@great-arrow/cli 0.1.7 → 0.1.10

package/dist/index.js

@@ -5253,7 +5253,7 @@ var require_minimist = __commonJS({
 var require_rc = __commonJS({
   "node_modules/.pnpm/rc@1.2.8/node_modules/rc/index.js"(exports, module) {
     var cc = require_utils();
-    var join3 = __require("path").join;
+    var join5 = __require("path").join;
     var deepExtend = require_deep_extend();
     var etc = "/etc";
     var win = process.platform === "win32";
@@ -5278,15 +5278,15 @@ var require_rc = __commonJS({
       }
       if (!win)
         [
-          join3(etc, name, "config"),
-          join3(etc, name + "rc")
+          join5(etc, name, "config"),
+          join5(etc, name + "rc")
         ].forEach(addConfigFile);
       if (home)
         [
-          join3(home, ".config", name, "config"),
-          join3(home, ".config", name),
-          join3(home, "." + name, "config"),
-          join3(home, "." + name + "rc")
+          join5(home, ".config", name, "config"),
+          join5(home, ".config", name),
+          join5(home, "." + name, "config"),
+          join5(home, "." + name + "rc")
         ].forEach(addConfigFile);
       addConfigFile(cc.find("." + name + "rc"));
       if (env4.config) addConfigFile(env4.config);
@@ -6624,11 +6624,11 @@ var require_util = __commonJS({
           if (files.includes("node_modules") || files.includes("package.json") || files.includes("package.json5") || files.includes("package.yaml") || files.includes("pnpm-workspace.yaml")) {
             return name2;
           }
-          const dirname3 = path9.dirname(name2);
-          if (dirname3 === name2) {
+          const dirname4 = path9.dirname(name2);
+          if (dirname4 === name2) {
             return original;
           }
-          return find(dirname3, original);
+          return find(dirname4, original);
         } catch (error) {
           if (name2 === original) {
             if (error.code === "ENOENT") {
@@ -9278,6 +9278,13 @@ function networkError(message, hint) {
     hint ?? "Check your internet connection or run 'gad doctor'."
   );
 }
+function validationError(message, hint) {
+  return new CliError(
+    message,
+    3 /* VALIDATION_ERROR */,
+    hint ?? "Check the command usage with --help."
+  );
+}
 function mapStatusToExitCode(status) {
   if (status === 401 || status === 403) {
     return 1 /* AUTH_ERROR */;
@@ -9302,8 +9309,9 @@ function isNodeError(value) {
 
 // src/lib/version.ts
 var CLI_PACKAGE_NAME = "@great-arrow/cli";
-var CLI_VERSION = "0.1.6";
-var GAD_INSTALL_VERSION = "2026.06.22";
+var CLI_VERSION = "0.1.10";
+var GAD_INSTALL_VERSION = "2026.07.06";
+var GAD_INSTALL_MIN_VERSION = "2026.06.22";
 var GAD_INSTALL_HEADER = "X-GAD-Install-Version";
 var GAD_CLI_VERSION_HEADER = "X-GAD-CLI-Version";
 
@@ -9543,12 +9551,12 @@ h1{font-size:1.25rem;margin:0 0 .5rem}p{color:#9a9aa3;margin:0}</style></head>
 <body><div class="card"><h1>${ok ? "\u2713 Signed in to Great Arrow" : "\u2717 Sign-in failed"}</h1>
 <p>${escapeHtml(detail)}</p></div></body></html>`;
 function listen(port) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const server = createServer();
     server.on("error", reject);
     server.listen(port, LOOPBACK_HOST, () => {
       const addr = server.address();
-      resolve({ server, port: addr.port });
+      resolve3({ server, port: addr.port });
     });
   });
 }
@@ -9573,7 +9581,7 @@ async function startLoopbackServer(opts) {
     port,
     close: () => server.close(),
     waitForCallback({ timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-      return new Promise((resolve, reject) => {
+      return new Promise((resolve3, reject) => {
         const timer = setTimeout(() => {
           server.close();
           reject(new Error("Timed out waiting for the browser callback."));
@@ -9613,7 +9621,7 @@ async function startLoopbackServer(opts) {
               "You can close this tab and return to your terminal."
             )
           );
-          settle(() => resolve({ code, state }));
+          settle(() => resolve3({ code, state }));
         });
       });
     }
@@ -9867,11 +9875,11 @@ async function confirm(message) {
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     rl.question(`${message} [y/N] `, (answer) => {
       rl.close();
       const normalized = answer.trim().toLowerCase();
-      resolve(normalized === "y" || normalized === "yes");
+      resolve3(normalized === "y" || normalized === "yes");
     });
   });
 }
@@ -10038,10 +10046,10 @@ function maskToken(token) {
 }
 function openBrowser(url) {
   if (!/^https?:\/\//i.test(url)) return Promise.resolve(false);
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const platform = process.platform;
     const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
-    execFile(cmd, args, (error) => resolve(!error));
+    execFile(cmd, args, (error) => resolve3(!error));
   });
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Great Arrow Digital account").option(
@@ -10270,7 +10278,7 @@ function parseMcpPayload(result) {
 
 // src/lib/client.ts
 var DEFAULT_TIMEOUT_MS2 = 3e4;
-var MAX_RETRIES = 3;
+var MAX_RETRIES = 5;
 var BASE_DELAY_MS = 1e3;
 function detectGitOrigin() {
   try {
@@ -10300,8 +10308,21 @@ function isRetryable(error) {
 function isRetryableStatus(status) {
   return status >= 500 && status < 600;
 }
+function describeError(error) {
+  if (error instanceof Error) {
+    const cause = error.cause;
+    if (cause instanceof Error) {
+      return `${error.name}: ${error.message}; cause=${cause.name}: ${cause.message}`;
+    }
+    if (cause) {
+      return `${error.name}: ${error.message}; cause=${String(cause)}`;
+    }
+    return `${error.name}: ${error.message}`;
+  }
+  return String(error);
+}
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 var GadClient = class {
   token;
@@ -10432,7 +10453,7 @@ var GadClient = class {
     } catch (error) {
       if (error instanceof CliError) throw error;
       throw networkError(
-        `Network error calling MCP tool '${toolName}'.`,
+        `Network error calling MCP tool '${toolName}' (${describeError(error)}).`,
         "Check your internet connection or run 'gad doctor'."
