feat(cli): multi-folder --shared at init + bdrive scope to edit the sync scope (#53)

* feat(cli): init --shared accepts multiple subfolders (repeatable or comma-separated)

--shared is now a slice flag: `--shared wiki --shared docs` or
`--shared wiki,docs` sync several subfolders into one project
(include list ["wiki/", "docs/"]). The interactive scope prompt takes a
space- or comma-separated list. Entries resolving to ".", "", or ".."
error out — silently dropping them would widen scope to the whole folder.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AubcaQscjcQucXwh578vqG

* docs(plugin): skills/commands propose multiple --shared folders at init

The init/install flows now scan for all knowledge folder candidates and
offer them as one --shared list (one project, one permission set), noting
that folders needing different access belong in separate projects.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AubcaQscjcQucXwh578vqG

* feat(cli): bdrive scope — add/remove shared subfolders without editing JSON

`bdrive scope` shows the include list; `scope add`/`scope rm` edit it from
the mount root. The daemon re-reads config each tick, so changes apply in
seconds. rm deletes nothing (newly filtered paths drop from the cache with
no delete op); removing the last entry is refused since an empty include
list means whole-folder sync. add onto a whole-folder project is refused
for the same narrowing hazard. Skill/README/docs updated; scope added to
the cli-sync diagram's command list.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AubcaQscjcQucXwh578vqG

* docs+cli: scoping guide covers multi-folder --shared and bdrive scope; init hints on ignored --shared at resume

The scoping guide (the dedicated page for this feature) now shows
--shared wiki,docs and a "Change the scope later" section for bdrive
scope; setup-by-hand and project-files point at it. init resume with an
explicit --shared now says the flag is ignored instead of staying silent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AubcaQscjcQucXwh578vqG

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

web/docs/src/content/docs/guides/scoping.md

@@ -1,6 +1,6 @@
 ---
 title: Scoping the folder
-description: Decide what agents can see — narrow a project to one subfolder, and opt files out with a gitignore-style .bdriveignore.
+description: Decide what agents can see — narrow a project to chosen subfolders, change the scope later with bdrive scope, and opt files out with a gitignore-style .bdriveignore.
 ---
 
 Shared agent memory works better when it's curated. A folder holding
@@ -12,15 +12,18 @@ subfolder, and **`.bdriveignore`** that opts individual paths out. Both are
 applied symmetrically — the same filter governs what's read from disk and what's
 written back to it.
 
-## Sync only a subfolder
+## Sync only subfolders
 
 ```sh
 bdrive init --shared wiki
+bdrive init --shared wiki,docs   # several subfolders, one project
 ```
 
 This is the right shape inside a code repository: sync `wiki/` or `docs/` and
 leave the source tree alone. The agent gets a knowledge folder; the code stays
-in git where it belongs. The interactive `bdrive init` asks the same question.
+in git where it belongs. `--shared` takes one folder or several — comma-separated
+or repeated — and they all join the same project, with one membership and one
+permission set. The interactive `bdrive init` asks the same question.
 
 The result lands in `.bdrive/config.json` as an include list:
 
@@ -29,6 +32,23 @@ The result lands in `.bdrive/config.json` as an include list:
   "remote": "https://drive.example.com/p/p-7f3a2c91", "include": ["wiki/"] }
 ```
 
+## Change the scope later
+
+`bdrive scope` shows the include list; `scope add` / `scope rm` edit it — no
+JSON editing, and the running daemon applies the change within seconds:
+
+```sh
+bdrive scope             # what syncs now
+bdrive scope add notes   # also sync ./notes
+bdrive scope rm docs     # stop syncing ./docs
+```
+
+Removing a folder stops syncing it but deletes nothing — local files stay, and
+the hub keeps everything already synced (the same
+[non-destructive rule](#opting-out-is-non-destructive) as `.bdriveignore`).
+Removing the *last* entry is refused, because an empty include list means the
+whole folder syncs; if you want to stop syncing entirely, that's `bdrive stop`.
+
 :::tip
 A `--shared` mount is also where the two-file
 [`AGENTS.md` pattern](/guides/shared-agent-memory/) earns its keep — the synced

web/docs/src/content/docs/manual/setup-by-hand.md

@@ -58,9 +58,11 @@ Init writes `.bdrive/config.json`, seeds a starter `.bdriveignore`
 in yet? It runs the login flow first.
 
 :::tip[Working inside a repository]
-Sync a subfolder rather than the repo root: `bdrive init --shared docs`. Git
-directories are never synced (per-file last-writer-wins would corrupt a
-repository), but a narrower scope keeps the sync surface honest.
+Sync subfolders rather than the repo root: `bdrive init --shared docs` (or
+several at once: `--shared wiki,docs`). Git directories are never synced
+(per-file last-writer-wins would corrupt a repository), but a narrower scope
+keeps the sync surface honest. Adjust it later with `bdrive scope add`/`rm` —
+see [Scoping the folder](/guides/scoping/).
 :::
 
 ## 3. Work normally

web/docs/src/content/docs/reference/cli.md

@@ -13,6 +13,7 @@ One binary, `bdrive` — the CLI, the sync daemon, and the web server.
 | `bdrive logout` | Sign this device out — clear the saved token and account. `--forget` also drops the remembered server |
 | `bdrive init [folder]` | Create or connect a project and start syncing. Interactive on a TTY; flags (`--name`, `--project`, `--shared`, `--yes`) for scripts. Re-run to resume |
 | `bdrive stop [folder]` | Stop syncing — daemon and agent sync hooks both pause. Files stay on disk; `bdrive init` resumes |
+| `bdrive scope [add\|rm <dirs...>]` | Show or change which subfolders sync — the include list set by `init --shared`. Run from the mount root; the daemon picks changes up in seconds. `rm` stops syncing a folder but deletes nothing, locally or on the hub |
 | `bdrive url [path]` | Internal hub link for a file or folder — sign-in and membership required. `--sync` pushes first; no argument gives the project home. Computed locally |
 | `bdrive share <file>` | Public URL for a synced file. `--list`, `--revoke`, `--expires` |
 | `bdrive sync [folder]` | Run one sync cycle now. Refuses folders this device never `init`ed and folders paused by `bdrive stop`. `--note <text>` stamps session context onto changes; `--note-ttl` (default 30m) bounds it. `--hook <label>` is agent-hook plumbing |
@@ -33,7 +34,8 @@ One binary, `bdrive` — the CLI, the sync daemon, and the web server.
 
 The front door. Interactive on a TTY, with survey menus for create-new versus
 connect-existing (showing a project list) and whole-folder versus
-`--shared <dir>` (which becomes the include list). Full flag bypass with
+`--shared <dirs>` (one or more subfolders, repeatable or comma-separated —
+`--shared wiki,docs` — which become the include list). Full flag bypass with
 `--name`, `--project`, `--shared`, `--yes`, and it never prompts without a TTY.
 
 It runs the login flow first when there is no session, writes

web/docs/src/content/docs/reference/project-files.md

@@ -18,7 +18,9 @@ plus project, remote, and include settings.
 ```
 
 Written by `bdrive init` and safe to hand-edit — a running daemon picks changes
-up automatically.
+up automatically. The `include` list (which subfolders sync, set by
+`init --shared`) has a friendlier editor: `bdrive scope add`/`rm` from the
+mount root.
 
 It is **never synced** and holds **no credentials**; the session token stays in
 `~/.bdrive`.