teamai-cli 0.25.0-beta.0 → 0.25.0-beta.1

package/dist/index.js

@@ -1344,7 +1344,8 @@ function resolveRoleResourceNamespaces(input) {
     skills: [],
     // Roles never contribute learnings namespaces; only projects do. Kept empty
     // so the shape matches project resolution for a clean union at the call site.
-    learnings: []
+    learnings: [],
+    agents: []
   };
   for (const type of ROLE_RESOURCE_TYPES) {
     const seen = /* @__PURE__ */ new Set();
@@ -1388,10 +1389,13 @@ var init_roles = __esm({
     "use strict";
     init_fs();
     init_logger();
-    ROLE_RESOURCE_TYPES = ["knowledge", "skills"];
+    ROLE_RESOURCE_TYPES = ["knowledge", "skills", "agents"];
     RoleResourceNamespacesSchema = z2.object({
       knowledge: z2.array(z2.string().min(1)),
       skills: z2.array(z2.string().min(1)),
+      // Optional: a role without `agents` receives root-level agents only, which
+      // is what every manifest written before this key existed already got.
+      agents: z2.array(z2.string().min(1)).default([]),
       // learnings is accepted for backward compatibility but ignored at runtime.
       // All learnings are shared flat across the entire team (no namespace isolation).
       learnings: z2.array(z2.string()).optional()
@@ -2626,6 +2630,7 @@ function toZcodeEntry(def) {
     PostToolUse: 3e4,
     UserPromptSubmit: 6e4
   };
+  const timeoutMs = def.timeout !== void 0 ? def.timeout * 1e3 : ZCODE_TIMEOUT_MS[def.event] ?? 6e4;
   const entry = process.platform === "win32" ? {
     // Windows must NOT spawn bare `bash`: CreateProcess resolves it to
     // System32's WSL launcher before any PATH directory, and the WSL side
@@ -2635,7 +2640,7 @@ function toZcodeEntry(def) {
     type: "process",
     command: "cmd",
     args: ["/c", def.command],
-    timeoutMs: ZCODE_TIMEOUT_MS[def.event] ?? 6e4
+    timeoutMs
   } : {
     type: "process",
     command: "bash",
@@ -2643,7 +2648,7 @@ function toZcodeEntry(def) {
     // so managed-entry detection and the managed-hooks manifest share one
     // command representation (the same invariant the Codex format keeps).
     args: ["-lc", def.command],
-    timeoutMs: ZCODE_TIMEOUT_MS[def.event] ?? 6e4
+    timeoutMs
   };
   const group = { hooks: [entry] };
   if (def.matcher && def.matcher !== "*") group.matcher = def.matcher;
@@ -8058,20 +8063,73 @@ var init_dashboard_collector = __esm({
   }
 });
 
+// src/utils/exec.ts
+import spawn from "cross-spawn";
+async function probeBinary(binary, args = ["--version"], executor = execCommand) {
+  try {
+    const result = await executor(binary, args, { timeoutMs: 5e3 });
+    if (result.code !== 0) return "";
+    return (result.stdout || result.stderr).trim();
+  } catch {
+    return "";
+  }
+}
+function formatCommand(command, args) {
+  const quote = (value) => /^[a-zA-Z0-9_./:@=+-]+$/.test(value) ? value : JSON.stringify(value);
+  return [command, ...args.map(quote)].join(" ");
+}
+var execCommand;
+var init_exec = __esm({
+  "src/utils/exec.ts"() {
+    "use strict";
+    execCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
+      const child = spawn(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: ["ignore", "pipe", "pipe"],
+        shell: false
+      });
+      let stdout = "";
+      let stderr = "";
+      let settled = false;
+      const timeoutMs = options.timeoutMs ?? 12e4;
+      const finish = (callback) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        callback();
+      };
+      child.stdout?.on("data", (chunk) => {
+        const text = chunk.toString();
+        stdout += text;
+        if (options.stream) process.stdout.write(text);
+      });
+      child.stderr?.on("data", (chunk) => {
+        const text = chunk.toString();
+        stderr += text;
+        if (options.stream) process.stderr.write(text);
+      });
+      const timer = setTimeout(() => {
+        child.kill();
+        finish(() => reject(new Error(
+          `Command timed out after ${timeoutMs}ms: ${command} ${args.join(" ")}`
+        )));
+      }, timeoutMs);
+      child.on("error", (error) => finish(() => reject(error)));
+      child.on("close", (code) => finish(() => resolve({
+        stdout,
+        stderr,
+        code: code ?? 1
+      })));
+    });
+  }
+});
+
 // src/agent-version.ts
-import { execFile } from "child_process";
 import { readFile } from "fs/promises";
 import path22 from "path";
 async function execVersion(bin, args = ["--version"]) {
-  return new Promise((resolve) => {
-    execFile(bin, args, { timeout: 5e3 }, (err, stdout) => {
-      if (err) {
-        resolve("");
-        return;
-      }
-      resolve(stdout.trim());
-    });
-  });
+  return probeBinary(bin, args);
 }
 async function readPlistVersion(appPath) {
   const plistPath = path22.join(appPath, "Contents", "Info.plist");
@@ -8145,6 +8203,7 @@ var init_agent_version = __esm({
   "src/agent-version.ts"() {
     "use strict";
     init_logger();
+    init_exec();
     VERSION_CACHE = /* @__PURE__ */ new Map();
     CODEBUDDY_IDE_PATHS = [
       "/Applications/CodeBuddy.app",
@@ -9305,7 +9364,7 @@ __export(local_agent_exports, {
 import fs14 from "fs";
 import os7 from "os";
 import path28 from "path";
-import { execFile as execFile2 } from "child_process";
+import { execFile } from "child_process";
 import { promisify } from "util";
 import fse4 from "fs-extra";
 function modelAgentKind(tool) {
@@ -11544,7 +11603,7 @@ var init_local_agent = __esm({
     init_types();
     init_home();
     init_git2();
-    execFileAsync = promisify(execFile2);
+    execFileAsync = promisify(execFile);
     LOCAL_AGENT_DIR = "local-agent";
     CONFIG_FILE = "config.json";
     MANIFEST_FILE = "manifest.json";
@@ -12441,6 +12500,7 @@ var init_skills = __esm({
         await this.addTombstone(name, localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.skills) continue;
+          if (isAgentExcluded(localConfig, tool)) continue;
           let skillDir;
           if (tool === "openclaw") {
             const wsDir = await resolveOpenclawWorkspaceDir();
@@ -12697,6 +12757,7 @@ var init_rules = __esm({
         await this.addTombstone(name, localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.rules) continue;
+          if (isAgentExcluded(localConfig, tool)) continue;
           const extensions = /* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"]);
           for (const extension of extensions) {
             const filePath = path32.join(baseDir, toolPath.rules, `${name}${extension}`);
@@ -12738,6 +12799,7 @@ var init_rules = __esm({
         const baseDir = resolveBaseDir(localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.rules) continue;
+          if (isAgentExcluded(localConfig, tool)) continue;
           if (!await ResourceHandler.isToolInstalled(toolPath.rules, baseDir)) continue;
           const destDir = path32.join(baseDir, toolPath.rules);
           if (!await pathExists(destDir)) continue;
@@ -12941,9 +13003,9 @@ var init_env = __esm({
         }
         const envYamlPath = path34.join(localConfig.repo.localPath, "env", "env.yaml");
         if (!await pathExists(envYamlPath)) return [];
-        const { execFile: execFile5 } = await import("child_process");
+        const { execFile: execFile4 } = await import("child_process");
         const { promisify: promisify4 } = await import("util");
-        const execFileAsync4 = promisify4(execFile5);
+        const execFileAsync4 = promisify4(execFile4);
         try {
           await execFileAsync4("git", ["diff", "--exit-code", "env/env.yaml"], {
             cwd: localConfig.repo.localPath
@@ -13111,6 +13173,12 @@ import path35 from "path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import matter3 from "gray-matter";
 import { stringify as stringifyToml, parse as parseToml } from "smol-toml";
+function agentStemFromFilename(filename) {
+  for (const ext of AGENT_FILE_EXTENSIONS) {
+    if (filename.endsWith(ext)) return filename.slice(0, -ext.length);
+  }
+  return null;
+}
 function agentFileExtensionForTool(tool) {
   switch (tool) {
     case "codex":
@@ -13528,7 +13596,7 @@ function renderForTool(spec, tool) {
       return renderForOpencode(spec);
   }
 }
-var ALL_SUPPORTED_TOOLS, KIRO_SESSION_START_COMMAND, COMMON_CLAUDE_FIELDS, COMMON_CURSOR_FIELDS, COMMON_CODEX_FIELDS, COMMON_KIRO_FIELDS, COMMON_OPENCODE_FIELDS, MERGE_COMMON_FIELDS;
+var ALL_SUPPORTED_TOOLS, AGENT_FILE_EXTENSIONS, KIRO_SESSION_START_COMMAND, COMMON_CLAUDE_FIELDS, COMMON_CURSOR_FIELDS, COMMON_CODEX_FIELDS, COMMON_KIRO_FIELDS, COMMON_OPENCODE_FIELDS, MERGE_COMMON_FIELDS;
 var init_agent_format = __esm({
   "src/resources/agent-format.ts"() {
     "use strict";
@@ -13548,6 +13616,7 @@ var init_agent_format = __esm({
       "zcode",
       "opencode"
     ];
+    AGENT_FILE_EXTENSIONS = [".md", ".toml", ".json"];
     KIRO_SESSION_START_COMMAND = getDispatchCommand("session-start", "kiro");
     COMMON_CLAUDE_FIELDS = /* @__PURE__ */ new Set(["name", "description", "model", "tools"]);
     COMMON_CURSOR_FIELDS = /* @__PURE__ */ new Set(["agent_id", "description", "model", "tools"]);
@@ -13585,8 +13654,7 @@ async function removeStaleAgentSiblings(targetAgentsDir, stem, targetExt) {
     return;
   }
   for (const file of files) {
-    const base = file.replace(/\.(md|toml|json)$/, "");
-    if (base !== stem) continue;
+    if (agentStemFromFilename(file) !== stem) continue;
     if (file === `${stem}${targetExt}`) continue;
     try {
       await remove(path36.join(targetAgentsDir, file));
@@ -13669,10 +13737,267 @@ var init_builtin_agents = __esm({
   }
 });
 
-// src/resources/agents.ts
+// src/projects.ts
+var projects_exports = {};
+__export(projects_exports, {
+  describeProjects: () => describeProjects,
+  findProject: () => findProject,
+  isSafeNamespaceSegment: () => isSafeNamespaceSegment,
+  listProjectIds: () => listProjectIds,
+  loadProjectsManifest: () => loadProjectsManifest,
+  mergeNamespaces: () => mergeNamespaces,
+  resolveActiveLearningsNamespaces: () => resolveActiveLearningsNamespaces,
+  resolveProjectResourceNamespaces: () => resolveProjectResourceNamespaces,
+  saveProjectsManifest: () => saveProjectsManifest
+});
 import path37 from "path";
+import YAML8 from "yaml";
+import { z as z6 } from "zod";
+function isSafeNamespaceSegment(seg) {
+  return SAFE_ID.test(seg) && seg !== "." && seg !== "..";
+}
+function validateManifestShape2(raw) {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid projects manifest: expected an object");
+  }
+  const candidate = raw;
+  const projects = candidate.projects;
+  if (projects !== void 0 && !Array.isArray(projects)) {
+    throw new Error("Invalid projects manifest: projects must be an array");
+  }
+  for (const project of projects ?? []) {
+    if (!project || typeof project !== "object") {
+      throw new Error("Invalid projects manifest: every project must be an object");
+    }
+    const resources = project.resources;
+    if (resources !== void 0 && (typeof resources !== "object" || Array.isArray(resources))) {
+      throw new Error(`Invalid projects manifest: project ${project.id ?? "<unknown>"} has invalid resources`);
+    }
+    if (resources) {
+      const ALLOWED_RESOURCE_KEYS = new Set(PROJECT_RESOURCE_TYPES);
+      for (const key of Object.keys(resources)) {
+        if (!ALLOWED_RESOURCE_KEYS.has(key)) {
+          throw new Error(`Invalid projects manifest: unknown resource type "${key}"`);
+        }
+      }
+    }
+  }
+  const manifest = ProjectsManifestSchema.parse(raw);
+  const ids = /* @__PURE__ */ new Set();
+  for (const project of manifest.projects) {
+    if (ids.has(project.id)) {
+      throw new Error(`Invalid projects manifest: duplicate project id "${project.id}"`);
+    }
+    ids.add(project.id);
+  }
+  return manifest;
+}
+async function loadProjectsManifest(repoPath) {
+  const manifestPath = path37.join(repoPath, "manifest", "projects.yaml");
+  const content = await readFileSafe(manifestPath);
+  if (!content) {
+    return null;
+  }
+  let raw;
+  try {
+    raw = YAML8.parse(content);
+  } catch (error) {
+    throw new Error(`Invalid projects manifest YAML: ${error.message}`);
+  }
+  return validateManifestShape2(raw);
+}
+async function saveProjectsManifest(repoPath, manifest) {
+  validateManifestShape2(manifest);
+  const manifestDir = path37.join(repoPath, "manifest");
+  const manifestPath = path37.join(manifestDir, "projects.yaml");
+  await ensureDir(manifestDir);
+  await writeFile(manifestPath, YAML8.stringify(manifest));
+}
+function findProject(manifest, projectId) {
+  return manifest.projects.find((candidate) => candidate.id === projectId);
+}
+function listProjectIds(manifest) {
+  return manifest.projects.map((project) => project.id);
+}
+function describeProjects(projects) {
+  return projects.map((project) => {
+    const label = project.name || project.id;
+    return project.description ? `${label}: ${project.description}` : label;
+  });
+}
+function getProjectOrThrow(manifest, projectId) {
+  const project = findProject(manifest, projectId);
+  if (!project) {
+    throw new Error(`Unknown project "${projectId}". Valid projects: ${listProjectIds(manifest).join(", ")}`);
+  }
+  return project;
+}
+function resolveProjectResourceNamespaces(input) {
+  const resolved = input.activeProjects.map((id) => getProjectOrThrow(input.manifest, id));
+  const namespaces = {
+    knowledge: [],
+    skills: [],
+    learnings: [],
+    agents: []
+  };
+  for (const type of PROJECT_RESOURCE_TYPES) {
+    const seen = /* @__PURE__ */ new Set();
+    for (const project of resolved) {
+      for (const namespace of project.resources[type]) {
+        if (seen.has(namespace)) continue;
+        seen.add(namespace);
+        namespaces[type].push(namespace);
+      }
+    }
+  }
+  return namespaces;
+}
+async function resolveActiveLearningsNamespaces(repoPath, activeProjects) {
+  if (activeProjects.length === 0) return [];
+  const manifest = await loadProjectsManifest(repoPath);
+  if (!manifest) return [];
+  try {
+    return resolveProjectResourceNamespaces({ manifest, activeProjects }).learnings;
+  } catch {
+    return [];
+  }
+}
+function mergeNamespaces(roleNamespaces, projectNamespaces) {
+  const dedupe = (a, b) => {
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const ns of [...a, ...b]) {
+      if (seen.has(ns)) continue;
+      seen.add(ns);
+      out.push(ns);
+    }
+    return out;
+  };
+  return {
+    knowledge: dedupe(roleNamespaces.knowledge, projectNamespaces.knowledge),
+    skills: dedupe(roleNamespaces.skills, projectNamespaces.skills),
+    // Roles never contribute learnings; this is effectively the project set.