       );
     }
@@ -10590,10 +10611,10 @@ function whoamiCommand() {
 
 // src/lib/stdin.ts
 function readStream(stream) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const chunks = [];
     stream.on("data", (chunk) => chunks.push(chunk));
-    stream.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+    stream.on("end", () => resolve3(Buffer.concat(chunks).toString("utf8")));
     stream.on("error", reject);
   });
 }
@@ -11215,14 +11236,928 @@ var claimCommand = new Command("claim").description("Preflight + atomically clai
 );
 var claim_default = claimCommand;
 
+// src/commands/work.ts
+import { readFileSync } from "node:fs";
+
+// src/lib/work-status.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+function run(command, args, cwd) {
+  try {
+    const stdout = execFileSync2(command, args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      maxBuffer: 10 * 1024 * 1024
+    });
+    return { status: 0, stdout, stderr: "" };
+  } catch (err) {
+    const e = err;
+    return {
+      status: e.status ?? 1,
+      stdout: e.stdout ?? "",
+      stderr: e.stderr ?? ""
+    };
+  }
+}
+function git(args, cwd) {
+  return run("git", args, cwd);
+}
+function requireGit(args, cwd) {
+  const result = git(args, cwd);
+  if (result.status !== 0) {
+    throw new Error(
+      `git ${args.join(" ")} failed: ${result.stderr.trim() || result.stdout.trim()}`
+    );
+  }
+  return result.stdout.trim();
+}
+function isAncestor(ancestor, ref, cwd) {
+  return git(["merge-base", "--is-ancestor", ancestor, ref], cwd).status === 0;
+}
+function revListCounts(head, cwd) {
+  const result = git(
+    ["rev-list", "--left-right", "--count", `origin/main...${head}`],
+    cwd
+  );
+  if (result.status !== 0) return { behindMain: 0, aheadMain: 0 };
+  const [behindRaw, aheadRaw] = result.stdout.trim().split(/\s+/);
+  const behind = Number(behindRaw ?? 0);
+  const ahead = Number(aheadRaw ?? 0);
+  return {
+    behindMain: Number.isFinite(behind) ? behind : 0,
+    aheadMain: Number.isFinite(ahead) ? ahead : 0
+  };
+}
+function parseWorktrees(raw) {
+  const worktrees = [];
+  let current = {};
+  function flush() {
+    if (current.path && current.head) {
+      worktrees.push({
+        path: current.path,
+        branch: current.branch ?? "(detached)",
+        head: current.head
+      });
+    }
+    current = {};
+  }
+  for (const line of raw.split("\n")) {
+    if (line === "") {
+      flush();
+    } else if (line.startsWith("worktree ")) {
+      current.path = line.slice("worktree ".length);
+    } else if (line.startsWith("HEAD ")) {
+      current.head = line.slice("HEAD ".length);
+    } else if (line.startsWith("branch refs/heads/")) {
+      current.branch = line.slice("branch refs/heads/".length);
+    } else if (line === "detached") {
+      current.branch = "(detached)";
+    }
+  }
+  flush();
+  return worktrees;
+}
+function classifyWorktree(audit) {
+  if (audit.path.includes("/.claude/worktrees/")) return "agent-harness";
+  if (audit.dirty) return "review-dirty";
+  if (audit.mergedToMain) return "cleanup-ready";
+  if (audit.upstreamGone) return "upstream-gone";
+  if (!audit.upstream) return "local-rescue";
+  return "active-unmerged";
+}
+function auditWorktrees(root) {
+  const raw = requireGit(["worktree", "list", "--porcelain"], root);
+  return parseWorktrees(raw).map((worktree) => {
+    const status = git(["status", "--porcelain"], worktree.path).stdout.trim();
+    const branchStatus = git(["status", "--short", "--branch"], worktree.path).stdout.split("\n")[0]?.trim();
+    const upstream = git(
+      ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"],
+      worktree.path
+    );
+    const counts = revListCounts(worktree.head, root);
+    const baseAudit = {
+      path: worktree.path,
+      branch: worktree.branch,
+      head: worktree.head,
+      dirty: status.length > 0,
+      mergedToMain: isAncestor(worktree.head, "origin/main", root),
+      upstream: upstream.status === 0 ? upstream.stdout.trim() : null,
+      upstreamGone: branchStatus?.includes("[gone]") ?? false,
+      ...counts
+    };
+    return { ...baseAudit, classification: classifyWorktree(baseAudit) };
+  });
+}
+function auditDetachedLocalBranches(root, checkedOutBranches) {
+  const raw = requireGit(
+    ["for-each-ref", "--format=%(refname:short)", "refs/heads"],
+    root
+  );
+  return raw.split("\n").map((branch) => branch.trim()).filter(Boolean).filter((branch) => !checkedOutBranches.has(branch)).map((branch) => {
+    const head = requireGit(["rev-parse", branch], root);
+    const counts = revListCounts(head, root);
+    return {
+      branch,
+      head,
+      mergedToMain: isAncestor(head, "origin/main", root),
+      ...counts
+    };
+  });
+}
+function readOpenPullRequests(root) {
+  const result = run(
+    "gh",
+    [
+      "pr",
+      "list",
+      "--state",
+      "open",
+      "--limit",
+      "50",
+      "--json",
+      "number,title,headRefName,mergeStateStatus,isDraft,url"
+    ],
+    root
+  );
+  if (result.status !== 0) return [];
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    return [];
+  }
+}
+async function readProductionVersion(apiUrl) {
+  const controller = new AbortController();
+  const timeout2 = setTimeout(() => controller.abort(), 8e3);
+  try {
+    const response = await fetch(`${apiUrl.replace(/\/$/, "")}/api/version`, {
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    return await response.json();
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout2);
+  }
+}
+function countBy(values) {
+  return values.reduce(
+    (counts, value) => {
+      counts[value] = (counts[value] ?? 0) + 1;
+      return counts;
+    },
+    {}
+  );
+}
+async function collectWorkStatus(opts) {
+  const root = requireGit(["rev-parse", "--show-toplevel"]);
+  if (opts.fetchRemote !== false) {
+    git(["fetch", "origin", "main", "--prune"], root);
+  }
+  const originMain = requireGit(["rev-parse", "origin/main"], root);
+  const originMainSubject = requireGit(
+    ["log", "-1", "--pretty=%s", "origin/main"],
+    root
+  );
+  const currentBranch = requireGit(["branch", "--show-current"], root);
+  const currentHead = requireGit(["rev-parse", "HEAD"], root);
+  const currentClean = git(["status", "--porcelain"], root).stdout.trim().length === 0;
+  const stashes = git(["stash", "list"], root).stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+  const worktrees = auditWorktrees(root);
+  const checkedOutBranches = new Set(
+    worktrees.map((worktree) => worktree.branch).filter((branch) => branch !== "(detached)")
+  );
+  const detachedBranches = auditDetachedLocalBranches(root, checkedOutBranches);
+  const openPullRequests = readOpenPullRequests(root);
+  const production = opts.includeProduction === false ? null : await readProductionVersion(opts.apiUrl);
+  const productionSha = production?.sha ?? null;
+  const productionContainedByMain = productionSha ? isAncestor(productionSha, "origin/main", root) : null;
