2532b1a · bf2c109 · 5b4ce3a · 7828c45
@@ -582,6 +582,14 @@
agent's push to the default branch whether or not it is protected, and
`mergePull` refuses an agent actor. Everything the agent can do, it does
through a pull a person merges.
Which seat each agent holds on a repository is read in one place,
`crewSeats` (`core/agents.ts`), which `listCrewRoles`, `crewWithRole` and so
the reviewer routing all read. On an org's repository the crew comes from
its write and admin teams: a `team_member.role` of planner, builder or
reviewer seats that agent, and `member` (the default, and every membership
from before roles) is access only. When no team seats an agent, the
repository's own `repo_crew` roster is the crew, as it always was (#571).
Work reaches an agent off the outbox with a sweep behind it, like every
other consumer: an assignment starts a run; a person's comment, verdict, or
line comment on the agent's pull starts a follow-up that resumes the same
@@ -0,0 +1,25 @@
# Give a team member a role
A team membership carries a role: `planner`, `builder`, `reviewer` or
`member` (the default). On an organization's write or admin team, an agent's
role is its seat on the crew of every repository the organization owns: a
`reviewer` there reviews the org's pulls, a `builder` takes what is ready. A
`member` holds no seat; the team gives them its access and nothing more.
When no team gives any agent a role, a repository's own crew roster is its
crew, as before.
- **Page:** the organization page lists each team's members with their roles.
  An org admin opens a team's Manage page, picks a Role beside the username
  and presses Add member; adding someone already on the team sets their role.
- **API:** `POST /api/v1/orgs/:org/teams/:team/members` with
  `{ "user": "mason", "role": "reviewer" }` (admin-scope token). A bad role is
  `422 bad_role`. `DELETE …/members/:username?role=reviewer` takes just that
  role off and leaves them a `member`; without `role` it removes them.
  `GET …/members` lists each member's `role`.
- **MCP:** `org_teams { org, action: "add_member", team, user, role }`, and
  `action: "members"` to list members with their roles.
- **Terminal:** the "Organization teams" command, Enter on a team, then `r` on
  a member to pick a role (org admins only).
Every change of role is told on the outbox as `team.member_role_set`, with
who made it, the member, and the role before and after.
@@ -15,12 +15,15 @@
import {
  isLastOwner,
  OWNERS_TEAM,
  removeTeamMember as dropMember,
  setTeamRole,
  teamRoleOf,
  type CreateOrgError,
  type CreateTeamError,
  type Permission,
  type Team,
} from "../core/orgs.ts";
import { getUserByName, type User } from "../core/users.ts";
import type { TeamRole } from "../core/agents.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { requireOrgAdmin, requireUser } from "./access.ts";
@@ -117,8 +120,9 @@
export function addTeamMember(
  org: User,
  team: Team,
  username: string,
  role?: TeamRole,
      
        sentinelcrew
        2d ago
        
      
      Both doors: this action has no terminal screen or MCP org_teams caller passing a role. Add both, with tests that a write in the terminal shows live on the web.
    
): Result<
  { added: boolean },
  { added: boolean; role: TeamRole },
  "not_found" | "no_such_user" | "agent_cannot_own"
> {
  const admin = requireOrgAdmin(app, actor, org);
@@ -130,14 +134,41 @@
export function addTeamMember(
  // any team that confers admin.
  if (user.kind === "agent" && team.permission === "admin")
    return err("agent_cannot_own");
  const added = insertMember(app.db, team, user.id);
  const added = insertMember(app.db, team, user.id, role);
  if (added)
    app.bus.append({
      kind: "team.member_added",
      actorId: admin.value.id,
      payload: { org: org.username, teamId: team.id, user: user.username },
    });
  return ok({ added });
  // Adding someone already on the team with a role sets it (#571).
  else if (role !== undefined) changeRole(app, admin.value, org, team, user, role);
      
        sentinelcrew
        2d ago
        outdated
      
      A role change on an existing member is a silent privilege change (it re-seats the crew on every org repo). Append a bus event for it and test it.
    
  return ok({ added, role: teamRoleOf(app.db, team.id, user.id) ?? "member" });
}
/**
 * Set a member's role and say so on the outbox (#571): a role re-seats the
 * crew on every repository the org owns, so it never changes silently.
 * False when they already hold it or are not on the team.
 */
function changeRole(
  app: App,
  admin: User,
  org: User,
  team: Team,
  user: User,
  role: TeamRole,
): boolean {
  const from = teamRoleOf(app.db, team.id, user.id);
  if (from === undefined) return false;
  const changed = setTeamRole(app.db, team.id, user.id, role);
  if (!changed) return false;
  app.bus.append({
    kind: "team.member_role_set",
    actorId: admin.id,
    payload: { org: org.username, teamId: team.id, user: user.username, from, role },
  });
  return true;
      
        sentinelcrew
        2d ago
        outdated
      
      A side effect (setTeamRole) hidden inside a && chain on a 140-char line. Write it as statements.
    
}
/**
@@ -151,12 +182,21 @@
export function removeTeamMember(
  org: User,
  team: Team,
  username: string,
  role?: TeamRole,
): Result<{ removed: boolean }, "not_found" | "no_such_user" | "last_owner"> {
  const admin = requireOrgAdmin(app, actor, org);
  if (!admin.ok) return admin;
  if (team.orgId !== org.id) return err("not_found");
  const user = getUserByName(app.db, username);
  if (!user) return err("no_such_user");
  // With a role, only that role comes off: the member stays on the team as
  // a plain `member` (#571). Nothing changes when they hold another.
  if (role !== undefined) {
    if (role === "member") return ok({ removed: false });
    if (teamRoleOf(app.db, team.id, user.id) !== role) return ok({ removed: false });
    const cleared = changeRole(app, admin.value, org, team, user, "member");
    return ok({ removed: cleared });
  }
  if (team.name === OWNERS_TEAM && isLastOwner(app.db, org.id, user))
    return err("last_owner");
  const removed = dropMember(app.db, team, user.id);
@@ -372,63 +372,126 @@
export function setCrewRole(
  );
}
/** The crew with each member's role, by name. */
/** The crew with each member's role, by name: `crewSeats` for one repository. */
export function listCrewRoles(
  db: Database,
  repoId: string,
): { agent: Agent; role: CrewRole }[] {
  const roles = new Map(
    db
      .query<{ user_id: string; role: string }, [string]>(
        "SELECT user_id, role FROM repo_crew WHERE repo_id = ?1",
      )
      .all(repoId)
      .map((r) => [r.user_id, r.role] as const),
  );
  return listCrew(db, repoId).map((agent) => ({
    agent,
    role: seatOf(roles.get(agent.user.id) ?? "", agent.roles),
  }));
  return (crewSeats(db, [repoId]).get(repoId) ?? []).map(({ agent, role }) => ({ agent, role }));
}
/** One seat on a repository's crew. */
export interface CrewSeat {
  readonly agent: Agent;
  readonly role: CrewRole;
  /**
   * Whether the seat is held as written: a team role, or a roster row
   * whose role the agent still declares.
   */
  readonly held: boolean;
}
/** A role on an org team (#571): a crew seat, or `member`, the team's access and no seat. */
export type TeamRole = CrewRole | "member";
export const TEAM_ROLES: readonly TeamRole[] = [...CREW_ROLES, "member"];
export const isTeamRole = (value: unknown): value is TeamRole =>
  (TEAM_ROLES as readonly unknown[]).includes(value);
/**
 * The crew of each repository, by repo, by name — the one function the
 * routing reads for planner, builder and reviewer (#571). An org-owned
 * repository's crew is the agents the org's write and admin teams give a
 * role, each in that seat (a role the agent does not declare sits in its
 * first declared one; on many teams an agent takes its first by team
 * name). A `member` holds no seat: it is the team's access, nothing more,
 * so a membership from before roles changes no crew. When no such team
 * seats an agent, the repository's own roster (`repo_crew`) is its crew,
 * unchanged.
 */
export function crewSeats(
  db: Database,
  repoIds: readonly string[],
): Map<string, CrewSeat[]> {
  const unique = [...new Set(repoIds)];
  type SeatRow = AgentRow & { repo_id: string; seat: string; source: "team" | "roster" };
  const rows: SeatRow[] = [];
  const CHUNK = 400;
  // One read per chunk: the team seats and the roster together, told apart by `source`.
  for (let i = 0; i < unique.length; i += CHUNK) {
    const batch = unique.slice(i, i + CHUNK);
    const marks = batch.map((_, n) => `?${n + 1}`).join(",");
    rows.push(
      ...db
        .query<SeatRow, string[]>(
          `SELECT * FROM (
             SELECT 'team' AS source, repo.id AS repo_id, team_member.role AS seat,
                    team.name AS via, user.username AS uname, agent.*
             FROM repo
             JOIN team ON team.org_id = repo.owner_id AND team.permission IN ('write','admin')
             JOIN team_member ON team_member.team_id = team.id AND team_member.role <> 'member'
             JOIN agent ON agent.user_id = team_member.user_id
             JOIN user ON user.id = agent.user_id
             WHERE repo.id IN (${marks})
             UNION ALL
             SELECT 'roster' AS source, repo_crew.repo_id, repo_crew.role AS seat,
                    '' AS via, user.username AS uname, agent.*
             FROM repo_crew
             JOIN agent ON agent.user_id = repo_crew.user_id
             JOIN user ON user.id = agent.user_id
             WHERE repo_crew.repo_id IN (${marks})
           ) ORDER BY uname COLLATE NOCASE, via COLLATE NOCASE`,
        )
        .all(...batch),
    );
  }
  const teamed = new Set(rows.filter((r) => r.source === "team").map((r) => r.repo_id));
  const teamRows = rows.filter((r) => r.source === "team");
  const rosterRows = rows.filter((r) => r.source === "roster" && !teamed.has(r.repo_id));
  const users = getUsersByIds(db, [...teamRows, ...rosterRows].map((r) => r.user_id));
  const out = new Map<string, CrewSeat[]>();
  const put = (repoId: string, seat: CrewSeat) => {
    const list = out.get(repoId);
    if (list) list.push(seat);
    else out.set(repoId, [seat]);
  };
  // Team rows: one seat per agent per repository, the first by team name.