+    learnings: dedupe(roleNamespaces.learnings, projectNamespaces.learnings),
+    agents: dedupe(roleNamespaces.agents, projectNamespaces.agents)
+  };
+}
+var PROJECT_RESOURCE_TYPES, ProjectResourceNamespacesSchema, SAFE_ID, ProjectSchema, ProjectsManifestSchema;
+var init_projects = __esm({
+  "src/projects.ts"() {
+    "use strict";
+    init_fs();
+    PROJECT_RESOURCE_TYPES = ["knowledge", "skills", "learnings", "agents"];
+    ProjectResourceNamespacesSchema = z6.object({
+      knowledge: z6.array(z6.string().min(1)).default([]),
+      skills: z6.array(z6.string().min(1)).default([]),
+      learnings: z6.array(z6.string().min(1)).default([]),
+      agents: z6.array(z6.string().min(1)).default([])
+    });
+    SAFE_ID = /^[A-Za-z0-9._-]+$/;
+    ProjectSchema = z6.object({
+      id: z6.string().min(1).refine((v) => isSafeNamespaceSegment(v), {
+        message: "project id must be a single path segment (letters, digits, '.', '_', '-'; no '/', '\\\\', or '..')"
+      }),
+      name: z6.string().default(""),
+      description: z6.string().default(""),
+      resources: ProjectResourceNamespacesSchema
+    });
+    ProjectsManifestSchema = z6.object({
+      version: z6.number(),
+      // Unlike roles (`.min(1)`), a repo may define zero projects — a team without
+      // project partitioning simply has no projects.yaml, and an empty list is valid.
+      projects: z6.array(ProjectSchema).default([])
+    });
+  }
+});
+
+// src/resource-namespaces.ts
+async function resolveResourceNamespaces(localConfig) {
+  const activeProjects = localConfig.projects ?? [];
+  const primaryRole = localConfig.primaryRole;
+  const hasRole = !!primaryRole;
+  const hasProjects = activeProjects.length > 0;
+  const projectsManifest = await loadProjectsManifest(localConfig.repo.localPath);
+  const teamHasProjects = !!projectsManifest && projectsManifest.projects.length > 0;
+  if (!hasRole && !hasProjects && !teamHasProjects) return null;
+  let roleNamespaces = { knowledge: [], skills: [], learnings: [], agents: [] };
+  let allRoleSkillNamespaces = /* @__PURE__ */ new Set();
+  if (primaryRole) {
+    let rolesManifest;
+    try {
+      rolesManifest = await loadRolesManifest(localConfig.repo.localPath);
+    } catch {
+      log.warn("Could not load roles manifest. Skipping role-based filtering.");
+      rolesManifest = null;
+    }
+    if (rolesManifest) {
+      try {
+        roleNamespaces = resolveRoleResourceNamespaces({
+          manifest: rolesManifest,
+          primaryRole,
+          additionalRoles: localConfig.additionalRoles ?? []
+        });
+        allRoleSkillNamespaces = new Set(rolesManifest.roles.flatMap((role) => role.resources.skills));
+      } catch {
+        log.warn(`Role "${localConfig.primaryRole}" not found in manifest. Falling back to unfiltered sync.`);
+        log.warn("Run `teamai roles set <role>` to pick a valid role.");
+        if (!hasProjects && !teamHasProjects) return null;
+      }
+    } else if (!hasProjects && !teamHasProjects) {
+      return null;
+    }
+  }
+  let projectNamespaces = { knowledge: [], skills: [], learnings: [], agents: [] };
+  let allProjectSkillNamespaces = /* @__PURE__ */ new Set();
+  if (projectsManifest) {
+    allProjectSkillNamespaces = new Set(projectsManifest.projects.flatMap((p) => p.resources.skills));
+    if (hasProjects) {
+      try {
+        projectNamespaces = resolveProjectResourceNamespaces({
+          manifest: projectsManifest,
+          activeProjects
+        });
+      } catch (e) {
+        log.warn(`${e instanceof Error ? e.message : String(e)} Falling back to role-only filtering.`);
+      }
+    }
+  } else if (hasProjects) {
+    log.warn("Active projects configured but no projects manifest found. Skipping project-based filtering.");
+  }
+  const activeNamespaces = mergeNamespaces(roleNamespaces, projectNamespaces);
+  const allSkillNamespaces = /* @__PURE__ */ new Set([...allRoleSkillNamespaces, ...allProjectSkillNamespaces]);
+  return { activeNamespaces, allSkillNamespaces };
+}
+var init_resource_namespaces = __esm({
+  "src/resource-namespaces.ts"() {
+    "use strict";
+    init_roles();
+    init_projects();
+    init_logger();
+  }
+});
+
+// src/resources/agents.ts
+import path38 from "path";
 import { isDeepStrictEqual } from "util";
 import { parse as parseYaml2 } from "yaml";
+async function listTeamAgentDirs(teamAgentsDir) {
+  const dirs = [{ dir: teamAgentsDir }];
+  for (const namespace of await listDirs(teamAgentsDir)) {
+    if (isSafeNamespaceSegment(namespace)) dirs.push({ dir: path38.join(teamAgentsDir, namespace), namespace });
+  }
+  return dirs;
+}
+async function findTeamAgentFiles(teamAgentsDir, stem) {
+  const found = [];
+  for (const { dir, namespace } of await listTeamAgentDirs(teamAgentsDir)) {
+    for (const ext of [".yaml", ".md"]) {
+      const candidate = path38.join(dir, `${stem}${ext}`);
+      if (await pathExists(candidate)) found.push({ path: candidate, ext, ...namespace ? { namespace } : {} });
+    }
+  }
+  return found;
+}
 function mergeCanonicalEdits(canonical, perTool) {
   const merged = { ...canonical };
   const extras = { ...canonical.tool_extras };
@@ -13714,16 +14039,10 @@ function mergeCanonicalEdits(canonical, perTool) {
   else delete merged.tool_extras;
   return { ok: true, spec: merged };
 }
-function getAgentStem(filename) {
-  if (filename.endsWith(".md")) return filename.slice(0, -3);
-  if (filename.endsWith(".toml")) return filename.slice(0, -5);
-  if (filename.endsWith(".json")) return filename.slice(0, -5);
-  return null;
-}
 async function removeStaleAgentSiblings2(agentsDir, stem, targetExt) {
   for (const file of await listFiles(agentsDir)) {
-    if (getAgentStem(file) !== stem || file === `${stem}${targetExt}`) continue;
-    await remove(path37.join(agentsDir, file));
+    if (agentStemFromFilename(file) !== stem || file === `${stem}${targetExt}`) continue;
+    await remove(path38.join(agentsDir, file));
     log.debug(`Removed stale agent sibling ${file} for ${stem}`);
   }
 }
@@ -13737,7 +14056,7 @@ async function agentContentEqual(tool, localPath, teamPath) {
   const canonicalContent = await readFileSafe(teamPath);
   const localContent = await readFileSafe(localPath);
   if (canonicalContent === null || localContent === null) return false;
-  const parsed = parseAgentYaml(canonicalContent, path37.basename(teamPath));
+  const parsed = parseAgentYaml(canonicalContent, path38.basename(teamPath));
   if (!parsed.ok) return false;
   return localContent === renderForTool(parsed.spec, tool).content;
 }
@@ -13767,7 +14086,7 @@ function reverseByTool(tool, filePath, content) {
       return reverseFromOpencode(filePath, content);
   }
 }
-var AgentsHandler;
+var AgentsHandler, LEGACY_MD_TOOLS;
 var init_agents = __esm({
   "src/resources/agents.ts"() {
     "use strict";
@@ -13776,6 +14095,9 @@ var init_agents = __esm({
     init_logger();
     init_types();
     init_builtin_agents();
+    init_resource_namespaces();
+    init_projects();
+    init_path_safety();
     init_agent_format();
     AgentsHandler = class extends ResourceHandler {
       type = "agents";
@@ -13787,50 +14109,53 @@ var init_agents = __esm({
        * Built-in CLI agents are excluded from push.
        */
       async scanLocalForPush(teamConfig, localConfig) {
-        const teamAgentsDir = path37.join(localConfig.repo.localPath, "agents");
+        const teamAgentsDir = path38.join(localConfig.repo.localPath, "agents");
         const tombstones = await this.readTombstones(localConfig);
         const baseDir = resolveBaseDir(localConfig);
         const directItems = [];
         const directStems = /* @__PURE__ */ new Set();
         if (isSelfMode(localConfig) && localConfig.projectRoot) {
-          const activeAgentsDir = path37.join(localConfig.projectRoot, ".teamai", "agents");
+          const activeAgentsDir = path38.join(localConfig.projectRoot, ".teamai", "agents");
           if (await pathExists(activeAgentsDir)) {
-            for (const file of await listFiles(activeAgentsDir)) {
-              const isYaml = file.endsWith(".yaml");
-              const isMd = file.endsWith(".md");
-              if (!isYaml && !isMd) continue;
-              const stem = file.replace(/\.(yaml|md)$/, "");
-              if (tombstones.has(stem)) continue;
-              if (BUILTIN_AGENT_NAMES.has(stem)) continue;
-              const activePath = path37.join(activeAgentsDir, file);
-              const basePath = path37.join(teamAgentsDir, file);
-              const baseExists = await pathExists(basePath);
-              if (baseExists && await fileContentEqual(activePath, basePath)) continue;
-              directItems.push({
-                name: stem,
-                type: "agents",
-                sourcePath: activePath,
-                relativePath: `agents/${file}`,
-                status: baseExists ? "modified" : "new",
-                legacy: isMd
-              });
-              directStems.add(stem);
+            for (const { dir, namespace } of await listTeamAgentDirs(activeAgentsDir)) {
+              const relDir = namespace ? `agents/${namespace}` : "agents";
+              for (const file of await listFiles(dir)) {
+                const isYaml = file.endsWith(".yaml");
+                const isMd = file.endsWith(".md");
+                if (!isYaml && !isMd) continue;
+                const stem = file.replace(/\.(yaml|md)$/, "");
+                if (tombstones.has(stem)) continue;
+                if (BUILTIN_AGENT_NAMES.has(stem)) continue;
+                const activePath = path38.join(dir, file);
+                const basePath = path38.join(localConfig.repo.localPath, relDir, file);
+                const baseExists = await pathExists(basePath);
+                if (baseExists && await fileContentEqual(activePath, basePath)) continue;
+                directItems.push({
+                  name: stem,
+                  type: "agents",
+                  sourcePath: activePath,
+                  relativePath: `${relDir}/${file}`,
+                  status: baseExists ? "modified" : "new",
+                  legacy: isMd
+                });
+                directStems.add(stem);
+              }
             }
           }
         }
         const grouped = /* @__PURE__ */ new Map();
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.agents) continue;
-          const agentsDir = path37.join(baseDir, toolPath.agents);
+          const agentsDir = path38.join(baseDir, toolPath.agents);
           if (!await pathExists(agentsDir)) continue;
           const files = await listFiles(agentsDir);
           for (const file of files) {
-            const stem = getAgentStem(file);
+            const stem = agentStemFromFilename(file);
             if (stem === null) continue;
             if (tombstones.has(stem)) continue;
             if (BUILTIN_AGENT_NAMES.has(stem)) continue;
             if (directStems.has(stem)) continue;
-            const filePath = path37.join(agentsDir, file);
+            const filePath = path38.join(agentsDir, file);
             let toolGroup = grouped.get(stem);
             if (!toolGroup) {
               toolGroup = /* @__PURE__ */ new Map();
@@ -13842,11 +14167,41 @@ var init_agents = __esm({
           }
         }
         const items = [...directItems];
+        const resolved = await resolveResourceNamespaces(localConfig);
+        const activeNamespaces = resolved?.activeNamespaces.agents ?? null;
         for (const [stem, toolFiles] of grouped) {
-          const teamYamlPath = path37.join(teamAgentsDir, `${stem}.yaml`);
-          const teamMdPath = path37.join(teamAgentsDir, `${stem}.md`);
-          const hasTeamYaml = await pathExists(teamYamlPath);
-          const hasTeamMd = await pathExists(teamMdPath);
+          const sources = await findTeamAgentFiles(teamAgentsDir, stem);
+          const candidates = sources.filter(
+            (file) => activeNamespaces === null || !file.namespace || activeNamespaces.includes(file.namespace)
+          );
+          if (candidates.length > 1) {
+            items.push({
+              name: stem,
+              type: "agents",
+              sourcePath: teamAgentsDir,
+              relativePath: `agents/${stem}.yaml`,
+              status: "modified",
+              skipReason: `Ambiguous agent "${stem}": multiple active sources (${candidates.map((file) => file.path).join(", ")}). Give active agents unique names before pushing.`
+            });
+            continue;
+          }
+          if (sources.length > 0 && candidates.length === 0) {
+            items.push({
+              name: stem,
+              type: "agents",
+              sourcePath: teamAgentsDir,
+              relativePath: `agents/${stem}.yaml`,
+              status: "modified",
+              skipReason: `Agent "${stem}" has no active source. Activate its role or project before pushing local edits.`
+            });
+            continue;
+          }
+          const located = candidates[0];
+          const teamYamlPath = located?.ext === ".yaml" ? located.path : path38.join(teamAgentsDir, `${stem}.yaml`);
+          const teamMdPath = located?.ext === ".md" ? located.path : path38.join(teamAgentsDir, `${stem}.md`);
+          const hasTeamYaml = located?.ext === ".yaml";
+          const hasTeamMd = located?.ext === ".md";
+          const teamDir = located?.namespace ? `agents/${located.namespace}` : "agents";
           let canonicalSpec;
           if (hasTeamYaml) {
             const raw = await readFileSafe(teamYamlPath);
@@ -13856,7 +14211,7 @@ var init_agents = __esm({
                 name: stem,
                 type: "agents",
                 sourcePath: teamYamlPath,
-                relativePath: `agents/${stem}.yaml`,
+                relativePath: `${teamDir}/${stem}.yaml`,
                 status: "modified",
                 skipReason: "cannot read or parse canonical agent YAML"
               });
@@ -13934,7 +14289,7 @@ var init_agents = __esm({
                 name: stem,
                 type: "agents",
                 sourcePath: bestPath,
-                relativePath: `agents/${stem}.yaml`,
+                relativePath: `${teamDir}/${stem}.yaml`,
                 status: status2,
                 mergedSpec: mergeResult.spec
               });
@@ -13945,7 +14300,7 @@ var init_agents = __esm({
             name: stem,
             type: "agents",
             sourcePath: bestPath,
-            relativePath: `agents/${stem}.md`,
+            relativePath: `${teamDir}/${stem}.md`,
             status: status2,
             skipReason
           });
@@ -13956,32 +14311,33 @@ var init_agents = __esm({
        * Scan team repo `agents/` for files to pull.