+  const productionAtMain = productionSha === originMain;
+  const detachedUnmerged = detachedBranches.filter(
+    (branch) => !branch.mergedToMain
+  );
+  const blockedPrs = openPullRequests.filter(
+    (pr) => pr.isDraft || !["CLEAN", "HAS_HOOKS"].includes(pr.mergeStateStatus)
+  );
+  return {
+    root,
+    current: {
+      branch: currentBranch,
+      head: currentHead,
+      clean: currentClean,
+      containedByMain: isAncestor(currentHead, "origin/main", root)
+    },
+    originMain: { sha: originMain, subject: originMainSubject },
+    production: production ? {
+      ...production,
+      containedByMain: productionContainedByMain,
+      atOriginMain: productionAtMain
+    } : null,
+    summary: {
+      worktrees: worktrees.length,
+      worktreeClassifications: countBy(
+        worktrees.map((worktree) => worktree.classification)
+      ),
+      detachedLocalBranches: detachedBranches.length,
+      detachedUnmergedBranches: detachedUnmerged.length,
+      stashes: stashes.length,
+      openPullRequests: openPullRequests.length,
+      blockedPullRequests: blockedPrs.length
+    },
+    worktrees,
+    detachedBranches,
+    openPullRequests,
+    strictFailures: []
+  };
+}
+
+// src/commands/work.ts
+function writeJson(value) {
+  process.stdout.write(`${JSON.stringify(value)}
+`);
+}
+function shortSha(value) {
+  return typeof value === "string" ? value.slice(0, 12) : "";
+}
+function collectOptions(opts) {
+  const result = { apiUrl: opts.apiUrl };
+  if (opts.fetch !== void 0) result.fetchRemote = opts.fetch;
+  if (opts.production !== void 0) result.includeProduction = opts.production;
+  return result;
+}
+function workCommand() {
+  const cmd = new Command("work").description(
+    "Inspect and publish unshipped work / work-at-risk state"
+  );
+  cmd.command("status").description("Show canonical work-at-risk state for the active workspace").option("--local", "Run a local git/worktree audit instead of app state").option("--no-fetch", "Skip git fetch when using --local").option(
+    "--no-production",
+    "Skip production version probe when using --local"
+  ).option("--limit <n>", "Maximum app rows to show", "20").action(
+    async (options, actionCmd) => {
+      const output = globalOutputOpts(actionCmd);
+      const fmt = createFormatter({
+        ...output,
+        isTTY: isTTY()
+      });
+      const auth = await resolveAuth();
+      if (options.local) {
+        const report = await collectWorkStatus({
+          ...collectOptions({
+            apiUrl: auth.apiUrl,
+            fetch: options.fetch,
+            production: options.production
+          })
+        });
+        if (output.json) return writeJson(report);
+        fmt.detail(
+          {
+            current: `${report.current.branch || "(detached)"} @ ${shortSha(
+              report.current.head
+            )}`,
+            clean: report.current.clean,
+            worktrees: report.summary.worktrees,
+            dirty: report.summary.worktreeClassifications["review-dirty"] ?? 0,
+            activeUnmerged: report.summary.worktreeClassifications["active-unmerged"] ?? 0,
+            detachedUnmerged: report.summary.detachedUnmergedBranches,
+            blockedPrs: report.summary.blockedPullRequests,
+            stashes: report.summary.stashes
+          },
+          [
+            { key: "current", header: "Current" },
+            { key: "clean", header: "Clean" },
+            { key: "worktrees", header: "Worktrees" },
+            { key: "dirty", header: "Dirty" },
+            { key: "activeUnmerged", header: "Unmerged" },
+            { key: "detachedUnmerged", header: "Detached" },
+            { key: "blockedPrs", header: "Blocked PRs" },
+            { key: "stashes", header: "Stashes" }
+          ]
+        );
+        return;
+      }
+      const client = new GadClient({
+        token: auth.token,
+        apiUrl: auth.apiUrl
+      });
+      const data = await client.get("/api/work/status", {
+        limit: String(Number.parseInt(options.limit ?? "20", 10) || 20)
+      });
+      if (output.json) return writeJson(data);
+      const items = Array.isArray(data.items) ? data.items : [];
+      fmt.table(items, [
+        { key: "riskLevel", header: "Risk" },
+        { key: "title", header: "Item" },
+        { key: "recommendedAction", header: "Action" }
+      ]);
+    }
+  );
+  cmd.command("publish").description("Publish the local release audit into the active workspace").option("--file <path>", "Publish a precomputed release-audit JSON file").option("--no-fetch", "Skip git fetch before collecting local status").option("--no-production", "Skip production version probe").option("--machine-id <id>", "Stable machine/session identifier").action(
+    async (options, actionCmd) => {
+      const output = globalOutputOpts(actionCmd);
+      const fmt = createFormatter({
+        ...output,
+        isTTY: isTTY()
+      });
+      const auth = await resolveAuth();
+      const client = new GadClient({
+        token: auth.token,
+        apiUrl: auth.apiUrl
+      });
+      const report = options.file ? JSON.parse(readFileSync(options.file, "utf8")) : await collectWorkStatus({
+        ...collectOptions({
+          apiUrl: auth.apiUrl,
+          fetch: options.fetch,
+          production: options.production
+        })
+      });
+      const result = await client.post("/api/work/publish", {
+        schemaVersion: 1,
+        kind: "release-logjam",
+        clientSource: "gad-cli",
+        machineId: options.machineId,
+        report
+      });
+      if (output.json) return writeJson(result);
+      const r = result;
+      fmt.success(
+        `Published work-at-risk snapshot (${r.itemCount ?? 0} item${r.itemCount === 1 ? "" : "s"}, ${r.resolvedCount ?? 0} resolved).`
+      );
+      if (Array.isArray(r.topItems) && r.topItems.length > 0) {
+        fmt.table(r.topItems, [
+          { key: "riskLevel", header: "Risk" },
+          { key: "title", header: "Item" },
+          { key: "recommendedAction", header: "Action" }
+        ]);
+      }
+    }
+  );
+  return cmd;
+}
+var work_default = workCommand;
+
+// src/commands/worktree.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { existsSync, readFileSync as readFileSync2, statSync, writeFileSync } from "node:fs";
+import { basename, dirname as dirname2, isAbsolute, join as join2, resolve } from "node:path";
+var realExec = (cmd, args, opts) => {
+  const out = execFileSync3(cmd, args, {
+    cwd: opts?.cwd,
+    encoding: "utf8",
+    stdio: opts?.inherit ? ["ignore", "inherit", "inherit"] : ["ignore", "pipe", "pipe"]
+  });
+  return typeof out === "string" ? out : "";
+};
+function assertCleanTree(statusPorcelain) {
+  if (statusPorcelain.trim().length === 0) return;
+  throw validationError(
+    "Working tree is dirty \u2014 commit, stash, or clean up uncommitted changes first.",
+    "A new task worktree must start from a clean state so another task's in-flight files can't leak into your first commit."