  const chosen = new Map<string, AgentRow & { repo_id: string; seat: string }>();
  for (const row of teamRows) {
    const key = `${row.repo_id}\u0000${row.user_id}`;
    if (!chosen.has(key)) chosen.set(key, row);
  }
  for (const row of chosen.values()) {
    const user = users.get(row.user_id);
    if (!user) continue;
    const agent = agentOf(user, row);
    put(row.repo_id, { agent, role: seatOf(row.seat, agent.roles), held: true });
  }
  for (const row of rosterRows) {
    const user = users.get(row.user_id);
    if (!user) continue;
    const agent = agentOf(user, row);
    put(row.repo_id, {
      agent,
      role: seatOf(row.seat, agent.roles),
      held: isCrewRole(row.seat) && agent.roles.includes(row.seat),
    });
  }
  return out;
}
/**
 * The crew members holding `role` on each of these repositories, by repo,
 * in `listCrew`'s order — the agents and their accounts one query per chunk
 * each, never one per repository or per member.
 * in name order — `crewSeats`, keeping the seats held as written.
 */
export function crewWithRole(
  db: Database,
  repoIds: readonly string[],
  role: CrewRole,
): Map<string, Agent[]> {
  const rows: (AgentRow & { repo_id: string })[] = [];
  const unique = [...new Set(repoIds)];
  const CHUNK = 400;
  for (let i = 0; i < unique.length; i += CHUNK) {
    const batch = unique.slice(i, i + CHUNK);
    rows.push(
      ...db
        .query<AgentRow & { repo_id: string }, string[]>(
          `SELECT repo_crew.repo_id, agent.* FROM repo_crew
           JOIN agent ON agent.user_id = repo_crew.user_id
           JOIN user ON user.id = agent.user_id
           WHERE repo_crew.role = ?1
             AND instr(',' || agent.roles || ',', ',' || ?1 || ',') > 0
             AND repo_crew.repo_id IN (${batch.map((_, n) => `?${n + 2}`).join(",")})
           ORDER BY user.username COLLATE NOCASE`,
        )
        .all(role, ...batch),
    );
  }
  const users = getUsersByIds(db, rows.map((r) => r.user_id));
  const out = new Map<string, Agent[]>();
  for (const row of rows) {
    const user = users.get(row.user_id);
    if (!user) continue;
    const agent = agentOf(user, row);
    const list = out.get(row.repo_id);
    if (list) list.push(agent);
    else out.set(row.repo_id, [agent]);
  for (const [repoId, seats] of crewSeats(db, repoIds)) {
    const agents = seats.filter((s) => s.held && s.role === role).map((s) => s.agent);
    if (agents.length > 0) out.set(repoId, agents);
  }
  return out;
}
@@ -443,18 +506,5 @@
export function reposWithBuilder(
  db: Database,
  repoIds: readonly string[],
): Set<string> {
  const out = new Set<string>();
  const unique = [...new Set(repoIds)];
  const CHUNK = 400;
  for (let i = 0; i < unique.length; i += CHUNK) {
    const batch = unique.slice(i, i + CHUNK);
    const rows = db
      .query<{ repo_id: string }, string[]>(
        `SELECT DISTINCT repo_id FROM repo_crew JOIN agent ON agent.user_id = repo_crew.user_id
         WHERE role = 'builder' AND instr(',' || agent.roles || ',', ',builder,') > 0 AND repo_id IN (${batch.map((_, n) => `?${n + 1}`).join(",")})`,
      )
      .all(...batch);
    for (const row of rows) out.add(row.repo_id);
  }
  return out;
  return new Set(crewWithRole(db, repoIds, "builder").keys());
}
@@ -104,6 +104,7 @@
const READER_KINDS: ReadonlySet<string> = new Set([
  "team.deleted",
  "team.member_added",
  "team.member_removed",
  "team.member_role_set",
  "forge.spawn.started",
  "forge.spawned",
  "forge.removed",
@@ -0,0 +1,1 @@
3817bca0554972817db65e07867ee49030e1cd103c3fe66c03a8f3c75c074a7b
@@ -0,0 +1,9 @@
// A team membership carries a role (#571): the crew of an org's repository is
// the agents on its write and admin teams, each in the seat named here
// (`crewSeats`, core/agents.ts). `member` holds no seat, so every row here
// before keeps the crew it had. Additive:
// one column with a default, applied once like every migration.
export default `
  ALTER TABLE team_member ADD COLUMN role TEXT NOT NULL DEFAULT 'member'
    CHECK (role IN ('planner','builder','reviewer','member'));
  `;
@@ -12,7 +12,8 @@
import { id } from "../kernel/id.ts";
import { err, ok, type Result } from "../kernel/result.ts";
import { forgetListings } from "./listings.ts";
import { reservedName } from "./reserved.ts";
import { getUserById, getUserByName, type User } from "./users.ts";
import { isTeamRole, type TeamRole } from "./agents.ts";
import { getUserById, getUserByName, getUsersByIds, type User } from "./users.ts";
export type Permission = "read" | "write" | "admin";
export type Access = "none" | Permission;
@@ -165,6 +166,7 @@
export function addTeamMember(
  db: Database,
  team: Team,
  userId: string,
  role: TeamRole = "member",
): boolean {
  const user = getUserById(db, userId);
  if (!user || user.kind === "org") return false; // can't nest orgs
@@ -174,9 +176,9 @@
export function addTeamMember(
  return (
    db
      .query(
        "INSERT OR IGNORE INTO team_member (team_id, user_id) VALUES (?1, ?2)",
        "INSERT OR IGNORE INTO team_member (team_id, user_id, role) VALUES (?1, ?2, ?3)",
      )
      .run(team.id, userId).changes > 0
      .run(team.id, userId, role).changes > 0
  );
}
@@ -314,6 +316,55 @@
export function listTeamsVisibleTo(
    .map(toTeam);
}
/**
 * Set the role a member holds on a team (#571); false when they are not on
 * it or already hold it.
 */
export function setTeamRole(
  db: Database,
  teamId: string,
  userId: string,
  role: TeamRole,
): boolean {
  return (
    db
      .query(
        "UPDATE team_member SET role = ?3 WHERE team_id = ?1 AND user_id = ?2 AND role <> ?3",
      )
      .run(teamId, userId, role).changes > 0
  );
}
/** The role a member holds on a team, or undefined when they are not on it. */
export function teamRoleOf(db: Database, teamId: string, userId: string): TeamRole | undefined {
  const row = db
    .query<{ role: string }, [string, string]>(
      "SELECT role FROM team_member WHERE team_id = ?1 AND user_id = ?2",
    )
    .get(teamId, userId);
  if (!row) return undefined;
  return isTeamRole(row.role) ? row.role : "member";
}
/** A team's members with the role each holds, by name. */
export function listTeamMemberRoles(
  db: Database,
  teamId: string,
): { user: User; role: TeamRole }[] {
  const rows = db
    .query<{ user_id: string; role: string }, [string]>(
      "SELECT user_id, role FROM team_member WHERE team_id = ?1",
    )
    .all(teamId);
  const users = getUsersByIds(db, rows.map((r) => r.user_id));
  return rows
    .flatMap((r) => {
      const user = users.get(r.user_id);
      return user ? [{ user, role: isTeamRole(r.role) ? r.role : ("member" as const) }] : [];
    })
    .sort((a, b) => a.user.username.toLowerCase().localeCompare(b.user.username.toLowerCase()));
}
export function listTeamMembers(db: Database, teamId: string): User[] {
  const ids = db
    .query<
@@ -13,6 +13,7 @@
import {
} from "../../actions/orgs.ts";
import {
  getOrg,
  listTeamMemberRoles,
  listTeamMembers,
  listTeams,
  listTeamsVisibleTo,
@@ -21,6 +22,7 @@
import {
} from "../../core/orgs.ts";
import { notePhase, takeSessionTime, timePhase } from "../../core/route_timing.ts";
import type { User } from "../../core/users.ts";
import { isTeamRole, TEAM_ROLES, type TeamRole } from "../../core/agents.ts";
import { keyedPage, keyedWindow } from "../api.ts";
import type { Ctx, Handler } from "../context.ts";
import {
@@ -146,7 +148,10 @@
export function orgRoutes(router: Router<Handler>): void {
    const window = keyedWindow(ctx);
    if (window instanceof Response) return window;
    const members = timePhase(ctx.request, "members", () =>
      listTeamMembers(ctx.app.db, found.team.id).map(publicProfile),
      listTeamMemberRoles(ctx.app.db, found.team.id).map(({ user, role }) => ({
        ...publicProfile(user),
        role,
      })),
    );
    return timePhase(ctx.request, "render", () =>
      tagged(ctx.request, keyedPage(members, (u) => u.username, window)),
@@ -159,12 +164,15 @@
export function orgRoutes(router: Router<Handler>): void {
    const found = loadTeam(ctx);
    if ("error" in found) return found.error;
    const input = await body(ctx.request);
    const role = roleOf(input.role);
    if (role instanceof Response) return role;
    const added = addTeamMember(
      ctx.app,
      ctx.auth.user,
      found.org,
      found.team,
      str(input.user),
      role,
    );
    if (!added.ok) return respondAccess(added.error, 422);
    return json(added.value, added.value.added ? 201 : 200);
@@ -178,6 +186,8 @@
export function orgRoutes(router: Router<Handler>): void {
      if (denied) return denied;
      const found = loadTeam(ctx);
      if ("error" in found) return found.error;
      const role = roleOf(new URL(ctx.request.url).searchParams.get("role") ?? undefined);
      if (role instanceof Response) return role;
      const username = ctx.params.username!;
      const isMember = listTeamMembers(ctx.app.db, found.team.id).some(
        (m) => m.username.toLowerCase() === username.toLowerCase(),
@@ -188,6 +198,7 @@
export function orgRoutes(router: Router<Handler>): void {
        found.org,
        found.team,
        username,
        role,
      );
      if (!removed.ok)
        return removed.error === "last_owner"
@@ -198,6 +209,18 @@
export function orgRoutes(router: Router<Handler>): void {
            )
          : respondAccess(removed.error, 422);
      if (!isMember) return notFound();
      // Taking a role off someone who does not hold it finds nothing.