        * Recognizes both *.yaml (new) and *.md (legacy).
        * Hidden files (tombstones) are filtered out by listFiles.
+       *
+       * Root-level files are shared with everyone. One level of subdirectories
+       * (`agents/<namespace>/`) carries role/project-scoped agents, the same
+       * convention `rules/<namespace>/` uses; pull filters them by the active
+       * `agents` namespaces. Deeper nesting is not scanned.
        */
       async scanTeamForPull(_teamConfig, localConfig) {
-        const agentsDir = path37.join(localConfig.repo.localPath, "agents");
+        const agentsDir = path38.join(localConfig.repo.localPath, "agents");
         if (!await pathExists(agentsDir)) return [];
-        const files = await listFiles(agentsDir);
         const items = [];
-        for (const file of files) {
-          if (file.endsWith(".yaml")) {
-            const stem = file.replace(/\.yaml$/, "");
+        const scanDir = async (dir, namespace) => {
+          const prefix = namespace ? `agents/${namespace}` : "agents";
+          for (const file of await listFiles(dir)) {
+            const legacy = file.endsWith(".md");
+            if (!legacy && !file.endsWith(".yaml")) continue;
             items.push({
-              name: stem,
+              name: file.replace(/\.(yaml|md)$/, ""),
               type: "agents",
-              sourcePath: path37.join(agentsDir, file),
-              relativePath: `agents/${file}`,
-              legacy: false
-            });
-          } else if (file.endsWith(".md")) {
-            const stem = file.replace(/\.md$/, "");
-            items.push({
-              name: stem,
-              type: "agents",
-              sourcePath: path37.join(agentsDir, file),
-              relativePath: `agents/${file}`,
-              legacy: true
+              sourcePath: path38.join(dir, file),
+              relativePath: `${prefix}/${file}`,
+              legacy,
+              ...namespace ? { namespace } : {}
             });
           }
+        };
+        for (const { dir, namespace } of await listTeamAgentDirs(agentsDir)) {
+          await scanDir(dir, namespace);
         }
         return items;
       }
@@ -13994,22 +14350,27 @@ var init_agents = __esm({
       async pushItem(item, _teamConfig, localConfig) {
         const agentItem = item;
         if (agentItem.skipReason) {
-          log.warn(`[agents] \u8DF3\u8FC7 ${item.name}: ${agentItem.skipReason}`);
-          log.warn("  \u5EFA\u8BAE\u4FEE\u6539\u540E\u91CD\u65B0 push \u8BE5 subagent");
+          log.warn(`[agents] Skipped ${item.name}: ${agentItem.skipReason}`);
           return;
         }
+        const teamDir = path38.resolve(localConfig.repo.localPath, path38.dirname(item.relativePath));
+        assertWithinRoot(
+          path38.join(localConfig.repo.localPath, "agents"),
+          teamDir,
+          `Invalid agent destination outside team repo agents directory: ${item.relativePath}`
+        );
         if (agentItem.mergedSpec) {
-          const dest2 = path37.join(localConfig.repo.localPath, "agents", `${item.name}.yaml`);
-          await ensureDir(path37.dirname(dest2));
+          const dest2 = path38.join(teamDir, `${item.name}.yaml`);
+          await ensureDir(path38.dirname(dest2));
           const yamlContent = serializeAgentYaml(agentItem.mergedSpec);
           await writeFile(dest2, yamlContent);
           log.debug(`Wrote agent ${item.name} \u2192 team repo (YAML format)`);
           return;
         }
         const ext = item.sourcePath.endsWith(".yaml") ? ".yaml" : ".md";
-        const dest = path37.join(localConfig.repo.localPath, "agents", `${item.name}${ext}`);
+        const dest = path38.join(teamDir, `${item.name}${ext}`);
         if (item.sourcePath !== dest) {
-          await ensureDir(path37.dirname(dest));
+          await ensureDir(path38.dirname(dest));
           await copyFile(item.sourcePath, dest);
         }
         log.debug(`Copied agent ${item.name} \u2192 team repo (${ext} verbatim)`);
@@ -14053,12 +14414,12 @@ var init_agents = __esm({
             continue;
           }
           if (isAgentExcluded(localConfig, tool)) continue;
-          const destDir = path37.join(baseDir, toolPath.agents);
+          const destDir = path38.join(baseDir, toolPath.agents);
           try {
             await ensureDir(destDir);
             const { ext, content: rendered } = renderForTool(spec, tool);
             await removeStaleAgentSiblings2(destDir, item.name, ext);
-            const dest = path37.join(destDir, `${item.name}${ext}`);
+            const dest = path38.join(destDir, `${item.name}${ext}`);
             await writeFile(dest, rendered);
             log.debug(`Rendered agent ${item.name} \u2192 ${tool} (${ext})`);
           } catch (e) {
@@ -14074,19 +14435,17 @@ var init_agents = __esm({
       async removeItem(name, teamConfig, localConfig) {
         const removed = [];
         const baseDir = resolveBaseDir(localConfig);
-        const teamAgentsDir = path37.join(localConfig.repo.localPath, "agents");
-        for (const ext of [".yaml", ".md"]) {
-          const teamFile = path37.join(teamAgentsDir, `${name}${ext}`);
-          if (await pathExists(teamFile)) {
-            await remove(teamFile);
-            removed.push(teamFile);
-          }
+        const teamAgentsDir = path38.join(localConfig.repo.localPath, "agents");
+        for (const located of await findTeamAgentFiles(teamAgentsDir, name)) {
+          await remove(located.path);
+          removed.push(located.path);
         }
         await this.addTombstone(name, localConfig);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
           if (!toolPath.agents) continue;
-          for (const ext of [".md", ".toml", ".json"]) {
-            const filePath = path37.join(baseDir, toolPath.agents, `${name}${ext}`);
+          if (isAgentExcluded(localConfig, tool)) continue;
+          for (const ext of AGENT_FILE_EXTENSIONS) {
+            const filePath = path38.join(baseDir, toolPath.agents, `${name}${ext}`);
             if (await pathExists(filePath)) {
               await remove(filePath);
               removed.push(filePath);
@@ -14096,14 +14455,69 @@ var init_agents = __esm({
         }
         return removed;
       }
+      /**
+       * Revocation pass for role/project scoping. Removes the deployed copies of
+       * every agent whose namespace is no longer active, on every installed tool.
+       *
+       * Data-safety gate, same as inactive skills: a file is deleted only when it
+       * is byte-equal to what pull would render from the team source. A local edit
+       * is kept and reported so nothing unpushed is lost. Root-level agents and
+       * agents still deployed to the same tool destination never qualify.
+       */
+      async cleanupInactiveNamespaces(teamConfig, localConfig, activeNamespaces) {
+        const items = await this.scanTeamForPull(teamConfig, localConfig);
+        const isActive = (item) => !item.namespace || activeNamespaces.includes(item.namespace);
+        const active = items.filter(isActive);
+        const inactive = items.filter((item) => !isActive(item) && !BUILTIN_AGENT_NAMES.has(item.name));
+        if (inactive.length === 0) return;
+        const baseDir = resolveBaseDir(localConfig);
+        for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
+          if (!toolPath.agents || !isKnownTool(tool) || isAgentExcluded(localConfig, tool)) continue;
+          if (!await ResourceHandler.isToolInstalled(toolPath.agents, baseDir)) continue;
+          const destDir = path38.join(baseDir, toolPath.agents);
+          const activeDestinations = /* @__PURE__ */ new Set();
+          for (const item of active) {
+            const rendered = await this.renderedForTool(item, tool);
+            if (rendered) activeDestinations.add(`${item.name}${rendered.ext}`);
+          }
+          for (const item of inactive) {
+            const expected = await this.renderedForTool(item, tool);
+            if (!expected || activeDestinations.has(`${item.name}${expected.ext}`)) continue;
+            const deployed = path38.join(destDir, `${item.name}${expected.ext}`);
+            const current = await readFileSafe(deployed);
+            if (current === null) continue;
+            if (current !== expected.content) {
+              log.warn(`[${localConfig.scope}] Kept agent "${item.name}" (${tool}): it differs from the team source ${item.relativePath}. Back it up, then delete it manually.`);
+              continue;
+            }
+            await remove(deployed);
+            log.debug(`[${localConfig.scope}] Removed inactive role-scoped agent ${item.name} from ${tool}`);
+          }
+        }
+      }
+      /**
+       * What `pullItem` writes for this agent on this tool, or null when the tool
+       * is not a target (legacy `.md` only reaches LEGACY_MD_TOOLS, a YAML spec
+       * honours `targets`, an unparsable spec is skipped like pull skips it).
+       */
+      async renderedForTool(item, tool) {
+        const content = await readFileSafe(item.sourcePath);
+        if (content === null) return null;
+        if (item.legacy) {
+          return LEGACY_MD_TOOLS.has(tool) ? { ext: ".md", content } : null;
+        }
+        const parsed = parseAgentYaml(content, `${item.name}.yaml`);
+        if (!parsed.ok) return null;
+        if (parsed.spec.targets && !parsed.spec.targets.includes(tool)) return null;
+        return renderForTool(parsed.spec, tool);
+      }
       // ─── Private helpers ──────────────────────────────────────────────────────
       /**
        * Legacy pull: copies .md as-is to Claude-compatible tools, including JoyCode.
        */
       async pullLegacyMd(item, teamConfig, baseDir, localConfig) {
-        const legacyTools = /* @__PURE__ */ new Set(["claude", "claude-internal", "tclaude", "codebuddy", "joycode"]);
         for (const [tool, toolPath] of Object.entries(scopedToolPaths(teamConfig, localConfig))) {
-          if (!legacyTools.has(tool)) continue;
+          if (!LEGACY_MD_TOOLS.has(tool)) continue;
           if (!toolPath.agents) {
             log.debug(`Skipping legacy agent sync for ${tool}: no agents path configured`);
             continue;
@@ -14113,10 +14527,10 @@ var init_agents = __esm({
             continue;
           }
           if (isAgentExcluded(localConfig, tool)) continue;
-          const destDir = path37.join(baseDir, toolPath.agents);
+          const destDir = path38.join(baseDir, toolPath.agents);
           try {
             await ensureDir(destDir);
-            const dest = path37.join(destDir, `${item.name}.md`);
+            const dest = path38.join(destDir, `${item.name}.md`);
             await copyFile(item.sourcePath, dest);
             log.debug(`Synced legacy agent ${item.name} \u2192 ${tool}`);
           } catch (e) {
@@ -14125,6 +14539,7 @@ var init_agents = __esm({
         }
       }
     };
+    LEGACY_MD_TOOLS = /* @__PURE__ */ new Set(["claude", "claude-internal", "tclaude", "codebuddy", "joycode"]);
   }
 });
 
@@ -14190,11 +14605,11 @@ __export(update_exports, {
   resolveRegistryForPackage: () => resolveRegistryForPackage,
   update: () => update
 });
-import { execFile as execFile3 } from "child_process";
+import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
 import { randomUUID as randomUUID2 } from "crypto";
 import fs16 from "fs";
-import path38 from "path";
+import path39 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 import fse7 from "fs-extra";
 function resolveRegistryForPackage(pkgName) {
@@ -14204,15 +14619,15 @@ function resolveRegistryForPackage(pkgName) {
   return PUBLIC_REGISTRY;
 }
 function resolveNpmCommand() {
-  const nodeDir = path38.dirname(process.execPath);
+  const nodeDir = path39.dirname(process.execPath);
   const candidates = [
     // Bundled runtimes: npm installed flat next to node.exe.
-    path38.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
+    path39.join(nodeDir, "node_modules", "npm", "bin", "npm-cli.js"),
     // POSIX layout rooted at the node dir itself.
-    path38.join(nodeDir, "lib", "node_modules", "npm", "bin", "npm-cli.js"),
+    path39.join(nodeDir, "lib", "node_modules", "npm", "bin", "npm-cli.js"),
     // Canonical POSIX install (official tarball, Homebrew, nvm): node lives in
     // <prefix>/bin with npm at <prefix>/lib/node_modules — one level up.