+  );
+}
+function parseDefaultBranch(symbolicRef) {
+  if (!symbolicRef) return null;
+  const match = symbolicRef.trim().match(/^refs\/remotes\/origin\/(.+)$/);
+  return match ? match[1] : null;
+}
+function detectPackageManager(repoRoot) {
+  if (existsSync(join2(repoRoot, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync(join2(repoRoot, "bun.lockb"))) return "bun";
+  if (existsSync(join2(repoRoot, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function defaultWorktreeDir(repoRoot, branch) {
+  const slug = (branch.split("/").pop() ?? branch).replace(
+    /[^A-Za-z0-9._-]+/g,
+    "-"
+  );
+  return join2(dirname2(repoRoot), `${basename(repoRoot)}-${slug}`);
+}
+var AGENT_PROCESS_RE = /(^|\/)(claude|kiro|cursor|codex)/i;
+function psField(pid, field) {
+  try {
+    return execFileSync3("ps", ["-o", `${field}=`, "-p", String(pid)], {
+      encoding: "utf8"
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+function findAgentPid(startPid) {
+  let pid = Number(startPid);
+  for (let i = 0; i < 40 && pid > 1; i++) {
+    if (AGENT_PROCESS_RE.test(basename(psField(pid, "comm")))) return pid;
+    const ppid = Number(psField(pid, "ppid"));
+    if (!ppid || ppid === pid) break;
+    pid = ppid;
+  }
+  return null;
+}
+function ownGitDir(worktreeDir) {
+  const dotGit = join2(worktreeDir, ".git");
+  if (!existsSync(dotGit)) return null;
+  if (statSync(dotGit).isDirectory()) return dotGit;
+  const match = readFileSync2(dotGit, "utf8").trim().match(/^gitdir:\s*(.+)$/m);
+  if (!match) return null;
+  return isAbsolute(match[1]) ? match[1] : resolve(worktreeDir, match[1]);
+}
+function stampWorktreeOwner(worktreeDir) {
+  try {
+    if (process.platform === "win32") return null;
+    const gitDir = ownGitDir(worktreeDir);
+    if (!gitDir) return null;
+    const ownerPid = findAgentPid(process.ppid);
+    if (!ownerPid) return null;
+    writeFileSync(
+      join2(gitDir, "agent-owner.json"),
+      JSON.stringify(
+        {
+          ownerPid,
+          comm: basename(psField(ownerPid, "comm")),
+          stampedAt: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        null,
+        2
+      )
+    );
+    return ownerPid;
+  } catch {
+    return null;
+  }
+}
+function createTaskWorktree(opts) {
+  const exec2 = opts.exec ?? realExec;
+  const cwd = opts.cwd ?? process.cwd();
+  const { branch } = opts;
+  let repoRoot;
+  try {
+    repoRoot = exec2("git", ["rev-parse", "--show-toplevel"], { cwd }).trim();
+  } catch {
+    throw validationError(
+      "Not inside a git repository.",
+      "Run this from the repo you want a task worktree for."
+    );
+  }
+  assertCleanTree(exec2("git", ["status", "--porcelain"], { cwd: repoRoot }));
+  let fetched = true;
+  try {
+    exec2("git", ["fetch", "origin", "--quiet"], { cwd: repoRoot });
+  } catch {
+    fetched = false;
+  }
+  let base = null;
+  try {
+    base = parseDefaultBranch(
+      exec2("git", ["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"], {
+        cwd: repoRoot
+      })
+    );
+  } catch {
+    base = null;
+  }
+  if (!base) {
+    for (const candidate of ["main", "master"]) {
+      try {
+        exec2(
+          "git",
+          [
+            "show-ref",
+            "--verify",
+            "--quiet",
+            `refs/remotes/origin/${candidate}`
+          ],
+          { cwd: repoRoot }
+        );
+        base = candidate;
+        break;
+      } catch {
+      }
+    }
+  }
+  if (!base) {
+    throw validationError(
+      "Could not determine the origin default branch.",
+      "Ensure the repo has an 'origin' remote with a main or master branch (git fetch origin)."
+    );
+  }
+  let branchExists = false;
+  try {
+    exec2("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`], {
+      cwd: repoRoot
+    });
+    branchExists = true;
+  } catch {
+    branchExists = false;
+  }
+  if (branchExists) {
+    throw validationError(
+      `Branch '${branch}' already exists locally \u2014 pick a new name or remove it.`
+    );
+  }
+  const dir = opts.dir ? resolve(cwd, opts.dir) : defaultWorktreeDir(repoRoot, branch);
+  const baseRef = `origin/${base}`;
+  exec2("git", ["worktree", "add", dir, "-b", branch, baseRef], {
+    cwd: repoRoot
+  });
+  const stampedPid = opts.stamp === false ? null : stampWorktreeOwner(dir);
+  const packageManager = detectPackageManager(repoRoot);
+  let installed = false;
+  if (opts.install !== false && existsSync(join2(repoRoot, "package.json"))) {
+    exec2(packageManager, ["install"], { cwd: dir, inherit: true });
+    installed = true;
+  }
+  return {
+    dir,
+    branch,
+    baseRef,
+    packageManager,
+    installed,
+    fetched,
+    stampedPid
+  };
+}
+var worktreeCommand = new Command("worktree").description(
+  "Isolated task worktrees for parallel agents"
+);
+worktreeCommand.command("new").description(
+  "Create a fresh worktree on a new branch off the origin default branch, with a real install"
+).argument("<branch>", "New branch name (e.g. feat/fix-login)").argument("[dir]", "Target directory (default: sibling <repo>-<slug>)").option("--no-install", "Skip the dependency install step").action((branch, dir, _options, cmd) => {
+  const parentOpts = cmd.optsWithGlobals();
+  const fmt = createFormatter({
+    json: parentOpts.json || false,
+    quiet: parentOpts.quiet || false,
+    isTTY: isTTY(),
+    noColor: parentOpts.noColor || false
+  });
+  const localOpts = cmd.opts();
+  const result = createTaskWorktree({
+    branch,
+    ...dir ? { dir } : {},
+    install: localOpts.install
+  });
+  if (parentOpts.json) {
+    process.stdout.write(JSON.stringify(result) + "\n");
+    return;
+  }
+  if (!result.fetched) {
+    fmt.warn(
+      "Could not fetch origin \u2014 branched off the last locally known " + result.baseRef + "."
+    );
+  }
+  fmt.success(
+    `Worktree ready: ${result.dir} on ${result.branch} (based on ${result.baseRef}).`
+  );
+  if (result.stampedPid) {
+    fmt.info(
+      "Stamped this agent session as the worktree owner (pairs with 'gad install-hooks')."
+    );
+  }
+  if (!result.installed) {
+    fmt.info(
+      `Install skipped \u2014 run '${result.packageManager} install' inside the worktree before building.`
+    );
+  }
+  fmt.info(`Next: cd ${result.dir}`);
+  fmt.info(`Done: git worktree remove ${result.dir}`);
+});
+var worktree_default = worktreeCommand;
+
+// src/commands/install-hooks.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import {
+  chmodSync,
+  existsSync as existsSync2,
+  mkdirSync,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { isAbsolute as isAbsolute2, join as join3, resolve as resolve2 } from "node:path";
+var GUARD_MARKER = "# gad-agent-guard v1";
+var SCHEMA_AUDIT_MARKER = "# gad-schema-audit v1";
+var GUARD_FILE = "gad-commit-guard.mjs";
+var realExec2 = (cmd, args, opts) => execFileSync4(cmd, args, {
+  cwd: opts?.cwd,
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "pipe"]
+});
+function buildGuardScript() {
+  return `#!/usr/bin/env node
+// gad-agent-guard v1 \u2014 pre-commit backstop against cross-worktree clobber.
+// Installed by \`gad install-hooks\`. Blocks a commit made inside a worktree
+// owned by a DIFFERENT still-live agent session. FAILS OPEN on every
+// ambiguity (no marker, dead owner, human committer, unsupported platform).
+// Deliberate override: ALLOW_FOREIGN_WORKTREE=1.