      if (role !== undefined && !removed.value.removed) return notFound();
      return new Response(null, { status: 204 });
    },
  );}
/**
 * A team role from a request (#571): absent is undefined, one of
 * `TEAM_ROLES` is itself, anything else a 422.
 */
function roleOf(raw: unknown): TeamRole | undefined | Response {
  if (raw === undefined || raw === null || raw === "") return undefined;
  if (isTeamRole(raw)) return raw;
  return apiError("bad_role", 422, `role is one of ${TEAM_ROLES.join(", ")}`);
}
@@ -1,19 +1,22 @@
import { addTeamMember, createTeam, deleteTeam } from "../../../actions/orgs.ts";
import { getOrg, listTeams, type Permission } from "../../../core/orgs.ts";
import { requireOrgAdmin } from "../../../actions/access.ts";
import { isTeamRole, TEAM_ROLES } from "../../../core/agents.ts";
import { getOrg, listTeamMemberRoles, listTeams, type Permission } from "../../../core/orgs.ts";
import { good, bad, type Tool } from "../shared.ts";
export const tool: Tool = {
  name: "org_teams",
  doc: "`{ org, action, team, user?, permission? }` (admin-scope token, an org owner): `create` a team (`permission` read, write or admin; read by default), `add_member` a `user`, or `remove` the team; the same as POST/DELETE `/api/v1/orgs/:org/teams`",
  description: "An org's teams: create, add member, remove.",
  doc: "`{ org, action, team, user?, permission?, role? }` (admin-scope token, an org owner): `create` a team (`permission` read, write or admin; read by default), `add_member` a `user` with an optional `role` (planner, builder, reviewer or member; setting it on someone already there changes their role), list its `members` with their roles, or `remove` the team; the same as `/api/v1/orgs/:org/teams` and its `members`",
  description: "An org's teams: create, add member with a role, list members, remove.",
  inputSchema: {
    type: "object",
    properties: {
      org: { type: "string", maxLength: 64 },
      action: { type: "string", enum: ["create", "add_member", "remove"] },
      action: { type: "string", enum: ["create", "add_member", "members", "remove"] },
      team: { type: "string", maxLength: 64 },
      user: { type: "string", maxLength: 64 },
      permission: { type: "string", enum: ["read", "write", "admin"], description: "create" },
      role: { type: "string", enum: [...TEAM_ROLES], description: "add_member: the seat on the crew" },
    },
    required: ["org", "action", "team"],
  },
@@ -34,13 +37,24 @@
export const tool: Tool = {
    const team = listTeams(ctx.app.db, org.id).find((t) => t.name.toLowerCase() === wanted);
    if (!team) return bad("not_found", "no such team");
    if (action === "add_member") {
      const added = addTeamMember(ctx.app, user, org, team, typeof args["user"] === "string" ? args["user"] : "");
      const role = args["role"];
      if (role !== undefined && !isTeamRole(role))
        return bad("bad_role", `role is one of ${TEAM_ROLES.join(", ")}`);
      const who = typeof args["user"] === "string" ? args["user"] : "";
      const added = addTeamMember(ctx.app, user, org, team, who, role);
      return added.ok ? good(added.value) : bad(added.error, added.error);
    }
    if (action === "members") {
      // The same admin gate as the page: only an org admin manages its teams.
      if (!requireOrgAdmin(ctx.app, user, org).ok) return bad("not_found", "no such team");
      return good(
        listTeamMemberRoles(ctx.app.db, team.id).map((m) => ({ user: m.user.username, role: m.role })),
      );
    }
    if (action === "remove") {
      const gone = deleteTeam(ctx.app, user, org, team);
      return gone.ok ? good({ removed: team.name }) : bad(gone.error, gone.error);
    }
    return bad("invalid", "action is create, add_member or remove");
    return bad("invalid", "action is create, add_member, members or remove");
  },
};
@@ -6,7 +6,9 @@
 * rule, the page's: an org admin sees every team, a member only their own.
 * An admin of the organization (`orgAccess` allowing `admin`, the page's
 * `requireOrgAdmin`) adds a person with `a` and removes the member under the
 * cursor with `d` after a y/n (#8125), through the same actions
 * cursor with `d` after a y/n (#8125), and sets the role of the member
 * under the cursor with `r` (#571: planner, builder, reviewer or member, the
 * seat a write team gives an agent on the org's crew), through the same actions
 * `POST /:owner/-/teams/:team/add` and `/remove` call, in the page's words.
 * On the list, an admin of the selected team's organization makes a team with
 * `n` (a name, then read, write or admin) and deletes the selected team with
@@ -27,8 +29,10 @@
import {
  removeRefusal,
  removedSays,
} from "../../actions/team_words.ts";
import { TEAM_ROLES, isTeamRole } from "../../core/agents.ts";
import {
  listOrgsForUser,
  listTeamMemberRoles,
  listTeamMembers,
  listTeamsVisibleTo,
  orgAccess,
@@ -66,10 +70,15 @@
export function orgTeamLines(f: Session): Line[] {
function teamMembersScreen(ctx: Ctx, f: Session, org: User, team: Team, changed: () => void): Screen {
  const state = new ListState();
  const admin = orgAccess(f.app.db, org.id, f.user) === "admin";
  const read = () => listTeamMembers(f.app.db, team.id).sort((a, b) => a.username.localeCompare(b.username));
  const read = () =>
    listTeamMemberRoles(f.app.db, team.id).map(({ user, role }) => ({ ...user, role }));
  let members = read();
  const rowsOf = (): ListRow[] =>
    members.map((u) => ({ title: `@${u.username}`, ...(u.displayName === "" ? {} : { secondary: u.displayName }) }));
    members.map((u) => ({
      title: `@${u.username}`,
      ...(u.displayName === "" ? {} : { secondary: u.displayName }),
      meta: u.role,
    }));
  let rows = rowsOf();
  const reload = () => {
    members = read();
@@ -81,7 +90,7 @@
function teamMembersScreen(ctx: Ctx, f: Session, org: User, team: Team, changed:
  const screen: Screen = {
    title: `${org.username} / ${team.name}`,
    keys: admin
      ? [binding(["j", "k"], "move cursor"), binding(["a"], "add"), binding(["d"], "remove")]
      ? [binding(["j", "k"], "move cursor"), binding(["a"], "add"), binding(["r"], "role"), binding(["d"], "remove")]
      : [binding(["j", "k"], "move cursor")],
    render(area, s) {
      drawList(s, area, ctx.theme.c, state, rows);
@@ -107,6 +116,24 @@
function teamMembersScreen(ctx: Ctx, f: Session, org: User, team: Team, changed:
        );
        return true;
      }
      if (e.key === "r") {
        const member = members[state.index];
        if (member === undefined) return false;
        ctx.push(
          pickerScreen(ctx, screen, {
            title: `@${member.username}: role`,
            items: TEAM_ROLES.map((role) => ({ id: role, label: role })),
            onPick: ([chosen]) => {
              if (!isTeamRole(chosen)) return;
              const set = addTeamMember(f.app, f.user, org, team, member.username, chosen);
              if (!set.ok) ctx.toast(addRefusal(set.error, member.username), "danger");
              else ctx.toast(`@${member.username} is ${set.value.role} on ${team.name}.`);
              reload();
            },
          }),
        );
        return true;
      }
      if (e.key === "d") {
        const member = members[state.index];
        if (member === undefined) return false;
@@ -32,6 +32,7 @@
import {
  accessAllows,
  getOrg,
  getTeam,
  listTeamMemberRoles,
  listTeamMembers,
  listTeams,
  orgAccess,
@@ -40,6 +41,7 @@
import {
  type Team,
} from "../../core/orgs.ts";
import { appsForRepos } from "../../core/apps.ts";
import { isTeamRole, TEAM_ROLES } from "../../core/agents.ts";
import { LIST_LIMIT_MAX } from "../../core/issues.ts";
import { listReposByOwner, type Repo } from "../../core/repos.ts";
import { getUserByName, hiddenFrom, type User } from "../../core/users.ts";
@@ -243,6 +245,14 @@
function orgMembers(ctx: Ctx, teams: Team[]): User[] {
  );
}
/** A team's members with the role each holds (#571), one fact each: name, then role. */
function teamMemberFacts(ctx: Ctx, team: Team): { label: string; value: string }[] {
  return listTeamMemberRoles(ctx.app.db, team.id).map(({ user, role }) => ({
    label: user.username,
    value: role,
  }));
}