-    path38.join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
+    path39.join(nodeDir, "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")
   ];
   for (const c of candidates) {
     if (fs16.existsSync(c)) return { cmd: process.execPath, args: [c] };
@@ -14221,16 +14636,16 @@ function resolveNpmCommand() {
   return { cmd: "npm", args: [] };
 }
 function prefixFromEntryPath(entry, posix) {
-  const marker = `${path38.sep}node_modules${path38.sep}`;
+  const marker = `${path39.sep}node_modules${path39.sep}`;
   const idx = entry.lastIndexOf(marker);
   if (idx <= 0) return null;
   const root = entry.slice(0, idx);
   const pkgDir = getCurrentPackageName();
-  if (posix && path38.basename(root) === "lib") {
-    const prefix = path38.dirname(root);
-    return fs16.existsSync(path38.join(prefix, "lib", "node_modules", pkgDir)) ? { prefix, global: true } : null;
+  if (posix && path39.basename(root) === "lib") {
+    const prefix = path39.dirname(root);
+    return fs16.existsSync(path39.join(prefix, "lib", "node_modules", pkgDir)) ? { prefix, global: true } : null;
   }
-  return fs16.existsSync(path38.join(root, "node_modules", pkgDir)) ? { prefix: root, global: !posix } : null;
+  return fs16.existsSync(path39.join(root, "node_modules", pkgDir)) ? { prefix: root, global: !posix } : null;
 }
 function resolveInstallPrefix() {
   return prefixFromEntryPath(fileURLToPath4(import.meta.url), process.platform !== "win32");
@@ -14355,7 +14770,7 @@ async function acquireLock(lockPath) {
     owner
   });
   try {
-    await ensureDir(path38.dirname(resolved));
+    await ensureDir(path39.dirname(resolved));
   } catch {
     return false;
   }
@@ -14484,12 +14899,12 @@ async function doUpdate() {
     if (entry) {
       try {
         const installed = JSON.parse(fs16.readFileSync(
-          path38.join(path38.dirname(path38.dirname(entry)), "package.json"),
+          path39.join(path39.dirname(path39.dirname(entry)), "package.json"),
           "utf-8"
         ));
         if (installed.version !== result.latest) {
           log.warn(
-            `The running install at ${path38.dirname(path38.dirname(entry))} is still v${installed.version ?? "unknown"} (expected v${result.latest}) \u2014 it may need a manual update.`
+            `The running install at ${path39.dirname(path39.dirname(entry))} is still v${installed.version ?? "unknown"} (expected v${result.latest}) \u2014 it may need a manual update.`
           );
         }
       } catch {
@@ -14543,7 +14958,7 @@ var init_update = __esm({
     init_types();
     init_prompt();
     init_package_info();
-    execFileAsync2 = promisify2(execFile3);
+    execFileAsync2 = promisify2(execFile2);
     PUBLIC_REGISTRY = "https://registry.npmjs.org";
     TNPM_REGISTRY = "http://r.tnpm.oa.com";
     VERSION_CHECK_TIMEOUT = 5e3;
@@ -14558,9 +14973,9 @@ var marketplace_exports = {};
 __export(marketplace_exports, {
   refreshMarketplace: () => refreshMarketplace
 });
-import path39 from "path";
+import path40 from "path";
 async function extractSkillDescription2(skillDir) {
-  const skillMdPath = path39.join(skillDir, SKILL_MD2);
+  const skillMdPath = path40.join(skillDir, SKILL_MD2);
   const content = await readFileSafe(skillMdPath);
   if (!content) return "";
   const { data } = parseFrontmatter(content);
@@ -14569,7 +14984,7 @@ async function extractSkillDescription2(skillDir) {
   return String(desc).replace(/\s+/g, " ").trim();
 }
 async function refreshMarketplace(repoPath) {
-  const marketplacePath = path39.join(repoPath, MARKETPLACE_PATH);
+  const marketplacePath = path40.join(repoPath, MARKETPLACE_PATH);
   if (!await pathExists(marketplacePath)) {
     return false;
   }
@@ -14583,11 +14998,11 @@ async function refreshMarketplace(repoPath) {
     return false;
   }
   if (!Array.isArray(marketplace.plugins)) return false;
-  const skillsDir = path39.join(repoPath, "skills");
+  const skillsDir = path40.join(repoPath, "skills");
   const currentSkills = /* @__PURE__ */ new Set();
   const dirs = await listDirs(skillsDir);
   for (const dir of dirs) {
-    const hasSkillMd = await pathExists(path39.join(skillsDir, dir, SKILL_MD2));
+    const hasSkillMd = await pathExists(path40.join(skillsDir, dir, SKILL_MD2));
     if (hasSkillMd) {
       currentSkills.add(dir);
     }
@@ -14606,7 +15021,7 @@ async function refreshMarketplace(repoPath) {
   for (const skillName of currentSkills) {
     const existing = existingPlugins.get(skillName);
     if (existing) {
-      const desc = await extractSkillDescription2(path39.join(skillsDir, skillName));
+      const desc = await extractSkillDescription2(path40.join(skillsDir, skillName));
       if (desc && desc !== existing.description) {
         existing.description = desc;
         changed = true;
@@ -14614,7 +15029,7 @@ async function refreshMarketplace(repoPath) {
       updatedPlugins.push(existing);
       existingPlugins.delete(skillName);
     } else {
-      const desc = await extractSkillDescription2(path39.join(skillsDir, skillName));
+      const desc = await extractSkillDescription2(path40.join(skillsDir, skillName));
       updatedPlugins.push({
         name: skillName,
         source: `./skills/${skillName}`,
@@ -14651,177 +15066,6 @@ var init_marketplace = __esm({
   }
 });
 
-// src/projects.ts
-var projects_exports = {};
-__export(projects_exports, {
-  describeProjects: () => describeProjects,
-  findProject: () => findProject,
-  isSafeNamespaceSegment: () => isSafeNamespaceSegment,
-  listProjectIds: () => listProjectIds,
-  loadProjectsManifest: () => loadProjectsManifest,
-  mergeNamespaces: () => mergeNamespaces,
-  resolveActiveLearningsNamespaces: () => resolveActiveLearningsNamespaces,
-  resolveProjectResourceNamespaces: () => resolveProjectResourceNamespaces,
-  saveProjectsManifest: () => saveProjectsManifest
-});
-import path40 from "path";
-import YAML8 from "yaml";
-import { z as z6 } from "zod";
-function isSafeNamespaceSegment(seg) {
-  return SAFE_ID.test(seg) && seg !== "." && seg !== "..";
-}
-function validateManifestShape2(raw) {
-  if (!raw || typeof raw !== "object") {
-    throw new Error("Invalid projects manifest: expected an object");
-  }
-  const candidate = raw;
-  const projects = candidate.projects;
-  if (projects !== void 0 && !Array.isArray(projects)) {
-    throw new Error("Invalid projects manifest: projects must be an array");
-  }
-  for (const project of projects ?? []) {
-    if (!project || typeof project !== "object") {
-      throw new Error("Invalid projects manifest: every project must be an object");
-    }
-    const resources = project.resources;
-    if (resources !== void 0 && (typeof resources !== "object" || Array.isArray(resources))) {
-      throw new Error(`Invalid projects manifest: project ${project.id ?? "<unknown>"} has invalid resources`);
-    }
-    if (resources) {
-      const ALLOWED_RESOURCE_KEYS = new Set(PROJECT_RESOURCE_TYPES);
-      for (const key of Object.keys(resources)) {
-        if (!ALLOWED_RESOURCE_KEYS.has(key)) {
-          throw new Error(`Invalid projects manifest: unknown resource type "${key}"`);
-        }
-      }
-    }
-  }
-  const manifest = ProjectsManifestSchema.parse(raw);
-  const ids = /* @__PURE__ */ new Set();
-  for (const project of manifest.projects) {
-    if (ids.has(project.id)) {
-      throw new Error(`Invalid projects manifest: duplicate project id "${project.id}"`);
-    }
-    ids.add(project.id);
-  }
-  return manifest;
-}
-async function loadProjectsManifest(repoPath) {
-  const manifestPath = path40.join(repoPath, "manifest", "projects.yaml");
-  const content = await readFileSafe(manifestPath);
-  if (!content) {
-    return null;
-  }
-  let raw;
-  try {
-    raw = YAML8.parse(content);
-  } catch (error) {
-    throw new Error(`Invalid projects manifest YAML: ${error.message}`);
-  }
-  return validateManifestShape2(raw);
-}
-async function saveProjectsManifest(repoPath, manifest) {
-  validateManifestShape2(manifest);
-  const manifestDir = path40.join(repoPath, "manifest");
-  const manifestPath = path40.join(manifestDir, "projects.yaml");
-  await ensureDir(manifestDir);
-  await writeFile(manifestPath, YAML8.stringify(manifest));
-}
-function findProject(manifest, projectId) {
-  return manifest.projects.find((candidate) => candidate.id === projectId);
-}
-function listProjectIds(manifest) {
-  return manifest.projects.map((project) => project.id);
-}
-function describeProjects(projects) {
-  return projects.map((project) => {
-    const label = project.name || project.id;
-    return project.description ? `${label}: ${project.description}` : label;
-  });
-}
-function getProjectOrThrow(manifest, projectId) {
-  const project = findProject(manifest, projectId);
-  if (!project) {
-    throw new Error(`Unknown project "${projectId}". Valid projects: ${listProjectIds(manifest).join(", ")}`);
-  }
-  return project;
-}
-function resolveProjectResourceNamespaces(input) {
-  const resolved = input.activeProjects.map((id) => getProjectOrThrow(input.manifest, id));
-  const namespaces = {
-    knowledge: [],
-    skills: [],
-    learnings: []
-  };
-  for (const type of PROJECT_RESOURCE_TYPES) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const project of resolved) {
-      for (const namespace of project.resources[type]) {
-        if (seen.has(namespace)) continue;
-        seen.add(namespace);
-        namespaces[type].push(namespace);
-      }
-    }
-  }
-  return namespaces;
-}
-async function resolveActiveLearningsNamespaces(repoPath, activeProjects) {
-  if (activeProjects.length === 0) return [];
-  const manifest = await loadProjectsManifest(repoPath);
-  if (!manifest) return [];
-  try {
-    return resolveProjectResourceNamespaces({ manifest, activeProjects }).learnings;
-  } catch {
-    return [];
-  }
-}
-function mergeNamespaces(roleNamespaces, projectNamespaces) {
-  const dedupe = (a, b) => {
-    const seen = /* @__PURE__ */ new Set();
-    const out = [];
-    for (const ns of [...a, ...b]) {
-      if (seen.has(ns)) continue;
-      seen.add(ns);
-      out.push(ns);
-    }
-    return out;
-  };
-  return {
-    knowledge: dedupe(roleNamespaces.knowledge, projectNamespaces.knowledge),
-    skills: dedupe(roleNamespaces.skills, projectNamespaces.skills),
-    // Roles never contribute learnings; this is effectively the project set.
-    learnings: dedupe(roleNamespaces.learnings, projectNamespaces.learnings)
-  };
-}
-var PROJECT_RESOURCE_TYPES, ProjectResourceNamespacesSchema, SAFE_ID, ProjectSchema, ProjectsManifestSchema;
-var init_projects = __esm({
-  "src/projects.ts"() {
-    "use strict";
-    init_fs();
-    PROJECT_RESOURCE_TYPES = ["knowledge", "skills", "learnings"];
-    ProjectResourceNamespacesSchema = z6.object({
-      knowledge: z6.array(z6.string().min(1)).default([]),
-      skills: z6.array(z6.string().min(1)).default([]),
-      learnings: z6.array(z6.string().min(1)).default([])
-    });
-    SAFE_ID = /^[A-Za-z0-9._-]+$/;
-    ProjectSchema = z6.object({
-      id: z6.string().min(1).refine((v) => isSafeNamespaceSegment(v), {
-        message: "project id must be a single path segment (letters, digits, '.', '_', '-'; no '/', '\\\\', or '..')"
-      }),
-      name: z6.string().default(""),
-      description: z6.string().default(""),
-      resources: ProjectResourceNamespacesSchema
-    });
-    ProjectsManifestSchema = z6.object({
-      version: z6.number(),
-      // Unlike roles (`.min(1)`), a repo may define zero projects — a team without
-      // project partitioning simply has no projects.yaml, and an empty list is valid.
