritance for this project").option("--role <id>", "Primary role ID (e.g. hai_dev) for non-interactive setup").option("--project <ids>", 'Active logical project(s) from manifest/projects.yaml (comma-separated); scopes which project resources and learnings this directory syncs. Pass "all" to activate every project the manifest declares (a snapshot taken now)').option("--agent <name>", "AI tools to set up (e.g. claude, codex, cursor, codebuddy, workbuddy, dsh). Repeatable or comma-separated. In single-repo mode, selects which tool dirs to create; omit for an interactive picker. Additive on repeated runs.", (val, acc) => acc.concat(val), []).option("--force", "Overwrite existing config without confirmation").action(async (repoArg, cmdOpts) => {
   const globalOpts = program.opts();
   const { init: init2 } = await Promise.resolve().then(() => (init_init(), init_exports));
   await init2({ ...globalOpts, ...cmdOpts, repoPositional: repoArg });
@@ -42589,7 +43326,8 @@ registerPackagesCommand(program);
 program.command("doctor").description("Diagnose configuration issues").action(async () => {
   const globalOpts = program.opts();
   const { doctor: doctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
-  await doctor2(globalOpts);
+  const allPassed = await doctor2(globalOpts);
+  if (!allPassed) process.exitCode = 1;
 });
 var rolesCmd = program.command("roles").description("Manage team roles and resource namespaces").action(async () => {
   const globalOpts = program.opts();
@@ -42890,7 +43628,7 @@ program.command("todowrite-hint", { hidden: true }).description("Remind the agen
     await todoWriteHint2();
   }
 });
-program.command("import").description("Import knowledge from local directories, remote repos, organizations, MRs, or iWiki").option("--dir <path>", "Extract code knowledge from a local directory (same as --from-repo but no clone)").addOption(new Option("--from-claude", "Scan Claude/Cursor rule directories (~/.claude/rules, ~/.cursor/rules)").hideHelp()).option("--from-mr <url>", "Extract learning from merged MR/PR and trigger incremental teamwiki update").option("--from-iwiki <space-id-or-url>", "Import documents from iWiki Space ID or page URL (requires TAI_PAT_TOKEN)").addOption(new Option("--resume", "Resume an interrupted import session").hideHelp()).option("--all", "Accept all suggestions without interactive confirmation").addOption(new Option("--output <path>", "Write drafts to this directory instead of pushing to team repo").hideHelp()).option("--from-repo <url>", "Clone a remote repo and generate per-repo codebase summary").addOption(new Option("--ssh", "Force SSH clone even if HTTPS token is available").hideHelp()).addOption(new Option("--domain <name>", "Skip AI recommendation and assign repo to this domain explicitly").hideHelp()).option("--from-repo-list <path>", "Batch import repos from a YAML whitelist").addOption(new Option("--concurrency <n>", "Concurrent repos for --from-repo-list (default 3)").default("3").hideHelp()).option("--incremental", "Use cached clone with fetch+reset (with --from-repo or --from-repo-list)").option("--skip-enrich", "Skip AI enrichment (only clone + extract + graph, no LLM calls)").option("--from-org <org>", "List repos under an org and generate a repo whitelist").addOption(new Option("--max-repos <n>", "Cap on repos pulled from --from-org (default 200)").default("200").hideHelp()).addOption(new Option("--exclude-archived", "Exclude archived repos from --from-org (default true)").hideHelp()).addOption(new Option("--include-pattern <re>", "Regex to include repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--exclude-pattern <re>", "Regex to exclude repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--skip-import", "Only write drafts; skip the actual --from-repo-list run").hideHelp()).addOption(new Option("--iwiki-dual", "Enable dual-output mode for --from-iwiki (write codebase sections in addition to learning)").hideHelp()).addOption(new Option("--require-review", "Defer codebase section writes to .teamai/pending-review.jsonl for human review").hideHelp()).option("--cache-status", "Show import cache status (repos cached, disk usage)").option("--cache-gc", "Garbage-collect stale import cache entries").addOption(new Option("--max-bytes <n>", "Override capacity cap for --cache-gc").hideHelp()).addOption(new Option("--stale-days <n>", "Threshold for stale-eviction in days (default 30)").default("30").hideHelp()).action(async (cmdOpts) => {
+program.command("import").description("Import knowledge from local directories, remote repos, organizations, MRs, or iWiki").option("--dir <path>", "Extract code knowledge from a local directory (same as --from-repo but no clone)").addOption(new Option("--from-claude", "Scan Claude/Cursor rule directories (~/.claude/rules, ~/.cursor/rules)").hideHelp()).option("--from-mr <url>", "Extract learning from merged MR/PR and trigger incremental teamwiki update").option("--from-iwiki <space-id-or-url>", "Import documents from iWiki Space ID or page URL (requires TAI_PAT_TOKEN)").addOption(new Option("--resume", "Resume an interrupted import session").hideHelp()).option("--all", "Accept all suggestions without interactive confirmation").addOption(new Option("--output <path>", "Write drafts to this directory instead of pushing to team repo").hideHelp()).option("--from-repo <url>", "Clone a remote repo and generate per-repo codebase summary").addOption(new Option("--ssh", "Force SSH clone even if HTTPS token is available").hideHelp()).addOption(new Option("--domain <name>", "Skip AI recommendation and assign repo to this domain explicitly").hideHelp()).option("--from-repo-list <path>", "Batch import repos from a YAML whitelist").addOption(new Option("--concurrency <n>", "Concurrent repos for --from-repo-list (default 3)").default("3").hideHelp()).option("--incremental", "Use cached clone with fetch+reset (with --from-repo or --from-repo-list)").option("--skip-enrich", "Skip AI enrichment (only clone + extract + graph, no LLM calls)").option("--from-org <org>", "List repos under an org and generate a repo whitelist").addOption(new Option("--max-repos <n>", "Cap on repos pulled from --from-org (default 200)").default("200").hideHelp()).addOption(new Option("--exclude-archived", "Exclude archived repos from --from-org (default true)").hideHelp()).addOption(new Option("--include-pattern <re>", "Regex to include repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--exclude-pattern <re>", "Regex to exclude repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--skip-import", "Only write drafts; skip the actual --from-repo-list run").hideHelp()).addOption(new Option("--iwiki-dual", "Enable dual-output mode for --from-iwiki (write codebase sections in addition to learning)").hideHelp()).addOption(new Option("--require-review", "Defer codebase section writes to .teamai/pending-review.jsonl for human review").hideHelp()).option("--cache-status", "Show import cache status (repos cached, disk usage)").option("--cache-gc", "Garbage-collect stale import cache entries").option("--json", "Output cache status or GC result as JSON").addOption(new Option("--max-bytes <n>", "Override capacity cap for --cache-gc").hideHelp()).addOption(new Option("--stale-days <n>", "Threshold for stale-eviction in days (default 30)").default("30").hideHelp()).action(async (cmdOpts) => {
   const globalOpts = program.opts();
   if (cmdOpts.cacheStatus || cmdOpts.cacheGc) {
     const { cacheCmd: cacheCmd2 } = await Promise.resolve().then(() => (init_cache_cmd(), cache_cmd_exports));