/** "1 member" / "4 members" — a sentence, not a number in a pill. */
function memberCount(n: number): Html {
  return html`${n} member${n === 1 ? "" : "s"}`;
@@ -277,6 +287,7 @@
function teamsSection(ctx: Ctx, org: User, canManage: boolean): Html {
            lead: icon("users"),
            title: t.name,
            meta: memberCount(listTeamMembers(ctx.app.db, t.id).length),
            facts: teamMemberFacts(ctx, t),
            trail: html`${badge(t.permission)}${when(canManage, () =>
              btn("Manage", {
                href: `/${org.username}/-/teams/${t.id}`,
@@ -534,7 +545,7 @@
export function teamPage(ctx: Ctx): Response {
  if (!team || team.orgId !== org.id) return notFoundPage(ctx);
  const members = timePhase(ctx.request, "members", () =>
    listTeamMembers(ctx.app.db, team.id),
    listTeamMemberRoles(ctx.app.db, team.id).map(({ user, role }) => ({ ...user, role })),
  );
  const rendering = performance.now();
  const teamBase = `/${org.username}/-/teams/${team.id}`;
@@ -556,7 +567,7 @@
export function teamPage(ctx: Ctx): Response {
              title: html`<a href="/${m.username}"
                >${m.displayName || m.username}</a
              >`,
              meta: html`@${m.username}`,
              meta: html`@${m.username}${m.role === "member" ? "" : html` · ${m.role}`}`,
              trail: when(
                !protectedTeam || members.length > 1,
                () =>
@@ -580,6 +591,12 @@
export function teamPage(ctx: Ctx): Response {
        required: true,
        hint: "Their username on this forge.",
      })}
      ${selectField({
        label: "Role",
        name: "role",
        hint: "An agent's role is its seat on the org's repositories.",
        options: TEAM_ROLES.map((r) => ({ value: r, label: r, selected: r === "member" })),
      })}
      <div class="form-actions">
        ${btn("Add member", { variant: "primary" })}
      </div>
      
        sentinelcrew
        2d ago
        outdated
      
      Principles 1 and 8: this hint explains the feature in three sentences. One plain sentence is enough: 'An agent's role is its seat on the org's repositories.'
    
@@ -629,7 +646,11 @@
export async function teamMemberAdd(ctx: Ctx): Promise<Response> {
  if (r instanceof Response) return r;
  const username = field(r.form, "user").trim();
  const dest = `/${r.org.username}/-/teams/${r.team.id}`;
  const added = addTeamMember(ctx.app, ctx.auth.user, r.org, r.team, username);
  const rawRole = field(r.form, "role");
  if (rawRole !== "" && !isTeamRole(rawRole))
    return flashTo(ctx, dest, { tone: "danger", message: `A role is one of ${TEAM_ROLES.join(", ")}.` });
  const role = isTeamRole(rawRole) ? rawRole : undefined;
  const added = addTeamMember(ctx.app, ctx.auth.user, r.org, r.team, username, role);
  if (!added.ok)
    return flashTo(ctx, dest, {
      tone: "danger",
@@ -281,7 +281,7 @@
describe("actions own authorization and events", () => {
    });
    expect(addTeamMember(app, alice, acme, devs.value, "bob")).toEqual({
      ok: true,
      value: { added: true },
      value: { added: true, role: "member" },
    });
    // Bob is now a writer in acme — but still not an admin.
@@ -256,7 +256,7 @@
describe("home's asks are read grouped, and once", () => {
    const rounds = sql.filter((s) => s.startsWith("SELECT r.issue_id AS issueId, r.id AS id"));
    const verdicts = sql.filter((s) => s.startsWith("SELECT review.issue_id, review.id"));
    const tries = sql.filter((s) => s.includes("run.reason = 'check_failed'"));
    const reviewers = sql.filter((s) => s.includes("WHERE repo_crew.role = ?1"));
    const reviewers = sql.filter((s) => s.includes("SELECT 'roster' AS source"));
    expect(active.length).toBe(1);
    expect(handovers.length).toBe(1);
    expect(rounds.length).toBe(1);
@@ -0,0 +1,315 @@
/**
 * Teams drive the crew (#571): a team membership carries a role, and an
 * org repository's crew is the agents on the org's write and admin teams,
 * each in that role. With no agent on such a team, the per-repo roster is
 * the crew, unchanged. The routing reads one function, `crewSeats`; the
 * reviewer it picks comes from there. The API takes and validates `role`;
 * the org page lists each team's members with their roles, escaped.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import {
  addCrew,
  createAgentRow,
  crewSeats,
  crewWithRole,
  listCrewRoles,
  reposWithBuilder,
} from "../src/core/agents.ts";
import {
  addTeamMember,
  createOrg,
  createTeam,
  listTeamMemberRoles,
  type Team,
} from "../src/core/orgs.ts";
import { createRepo, type Repo } from "../src/core/repos.ts";
import { createSession } from "../src/core/sessions.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { reviewersOf } from "../src/crew/review.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { listEvents } from "../src/core/events.ts";
import { createForgeApp } from "../src/tui/forge.ts";
import { headlessTerminal } from "../src/tui/term/terminal.ts";
import { quietLogs } from "./helpers/globals.ts";
import { settleApp } from "./helpers/tui.ts";
quietLogs();
const ALL = ["planner", "builder", "reviewer"] as const;
describe("teams drive the crew", () => {
  let dataDir = "";
  let app: App;
  let servers: Servers;
  let alice: User;
  let juniper: User;
  let sentinel: User;
  let mason: User;
  let org: User;
  let crewTeam: Team;
  let readers: Team;
  let teamed: Repo;
  let rostered: Repo;
  let personal: Repo;
  let rw = "";
  let cookie = "";
  const user = async (username: string, agent = false): Promise<User> => {
    const made = await createUser(app.db, {
      username,
      email: `${username}@forge.test`,
      ...(agent
        ? { agent: true, origin: "agent" as const }
        : { password: "a-good-passphrase", origin: "seed" as const, trusted: true }),
    });
    if (!made.ok) throw new Error(`seed ${username}: ${made.error}`);
    if (agent) createAgentRow(app.db, { userId: made.value.id, roles: ALL });
    return made.value;
  };
  const repo = async (ownerId: string, name: string): Promise<Repo> => {
    const made = await createRepo(app.db, app.reposRoot, { ownerId, name, visibility: "public" });
    if (!made.ok) throw new Error(`repo ${name}: ${made.error}`);
    return made.value;
  };
  const names = (agents: { user: User }[] | undefined) => (agents ?? []).map((a) => a.user.username);
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-teams-crew-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    alice = await user("alice");
    juniper = await user("juniper", true);
    sentinel = await user("sentinel", true);
    mason = await user("mason", true);
    const made = createOrg(app.db, "acme", alice.id);
    if (!made.ok) throw new Error(made.error);
    org = made.value;
    const t = createTeam(app.db, org.id, "Crew", "write");
    const r = createTeam(app.db, org.id, "Readers", "read");
    if (!t.ok || !r.ok) throw new Error("teams");
    crewTeam = t.value;
    readers = r.value;
    teamed = await repo(org.id, "teamed");
    rostered = await repo(org.id, "rostered");
    personal = await repo(alice.id, "own");
    // Today's roster on both org repos and the personal one: juniper reviews, sentinel builds.
    for (const target of [teamed, rostered, personal]) {
      addCrew(app.db, target.id, juniper.id, alice.id, "reviewer");
      addCrew(app.db, target.id, sentinel.id, alice.id, "builder");
    }
    rw = createToken(app.db, alice.id, "admin", "admin").token;
    cookie = `forge_session=${createSession(app.db, alice.id).token}`;
  });
  afterAll(async () => {
    servers?.stop();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a membership defaults to member, and the column refuses anything else", () => {
    expect(addTeamMember(app.db, readers, alice.id)).toBe(true);
    expect(listTeamMemberRoles(app.db, readers.id)).toEqual([{ user: expect.objectContaining({ username: "alice" }), role: "member" }]);
    expect(() =>
      app.db.query("UPDATE team_member SET role = 'king' WHERE team_id = ?1").run(readers.id),
    ).toThrow();
  });
  test("with no agent seated by a write team the roster is the crew, unchanged", () => {
    // An agent on a read team grants nothing.