-      projects: z6.array(ProjectSchema).default([])
-    });
-  }
-});
-
 // src/pkg/types.ts
 import { z as z7 } from "zod";
 var PackageScopeSchema, NpmSpecSchema, ClaudeMarketplaceSchema, ClaudePluginSpecSchema, ClaudeEcosystemSchema, PackageSetSchema, PackageManifestSchema, NpmLockEntrySchema, ClaudeMarketplaceLockSchema, ClaudePluginLockSchema, PackageLockSchema;
@@ -15073,6 +15317,7 @@ __export(reports_branch_exports, {
   ensureReportsDir: () => ensureReportsDir,
   ensureReportsWorktree: () => ensureReportsWorktree,
   refreshReportsWorktree: () => refreshReportsWorktree,
+  updateReports: () => updateReports,
   withKnowledgeWorktree: () => withKnowledgeWorktree
 });
 import path42 from "path";
@@ -15196,6 +15441,38 @@ async function writeWorktreeGitignore(wt) {
   ].join("\n");
   await writeFile(path42.join(wt, ".gitignore"), content);
 }
+async function commitAndPushReportsAt(wt, message, files, options = {}) {
+  const git = createGit2(wt);
+  await git.add(files);
+  const status2 = await git.status();
+  if (status2.staged.length === 0 && !options.pushIfUnchanged) {
+    log.debug("[reports] nothing to commit");
+    return false;
+  }
+  if (status2.staged.length > 0) await commitSkippingHooks(git, message);
+  for (let attempt = 1; attempt <= MAX_PUSH_RETRIES; attempt++) {
+    try {
+      await git.push(["origin", REPORTS_BRANCH]);
+      return true;
+    } catch (pushErr) {
+      if (attempt === MAX_PUSH_RETRIES) {
+        log.debug(`[reports] push failed after ${attempt} attempts: ${pushErr.message}`);
+        return false;
+      }
+      try {
+        await git.fetch(["origin", REPORTS_BRANCH]);
+        await git.rebase([`origin/${REPORTS_BRANCH}`]);
+      } catch (rebaseErr) {
+        log.debug(`[reports] rebase failed, retrying: ${rebaseErr.message}`);
+        try {
+          await git.rebase(["--abort"]);
+        } catch {
+        }
+      }
+    }
+  }
+  return false;
+}
 async function commitAndPushReports(localConfig, message, files, options = {}) {
   const lockPath = reportsLockPath(localConfig);
   const locked = await acquireLock(lockPath);
@@ -15205,38 +15482,37 @@ async function commitAndPushReports(localConfig, message, files, options = {}) {
   }
   try {
     const wt = await ensureReportsWorktree(localConfig);
-    const git = createGit2(wt);
-    await git.add(files);
-    const status2 = await git.status();
-    if (status2.staged.length === 0 && !options.pushIfUnchanged) {
-      log.debug("[reports] nothing to commit");
-      return false;
+    return await commitAndPushReportsAt(wt, message, files, options);
+  } catch (e) {
+    log.debug(`[reports] commitAndPushReports failed (non-blocking): ${e.message}`);
+    return false;
+  } finally {
+    await releaseLock(lockPath);
+  }
+}
+async function updateReports(localConfig, write, options = {}) {
+  if (!usesReportsBranch(localConfig)) {
+    throw new Error("updateReports requires a repo that stores reports on the teamai-reports branch");
+  }
+  const lockPath = reportsLockPath(localConfig);
+  if (!await acquireLock(lockPath)) {
+    log.debug("[reports] another reports write is in progress; skipping");
+    return false;
+  }
+  try {
+    const wt = await ensureReportsWorktree(localConfig);
+    try {
+      await syncReportsWorktree(wt);
+    } catch (e) {
+      log.debug(`[reports] sync before write failed, writing onto the local copy: ${e.message}`);
     }
-    if (status2.staged.length > 0) await commitSkippingHooks(git, message);
-    for (let attempt = 1; attempt <= MAX_PUSH_RETRIES; attempt++) {
-      try {
-        await git.push(["origin", REPORTS_BRANCH]);
-        return true;
-      } catch (pushErr) {
-        if (attempt === MAX_PUSH_RETRIES) {
-          log.debug(`[reports] push failed after ${attempt} attempts: ${pushErr.message}`);
-          return false;
-        }
-        try {
-          await git.fetch(["origin", REPORTS_BRANCH]);
-          await git.rebase([`origin/${REPORTS_BRANCH}`]);
-        } catch (rebaseErr) {
-          log.debug(`[reports] rebase failed, retrying: ${rebaseErr.message}`);
-          try {
-            await git.rebase(["--abort"]);
-          } catch {
-          }
-        }
-      }
+    const change = await write(wt);
+    if (!change || change.files.length === 0) {
+      return false;
     }
-    return false;
+    return await commitAndPushReportsAt(wt, change.message, change.files, options);
   } catch (e) {
-    log.debug(`[reports] commitAndPushReports failed (non-blocking): ${e.message}`);
+    log.debug(`[reports] updateReports failed (non-blocking): ${e.message}`);
     return false;
   } finally {
     await releaseLock(lockPath);
@@ -15706,6 +15982,7 @@ var init_known_agents = __esm({
 // src/init.ts
 var init_exports = {};
 __export(init_exports, {
+  ALL_PROJECTS_SELECTOR: () => ALL_PROJECTS_SELECTOR,
   buildSelfModeGitignore: () => buildSelfModeGitignore,
   init: () => init,
   initHttp: () => initHttp,
@@ -15713,6 +15990,7 @@ __export(init_exports, {
   migrateSelfModeGitignore: () => migrateSelfModeGitignore,
   migrateSelfModeGitignoreContent: () => migrateSelfModeGitignoreContent,
   promptForSelfModeAgents: () => promptForSelfModeAgents,
+  resolveActiveProjects: () => resolveActiveProjects,
   resolveInheritUserScope: () => resolveInheritUserScope,
   resolveInitRepo: () => resolveInitRepo,
   resolveInitScope: () => resolveInitScope,
@@ -15783,6 +16061,10 @@ async function promptForRoleProfile(repoPath, roleFlag) {
     resourceProfileVersion: manifest.version
   };
 }
+function dedupeIds(ids) {
+  const seen = /* @__PURE__ */ new Set();
+  return ids.filter((id) => seen.has(id) ? false : (seen.add(id), true));
+}
 async function resolveActiveProjects(repoPath, projectFlag) {
   const requested = (projectFlag ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   if (requested.length === 0) {
@@ -15794,7 +16076,27 @@ async function resolveActiveProjects(repoPath, projectFlag) {
       `--project given but no projects manifest (manifest/projects.yaml) exists in the team repo.`
     );
   }
-  const validIds = new Set(listProjectIds(manifest));
+  const declared = listProjectIds(manifest);
+  if (requested.includes(ALL_PROJECTS_SELECTOR)) {
+    if (requested.length > 1) {
+      throw new Error(
+        `--project "${ALL_PROJECTS_SELECTOR}" already covers every declared project; drop the other ids (got: ${requested.join(", ")}).`
+      );
+    }
+    if (declared.length === 0) {
+      log.warn(
+        `--project "${ALL_PROJECTS_SELECTOR}" was given but manifest/projects.yaml declares no projects; nothing was activated.`
+      );
+      return { projects: [] };
+    }
+    if (declared.includes(ALL_PROJECTS_SELECTOR)) {
+      log.warn(
+        `manifest/projects.yaml declares a project with the id "${ALL_PROJECTS_SELECTOR}", which is the reserved --project selector: every project is activated (that one included). To activate only it, run \`teamai projects set ${ALL_PROJECTS_SELECTOR}\`.`
+      );
+    }
+    return { projects: declared };
+  }
+  const validIds = new Set(declared);
   for (const id of requested) {
     if (!validIds.has(id)) {
       throw new Error(
@@ -15802,9 +16104,7 @@ async function resolveActiveProjects(repoPath, projectFlag) {
       );
     }
   }
-  const seen = /* @__PURE__ */ new Set();
-  const projects = requested.filter((id) => seen.has(id) ? false : (seen.add(id), true));
-  return { projects };
+  return { projects: dedupeIds(requested) };
 }
 function resolveInitScope(rawScope, cwd, homeDir) {
   const cwdResolved = resolveRealPath(cwd);
@@ -16322,20 +16622,28 @@ async function initSelfRepo(options) {
   }
   if (!options.dryRun) {
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(localConfig);
-      const memberDir = path45.join(wt, "members");
-      await ensureDir(memberDir);
-      const memberPath = path45.join(memberDir, `${username}.yaml`);
-      const isNewSelfMember = !await pathExists(memberPath);
-      const existingSelfMember = await getMemberConfig(wt, username);
-      const { config: selfMemberConfig, changed: selfMemberChanged } = mergeMemberConfig(existingSelfMember, {
-        username,
-        projects: localConfig.projects
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      let isNewSelfMember = false;
+      let selfMemberChanged = false;
+      const pushed = await updateReports2(localConfig, async (wt) => {
+        const memberDir = path45.join(wt, "members");
+        await ensureDir(memberDir);
+        const memberPath = path45.join(memberDir, `${username}.yaml`);
+        isNewSelfMember = !await pathExists(memberPath);
+        const existingSelfMember = await getMemberConfig(wt, username);
+        const merged = mergeMemberConfig(existingSelfMember, {
+          username,
+          projects: localConfig.projects
+        });
+        selfMemberChanged = merged.changed;
+        if (!merged.changed) return null;
+        await writeFile(memberPath, YAML11.stringify(merged.config));
+        return {
+          files: ["members/"],
+          message: isNewSelfMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`
+        };
       });
       if (selfMemberChanged) {
-        await writeFile(memberPath, YAML11.stringify(selfMemberConfig));
-        const pushed = await commitAndPushReports2(localConfig, isNewSelfMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`, ["members/"]);
         if (pushed) {
           log.success(isNewSelfMember ? "Member registered on the teamai-reports branch" : "Member roster updated on the teamai-reports branch");
         } else {
@@ -16510,6 +16818,17 @@ async function init(options) {
         }
       } else {
         log.info(`Repo already exists at ${localPath}, using existing clone`);
+        try {
+          const pullResult = await pullRepoFastForward(localPath);
+          if (pullResult !== "already up to date") {
+            log.info(`Refreshed existing clone (${pullResult})`);
+          }
+        } catch (e) {
+          log.error(
+            `Failed to refresh existing clone at ${localPath}: ${e.message}. The local clone was left unchanged. Fix network/auth or resolve divergence (commit/stash local edits), or remove ${localPath} manually to start fresh.`
+          );
+          process.exit(1);
+        }
       }
     } else {
       log.warn(`Existing ${localPath} is not a git repository, re-cloning`);
@@ -16656,29 +16975,37 @@ async function init(options) {
   let isNewMember = true;
   if (!options.dryRun) {
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(reportsConfig);
-      const memberDir = path45.join(wt, "members");
-      await ensureDir(memberDir);
-      const memberPath = path45.join(memberDir, `${username}.yaml`);
-      isNewMember = !await pathExists(memberPath);
-      const existingMember = await getMemberConfig(wt, username);
-      const { config: memberConfig, changed: memberChanged } = mergeMemberConfig(existingMember, {
-        username,
-        projects: resolvedProjects
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      let memberChanged = false;
+      let memberProjects;
+      const pushed = await updateReports2(reportsConfig, async (wt) => {
+        const memberDir = path45.join(wt, "members");
+        await ensureDir(memberDir);
+        const memberPath = path45.join(memberDir, `${username}.yaml`);
+        isNewMember = !await pathExists(memberPath);
+        const existingMember = await getMemberConfig(wt, username);
+        const merged = mergeMemberConfig(existingMember, {
+          username,
+          projects: resolvedProjects
+        });
+        memberChanged = merged.changed;
+        memberProjects = merged.config.projects;
+        if (!merged.changed) return null;
+        await writeFile(memberPath, YAML11.stringify(merged.config));
+        return {
+          files: ["members/"],
+          message: isNewMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`
+        };
       });
       if (memberChanged) {
-        await writeFile(memberPath, YAML11.stringify(memberConfig));
-        log.success(isNewMember ? `Registered as team member: ${username}` : `Updated member roster: ${username}${memberConfig.projects ? ` (projects: ${memberConfig.projects.join(", ")})` : ""}`);
-        const pushed = await commitAndPushReports2(reportsConfig, isNewMember ? `[teamai] Register member: ${username}` : `[teamai] Update member roster: ${username}`, ["members/"]);
+        log.success(isNewMember ? `Registered as team member: ${username}` : `Updated member roster: ${username}${memberProjects ? ` (projects: ${memberProjects.join(", ")})` : ""}`);
         if (pushed) {
           log.success(isNewMember ? "Member registered on the teamai-reports branch" : "Member roster updated on the teamai-reports branch");
         } else {
           log.warn("Member registration could not be pushed (no write access?). You are still set up locally.");
         }
-      } else {
+      } else if (!isNewMember) {
         log.info(`Member ${username} already registered`);
-        isNewMember = false;
       }
     } catch (e) {
       log.warn(`Member registration skipped (non-blocking): ${e.message}`);
@@ -16804,6 +17131,7 @@ async function init(options) {
   log.info("Run `teamai status` to check current config.");
   closePrompt();
 }
+var ALL_PROJECTS_SELECTOR;
 var init_init = __esm({
   "src/init.ts"() {
     "use strict";
@@ -16822,6 +17150,7 @@ var init_init = __esm({
     init_members();
     init_prompt();
     init_known_agents();
+    ALL_PROJECTS_SELECTOR = "all";
   }
 });
 
@@ -17144,13 +17473,19 @@ async function pushCore(localConfig, teamConfig, options, initialPendingTeamConf
     }
   } : teamConfig;
   const pushableTypes = ["skills", "rules", "env", "agents"];
-  const allItems = [];
+  const fullScan = [];
   for (const type of pushableTypes) {
     const handler = getHandler(type);
     const items = await handler.scanLocalForPush(scanTeamConfig, localConfig);
-    allItems.push(...items);
+    fullScan.push(...items);
   }
-  const fullScan = [...allItems];
+  const allItems = fullScan.filter((item) => {
+    if (item.type === "agents" && "skipReason" in item && typeof item.skipReason === "string" && item.skipReason) {
+      log.warn(`[agents] Skipped ${item.name}: ${item.skipReason}`);
+      return false;
+    }
+    return true;
+  });
   spin.stop();
   if (options.skill) {
     const skillBasename = path46.basename(
@@ -17536,6 +17871,7 @@ __export(git_exports, {
   listWorktrees: () => listWorktrees,