+import { existsSync, statSync, readFileSync } from "node:fs";
+import { join, basename, isAbsolute, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
+
+const OWNER_FILE = "agent-owner.json";
+const AGENT_RE = /(^|\\/)(claude|kiro|cursor|codex)/i;
+
+function psField(pid, field) {
+  try {
+    return execFileSync("ps", ["-o", field + "=", "-p", String(pid)], {
+      encoding: "utf8",
+    }).trim();
+  } catch {
+    return "";
+  }
+}
+
+function ancestry(startPid) {
+  const pids = new Set();
+  let pid = Number(startPid);
+  for (let i = 0; i < 40 && pid > 1; i++) {
+    pids.add(pid);
+    const ppid = Number(psField(pid, "ppid"));
+    if (!ppid || ppid === pid) break;
+    pid = ppid;
+  }
+  return pids;
+}
+
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function ownGitDir(cwd) {
+  const dotGit = join(cwd, ".git");
+  if (!existsSync(dotGit)) return null;
+  if (statSync(dotGit).isDirectory()) return dotGit;
+  const m = readFileSync(dotGit, "utf8").trim().match(/^gitdir:\\s*(.+)$/m);
+  if (!m) return null;
+  return isAbsolute(m[1]) ? m[1] : resolve(cwd, m[1]);
+}
+
+function evaluate(cwd, env) {
+  if (env.ALLOW_FOREIGN_WORKTREE) return { block: false, reason: "override" };
+  if (process.platform === "win32")
+    return { block: false, reason: "unsupported-platform" };
+  const isAgent =
+    env.CLAUDECODE ||
+    env.CLAUDE_CODE ||
+    env.KIRO_AGENT ||
+    env.CURSOR_AGENT ||
+    env.CODEX_AGENT ||
+    env.AGENT_SESSION;
+  if (!isAgent) return { block: false, reason: "not-an-agent" };
+  const gd = ownGitDir(cwd);
+  if (!gd) return { block: false, reason: "no-gitdir" };
+  const markerPath = join(gd, OWNER_FILE);
+  if (!existsSync(markerPath)) return { block: false, reason: "no-marker" };
+  let owner;
+  try {
+    owner = JSON.parse(readFileSync(markerPath, "utf8"));
+  } catch {
+    return { block: false, reason: "marker-unreadable" };
+  }
+  if (!owner || !owner.ownerPid)
+    return { block: false, reason: "marker-no-owner" };
+  const anc = ancestry(process.ppid);
+  if (anc.has(Number(owner.ownerPid)))
+    return { block: false, reason: "owner-match" };
+  if (!isAlive(Number(owner.ownerPid)))
+    return { block: false, reason: "owner-dead" };
+  return { block: true, reason: "foreign-owner ownerPid=" + owner.ownerPid };
+}
+
+const { block, reason } = evaluate(process.cwd(), process.env);
+if (block) {
+  console.error("");
+  console.error(
+    "gad-agent-guard: commit blocked \u2014 this worktree belongs to a DIFFERENT live agent session.",
+  );
+  console.error("  " + reason);
+  console.error(
+    "  You are about to commit another agent's in-flight work. Use your own worktree:",
+  );
+  console.error("    gad worktree new <branch>");
+  console.error("  Deliberate override: ALLOW_FOREIGN_WORKTREE=1");
+  console.error("");
+  process.exit(1);
+}
+`;
+}
+function buildHookBlock() {
+  return `${GUARD_MARKER} (managed by \`gad install-hooks\` \u2014 do not edit this block)
+if command -v node >/dev/null 2>&1; then
+  gad_guard_dir="$(git rev-parse --git-common-dir 2>/dev/null)"
+  if [ -n "$gad_guard_dir" ] && [ -f "$gad_guard_dir/hooks/${GUARD_FILE}" ]; then
+    node "$gad_guard_dir/hooks/${GUARD_FILE}" || exit 1
+  fi
+fi
+`;
+}
+function buildSchemaAuditHookBlock() {
+  return `${SCHEMA_AUDIT_MARKER} (managed by \`gad install-hooks\` \u2014 do not edit this block)
+if [ -f package.json ] && grep -q '"schema:audit"' package.json; then
+  if command -v pnpm >/dev/null 2>&1; then
+    pnpm schema:audit --pre-push || exit 1
+  else
+    echo "gad-schema-audit: pnpm not found; skipping schema audit" >&2
+  fi
+fi
+`;
+}
+function planHookInstall(existing) {
+  if (existing !== null && existing.includes(GUARD_MARKER)) {
+    return { action: "noop", content: existing };
+  }
+  if (existing === null) {
+    return { action: "create", content: `#!/bin/sh
+${buildHookBlock()}` };
+  }
+  return {
+    action: "append",
+    content: `${existing.trimEnd()}
+
+${buildHookBlock()}`
+  };
+}
+function planSchemaAuditHookInstall(existing) {
+  if (existing !== null && existing.includes(SCHEMA_AUDIT_MARKER)) {
+    return { action: "noop", content: existing };
+  }
+  if (existing === null) {
+    return {
+      action: "create",
+      content: `#!/bin/sh
+${buildSchemaAuditHookBlock()}`
+    };
+  }
+  return {
+    action: "append",
+    content: `${existing.trimEnd()}
+
+${buildSchemaAuditHookBlock()}`
+  };
+}
+function installCommitGuard(opts) {
+  const exec2 = opts?.exec ?? realExec2;
+  const cwd = opts?.cwd ?? process.cwd();
+  let repoRoot;
+  let commonDir;
+  try {
+    repoRoot = exec2("git", ["rev-parse", "--show-toplevel"], { cwd }).trim();
+    commonDir = exec2("git", ["rev-parse", "--git-common-dir"], {
+      cwd: repoRoot
+    }).trim();
+  } catch {
+    throw validationError(
+      "Not inside a git repository.",
+      "Run this from the repo whose commits you want guarded."
+    );
+  }
+  if (!isAbsolute2(commonDir)) commonDir = resolve2(repoRoot, commonDir);
+  const hooksDir = join3(commonDir, "hooks");
+  mkdirSync(hooksDir, { recursive: true });
+  const guardPath = join3(hooksDir, GUARD_FILE);
+  writeFileSync2(guardPath, buildGuardScript());
+  chmodSync(guardPath, 493);
+  const huskyHook = join3(repoRoot, ".husky", "pre-commit");
+  const hookPath = existsSync2(huskyHook) ? huskyHook : join3(hooksDir, "pre-commit");
+  const existing = existsSync2(hookPath) ? readFileSync3(hookPath, "utf8") : null;
+  const plan = planHookInstall(existing);
+  if (plan.action !== "noop") {
+    writeFileSync2(hookPath, plan.content);
+  }
+  chmodSync(hookPath, 493);
+  const huskyDir = join3(repoRoot, ".husky");
+  const huskyPrePush = join3(huskyDir, "pre-push");
+  const schemaAuditHookPath = existsSync2(huskyPrePush) || existsSync2(huskyDir) ? huskyPrePush : join3(hooksDir, "pre-push");
+  const existingSchemaAuditHook = existsSync2(schemaAuditHookPath) ? readFileSync3(schemaAuditHookPath, "utf8") : null;
+  const schemaAuditPlan = planSchemaAuditHookInstall(existingSchemaAuditHook);
+  if (schemaAuditPlan.action !== "noop") {
+    writeFileSync2(schemaAuditHookPath, schemaAuditPlan.content);
+  }
+  chmodSync(schemaAuditHookPath, 493);
+  return {
+    guardPath,
+    hookPath,
+    action: plan.action,
+    schemaAuditHookPath,
+    schemaAuditAction: schemaAuditPlan.action
+  };
+}
+var installHooksCommand = new Command("install-hooks").description(
+  "Install the fail-open agent commit guard into this repo's pre-commit hook (idempotent)"
+).action((_options, cmd) => {
+  const parentOpts = cmd.optsWithGlobals();
+  const fmt = createFormatter({
+    json: parentOpts.json || false,
+    quiet: parentOpts.quiet || false,
+    isTTY: isTTY(),
+    noColor: parentOpts.noColor || false
+  });
+  const result = installCommitGuard();
+  if (parentOpts.json) {
+    process.stdout.write(JSON.stringify(result) + "\n");
+    return;
+  }
+  if (result.action === "noop") {
+    fmt.success(`Commit guard already installed at ${result.hookPath}.`);
+  } else {
+    fmt.success(
+      `Commit guard ${result.action === "append" ? "chained into" : "installed at"} ${result.hookPath}.`
+    );
+  }
+  if (result.schemaAuditAction === "noop") {
+    fmt.success(
+      `Schema audit pre-push hook already installed at ${result.schemaAuditHookPath}.`
+    );
+  } else {
+    fmt.success(
+      `Schema audit pre-push hook ${result.schemaAuditAction === "append" ? "chained into" : "installed at"} ${result.schemaAuditHookPath}.`
+    );
+  }
+  fmt.info(
+    "The guard fails open for humans and dead sessions; override deliberately with ALLOW_FOREIGN_WORKTREE=1."