    expect(addTeamMember(app.db, readers, mason.id, "reviewer")).toBe(true);
    for (const target of [teamed, rostered, personal]) {
      expect(listCrewRoles(app.db, target.id).map((c) => [c.agent.user.username, c.role])).toEqual([
        ["juniper", "reviewer"],
        ["sentinel", "builder"],
      ]);
      expect(names(reviewersOf(app.db, target.id))).toEqual(["juniper"]);
    }
  });
  test("a write team with a reviewer is the crew: the routing picks its reviewer", () => {
    expect(addTeamMember(app.db, crewTeam, mason.id, "reviewer")).toBe(true);
    expect(addTeamMember(app.db, crewTeam, sentinel.id, "builder")).toBe(true);
    // Every repository the org owns now reads its crew from the team …
    for (const target of [teamed, rostered]) {
      expect(listCrewRoles(app.db, target.id).map((c) => [c.agent.user.username, c.role])).toEqual([
        ["mason", "reviewer"],
        ["sentinel", "builder"],
      ]);
      expect(names(reviewersOf(app.db, target.id))).toEqual(["mason"]);
      expect(names(crewWithRole(app.db, [target.id], "builder").get(target.id))).toEqual(["sentinel"]);
    }
    // … and a repository with no org keeps its roster: juniper still reviews it.
    expect(names(reviewersOf(app.db, personal.id))).toEqual(["juniper"]);
    expect([...crewSeats(app.db, [teamed.id, personal.id]).keys()].sort()).toEqual([teamed.id, personal.id].sort());
  });
  test("a write team without a reviewer leaves the seat empty, not the roster's", () => {
    app.db.query("UPDATE team_member SET role = 'planner' WHERE team_id = ?1 AND user_id = ?2").run(crewTeam.id, mason.id);
    expect(reviewersOf(app.db, teamed.id)).toEqual([]);
    expect(names(crewWithRole(app.db, [teamed.id], "planner").get(teamed.id))).toEqual(["mason"]);
    expect(reposWithBuilder(app.db, [teamed.id, personal.id])).toEqual(new Set([teamed.id, personal.id]));
    expect(names(reviewersOf(app.db, personal.id))).toEqual(["juniper"]);
  });
  test("a plain member of a write team holds no seat, so a membership from before roles changes no crew", async () => {
    const second = createTeam(app.db, org.id, "Second", "write");
    if (!second.ok) throw new Error(second.error);
    expect(addTeamMember(app.db, second.value, juniper.id)).toBe(true);
    expect(listCrewRoles(app.db, teamed.id).some((c) => c.agent.user.id === juniper.id)).toBe(false);
    // An org whose write teams hold only members keeps its roster.
    const other = createOrg(app.db, "plain", alice.id);
    if (!other.ok) throw new Error(other.error);
    const writers = createTeam(app.db, other.value.id, "Writers", "write");
    if (!writers.ok) throw new Error(writers.error);
    expect(addTeamMember(app.db, writers.value, mason.id)).toBe(true);
    const plain = await repo(other.value.id, "plain-repo");
    addCrew(app.db, plain.id, juniper.id, alice.id, "reviewer");
    expect(crewSeats(app.db, [plain.id]).get(plain.id)?.map((s) => [s.agent.user.username, s.role])).toEqual([["juniper", "reviewer"]]);
    expect(names(reviewersOf(app.db, plain.id))).toEqual(["juniper"]);
    expect(addTeamMember(app.db, crewTeam, juniper.id, "reviewer")).toBe(true);
    expect(names(reviewersOf(app.db, teamed.id))).toEqual(["juniper"]);
  });
  const api = (method: string, path: string, body?: unknown) =>
    fetch(`${servers.url}/api/v1/orgs/acme/teams/crew/members${path}`, {
      method,
      headers: {
        authorization: `Bearer ${rw}`,
        origin: servers.url,
        ...(body === undefined ? {} : { "content-type": "application/json" }),
      },
      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
    });
  test("POST accepts and validates a role; GET lists it", async () => {
    const bad = await api("POST", "", { user: "mason", role: "king" });
    expect(bad.status).toBe(422);
    expect(((await bad.json()) as { error: string }).error).toBe("bad_role");
    const set = await api("POST", "", { user: "mason", role: "reviewer" });
    expect(set.status).toBe(200);
    expect(await set.json()).toEqual({ added: false, role: "reviewer" });
    const listed = ((await (await api("GET", "")).json()) as { items: { username: string; role: string }[] }).items;
    expect(listed.map((m) => [m.username, m.role])).toEqual([
      ["juniper", "reviewer"],
      ["mason", "reviewer"],
      ["sentinel", "builder"],
    ]);
  });
  test("DELETE with a role takes that role off and keeps the member; a bad role is refused", async () => {
    expect((await api("DELETE", "/mason?role=king")).status).toBe(422);
    expect((await api("DELETE", "/mason?role=builder")).status).toBe(404);
    expect((await api("DELETE", "/mason?role=reviewer")).status).toBe(204);
    expect(listTeamMemberRoles(app.db, crewTeam.id).find((m) => m.user.id === mason.id)?.role).toBe("member");
    expect((await api("DELETE", "/mason")).status).toBe(204);
    expect(listTeamMemberRoles(app.db, crewTeam.id).some((m) => m.user.id === mason.id)).toBe(false);
  });
  test("the org page lists each team's members with their roles, escaped", async () => {
    app.db.query("UPDATE user SET username = 'sen<b>' WHERE id = ?1").run(sentinel.id);
    const page = await (await fetch(`${servers.url}/acme`, { headers: { cookie } })).text();
    app.db.query("UPDATE user SET username = 'sentinel' WHERE id = ?1").run(sentinel.id);
    expect(page).toContain("<dt>juniper</dt><dd>reviewer</dd>");
    expect(page).toContain("<dt>sen&lt;b&gt;</dt><dd>builder</dd>");
    expect(page).not.toContain("sen<b>");
  });
  const roleEvents = () =>
    listEvents(app.db, { limit: 200 }).filter((e) => e.kind === "team.member_role_set");
  test("a role change on a member is told on the outbox, with who, from and to", async () => {
    const before = roleEvents().length;
    expect((await api("POST", "", { user: "juniper", role: "planner" })).status).toBe(200);
    const heard = roleEvents();
    expect(heard.length).toBe(before + 1);
    const last = heard.find((e) => e.payload.role === "planner" && e.payload.user === "juniper")!;
    expect(last.actorId).toBe(alice.id);
    expect(last.payload.from).toBe("reviewer");
    // Setting the role they already hold, or a refused one, says nothing.
    await api("POST", "", { user: "juniper", role: "planner" });
    await api("POST", "", { user: "juniper", role: "king" });
    expect(roleEvents().length).toBe(before + 1);
    // Taking the role off is a change too.
    expect((await api("DELETE", "/juniper?role=planner")).status).toBe(204);
    expect(roleEvents().length).toBe(before + 2);
    expect((await api("POST", "", { user: "juniper", role: "reviewer" })).status).toBe(200);
  });
  const mcp = async (token: string, args: unknown) => {
    const res = await fetch(`${servers.url}/mcp`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        accept: "application/json, text/event-stream",
        authorization: `Bearer ${token}`,
      },
      body: JSON.stringify({
        jsonrpc: "2.0",
        id: 1,
        method: "tools/call",
        params: { name: "org_teams", arguments: args },
      }),
    });
    const body = (await res.json()) as { result: { content: { text: string }[]; isError?: boolean } };
    return { text: body.result.content[0]!.text, isError: body.result.isError === true };
  };
  test("MCP org_teams takes a role on add_member, refuses a bad one, and lists members with roles", async () => {
    const bad = await mcp(rw, { org: "acme", action: "add_member", team: "Crew", user: "mason", role: "king" });
    expect(bad.isError).toBe(true);
    expect(bad.text).toContain("bad_role");
    const added = await mcp(rw, { org: "acme", action: "add_member", team: "Crew", user: "mason", role: "builder" });
    expect(added.isError).toBe(false);
    expect(JSON.parse(added.text)).toEqual({ added: true, role: "builder" });
    const listed = await mcp(rw, { org: "acme", action: "members", team: "Crew" });
    expect(JSON.parse(listed.text)).toContainEqual({ user: "mason", role: "builder" });
    // Someone who is not an org admin is told there is no such team.
    const outsider = createToken(app.db, mason.id, "admin", "admin").token;
    expect((await mcp(outsider, { org: "acme", action: "members", team: "Crew" })).isError).toBe(true);
    expect((await api("DELETE", "/mason")).status).toBe(204);
  });
  test("the terminal sets a role with r, and the org page shows it on the next request", async () => {
    const terminal = headlessTerminal(140, 32);
    const { app: tui } = createForgeApp(
      app,
      { sshUsername: "t", remoteAddress: "127.0.0.1", user: alice },
      { terminal, exitHooks: false },
    );
    tui.start();
    const key = (k: string, ctrl = false) => tui.dispatch({ type: "key", key: k, ctrl, alt: false, shift: false });
    const press = async (...keys: string[]) => {
      keys.forEach((k) => key(k));
      await settleApp(tui);
    };
    try {
      key("k", true);
      await settleApp(tui);
      for (const ch of "Organization teams") key(ch);
      await press("enter");
      // Crew is the first team of acme, the first org.
      await press("enter");
      expect(tui.screen.toText()).toContain("acme / Crew");
      expect(tui.screen.toText()).toContain("r  role");
      const lineOf = (who: string) => tui.screen.toText().split("\n").find((l) => l.includes(`@${who}`)) ?? "";
      expect(lineOf("sentinel")).toContain("builder");
      await press("j", "r");
      expect(tui.screen.toText()).toContain("@sentinel: role");
      await press("enter"); // planner, the first
      expect(lineOf("sentinel")).toContain("planner");
    } finally {
      tui.stop();
    }
    expect(roleEvents().some((e) => e.payload.user === "sentinel" && e.payload.role === "planner")).toBe(true);
    const page = await (await fetch(`${servers.url}/acme`, { headers: { cookie } })).text();
    expect(page).toContain("<dt>sentinel</dt><dd>planner</dd>");
  });
});
		@@ -582,6 +582,14 @@ agent's push to the default branch whether or not it is protected, and
582	582	`mergePull` refuses an agent actor. Everything the agent can do, it does
583	583	through a pull a person merges.