   normalizeRepoUrlForCompare: () => normalizeRepoUrlForCompare,
   pullRepo: () => pullRepo,
+  pullRepoFastForward: () => pullRepoFastForward,
   pushLearningToOrigin: () => pushLearningToOrigin,
   pushRepoBranch: () => pushRepoBranch,
   pushRepoDirectly: () => pushRepoDirectly,
@@ -17674,6 +18010,14 @@ async function pullRepo(localPath) {
     return "reset to origin (diverged)";
   }
 }
+async function pullRepoFastForward(localPath) {
+  const git = createGit2(localPath);
+  const result = await git.pull(["--ff-only"]);
+  if (result.summary.changes === 0 && result.summary.insertions === 0 && result.summary.deletions === 0) {
+    return "already up to date";
+  }
+  return `${result.summary.changes} file(s) changed`;
+}
 async function getDefaultBranch(localPath) {
   const cached = defaultBranchCache.get(localPath);
   if (cached) return cached;
@@ -18249,19 +18593,19 @@ async function bootstrapSelfRepo(dir, opts) {
       log.debug(`[bootstrap] hook injection failed (non-blocking): ${e.message}`);
     }
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(localConfig);
-      const memberDir = path49.join(wt, "members");
-      await ensureDir(memberDir);
-      const memberPath = path49.join(memberDir, `${username}.yaml`);
-      if (!await pathExists(memberPath)) {
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      await updateReports2(localConfig, async (wt) => {
+        const memberDir = path49.join(wt, "members");
+        await ensureDir(memberDir);
+        const memberPath = path49.join(memberDir, `${username}.yaml`);
+        if (await pathExists(memberPath)) return null;
         await writeFile(memberPath, YAML14.stringify({
           username,
           displayName: username,
           registeredAt: (/* @__PURE__ */ new Date()).toISOString()
         }));
-        await commitAndPushReports2(localConfig, `[teamai] Register member: ${username}`, ["members/"]);
-      }
+        return { files: ["members/"], message: `[teamai] Register member: ${username}` };
+      });
     } catch (e) {
       log.debug(`[bootstrap] member registration skipped (non-blocking): ${e.message}`);
     }
@@ -18529,68 +18873,6 @@ var init_config = __esm({
   }
 });
 
-// src/utils/exec.ts
-import spawn from "cross-spawn";
-async function probeBinary(binary, args = ["--version"], executor = execCommand) {
-  try {
-    const result = await executor(binary, args, { timeoutMs: 5e3 });
-    if (result.code !== 0) return "";
-    return (result.stdout || result.stderr).trim();
-  } catch {
-    return "";
-  }
-}
-function formatCommand(command, args) {
-  const quote = (value) => /^[a-zA-Z0-9_./:@=+-]+$/.test(value) ? value : JSON.stringify(value);
-  return [command, ...args.map(quote)].join(" ");
-}
-var execCommand;
-var init_exec = __esm({
-  "src/utils/exec.ts"() {
-    "use strict";
-    execCommand = (command, args, options = {}) => new Promise((resolve, reject) => {
-      const child = spawn(command, args, {
-        cwd: options.cwd,
-        env: options.env,
-        stdio: ["ignore", "pipe", "pipe"],
-        shell: false
-      });
-      let stdout = "";
-      let stderr = "";
-      let settled = false;
-      const timeoutMs = options.timeoutMs ?? 12e4;
-      const finish = (callback) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timer);
-        callback();
-      };
-      child.stdout?.on("data", (chunk) => {
-        const text = chunk.toString();
-        stdout += text;
-        if (options.stream) process.stdout.write(text);
-      });
-      child.stderr?.on("data", (chunk) => {
-        const text = chunk.toString();
-        stderr += text;
-        if (options.stream) process.stderr.write(text);
-      });
-      const timer = setTimeout(() => {
-        child.kill();
-        finish(() => reject(new Error(
-          `Command timed out after ${timeoutMs}ms: ${command} ${args.join(" ")}`
-        )));
-      }, timeoutMs);
-      child.on("error", (error) => finish(() => reject(error)));
-      child.on("close", (code) => finish(() => resolve({
-        stdout,
-        stderr,
-        code: code ?? 1
-      })));
-    });
-  }
-});
-
 // src/pkg/adapters/base.ts
 var PackageAdapter;
 var init_base2 = __esm({
@@ -19596,9 +19878,9 @@ async function verifyStaging(legacyDir, staging) {
       throw new Error("migration verify: team-repo/.git missing after copy (clone would be broken)");
     }
     try {
-      const { execFile: execFile5 } = await import("child_process");
+      const { execFile: execFile4 } = await import("child_process");
       const { promisify: promisify4 } = await import("util");
-      await promisify4(execFile5)("git", ["rev-parse", "HEAD"], { cwd: stagedRepo });
+      await promisify4(execFile4)("git", ["rev-parse", "HEAD"], { cwd: stagedRepo });
     } catch (e) {
       throw new Error(
         `migration verify: the staged team-repo clone is not a usable git repository (${e.message})`
@@ -19983,6 +20265,7 @@ var init_tokenizer = __esm({
 // src/votes.ts
 var votes_exports = {};
 __export(votes_exports, {
+  hasPendingVoteDeltas: () => hasPendingVoteDeltas,
   incrementRecalled: () => incrementRecalled,
   incrementUpvoted: () => incrementUpvoted,
   loadUserVotes: () => loadUserVotes,
@@ -20097,6 +20380,10 @@ function mergeDeltas(local, remote) {
   }
   return { version: 2, votes, deltas: {} };
 }
+async function hasPendingVoteDeltas(localVotesDir, username) {
+  const local = await loadUserVotes(path57.join(localVotesDir, `${username}.yaml`));
+  return Object.keys(local.deltas).length > 0;
+}
 async function syncVotesToTeam(repoPath, username, localVotesDir) {
   const localVotePath = path57.join(localVotesDir, `${username}.yaml`);
   const remoteVotePath = path57.join(repoPath, "votes", `${username}.yaml`);
@@ -22537,10 +22824,67 @@ async function reportUsageToTeam(repoPath, username, options) {
     const hasInterventions = hasInterventionDelta(interventionDelta);
     const hasPromptTokens = hasPromptTokenDelta(promptTokenDelta);
     const hasDaily = hasDailyDelta(dailyDelta);
-    let writeRoot = repoPath;
+    const hasStats = hasUsage || hasInterventions || hasPromptTokens || hasDaily;
+    const commitMsg = hasUsage ? `[teamai] Update usage stats for ${username}` : hasInterventions || hasPromptTokens || hasDaily ? `[teamai] Update session stats for ${username}` : `[teamai] Update votes for ${username}`;
+    const writeReportFiles = async (writeRoot) => {
+      if (hasStats) {
+        const statsDir = path64.join(writeRoot, "stats");
+        await ensureDir(statsDir);
+        const statsPath = path64.join(statsDir, `${username}.yaml`);
+        const existing = await readExistingStats(statsPath);
+        if (useReportsBranch) {
+          const previousContent = await readFileSafe(statsPath);
+          restoreStats = () => writeFile(statsPath, previousContent ?? "");
+        }
+        const newStats = hasUsage ? aggregateUsage(events) : [];
+        const merged = mergeStats(existing, username, newStats);
+        if (hasInterventions) {
+          merged.interventions = mergeInterventionStats(existing?.interventions, interventionDelta);
+        }
+        if (hasPromptTokens) {
+          const pt = mergePromptTokenStats(existing?.prompts, existing?.tokens, promptTokenDelta);
+          merged.prompts = pt.prompts;
+          merged.tokens = pt.tokens;
+        }
+        if (hasDaily) {
+          merged.daily = mergeDailyStats(existing?.daily, dailyDelta);
+        }
+        await writeFile(statsPath, YAML21.stringify(merged));
+        filesToPush.push(`stats/${username}.yaml`);
+      }
+      try {
+        if (await pathExists(getUserVotesDir())) {
+          const { syncVotesToTeam: syncVotesToTeam2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
+          const synced = await syncVotesToTeam2(writeRoot, username, getUserVotesDir());
+          if (synced) {
+            filesToPush.push(`votes/${username}.yaml`);
+          }
+        }
+      } catch (e) {
+        log.error(`Vote staging skipped: ${e.message}`);
+      }
+    };
     if (useReportsBranch && reportsConfig) {
-      const { ensureReportsWorktree: ensureReportsWorktree2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      writeRoot = await ensureReportsWorktree2(reportsConfig);
+      let hasVotes = false;
+      if (!hasStats && await pathExists(getUserVotesDir())) {
+        const { hasPendingVoteDeltas: hasPendingVoteDeltas2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
+        hasVotes = await hasPendingVoteDeltas2(getUserVotesDir(), username);
+      }
+      if (!hasStats && !hasVotes) {
+        log.debug("No usage events or votes to report");
+        return true;
+      }
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      const pushed = await updateReports2(reportsConfig, async (wt) => {
+        filesToPush.length = 0;
+        await writeReportFiles(wt);
+        return filesToPush.length > 0 ? { files: [...filesToPush], message: commitMsg } : null;
+      }, { pushIfUnchanged: true });
+      if (!pushed) {
+        log.debug("Auto-report push was not confirmed; keeping local report data");
+        await restoreStats?.();
+        return false;
+      }
     } else {
       const git = createGit2(repoPath);
       if (!await isDedicatedRepoRoot(repoPath)) {
@@ -22564,56 +22908,11 @@ async function reportUsageToTeam(repoPath, username, options) {
           await writeFile(yamlPath, pendingTeamConfig);
         }
       }
-    }
-    if (hasUsage || hasInterventions || hasPromptTokens || hasDaily) {
-      const statsDir = path64.join(writeRoot, "stats");
-      await ensureDir(statsDir);
-      const statsPath = path64.join(statsDir, `${username}.yaml`);
-      const existing = await readExistingStats(statsPath);
-      if (useReportsBranch) {
-        const previousContent = await readFileSafe(statsPath);
-        restoreStats = () => writeFile(statsPath, previousContent ?? "");
-      }
-      const newStats = hasUsage ? aggregateUsage(events) : [];
-      const merged = mergeStats(existing, username, newStats);
-      if (hasInterventions) {
-        merged.interventions = mergeInterventionStats(existing?.interventions, interventionDelta);
-      }
-      if (hasPromptTokens) {
-        const pt = mergePromptTokenStats(existing?.prompts, existing?.tokens, promptTokenDelta);
-        merged.prompts = pt.prompts;
-        merged.tokens = pt.tokens;
-      }
-      if (hasDaily) {
-        merged.daily = mergeDailyStats(existing?.daily, dailyDelta);
-      }
-      await writeFile(statsPath, YAML21.stringify(merged));
-      filesToPush.push(`stats/${username}.yaml`);
-    }
-    try {
-      if (await pathExists(getUserVotesDir())) {
-        const { syncVotesToTeam: syncVotesToTeam2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
-        const synced = await syncVotesToTeam2(writeRoot, username, getUserVotesDir());
-        if (synced) {
-          filesToPush.push(`votes/${username}.yaml`);
-        }
-      }
-    } catch (e) {
-      log.error(`Vote staging skipped: ${e.message}`);
-    }
-    if (filesToPush.length === 0) {
-      log.debug("No usage events or votes to report");
-      return true;
-    }
-    const commitMsg = hasUsage ? `[teamai] Update usage stats for ${username}` : hasInterventions || hasPromptTokens || hasDaily ? `[teamai] Update session stats for ${username}` : `[teamai] Update votes for ${username}`;
-    if (useReportsBranch && reportsConfig) {
-      const { commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      if (!await commitAndPushReports2(reportsConfig, commitMsg, filesToPush, { pushIfUnchanged: true })) {
-        log.debug("Auto-report push was not confirmed; keeping local report data");
-        await restoreStats?.();
-        return false;
+      await writeReportFiles(repoPath);
+      if (filesToPush.length === 0) {
+        log.debug("No usage events or votes to report");
+        return true;
       }
-    } else {
       await pushRepoDirectly(repoPath, commitMsg, filesToPush);
     }
     restoreStats = void 0;
@@ -22836,6 +23135,7 @@ __export(pull_exports, {
   compileClaudemd: () => compileClaudemd,
   compileCulture: () => compileCulture,
   compileRecallRulesBlock: () => compileRecallRulesBlock,
+  filterAgentsByNamespaces: () => filterAgentsByNamespaces,
   filterRulesByKnowledgeNamespaces: () => filterRulesByKnowledgeNamespaces,
   injectRecallBlockIntoTools: () => injectRecallBlockIntoTools,
   pull: () => pull,
@@ -22913,58 +23213,9 @@ async function usageReportDisabled(repoPath) {
   return (await loadTeamConfig(repoPath))?.usageReport === false;
 }
 async function buildRolePullContext(localConfig) {
-  const activeProjects = localConfig.projects ?? [];
-  const hasRole = !!localConfig.primaryRole;
-  const hasProjects = activeProjects.length > 0;
-  const projectsManifest = await loadProjectsManifest(localConfig.repo.localPath);
-  const teamHasProjects = !!projectsManifest && projectsManifest.projects.length > 0;
-  if (!hasRole && !hasProjects && !teamHasProjects) return null;
-  let roleNamespaces = { knowledge: [], skills: [], learnings: [] };
-  let allRoleSkillNamespaces = /* @__PURE__ */ new Set();
-  if (hasRole) {
-    let rolesManifest;
-    try {
-      rolesManifest = await loadRolesManifest(localConfig.repo.localPath);
-    } catch {
-      log.warn("Could not load roles manifest. Skipping role-based filtering.");
-      rolesManifest = null;
-    }
-    if (rolesManifest) {
-      try {
-        roleNamespaces = resolveRoleResourceNamespaces({
-          manifest: rolesManifest,
-          primaryRole: localConfig.primaryRole,
-          additionalRoles: localConfig.additionalRoles ?? []
-        });
-        allRoleSkillNamespaces = new Set(rolesManifest.roles.flatMap((role) => role.resources.skills));
-      } catch {
-        log.warn(`Role "${localConfig.primaryRole}" not found in manifest. Falling back to unfiltered sync.`);
-        log.warn("Run `teamai roles set <role>` to pick a valid role.");
-        if (!hasProjects && !teamHasProjects) return null;
-      }
-    } else if (!hasProjects && !teamHasProjects) {
-      return null;
-    }
-  }
-  let projectNamespaces = { knowledge: [], skills: [], learnings: [] };
-  let allProjectSkillNamespaces = /* @__PURE__ */ new Set();
-  if (projectsManifest) {
-    allProjectSkillNamespaces = new Set(projectsManifest.projects.flatMap((p) => p.resources.skills));
-    if (hasProjects) {
-      try {
-        projectNamespaces = resolveProjectResourceNamespaces({
-          manifest: projectsManifest,