+  );
+  fmt.info(
+    "Pair with 'gad worktree new <branch>' so each agent session owns its worktree."
+  );
+});
+var install_hooks_default = installHooksCommand;
+
+// src/commands/guardrails.ts
+function writeJson2(value) {
+  process.stdout.write(`${JSON.stringify(value)}
+`);
+}
+function normalizeResponse(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+async function createClient2() {
+  const auth = await resolveAuth();
+  return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
+}
+function renderGuardrails(data, cmd) {
+  const output = globalOutputOpts(cmd);
+  const fmt = createFormatter({ ...output, isTTY: isTTY() });
+  if (output.json) return writeJson2(data);
+  const guardrails = Array.isArray(data.guardrails) ? data.guardrails : [];
+  fmt.table(
+    guardrails.map((guardrail) => ({
+      ...guardrail,
+      state: guardrail.enabled ? "on" : "off",
+      surfacesLabel: guardrail.surfaces.join(", ")
+    })),
+    [
+      { key: "state", header: "State" },
+      { key: "id", header: "ID" },
+      { key: "title", header: "Guardrail" },
+      { key: "command", header: "Command" },
+      { key: "surfacesLabel", header: "Surfaces" }
+    ]
+  );
+}
+function guardrailsCommand() {
+  const cmd = new Command("guardrails").description(
+    "List and manage optional engineering guardrails for the active workspace"
+  );
+  cmd.command("list").description("List guardrails, explanations, commands, and enabled state").action(async (_options, actionCmd) => {
+    const client = await createClient2();
+    const result = normalizeResponse(
+      await client.mcpCall("engineering_guardrails_list", {})
+    );
+    renderGuardrails(result, actionCmd);
+  });
+  cmd.command("enable").description("Enable a guardrail for the active workspace").argument("<id>", "Guardrail id from `gad guardrails list`").action(async (id, _options, actionCmd) => {
+    const client = await createClient2();
+    const result = normalizeResponse(
+      await client.mcpCall("engineering_guardrails_update", {
+        id,
+        enabled: true
+      })
+    );
+    renderGuardrails(result, actionCmd);
+  });
+  cmd.command("disable").description("Disable a guardrail for the active workspace").argument("<id>", "Guardrail id from `gad guardrails list`").action(async (id, _options, actionCmd) => {
+    const client = await createClient2();
+    const result = normalizeResponse(
+      await client.mcpCall("engineering_guardrails_update", {
+        id,
+        enabled: false
+      })
+    );
+    renderGuardrails(result, actionCmd);
+  });
+  return cmd;
+}
+
 // src/commands/doctor.ts
-import { existsSync } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 import { copyFile, mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { dirname as dirname3, join as join4 } from "node:path";
 
 // src/lib/codex-config.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 var CODEX_SERVER_NAME = "great-arrow";
 var CODEX_CLIENT_ID = "codex-cli";
 var SAFE_GLOBAL_MCP_SERVERS = /* @__PURE__ */ new Set([
@@ -11245,13 +12180,31 @@ function mcpEndpoint(apiUrl) {
 function tomlEscape(value) {
   return value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
 }
+function compareVersion(a, b) {
+  if (!a && !b) return 0;
+  if (!a) return -1;
+  if (!b) return 1;
+  const left = a.match(/\d+|[a-z]+/gi) ?? [];
+  const right = b.match(/\d+|[a-z]+/gi) ?? [];
+  const length = Math.max(left.length, right.length);
+  for (let i = 0; i < length; i += 1) {
+    const l = left[i] ?? "0";
+    const r = right[i] ?? "0";
+    const ln = Number(l);
+    const rn = Number(r);
+    const bothNumeric = Number.isFinite(ln) && Number.isFinite(rn);
+    if (bothNumeric && ln !== rn) return ln > rn ? 1 : -1;
+    if (!bothNumeric && l !== r) return l > r ? 1 : -1;
+  }
+  return 0;
+}
 function detectGitOrigin2(cwd = process.cwd()) {
   try {
     const env4 = { ...process.env };
     for (const key of Object.keys(env4)) {
       if (key.startsWith("GIT_")) delete env4[key];
     }
-    const url = execFileSync2(
+    const url = execFileSync5(
       "git",
       ["-C", cwd, "remote", "get-url", "origin"],
       {
@@ -11381,9 +12334,29 @@ function extractConfiguredRepoKeys(text) {
   }
   return [...keys];
 }
-function hasJobbyJobMarker(server, text) {
-  return /jobby\s*job|jobbyjob|jobbyjob\.ai/i.test(`${server}
-${text}`);
+function extractInstallVersion(text) {
+  const escapedHeader = GAD_INSTALL_HEADER.replace(
+    /[.*+?^${}()|[\]\\]/g,
+    "\\$&"
+  );
+  const match = text.match(
+    new RegExp(`^\\s*${escapedHeader}\\s*=\\s*"([^"]+)"\\s*$`, "m")
+  );
+  return match?.[1]?.trim() || null;
+}
+function localPathArgs(text) {
+  return [...text.matchAll(/"((?:\/|~\/)[^"]+)"/g)].map((m) => m[1] ?? "");
+}
+function hasForeignRepoMarker(text, expectedRepoKey) {
+  if (!expectedRepoKey) return false;
+  const repoName = expectedRepoKey.split("/").pop()?.toLowerCase() ?? "";
+  if (!repoName) return false;
+  for (const p of localPathArgs(text)) {
+    const lower = p.toLowerCase();
+    const looksLikeCheckout = /server-filesystem/.test(text) || /\.(c?js|mjs|ts|py|sh)$/.test(lower);
+    if (looksLikeCheckout && !lower.includes(repoName)) return true;
+  }
+  return false;
 }
 function isUnmanagedServer(server) {
   return !SAFE_GLOBAL_MCP_SERVERS.has(server);
@@ -11394,6 +12367,7 @@ function inspectCodexConfig(content, expectedRepoUrl) {
   const serverNames = [...grouped.keys()].sort();
   const greatArrowText = grouped.get(CODEX_SERVER_NAME) ?? "";
   const hasGreatArrowServer = grouped.has(CODEX_SERVER_NAME);
+  const greatArrowInstallVersion = extractInstallVersion(greatArrowText);
   const greatArrowRepoKeys = extractConfiguredRepoKeys(greatArrowText);
   const greatArrowHasRepoHeader = Boolean(
     expectedRepoKey && greatArrowRepoKeys.includes(expectedRepoKey)
@@ -11404,7 +12378,7 @@ function inspectCodexConfig(content, expectedRepoUrl) {
     if (server === CODEX_SERVER_NAME) continue;
     const keys = extractConfiguredRepoKeys(text);
     const mismatchedExplicitRepo = expectedRepoKey && keys.length > 0 && !keys.some((key) => key === expectedRepoKey);
-    if (mismatchedExplicitRepo || hasJobbyJobMarker(server, text)) {
+    if (mismatchedExplicitRepo || hasForeignRepoMarker(text, expectedRepoKey)) {
       staleRepoServers.push(server);
     }
   }
@@ -11436,6 +12410,36 @@ function inspectCodexConfig(content, expectedRepoUrl) {
       }
     );
   }
+  if (hasGreatArrowServer) {
+    if (!greatArrowInstallVersion) {
+      issues.push({
+        code: "install_version_missing",
+        level: "warn",
+        message: "Great Arrow is missing the install-version header.",
+        hint: "Run `gad mcp install codex` to refresh Codex update tracking."