584	584
	585	Which seat each agent holds on a repository is read in one place,
	586	`crewSeats` (`core/agents.ts`), which `listCrewRoles`, `crewWithRole` and so
	587	the reviewer routing all read. On an org's repository the crew comes from
	588	its write and admin teams: a `team_member.role` of planner, builder or
	589	reviewer seats that agent, and `member` (the default, and every membership
	590	from before roles) is access only. When no team seats an agent, the
	591	repository's own `repo_crew` roster is the crew, as it always was (#571).
	592
585	593	Work reaches an agent off the outbox with a sweep behind it, like every
586	594	other consumer: an assignment starts a run; a person's comment, verdict, or
587	595	line comment on the agent's pull starts a follow-up that resumes the same
		@@ -0,0 +1,25 @@
	1	# Give a team member a role
	2
	3	A team membership carries a role: `planner`, `builder`, `reviewer` or
	4	`member` (the default). On an organization's write or admin team, an agent's
	5	role is its seat on the crew of every repository the organization owns: a
	6	`reviewer` there reviews the org's pulls, a `builder` takes what is ready. A
	7	`member` holds no seat; the team gives them its access and nothing more.
	8	When no team gives any agent a role, a repository's own crew roster is its
	9	crew, as before.
	10
	11	- Page: the organization page lists each team's members with their roles.
	12	An org admin opens a team's Manage page, picks a Role beside the username
	13	and presses Add member; adding someone already on the team sets their role.
	14	- API: `POST /api/v1/orgs/:org/teams/:team/members` with
	15	`{ "user": "mason", "role": "reviewer" }` (admin-scope token). A bad role is
	16	`422 bad_role`. `DELETE …/members/:username?role=reviewer` takes just that
	17	role off and leaves them a `member`; without `role` it removes them.
	18	`GET …/members` lists each member's `role`.
	19	- MCP: `org_teams { org, action: "add_member", team, user, role }`, and
	20	`action: "members"` to list members with their roles.
	21	- Terminal: the "Organization teams" command, Enter on a team, then `r` on
	22	a member to pick a role (org admins only).
	23
	24	Every change of role is told on the outbox as `team.member_role_set`, with
	25	who made it, the member, and the role before and after.
		@@ -15,12 +15,15 @@ import {
15	15	isLastOwner,
16	16	OWNERS_TEAM,
17	17	removeTeamMember as dropMember,
	18	setTeamRole,
	19	teamRoleOf,
18	20	type CreateOrgError,
19	21	type CreateTeamError,
20	22	type Permission,
21	23	type Team,
22	24	} from "../core/orgs.ts";
23	25	import { getUserByName, type User } from "../core/users.ts";
	26	import type { TeamRole } from "../core/agents.ts";
24	27	import { err, ok, type Result } from "../kernel/result.ts";
25	28	import { requireOrgAdmin, requireUser } from "./access.ts";
26	29
		@@ -117,8 +120,9 @@ export function addTeamMember(
117	120	org: User,
118	121	team: Team,
119	122	username: string,
	123	role?: TeamRole,
		sentinelcrew 2d ago Both doors: this action has no terminal screen or MCP org_teams caller passing a role. Add both, with tests that a write in the terminal shows live on the web.
120	124	): Result<
121		{ added: boolean },
	125	{ added: boolean; role: TeamRole },
122	126	"not_found" \| "no_such_user" \| "agent_cannot_own"
123	127	> {
124	128	const admin = requireOrgAdmin(app, actor, org);
		@@ -130,14 +134,41 @@ export function addTeamMember(
130	134	// any team that confers admin.
131	135	if (user.kind === "agent" && team.permission === "admin")
132	136	return err("agent_cannot_own");
133		const added = insertMember(app.db, team, user.id);
	137	const added = insertMember(app.db, team, user.id, role);
134	138	if (added)
135	139	app.bus.append({
136	140	kind: "team.member_added",
137	141	actorId: admin.value.id,
138	142	payload: { org: org.username, teamId: team.id, user: user.username },
139	143	});
140		return ok({ added });
	144	// Adding someone already on the team with a role sets it (#571).
	145	else if (role !== undefined) changeRole(app, admin.value, org, team, user, role);
		sentinelcrew 2d ago outdated A role change on an existing member is a silent privilege change (it re-seats the crew on every org repo). Append a bus event for it and test it.
	146	return ok({ added, role: teamRoleOf(app.db, team.id, user.id) ?? "member" });
	147	}
	148
	149	/**
	150	* Set a member's role and say so on the outbox (#571): a role re-seats the
	151	* crew on every repository the org owns, so it never changes silently.
	152	* False when they already hold it or are not on the team.
	153	*/
	154	function changeRole(
	155	app: App,
	156	admin: User,
	157	org: User,
	158	team: Team,
	159	user: User,
	160	role: TeamRole,
	161	): boolean {
	162	const from = teamRoleOf(app.db, team.id, user.id);
	163	if (from === undefined) return false;
	164	const changed = setTeamRole(app.db, team.id, user.id, role);
	165	if (!changed) return false;
	166	app.bus.append({
	167	kind: "team.member_role_set",
	168	actorId: admin.id,
	169	payload: { org: org.username, teamId: team.id, user: user.username, from, role },
	170	});
	171	return true;
		sentinelcrew 2d ago outdated A side effect (setTeamRole) hidden inside a && chain on a 140-char line. Write it as statements.
141	172	}
142	173
143	174	/**
		@@ -151,12 +182,21 @@ export function removeTeamMember(
151	182	org: User,
152	183	team: Team,
153	184	username: string,
	185	role?: TeamRole,
154	186	): Result<{ removed: boolean }, "not_found" \| "no_such_user" \| "last_owner"> {
155	187	const admin = requireOrgAdmin(app, actor, org);
156	188	if (!admin.ok) return admin;
157	189	if (team.orgId !== org.id) return err("not_found");
158	190	const user = getUserByName(app.db, username);
159	191	if (!user) return err("no_such_user");
	192	// With a role, only that role comes off: the member stays on the team as
	193	// a plain `member` (#571). Nothing changes when they hold another.
	194	if (role !== undefined) {
	195	if (role === "member") return ok({ removed: false });
	196	if (teamRoleOf(app.db, team.id, user.id) !== role) return ok({ removed: false });
	197	const cleared = changeRole(app, admin.value, org, team, user, "member");
	198	return ok({ removed: cleared });
	199	}
160	200	if (team.name === OWNERS_TEAM && isLastOwner(app.db, org.id, user))
161	201	return err("last_owner");
162	202	const removed = dropMember(app.db, team, user.id);
		@@ -372,63 +372,126 @@ export function setCrewRole(
372	372	);
373	373	}
374	374
375		/** The crew with each member's role, by name. */
	375	/** The crew with each member's role, by name: `crewSeats` for one repository. */
376	376	export function listCrewRoles(
377	377	db: Database,
378	378	repoId: string,
379	379	): { agent: Agent; role: CrewRole }[] {
380		const roles = new Map(
381		db
382		.query<{ user_id: string; role: string }, [string]>(
383		"SELECT user_id, role FROM repo_crew WHERE repo_id = ?1",
384		)
385		.all(repoId)
386		.map((r) => [r.user_id, r.role] as const),
387		);
388		return listCrew(db, repoId).map((agent) => ({
389		agent,
390		role: seatOf(roles.get(agent.user.id) ?? "", agent.roles),
391		}));
	380	return (crewSeats(db, [repoId]).get(repoId) ?? []).map(({ agent, role }) => ({ agent, role }));
	381	}
	382
	383	/** One seat on a repository's crew. */
	384	export interface CrewSeat {
	385	readonly agent: Agent;
	386	readonly role: CrewRole;
	387	/**
	388	* Whether the seat is held as written: a team role, or a roster row
	389	* whose role the agent still declares.
	390	*/
	391	readonly held: boolean;
	392	}
	393
	394	/** A role on an org team (#571): a crew seat, or `member`, the team's access and no seat. */
	395	export type TeamRole = CrewRole \| "member";
	396	export const TEAM_ROLES: readonly TeamRole[] = [...CREW_ROLES, "member"];
	397	export const isTeamRole = (value: unknown): value is TeamRole =>
	398	(TEAM_ROLES as readonly unknown[]).includes(value);
	399
	400	/**
	401	* The crew of each repository, by repo, by name — the one function the
	402	* routing reads for planner, builder and reviewer (#571). An org-owned
	403	* repository's crew is the agents the org's write and admin teams give a
	404	* role, each in that seat (a role the agent does not declare sits in its
	405	* first declared one; on many teams an agent takes its first by team
	406	* name). A `member` holds no seat: it is the team's access, nothing more,
	407	* so a membership from before roles changes no crew. When no such team
	408	* seats an agent, the repository's own roster (`repo_crew`) is its crew,
	409	* unchanged.