-          activeProjects
-        });
-      } catch (e) {
-        log.warn(`${e.message} Falling back to role-only filtering.`);
-      }
-    }
-  } else if (hasProjects) {
-    log.warn("Active projects configured but no projects manifest found. Skipping project-based filtering.");
-  }
-  const activeNamespaces = mergeNamespaces(roleNamespaces, projectNamespaces);
-  const allSkillNamespaces = /* @__PURE__ */ new Set([...allRoleSkillNamespaces, ...allProjectSkillNamespaces]);
+  const resolved = await resolveResourceNamespaces(localConfig);
+  if (!resolved) return null;
+  const { activeNamespaces, allSkillNamespaces } = resolved;
   const inactiveSkillNamespaces = [...allSkillNamespaces].filter((namespace) => !activeNamespaces.skills.includes(namespace));
   const activeSkillNames = /* @__PURE__ */ new Set();
   const inactiveSkillNames = /* @__PURE__ */ new Set();
@@ -22997,6 +23248,20 @@ function filterRulesByKnowledgeNamespaces(rules, knowledgeNamespaces) {
     return knowledgeNamespaces.includes(namespace);
   });
 }
+function filterAgentsByNamespaces(agents, agentNamespaces) {
+  const kept = agentNamespaces ? agents.filter((agent) => !agent.namespace || agentNamespaces.includes(agent.namespace)) : agents;
+  const seen = /* @__PURE__ */ new Map();
+  for (const agent of kept) {
+    const existing = seen.get(agent.name);
+    if (existing) {
+      throw new Error(
+        `Duplicate agent "${agent.name}" found in active namespaces "${existing.namespace ?? "(root)"}" and "${agent.namespace ?? "(root)"}"`
+      );
+    }
+    seen.set(agent.name, agent);
+  }
+  return kept;
+}
 async function scanRoleAwareSkills(localConfig, namespaces) {
   const items = /* @__PURE__ */ new Map();
   for (const namespace of namespaces.skills) {
@@ -23098,6 +23363,42 @@ async function getInstalledResourceTargets(teamConfig, localConfig) {
   }
   return targets.sort();
 }
+function tombstoneExtensions(type, tool) {
+  if (type === "rules") return [.../* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"])];
+  if (type === "agents") return AGENT_FILE_EXTENSIONS;
+  return [""];
+}
+async function cleanupTombstonedResources(freshConfig, localConfig, scopeLabel) {
+  const tombstoneTypes = [
+    { type: "rules", toolPathField: "rules" },
+    { type: "skills", toolPathField: "skills" },
+    { type: "agents", toolPathField: "agents" }
+  ];
+  const baseDir = resolveBaseDir(localConfig);
+  for (const { type, toolPathField } of tombstoneTypes) {
+    const handler = getHandler(type);
+    const tombstones = await handler.readTombstones(localConfig);
+    if (tombstones.size === 0) continue;
+    for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
+      const dir = toolPath[toolPathField];
+      if (!dir) continue;
+      if (!await ResourceHandler.isToolInstalled(dir, baseDir)) continue;
+      if (isAgentExcluded(localConfig, tool)) continue;
+      for (const name of tombstones) {
+        for (const extension of tombstoneExtensions(type, tool)) {
+          const localPath = path66.join(baseDir, dir, `${name}${extension}`);
+          if (!await pathExists(localPath)) continue;
+          if (type === "skills" && await hasVcsMetadataRecursive(localPath)) {
+            log.warn(`[${scopeLabel}] Kept tombstoned skill "${name}" (${tool}): it has local VCS metadata (.git) that may hold unpushed history. Back it up, then delete it manually.`);
+            continue;
+          }
+          await remove(localPath);
+          log.debug(`[${scopeLabel}] Cleaned up tombstoned ${type} ${name} from ${dir}`);
+        }
+      }
+    }
+  }
+}
 async function pullForScope(localConfig, options, policy = {}) {
   const scopeLabel = localConfig.scope;
   const revisionField = policy.revisionField ?? "lastPullRev";
@@ -23151,6 +23452,7 @@ async function pullForScope(localConfig, options, policy = {}) {
           } catch {
           }
           await injectRecallBlockIntoTools(freshConfig, localConfig, scopeLabel);
+          await cleanupTombstonedResources(freshConfig, localConfig, scopeLabel);
           return;
         }
         log.debug(`[${scopeLabel}] Repo unchanged; resource target set changed, syncing`);
@@ -23223,6 +23525,11 @@ async function pullForScope(localConfig, options, policy = {}) {
       desiredSkillNames = new Set(items.map((i) => i.name));
       knownRepoSkillNames = new Set(allTeamSkills.map((i) => i.name));
       knownRepoSkillSources = new Map(allTeamSkills.map((i) => [i.name, i.sourcePath]));
+    } else if (type === "agents") {
+      items = filterAgentsByNamespaces(
+        await handler.scanTeamForPull(freshConfig, localConfig),
+        roleContext ? roleContext.activeNamespaces.agents : null
+      );
     } else {
       items = await handler.scanTeamForPull(freshConfig, localConfig);
     }
@@ -23281,37 +23588,7 @@ async function pullForScope(localConfig, options, policy = {}) {
     totalSynced += items.length;
   }
   if (!options.dryRun) {
-    const tombstoneTypes = [
-      { type: "rules", ext: ".md", toolPathField: "rules" },
-      { type: "skills", toolPathField: "skills" },
-      { type: "agents", ext: ".md", toolPathField: "agents" }
-    ];
-    const baseDir = resolveBaseDir(localConfig);
-    for (const { type, ext, toolPathField } of tombstoneTypes) {
-      const handler = getHandler(type);
-      const tombstones = await handler.readTombstones(localConfig);
-      if (tombstones.size === 0) continue;
-      for (const [tool, toolPath] of Object.entries(scopedToolPaths(freshConfig, localConfig))) {
-        const dir = toolPath[toolPathField];
-        if (!dir) continue;
-        if (!await ResourceHandler.isToolInstalled(dir, baseDir)) continue;
-        if (isAgentExcluded(localConfig, tool)) continue;
-        const extensions = type === "rules" ? [.../* @__PURE__ */ new Set([ruleFileExtensionForTool(tool), ".md"])] : [ext];
-        for (const name of tombstones) {
-          for (const extension of extensions) {
-            const localPath = path66.join(baseDir, dir, extension ? `${name}${extension}` : name);
-            if (await pathExists(localPath)) {
-              if (type === "skills" && await hasVcsMetadataRecursive(localPath)) {
-                log.warn(`[${scopeLabel}] Kept tombstoned skill "${name}" (${tool}): it has local VCS metadata (.git) that may hold unpushed history. Back it up, then delete it manually.`);
-                continue;
-              }
-              await remove(localPath);
-              log.debug(`[${scopeLabel}] Cleaned up tombstoned ${type} ${name} from ${dir}`);
-            }
-          }
-        }
-      }
-    }
+    await cleanupTombstonedResources(freshConfig, localConfig, scopeLabel);
     if (roleContext) {
       await cleanupInactiveNamespaceSkills(
         freshConfig,
@@ -23320,6 +23597,11 @@ async function pullForScope(localConfig, options, policy = {}) {
         roleContext.inactiveSkillNames,
         roleContext.inactiveSkillSources
       );
+      await getHandler("agents").cleanupInactiveNamespaces(
+        freshConfig,
+        localConfig,
+        roleContext.activeNamespaces.agents
+      );
     }
   }
   if (!options.dryRun && desiredSkillNames && knownRepoSkillNames) {
@@ -24034,11 +24316,11 @@ var init_pull = __esm({
     init_resources();
     init_base();
     init_rule_format();
+    init_agent_format();
     init_tags();
     init_builtin_skills();
     init_types();
-    init_roles();
-    init_projects();
+    init_resource_namespaces();
     init_home();
     init_update();
     init_learnings_mirror();
@@ -24898,17 +25180,24 @@ async function doctor(options) {
   log.info("Running diagnostics...\n");
   const projectConfig = await detectProjectConfig();
   const localConfig = projectConfig ?? await loadLocalConfig();
-  const scope = localConfig?.scope ?? "user";
-  const configPathLabel = projectConfig ? `${projectConfig.projectRoot}/.teamai/config.yaml` : "~/.teamai/config.yaml";
-  console.log(`  Scope: ${scope}${scope === "project" && localConfig?.projectRoot ? ` (${localConfig.projectRoot})` : ""}
-`);
-  let teamConfig = null;
-  if (localConfig) {
-    teamConfig = await loadTeamConfig(localConfig.repo.localPath);
+  if (!localConfig) {
+    console.log("  Scope: not initialized\n");
+    console.log("  \u2716 TeamAI is not initialized");
+    console.log("    \u2192 Run `teamai init <repo-url>` in a project, or add `--scope user` for all projects");
+    console.log("");
+    log.warn("Initialization is required before diagnostics can run.");
+    return false;
   }
-  const toolPaths = teamConfig?.toolPaths ?? TeamaiConfigSchema.shape.toolPaths.parse(void 0);
-  const providerName = teamConfig?.provider ?? "tgit";
-  const baseDir = localConfig ? resolveHookScope(localConfig).baseDir : getUserHome();
+  const scope = localConfig.scope ?? "user";
+  const scopeLabel = `${scope}${scope === "project" && localConfig.projectRoot ? ` (${localConfig.projectRoot})` : ""}`;
+  console.log(`  Scope: ${scopeLabel}
+`);
+  const teamConfig = await loadTeamConfig(localConfig.repo.localPath);
+  const toolPaths = teamConfig ? Object.fromEntries(
+    Object.entries(scopedToolPaths(teamConfig, localConfig)).filter(([tool]) => !isAgentExcluded(localConfig, tool))
+  ) : {};
+  const providerName = teamConfig?.provider;
+  const baseDir = resolveHookScope(localConfig).baseDir;
   const checks = [];
   if (providerName === "tgit") {
     const { isGfInstalled: isGfInstalled2, gfIsAuthenticated: gfIsAuthenticated2 } = await Promise.resolve().then(() => (init_tgit(), tgit_exports));
@@ -24954,23 +25243,14 @@ async function doctor(options) {
     });
   }
   checks.push(
-    {
-      name: `Local config exists (${configPathLabel})`,
-      check: async () => localConfig !== null,
-      fix: "Run `teamai init` to initialize"
-    },
     {
       name: "Team repo exists locally",
-      check: async () => {
-        if (!localConfig) return false;
-        return pathExists(localConfig.repo.localPath);
-      },
+      check: async () => pathExists(localConfig.repo.localPath),
       fix: "Run `teamai init` to clone the team repo"
     },
     {
       name: "Team config (teamai.yaml) is valid",
       check: async () => {
-        if (!localConfig) return false;
         const config = await loadTeamConfig(localConfig.repo.localPath);
         return config !== null;
       },
@@ -24981,7 +25261,6 @@ async function doctor(options) {
       name: "Env variables injected in shell profile",
       check: async () => {
         if (teamConfig?.sharing?.env?.injectShellProfile === false) return true;
-        if (!localConfig) return true;
         const envYamlPath = path70.join(localConfig.repo.localPath, "env", "env.yaml");
         if (!await pathExists(envYamlPath)) return true;
         const home = getUserHome();
@@ -25010,13 +25289,11 @@ async function doctor(options) {
       allPassed = false;
     }
   }
-  if (localConfig) {
-    const { pkgDoctorReport: pkgDoctorReport2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
-    const packageReport = await pkgDoctorReport2(localConfig, process.cwd());
-    if (packageReport) {
-      for (const line of packageReport.lines) console.log(line);
-      if (!packageReport.allPassed) allPassed = false;
-    }
+  const { pkgDoctorReport: pkgDoctorReport2 } = await Promise.resolve().then(() => (init_commands(), commands_exports));
+  const packageReport = await pkgDoctorReport2(localConfig, process.cwd());
+  if (packageReport) {
+    for (const line of packageReport.lines) console.log(line);
+    if (!packageReport.allPassed) allPassed = false;
   }
   if (await hasInstalledCodexHooks(toolPaths, baseDir)) {
     console.log("");
@@ -25028,6 +25305,7 @@ async function doctor(options) {
   } else {
     log.warn("Some checks failed. See suggestions above.");
   }
+  return allPassed;
 }
 var init_doctor = __esm({
   "src/doctor.ts"() {
@@ -25152,7 +25430,8 @@ async function rolesInit(options) {
       description,
       resources: {
         knowledge: namespaces,
-        skills: namespaces
+        skills: namespaces,
+        agents: namespaces
       }
     });
     log.success(`Added role: ${id} (namespaces: ${namespaces.join(", ")})`);
@@ -25296,7 +25575,8 @@ async function rolesAdd(roleId, options) {
       description: options.description ?? "",
       resources: {
         knowledge: namespaces,
-        skills: namespaces
+        skills: namespaces,
+        agents: namespaces
       }
     };
     const updatedManifest = {
@@ -25410,7 +25690,8 @@ async function rolesUpdate(roleId, options) {
       description: hasDesc ? options.description : existingRole.description,
       resources: {
         knowledge: updatedNamespaces,
-        skills: updatedNamespaces
+        skills: updatedNamespaces,
+        agents: updatedNamespaces
       }
     };
     const updatedManifest = {
@@ -25833,10 +26114,13 @@ async function collectTeamRuleNames(repoPath) {
 async function collectTeamAgentNames(repoPath) {
   const teamAgentsDir = path74.join(repoPath, "agents");
   if (!await pathExists(teamAgentsDir)) return /* @__PURE__ */ new Set();
-  const files = await listFiles(teamAgentsDir);
-  return new Set(
-    files.filter((file) => file.endsWith(".yaml") || file.endsWith(".md")).map((file) => path74.basename(file).replace(/\.(yaml|md)$/, ""))
-  );
+  const names = /* @__PURE__ */ new Set();
+  for (const { dir } of await listTeamAgentDirs(teamAgentsDir)) {
+    for (const file of await listFiles(dir)) {
+      if (file.endsWith(".yaml") || file.endsWith(".md")) names.add(file.replace(/\.(yaml|md)$/, ""));
+    }
+  }
+  return names;
 }
 function isEmptyHooksResidue(parsed) {
   if (parsed == null || !("hooks" in parsed) || typeof parsed.hooks !== "object" || parsed.hooks == null) return false;
@@ -25936,8 +26220,8 @@ async function discoverToolResources(tool, toolPath, baseDir, teamSkillNames, te
     const agentsDir = path74.join(baseDir, toolPath.agents);
     if (await pathExists(agentsDir)) {
       for (const file of await listFiles(agentsDir)) {
-        if (!file.endsWith(".md") && !file.endsWith(".toml") && !file.endsWith(".json")) continue;
-        const name = path74.basename(file).replace(/\.(md|toml|json)$/, "");
+        const name = agentStemFromFilename(path74.basename(file));
+        if (name === null) continue;
         if (!teamAgentNames.has(name) && !BUILTIN_AGENT_NAMES.has(name)) continue;
         res.agentFiles.push(path74.join(agentsDir, file));
       }
@@ -26415,6 +26699,8 @@ var init_uninstall = __esm({
     init_types();