+      });
+    } else if (compareVersion(greatArrowInstallVersion, GAD_INSTALL_MIN_VERSION) < 0) {
+      issues.push({
+        code: "install_version_required",
+        level: "fail",
+        message: `Great Arrow install ${greatArrowInstallVersion} is below the supported minimum ${GAD_INSTALL_MIN_VERSION}.`,
+        hint: "Update the CLI with `npm install -g @great-arrow/cli@latest`, then run `gad mcp install codex`."
+      });
+    } else if (compareVersion(greatArrowInstallVersion, GAD_INSTALL_VERSION) < 0) {
+      issues.push({
+        code: "install_version_stale",
+        level: "warn",
+        message: `Great Arrow install ${greatArrowInstallVersion} can be refreshed to ${GAD_INSTALL_VERSION}.`,
+        hint: "Run `gad mcp install codex` to rewrite the Codex block with the latest self-healing headers."
+      });
+    } else {
+      issues.push({
+        code: "install_version_current",
+        level: "pass",
+        message: `Great Arrow install version ${greatArrowInstallVersion} is current.`
+      });
+    }
+  }
   if (staleRepoServers.length > 0) {
     issues.push({
       code: "stale_repo_servers",
@@ -11463,6 +12467,8 @@ function inspectCodexConfig(content, expectedRepoUrl) {
     expectedRepoKey,
     hasGreatArrowServer,
     greatArrowHasRepoHeader,
+    greatArrowInstallVersion,
+    greatArrowInstallVersionCurrent: Boolean(greatArrowInstallVersion) && compareVersion(greatArrowInstallVersion, GAD_INSTALL_VERSION) >= 0,
     unmanagedServers,
     staleRepoServers,
     issues
@@ -11481,8 +12487,134 @@ function repairCodexConfig(content, staleRepoServers) {
   };
 }
 
+// src/lib/json-mcp-config.ts
+var JSON_SERVER_NAME = "great-arrow";
+function stripBom(content) {
+  return content.codePointAt(0) === 65279 ? content.slice(1) : content;
+}
+function asString(v) {
+  return typeof v === "string" ? v : null;
+}
+function explicitRepoKeys(entry) {
+  const keys = /* @__PURE__ */ new Set();
+  const headerVal = asString(entry.headers?.["X-Repo-URL"]) ?? asString(entry.headers?.["x-repo-url"]);
+  const envVals = [
+    asString(entry.env?.MEMORY_REPO_URL),
+    asString(entry.env?.GAD_REPO_URL)
+  ];
+  for (const v of [headerVal, ...envVals]) {
+    const k = repoKey(v);
+    if (k) keys.add(k);
+  }
+  const text = JSON.stringify([entry.url, entry.args]);
+  const gitUrls = /(?:https:\/\/|ssh:\/\/git@|git@)(?:github\.com|gitlab\.com|bitbucket\.org)[:/][^\s"',\]]+/gi;
+  for (const m of text.matchAll(gitUrls)) {
+    const k = repoKey(m[0]);
+    if (k) keys.add(k);
+  }
+  return [...keys];
+}
+function inspectJsonMcpConfig(content, expectedRepoUrl) {
+  const expectedRepoKey = repoKey(expectedRepoUrl);
+  const base = {
+    expectedRepoUrl: expectedRepoUrl ?? null,
+    expectedRepoKey
+  };
+  if (!content.trim()) {
+    return {
+      ...base,
+      parseError: null,
+      staleRepoServers: [],
+      issues: [
+        { code: "no_config", level: "warn", message: "No MCP config found." }
+      ]
+    };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripBom(content));
+  } catch (e) {
+    return {
+      ...base,
+      parseError: e instanceof Error ? e.message : String(e),
+      staleRepoServers: [],
+      issues: [
+        {
+          code: "parse_error",
+          level: "warn",
+          message: "Could not parse MCP config (left untouched)."
+        }
+      ]
+    };
+  }
+  const serversRaw = parsed.mcpServers;
+  const servers = serversRaw && typeof serversRaw === "object" && !Array.isArray(serversRaw) ? serversRaw : {};
+  const stale = [];
+  for (const [name, entry] of Object.entries(servers)) {
+    if (name === JSON_SERVER_NAME) continue;
+    if (!entry || typeof entry !== "object") continue;
+    const keys = explicitRepoKeys(entry);
+    const mismatchedExplicit = expectedRepoKey && keys.length > 0 && !keys.some((k) => k === expectedRepoKey);
+    if (mismatchedExplicit || hasForeignRepoMarker(JSON.stringify(entry), expectedRepoKey)) {
+      stale.push(name);
+    }
+  }
+  stale.sort();
+  const issues = [
+    JSON_SERVER_NAME in servers ? {
+      code: "great_arrow_present",
+      level: "pass",
+      message: "Great Arrow MCP server present."
+    } : {
+      code: "great_arrow_missing",
+      level: "warn",
+      message: "Great Arrow MCP server not found in this config.",
+      hint: "Run `gad mcp install` from the repo root."
+    },
+    stale.length > 0 ? {
+      code: "stale_repo_servers",
+      level: "fail",
+      message: `Found stale repo-scoped MCP server(s): ${stale.join(", ")}.`,
+      hint: "Run `gad doctor clients --enforce` to remove the stale blocks."
+    } : {
+      code: "no_stale_repo_servers",
+      level: "pass",
+      message: "No stale repo-scoped MCP server blocks found."