	410	*/
	411	export function crewSeats(
	412	db: Database,
	413	repoIds: readonly string[],
	414	): Map<string, CrewSeat[]> {
	415	const unique = [...new Set(repoIds)];
	416	type SeatRow = AgentRow & { repo_id: string; seat: string; source: "team" \| "roster" };
	417	const rows: SeatRow[] = [];
	418	const CHUNK = 400;
	419	// One read per chunk: the team seats and the roster together, told apart by `source`.
	420	for (let i = 0; i < unique.length; i += CHUNK) {
	421	const batch = unique.slice(i, i + CHUNK);
	422	const marks = batch.map((_, n) => `?${n + 1}`).join(",");
	423	rows.push(
	424	...db
	425	.query<SeatRow, string[]>(
	426	`SELECT * FROM (
	427	SELECT 'team' AS source, repo.id AS repo_id, team_member.role AS seat,
	428	team.name AS via, user.username AS uname, agent.*
	429	FROM repo
	430	JOIN team ON team.org_id = repo.owner_id AND team.permission IN ('write','admin')
	431	JOIN team_member ON team_member.team_id = team.id AND team_member.role <> 'member'
	432	JOIN agent ON agent.user_id = team_member.user_id
	433	JOIN user ON user.id = agent.user_id
	434	WHERE repo.id IN (${marks})
	435	UNION ALL
	436	SELECT 'roster' AS source, repo_crew.repo_id, repo_crew.role AS seat,
	437	'' AS via, user.username AS uname, agent.*
	438	FROM repo_crew
	439	JOIN agent ON agent.user_id = repo_crew.user_id
	440	JOIN user ON user.id = agent.user_id
	441	WHERE repo_crew.repo_id IN (${marks})
	442	) ORDER BY uname COLLATE NOCASE, via COLLATE NOCASE`,
	443	)
	444	.all(...batch),
	445	);
	446	}
	447	const teamed = new Set(rows.filter((r) => r.source === "team").map((r) => r.repo_id));
	448	const teamRows = rows.filter((r) => r.source === "team");
	449	const rosterRows = rows.filter((r) => r.source === "roster" && !teamed.has(r.repo_id));
	450	const users = getUsersByIds(db, [...teamRows, ...rosterRows].map((r) => r.user_id));
	451	const out = new Map<string, CrewSeat[]>();
	452	const put = (repoId: string, seat: CrewSeat) => {
	453	const list = out.get(repoId);
	454	if (list) list.push(seat);
	455	else out.set(repoId, [seat]);
	456	};
	457	// Team rows: one seat per agent per repository, the first by team name.
	458	const chosen = new Map<string, AgentRow & { repo_id: string; seat: string }>();
	459	for (const row of teamRows) {
	460	const key = `${row.repo_id}\u0000${row.user_id}`;
	461	if (!chosen.has(key)) chosen.set(key, row);
	462	}
	463	for (const row of chosen.values()) {
	464	const user = users.get(row.user_id);
	465	if (!user) continue;
	466	const agent = agentOf(user, row);
	467	put(row.repo_id, { agent, role: seatOf(row.seat, agent.roles), held: true });
	468	}
	469	for (const row of rosterRows) {
	470	const user = users.get(row.user_id);
	471	if (!user) continue;
	472	const agent = agentOf(user, row);
	473	put(row.repo_id, {
	474	agent,
	475	role: seatOf(row.seat, agent.roles),
	476	held: isCrewRole(row.seat) && agent.roles.includes(row.seat),
	477	});
	478	}
	479	return out;
392	480	}
393	481
394	482	/**
395	483	* The crew members holding `role` on each of these repositories, by repo,
396		* in `listCrew`'s order — the agents and their accounts one query per chunk
397		* each, never one per repository or per member.
	484	* in name order — `crewSeats`, keeping the seats held as written.
398	485	*/
399	486	export function crewWithRole(
400	487	db: Database,
401	488	repoIds: readonly string[],
402	489	role: CrewRole,
403	490	): Map<string, Agent[]> {
404		const rows: (AgentRow & { repo_id: string })[] = [];
405		const unique = [...new Set(repoIds)];
406		const CHUNK = 400;
407		for (let i = 0; i < unique.length; i += CHUNK) {
408		const batch = unique.slice(i, i + CHUNK);
409		rows.push(
410		...db
411		.query<AgentRow & { repo_id: string }, string[]>(
412		`SELECT repo_crew.repo_id, agent.* FROM repo_crew
413		JOIN agent ON agent.user_id = repo_crew.user_id
414		JOIN user ON user.id = agent.user_id
415		WHERE repo_crew.role = ?1
416		AND instr(',' \|\| agent.roles \|\| ',', ',' \|\| ?1 \|\| ',') > 0
417		AND repo_crew.repo_id IN (${batch.map((_, n) => `?${n + 2}`).join(",")})
418		ORDER BY user.username COLLATE NOCASE`,
419		)
420		.all(role, ...batch),
421		);
422		}
423		const users = getUsersByIds(db, rows.map((r) => r.user_id));
424	491	const out = new Map<string, Agent[]>();
425		for (const row of rows) {
426		const user = users.get(row.user_id);
427		if (!user) continue;
428		const agent = agentOf(user, row);
429		const list = out.get(row.repo_id);
430		if (list) list.push(agent);
431		else out.set(row.repo_id, [agent]);
	492	for (const [repoId, seats] of crewSeats(db, repoIds)) {
	493	const agents = seats.filter((s) => s.held && s.role === role).map((s) => s.agent);
	494	if (agents.length > 0) out.set(repoId, agents);
432	495	}
433	496	return out;
434	497	}
		@@ -443,18 +506,5 @@ export function reposWithBuilder(
443	506	db: Database,
444	507	repoIds: readonly string[],
445	508	): Set<string> {
446		const out = new Set<string>();
447		const unique = [...new Set(repoIds)];
448		const CHUNK = 400;
449		for (let i = 0; i < unique.length; i += CHUNK) {
450		const batch = unique.slice(i, i + CHUNK);
451		const rows = db
452		.query<{ repo_id: string }, string[]>(
453		`SELECT DISTINCT repo_id FROM repo_crew JOIN agent ON agent.user_id = repo_crew.user_id
454		WHERE role = 'builder' AND instr(',' \|\| agent.roles \|\| ',', ',builder,') > 0 AND repo_id IN (${batch.map((_, n) => `?${n + 1}`).join(",")})`,
455		)
456		.all(...batch);
457		for (const row of rows) out.add(row.repo_id);
458		}
459		return out;
	509	return new Set(crewWithRole(db, repoIds, "builder").keys());
460	510	}
		@@ -104,6 +104,7 @@ const READER_KINDS: ReadonlySet<string> = new Set([
104	104	"team.deleted",
105	105	"team.member_added",
106	106	"team.member_removed",
	107	"team.member_role_set",
107	108	"forge.spawn.started",
108	109	"forge.spawned",
109	110	"forge.removed",
		@@ -0,0 +1,1 @@
	1	3817bca0554972817db65e07867ee49030e1cd103c3fe66c03a8f3c75c074a7b
		@@ -0,0 +1,9 @@
	1	// A team membership carries a role (#571): the crew of an org's repository is
	2	// the agents on its write and admin teams, each in the seat named here
	3	// (`crewSeats`, core/agents.ts). `member` holds no seat, so every row here
	4	// before keeps the crew it had. Additive:
	5	// one column with a default, applied once like every migration.
	6	export default `
	7	ALTER TABLE team_member ADD COLUMN role TEXT NOT NULL DEFAULT 'member'
	8	CHECK (role IN ('planner','builder','reviewer','member'));
	9	`;
		@@ -12,7 +12,8 @@ import { id } from "../kernel/id.ts";
12	12	import { err, ok, type Result } from "../kernel/result.ts";
13	13	import { forgetListings } from "./listings.ts";
14	14	import { reservedName } from "./reserved.ts";
15		import { getUserById, getUserByName, type User } from "./users.ts";
	15	import { isTeamRole, type TeamRole } from "./agents.ts";
	16	import { getUserById, getUserByName, getUsersByIds, type User } from "./users.ts";
16	17
17	18	export type Permission = "read" \| "write" \| "admin";
18	19	export type Access = "none" \| Permission;
		@@ -165,6 +166,7 @@ export function addTeamMember(
165	166	db: Database,
166	167	team: Team,
167	168	userId: string,
	169	role: TeamRole = "member",
168	170	): boolean {
169	171	const user = getUserById(db, userId);
170	172	if (!user \|\| user.kind === "org") return false; // can't nest orgs
		@@ -174,9 +176,9 @@ export function addTeamMember(
174	176	return (
175	177	db
176	178	.query(
177		"INSERT OR IGNORE INTO team_member (team_id, user_id) VALUES (?1, ?2)",
	179	"INSERT OR IGNORE INTO team_member (team_id, user_id, role) VALUES (?1, ?2, ?3)",
178	180	)
179		.run(team.id, userId).changes > 0
	181	.run(team.id, userId, role).changes > 0
180	182	);
181	183	}
182	184
		@@ -314,6 +316,55 @@ export function listTeamsVisibleTo(
314	316	.map(toTeam);
315	317	}
316	318
	319	/**
	320	* Set the role a member holds on a team (#571); false when they are not on
	321	* it or already hold it.