     init_builtin_rules();
     init_rule_format();
+    init_agent_format();
+    init_agents();
     init_builtin_agents();
     init_builtin_skills();
     init_fs();
@@ -26967,20 +27253,25 @@ async function saveSession(options) {
   if (usesReportsBranch(localConfig)) {
     const spin2 = spinner("Pushing session summary to team...").start();
     try {
-      const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-      const wt = await ensureReportsWorktree2(localConfig);
-      const teamDir2 = path79.join(wt, "sessions", username);
-      const written = await appendMonthlyLog(teamDir2, summary, { includePrompt: options.includePrompt });
-      if (!written) {
-        spin2.info("Session already present in the team log \u2014 nothing to push.");
-        return;
-      }
-      const rel = path79.relative(wt, written);
+      const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+      let rel;
+      let ran = false;
       const pushed = await withTimeout(
-        commitAndPushReports2(localConfig, commitMsg, [rel]),
+        updateReports2(localConfig, async (wt) => {
+          ran = true;
+          const teamDir2 = path79.join(wt, "sessions", username);
+          const written = await appendMonthlyLog(teamDir2, summary, { includePrompt: options.includePrompt });
+          if (!written) return null;
+          rel = path79.relative(wt, written);
+          return { files: [rel], message: commitMsg };
+        }),
         1e4,
         "Push timeout (10s)"
       );
+      if (ran && !rel) {
+        spin2.info("Session already present in the team log \u2014 nothing to push.");
+        return;
+      }
       if (pushed) spin2.succeed(`Pushed: ${rel}`);
       else spin2.info("Nothing new to push.");
     } catch (e) {
@@ -31104,11 +31395,13 @@ var init_hook_handlers = __esm({
           const { usesReportsBranch: usesReportsBranch2 } = await Promise.resolve().then(() => (init_types(), types_exports));
           if (usesReportsBranch2(localConfig)) {
             try {
-              const { ensureReportsWorktree: ensureReportsWorktree2, commitAndPushReports: commitAndPushReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
-              const wt = await ensureReportsWorktree2(localConfig);
-              const synced = await syncVotesToTeam2(wt, localConfig.username, votesDir);
-              if (synced) {
-                await commitAndPushReports2(localConfig, `[teamai] Update votes for ${localConfig.username}`, [`votes/${localConfig.username}.yaml`]);
+              const { hasPendingVoteDeltas: hasPendingVoteDeltas2 } = await Promise.resolve().then(() => (init_votes(), votes_exports));
+              if (await hasPendingVoteDeltas2(votesDir, localConfig.username)) {
+                const { updateReports: updateReports2 } = await Promise.resolve().then(() => (init_reports_branch(), reports_branch_exports));
+                await updateReports2(localConfig, async (wt) => await syncVotesToTeam2(wt, localConfig.username, votesDir) ? {
+                  files: [`votes/${localConfig.username}.yaml`],
+                  message: `[teamai] Update votes for ${localConfig.username}`
+                } : null);
               }
             } catch {
             }
@@ -34828,7 +35121,7 @@ var init_codebase = __esm({
 
 // src/wiki-engine/code-knowledge/code-collector.ts
 import { createHash as createHash5 } from "crypto";
-import { execFile as execFile4 } from "child_process";
+import { execFile as execFile3 } from "child_process";
 import { readFile as readFile6, readdir as readdir2, stat as stat2 } from "fs/promises";
 import path105 from "path";
 import { promisify as promisify3 } from "util";
@@ -34984,7 +35277,7 @@ var init_code_collector = __esm({
   "src/wiki-engine/code-knowledge/code-collector.ts"() {
     "use strict";
     init_wiki_protocol();
-    execFileAsync3 = promisify3(execFile4);
+    execFileAsync3 = promisify3(execFile3);
     KEY_FILE_PATTERNS = {
       go: [/main\.go$/, /cmd\/.*\.go$/, /handler.*\.go$/, /server\.go$/, /router\.go$/],
       python: [/main\.py$/, /app\.py$/, /server\.py$/, /routes?\.py$/, /models?\.py$/],
@@ -42953,7 +43246,7 @@ program.name("teamai").description("TeamAI \u2014 Make Every Team AI Native").ve
     process.exit(1);
   }
 });
-program.command("init").description("Initialize teamai (configure Git provider, clone repo, register member)").argument("[repo]", 'Team repo (owner/repo or full URL). Pass "." for single-repo mode (the current git repo is the team repo).').option("--repo <repo>", "Team repo (alias of the positional argument)").option("--http <url>", "Git-free HTTP team repo (read-only consumer; only needs an API key)").option("--self", "Single-repo mode: the current git repo is the team repo (equivalent to `teamai init .`). Knowledge lives on main under .teamai/; reports go to the teamai-reports orphan branch.").option("--token <key>", "API key for HTTP team repo / status reporting (stored 0600, never committed). Also reads TEAMAI_API_TOKEN.").option("--scope <scope>", "Install scope: project (default, <cwd>/.teamai + <cwd>/.claude) or user (~/.teamai + ~/.claude)").option("--inherit-user-scope", "In project scope, also sync safe user-scope resources and search its knowledge").option("--no-inherit-user-scope", "Disable user-scope inheritance for this project").option("--role <id>", "Primary role ID (e.g. hai_dev) for non-interactive setup").option("--project <ids>", "Active logical project(s) from manifest/projects.yaml (comma-separated); scopes which project resources and learnings this directory syncs").option("--agent <name>", "AI tools to set up (e.g. claude, codex, cursor, codebuddy, workbuddy, dsh). Repeatable or comma-separated. In single-repo mode, selects which tool dirs to create; omit for an interactive picker. Additive on repeated runs.", (val, acc) => acc.concat(val), []).option("--force", "Overwrite existing config without confirmation").action(async (repoArg, cmdOpts) => {
+program.command("init").description("Initialize teamai (configure Git provider, clone repo, register member)").argument("[repo]", 'Team repo (owner/repo or full URL). Pass "." for single-repo mode (the current git repo is the team repo).').option("--repo <repo>", "Team repo (alias of the positional argument)").option("--http <url>", "Git-free HTTP team repo (read-only consumer; only needs an API key)").option("--self", "Single-repo mode: the current git repo is the team repo (equivalent to `teamai init .`). Knowledge lives on main under .teamai/; reports go to the teamai-reports orphan branch.").option("--token <key>", "API key for HTTP team repo / status reporting (stored 0600, never committed). Also reads TEAMAI_API_TOKEN.").option("--scope <scope>", "Install scope: project (default, <cwd>/.teamai + <cwd>/.claude) or user (~/.teamai + ~/.claude)").option("--inherit-user-scope", "In project scope, also sync safe user-scope resources and search its knowledge").option("--no-inherit-user-scope", "Disable user-scope inheritance for this project").option("--role <id>", "Primary role ID (e.g. hai_dev) for non-interactive setup").option("--project <ids>", 'Active logical project(s) from manifest/projects.yaml (comma-separated); scopes which project resources and learnings this directory syncs. Pass "all" to activate every project the manifest declares (a snapshot taken now)').option("--agent <name>", "AI tools to set up (e.g. claude, codex, cursor, codebuddy, workbuddy, dsh). Repeatable or comma-separated. In single-repo mode, selects which tool dirs to create; omit for an interactive picker. Additive on repeated runs.", (val, acc) => acc.concat(val), []).option("--force", "Overwrite existing config without confirmation").action(async (repoArg, cmdOpts) => {
   const globalOpts = program.opts();
   const { init: init2 } = await Promise.resolve().then(() => (init_init(), init_exports));
   await init2({ ...globalOpts, ...cmdOpts, repoPositional: repoArg });
@@ -43033,7 +43326,8 @@ registerPackagesCommand(program);
 program.command("doctor").description("Diagnose configuration issues").action(async () => {
   const globalOpts = program.opts();
   const { doctor: doctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
-  await doctor2(globalOpts);
+  const allPassed = await doctor2(globalOpts);
+  if (!allPassed) process.exitCode = 1;
 });
 var rolesCmd = program.command("roles").description("Manage team roles and resource namespaces").action(async () => {
   const globalOpts = program.opts();
@@ -43334,7 +43628,7 @@ program.command("todowrite-hint", { hidden: true }).description("Remind the agen
     await todoWriteHint2();
   }
 });
-program.command("import").description("Import knowledge from local directories, remote repos, organizations, MRs, or iWiki").option("--dir <path>", "Extract code knowledge from a local directory (same as --from-repo but no clone)").addOption(new Option("--from-claude", "Scan Claude/Cursor rule directories (~/.claude/rules, ~/.cursor/rules)").hideHelp()).option("--from-mr <url>", "Extract learning from merged MR/PR and trigger incremental teamwiki update").option("--from-iwiki <space-id-or-url>", "Import documents from iWiki Space ID or page URL (requires TAI_PAT_TOKEN)").addOption(new Option("--resume", "Resume an interrupted import session").hideHelp()).option("--all", "Accept all suggestions without interactive confirmation").addOption(new Option("--output <path>", "Write drafts to this directory instead of pushing to team repo").hideHelp()).option("--from-repo <url>", "Clone a remote repo and generate per-repo codebase summary").addOption(new Option("--ssh", "Force SSH clone even if HTTPS token is available").hideHelp()).addOption(new Option("--domain <name>", "Skip AI recommendation and assign repo to this domain explicitly").hideHelp()).option("--from-repo-list <path>", "Batch import repos from a YAML whitelist").addOption(new Option("--concurrency <n>", "Concurrent repos for --from-repo-list (default 3)").default("3").hideHelp()).option("--incremental", "Use cached clone with fetch+reset (with --from-repo or --from-repo-list)").option("--skip-enrich", "Skip AI enrichment (only clone + extract + graph, no LLM calls)").option("--from-org <org>", "List repos under an org and generate a repo whitelist").addOption(new Option("--max-repos <n>", "Cap on repos pulled from --from-org (default 200)").default("200").hideHelp()).addOption(new Option("--exclude-archived", "Exclude archived repos from --from-org (default true)").hideHelp()).addOption(new Option("--include-pattern <re>", "Regex to include repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--exclude-pattern <re>", "Regex to exclude repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--skip-import", "Only write drafts; skip the actual --from-repo-list run").hideHelp()).addOption(new Option("--iwiki-dual", "Enable dual-output mode for --from-iwiki (write codebase sections in addition to learning)").hideHelp()).addOption(new Option("--require-review", "Defer codebase section writes to .teamai/pending-review.jsonl for human review").hideHelp()).option("--cache-status", "Show import cache status (repos cached, disk usage)").option("--cache-gc", "Garbage-collect stale import cache entries").addOption(new Option("--max-bytes <n>", "Override capacity cap for --cache-gc").hideHelp()).addOption(new Option("--stale-days <n>", "Threshold for stale-eviction in days (default 30)").default("30").hideHelp()).action(async (cmdOpts) => {
+program.command("import").description("Import knowledge from local directories, remote repos, organizations, MRs, or iWiki").option("--dir <path>", "Extract code knowledge from a local directory (same as --from-repo but no clone)").addOption(new Option("--from-claude", "Scan Claude/Cursor rule directories (~/.claude/rules, ~/.cursor/rules)").hideHelp()).option("--from-mr <url>", "Extract learning from merged MR/PR and trigger incremental teamwiki update").option("--from-iwiki <space-id-or-url>", "Import documents from iWiki Space ID or page URL (requires TAI_PAT_TOKEN)").addOption(new Option("--resume", "Resume an interrupted import session").hideHelp()).option("--all", "Accept all suggestions without interactive confirmation").addOption(new Option("--output <path>", "Write drafts to this directory instead of pushing to team repo").hideHelp()).option("--from-repo <url>", "Clone a remote repo and generate per-repo codebase summary").addOption(new Option("--ssh", "Force SSH clone even if HTTPS token is available").hideHelp()).addOption(new Option("--domain <name>", "Skip AI recommendation and assign repo to this domain explicitly").hideHelp()).option("--from-repo-list <path>", "Batch import repos from a YAML whitelist").addOption(new Option("--concurrency <n>", "Concurrent repos for --from-repo-list (default 3)").default("3").hideHelp()).option("--incremental", "Use cached clone with fetch+reset (with --from-repo or --from-repo-list)").option("--skip-enrich", "Skip AI enrichment (only clone + extract + graph, no LLM calls)").option("--from-org <org>", "List repos under an org and generate a repo whitelist").addOption(new Option("--max-repos <n>", "Cap on repos pulled from --from-org (default 200)").default("200").hideHelp()).addOption(new Option("--exclude-archived", "Exclude archived repos from --from-org (default true)").hideHelp()).addOption(new Option("--include-pattern <re>", "Regex to include repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--exclude-pattern <re>", "Regex to exclude repos by full name (used with --from-org)").hideHelp()).addOption(new Option("--skip-import", "Only write drafts; skip the actual --from-repo-list run").hideHelp()).addOption(new Option("--iwiki-dual", "Enable dual-output mode for --from-iwiki (write codebase sections in addition to learning)").hideHelp()).addOption(new Option("--require-review", "Defer codebase section writes to .teamai/pending-review.jsonl for human review").hideHelp()).option("--cache-status", "Show import cache status (repos cached, disk usage)").option("--cache-gc", "Garbage-collect stale import cache entries").option("--json", "Output cache status or GC result as JSON").addOption(new Option("--max-bytes <n>", "Override capacity cap for --cache-gc").hideHelp()).addOption(new Option("--stale-days <n>", "Threshold for stale-eviction in days (default 30)").default("30").hideHelp()).action(async (cmdOpts) => {
   const globalOpts = program.opts();
   if (cmdOpts.cacheStatus || cmdOpts.cacheGc) {
     const { cacheCmd: cacheCmd2 } = await Promise.resolve().then(() => (init_cache_cmd(), cache_cmd_exports));