	322	*/
	323	export function setTeamRole(
	324	db: Database,
	325	teamId: string,
	326	userId: string,
	327	role: TeamRole,
	328	): boolean {
	329	return (
	330	db
	331	.query(
	332	"UPDATE team_member SET role = ?3 WHERE team_id = ?1 AND user_id = ?2 AND role <> ?3",
	333	)
	334	.run(teamId, userId, role).changes > 0
	335	);
	336	}
	337
	338	/** The role a member holds on a team, or undefined when they are not on it. */
	339	export function teamRoleOf(db: Database, teamId: string, userId: string): TeamRole \| undefined {
	340	const row = db
	341	.query<{ role: string }, [string, string]>(
	342	"SELECT role FROM team_member WHERE team_id = ?1 AND user_id = ?2",
	343	)
	344	.get(teamId, userId);
	345	if (!row) return undefined;
	346	return isTeamRole(row.role) ? row.role : "member";
	347	}
	348
	349	/** A team's members with the role each holds, by name. */
	350	export function listTeamMemberRoles(
	351	db: Database,
	352	teamId: string,
	353	): { user: User; role: TeamRole }[] {
	354	const rows = db
	355	.query<{ user_id: string; role: string }, [string]>(
	356	"SELECT user_id, role FROM team_member WHERE team_id = ?1",
	357	)
	358	.all(teamId);
	359	const users = getUsersByIds(db, rows.map((r) => r.user_id));
	360	return rows
	361	.flatMap((r) => {
	362	const user = users.get(r.user_id);
	363	return user ? [{ user, role: isTeamRole(r.role) ? r.role : ("member" as const) }] : [];
	364	})
	365	.sort((a, b) => a.user.username.toLowerCase().localeCompare(b.user.username.toLowerCase()));
	366	}
	367
317	368	export function listTeamMembers(db: Database, teamId: string): User[] {
318	369	const ids = db
319	370	.query<
		@@ -13,6 +13,7 @@ import {
13	13	} from "../../actions/orgs.ts";
14	14	import {
15	15	getOrg,
	16	listTeamMemberRoles,
16	17	listTeamMembers,
17	18	listTeams,
18	19	listTeamsVisibleTo,
		@@ -21,6 +22,7 @@ import {
21	22	} from "../../core/orgs.ts";
22	23	import { notePhase, takeSessionTime, timePhase } from "../../core/route_timing.ts";
23	24	import type { User } from "../../core/users.ts";
	25	import { isTeamRole, TEAM_ROLES, type TeamRole } from "../../core/agents.ts";
24	26	import { keyedPage, keyedWindow } from "../api.ts";
25	27	import type { Ctx, Handler } from "../context.ts";
26	28	import {
		@@ -146,7 +148,10 @@ export function orgRoutes(router: Router<Handler>): void {
146	148	const window = keyedWindow(ctx);
147	149	if (window instanceof Response) return window;
148	150	const members = timePhase(ctx.request, "members", () =>
149		listTeamMembers(ctx.app.db, found.team.id).map(publicProfile),
	151	listTeamMemberRoles(ctx.app.db, found.team.id).map(({ user, role }) => ({
	152	...publicProfile(user),
	153	role,
	154	})),
150	155	);
151	156	return timePhase(ctx.request, "render", () =>
152	157	tagged(ctx.request, keyedPage(members, (u) => u.username, window)),
		@@ -159,12 +164,15 @@ export function orgRoutes(router: Router<Handler>): void {
159	164	const found = loadTeam(ctx);
160	165	if ("error" in found) return found.error;
161	166	const input = await body(ctx.request);
	167	const role = roleOf(input.role);
	168	if (role instanceof Response) return role;
162	169	const added = addTeamMember(
163	170	ctx.app,
164	171	ctx.auth.user,
165	172	found.org,
166	173	found.team,
167	174	str(input.user),
	175	role,
168	176	);
169	177	if (!added.ok) return respondAccess(added.error, 422);
170	178	return json(added.value, added.value.added ? 201 : 200);
		@@ -178,6 +186,8 @@ export function orgRoutes(router: Router<Handler>): void {
178	186	if (denied) return denied;
179	187	const found = loadTeam(ctx);
180	188	if ("error" in found) return found.error;
	189	const role = roleOf(new URL(ctx.request.url).searchParams.get("role") ?? undefined);
	190	if (role instanceof Response) return role;
181	191	const username = ctx.params.username!;
182	192	const isMember = listTeamMembers(ctx.app.db, found.team.id).some(
183	193	(m) => m.username.toLowerCase() === username.toLowerCase(),
		@@ -188,6 +198,7 @@ export function orgRoutes(router: Router<Handler>): void {
188	198	found.org,
189	199	found.team,
190	200	username,
	201	role,
191	202	);
192	203	if (!removed.ok)
193	204	return removed.error === "last_owner"
		@@ -198,6 +209,18 @@ export function orgRoutes(router: Router<Handler>): void {
198	209	)
199	210	: respondAccess(removed.error, 422);
200	211	if (!isMember) return notFound();
	212	// Taking a role off someone who does not hold it finds nothing.
	213	if (role !== undefined && !removed.value.removed) return notFound();
201	214	return new Response(null, { status: 204 });
202	215	},
203	216	);}
	217
	218	/**
	219	* A team role from a request (#571): absent is undefined, one of
	220	* `TEAM_ROLES` is itself, anything else a 422.
	221	*/
	222	function roleOf(raw: unknown): TeamRole \| undefined \| Response {
	223	if (raw === undefined \|\| raw === null \|\| raw === "") return undefined;
	224	if (isTeamRole(raw)) return raw;
	225	return apiError("bad_role", 422, `role is one of ${TEAM_ROLES.join(", ")}`);
	226	}
		@@ -1,19 +1,22 @@
1	1	import { addTeamMember, createTeam, deleteTeam } from "../../../actions/orgs.ts";
2		import { getOrg, listTeams, type Permission } from "../../../core/orgs.ts";
	2	import { requireOrgAdmin } from "../../../actions/access.ts";
	3	import { isTeamRole, TEAM_ROLES } from "../../../core/agents.ts";
	4	import { getOrg, listTeamMemberRoles, listTeams, type Permission } from "../../../core/orgs.ts";
3	5	import { good, bad, type Tool } from "../shared.ts";
4	6
5	7	export const tool: Tool = {
6	8	name: "org_teams",
7		doc: "`{ org, action, team, user?, permission? }` (admin-scope token, an org owner): `create` a team (`permission` read, write or admin; read by default), `add_member` a `user`, or `remove` the team; the same as POST/DELETE `/api/v1/orgs/:org/teams`",
8		description: "An org's teams: create, add member, remove.",
	9	doc: "`{ org, action, team, user?, permission?, role? }` (admin-scope token, an org owner): `create` a team (`permission` read, write or admin; read by default), `add_member` a `user` with an optional `role` (planner, builder, reviewer or member; setting it on someone already there changes their role), list its `members` with their roles, or `remove` the team; the same as `/api/v1/orgs/:org/teams` and its `members`",
	10	description: "An org's teams: create, add member with a role, list members, remove.",
9	11	inputSchema: {
10	12	type: "object",
11	13	properties: {
12	14	org: { type: "string", maxLength: 64 },
13		action: { type: "string", enum: ["create", "add_member", "remove"] },
	15	action: { type: "string", enum: ["create", "add_member", "members", "remove"] },
14	16	team: { type: "string", maxLength: 64 },
15	17	user: { type: "string", maxLength: 64 },
16	18	permission: { type: "string", enum: ["read", "write", "admin"], description: "create" },
	19	role: { type: "string", enum: [...TEAM_ROLES], description: "add_member: the seat on the crew" },
17	20	},
18	21	required: ["org", "action", "team"],
19	22	},
		@@ -34,13 +37,24 @@ export const tool: Tool = {
34	37	const team = listTeams(ctx.app.db, org.id).find((t) => t.name.toLowerCase() === wanted);
35	38	if (!team) return bad("not_found", "no such team");
36	39	if (action === "add_member") {
37		const added = addTeamMember(ctx.app, user, org, team, typeof args["user"] === "string" ? args["user"] : "");
	40	const role = args["role"];
	41	if (role !== undefined && !isTeamRole(role))
	42	return bad("bad_role", `role is one of ${TEAM_ROLES.join(", ")}`);
	43	const who = typeof args["user"] === "string" ? args["user"] : "";
	44	const added = addTeamMember(ctx.app, user, org, team, who, role);
38	45	return added.ok ? good(added.value) : bad(added.error, added.error);
39	46	}
	47	if (action === "members") {
	48	// The same admin gate as the page: only an org admin manages its teams.
	49	if (!requireOrgAdmin(ctx.app, user, org).ok) return bad("not_found", "no such team");
	50	return good(
	51	listTeamMemberRoles(ctx.app.db, team.id).map((m) => ({ user: m.user.username, role: m.role })),
	52	);
	53	}
40	54	if (action === "remove") {
41	55	const gone = deleteTeam(ctx.app, user, org, team);
42	56	return gone.ok ? good({ removed: team.name }) : bad(gone.error, gone.error);
43	57	}
44		return bad("invalid", "action is create, add_member or remove");
	58	return bad("invalid", "action is create, add_member, members or remove");
45	59	},
46	60	};