+    }
+  ];
+  return { ...base, parseError: null, staleRepoServers: stale, issues };
+}
+function repairJsonMcpConfig(content, staleRepoServers) {
+  if (!content.trim() || staleRepoServers.length === 0) {
+    return { content, removedServers: [] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(stripBom(content));
+  } catch {
+    return { content, removedServers: [] };
+  }
+  const servers = parsed.mcpServers;
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+    return { content, removedServers: [] };
+  }
+  const removed = [];
+  for (const name of new Set(staleRepoServers)) {
+    if (name in servers) {
+      delete servers[name];
+      removed.push(name);
+    }
+  }
+  removed.sort();
+  if (removed.length === 0) return { content, removedServers: [] };
+  return {
+    content: JSON.stringify(parsed, null, 2) + "\n",
+    removedServers: removed
+  };
+}
+
 // src/commands/doctor.ts
-function compareVersion(a, b) {
+function compareVersion2(a, b) {
   const left = a.match(/\d+|[a-z]+/gi) ?? [];
   const right = b.match(/\d+|[a-z]+/gi) ?? [];
   const length = Math.max(left.length, right.length);
@@ -11584,7 +12716,7 @@ async function checkCliVersion(auth) {
     const latest = cli.latest ?? CLI_VERSION;
     const minimum = cli.minimum ?? CLI_VERSION;
     const updateCommand2 = cli.updateCommand ?? `npm install -g ${CLI_PACKAGE_NAME}@latest`;
-    if (compareVersion(CLI_VERSION, minimum) < 0) {
+    if (compareVersion2(CLI_VERSION, minimum) < 0) {
       return {
         name: "CLI Version",
         status: "fail",
@@ -11592,7 +12724,7 @@ async function checkCliVersion(auth) {
         hint: `Update with: ${updateCommand2}`
       };
     }
-    if (compareVersion(CLI_VERSION, latest) < 0) {
+    if (compareVersion2(CLI_VERSION, latest) < 0) {
       return {
         name: "CLI Version",
         status: "warn",
@@ -11682,7 +12814,7 @@ async function checkMcp(auth) {
   }
 }
 function defaultCodexConfigPath() {
-  return join2(homedir2(), ".codex", "config.toml");
+  return join4(homedir2(), ".codex", "config.toml");
 }
 function codexIssuesToChecks(issues) {
   return issues.map((issue) => {
@@ -11720,13 +12852,13 @@ function codexCommand() {
       });
       const configPath = options.config ?? defaultCodexConfigPath();
       const expectedRepoUrl = options.expectedRepo ?? detectGitOrigin2();
-      let content = existsSync(configPath) ? await readFile2(configPath, "utf8") : "";
+      let content = existsSync3(configPath) ? await readFile2(configPath, "utf8") : "";
       let backupPath = null;
       let removedServers = [];
       if (options.enforce) {
         const apiUrl = extractCodexGreatArrowApiUrl(content) ?? (await resolveAuth()).apiUrl;
         const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-        await mkdir2(dirname2(configPath), { recursive: true });
+        await mkdir2(dirname3(configPath), { recursive: true });
         if (content.trim()) {
           backupPath = `${configPath}.bak.${timestamp}`;
           await copyFile(configPath, backupPath);
@@ -11808,6 +12940,137 @@ function codexCommand() {
     }
   );
 }
+function defaultJsonClientConfigs() {
+  const home = homedir2();
+  return [
+    { name: "Claude Code", path: join4(home, ".claude.json") },
+    { name: "Cursor", path: join4(home, ".cursor", "mcp.json") },
+    { name: "Kiro", path: join4(home, ".kiro", "settings", "mcp.json") },
+    { name: "Gemini CLI", path: join4(home, ".gemini", "settings.json") }
+  ];
+}
+function clientsCommand() {
+  return new Command("clients").description(
+    "Check JSON MCP client configs (Claude Code / Cursor / Kiro / Gemini) for wrong-repo server entries and optionally repair"
+  ).option(
+    "--expected-repo <url>",
+    "Expected repo URL (defaults to current git origin)"
+  ).option(
+    "--enforce",
+    "Back up each config and remove stale repo-scoped MCP servers"
+  ).option("--json", "Output as JSON").option("--quiet", "Suppress decorative output").option("--no-color", "Disable color output").action(
+    async (options, command) => {
+      const g = globalOutputOpts(command);
+      const color2 = createColor(g.noColor);
+      const fmt = createFormatter({
+        json: g.json,
+        quiet: g.quiet,
+        isTTY: isTTY(),
+        noColor: g.noColor
+      });
+      const expectedRepoUrl = options.expectedRepo ?? detectGitOrigin2();
+      const checks = [];
+      const results = [];
+      for (const { name, path: path9 } of defaultJsonClientConfigs()) {
+        if (!existsSync3(path9)) continue;
+        let content = await readFile2(path9, "utf8");
+        let backupPath = null;
+        let removedServers = [];
+        if (options.enforce) {
+          const pre = inspectJsonMcpConfig(content, expectedRepoUrl);
+          if (!pre.parseError && pre.staleRepoServers.length > 0) {
+            const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+            backupPath = `${path9}.bak.${timestamp}`;
+            await copyFile(path9, backupPath);
+            const repaired = repairJsonMcpConfig(
+              content,
+              pre.staleRepoServers
+            );
+            content = repaired.content;
+            removedServers = repaired.removedServers;
+            await writeFile2(path9, content, "utf8");
+          }
+        }
+        const inspection = inspectJsonMcpConfig(content, expectedRepoUrl);
+        for (const issue of inspection.issues) {
+          const check = {
+            name: `${name}: ${issue.code}`,
+            status: issue.level,
+            message: issue.message
+          };
+          if (issue.hint) check.hint = issue.hint;
+          checks.push(check);
+        }
+        if (options.enforce && removedServers.length > 0) {
+          const enforcementCheck = {
+            name: `${name}: enforcement`,
+            status: "pass",
+            message: `Removed stale server(s): ${removedServers.join(", ")}`
+          };
+          if (backupPath) enforcementCheck.hint = `Backup: ${backupPath}`;
+          checks.push(enforcementCheck);
+        }
+        results.push({
+          name,
+          path: path9,
+          backupPath,
+          removedServers,
+          inspection
+        });
+      }
+      if (results.length === 0) {
+        checks.push({
+          name: "JSON clients",
+          status: "warn",
+          message: "No JSON MCP client configs found on this machine."
+        });
+      }
+      if (g.json) {
+        process.stdout.write(
+          JSON.stringify(
+            { expectedRepoUrl, enforce: Boolean(options.enforce), results },
+            null,
+            2
+          ) + "\n"
+        );
+      } else {
+        if (!expectedRepoUrl) {
+          process.stdout.write(
+            renderCheck(
+              {
+                name: "JSON clients: repo detection",
+                status: "warn",
+                message: "No git origin detected for this directory",
+                hint: "Run from a repo root or pass --expected-repo."
+              },
+              color2
+            ) + "\n"
+          );
+        }
+        for (const check of checks) {
+          process.stdout.write(renderCheck(check, color2) + "\n");
+        }
+        if (!g.quiet) {
+          const failed = checks.filter((c) => c.status === "fail").length;
+          const warned = checks.filter((c) => c.status === "warn").length;
+          process.stdout.write("\n");
+          if (failed === 0 && warned === 0) {
+            fmt.success("JSON client config guard passed");
+          } else if (failed === 0) {
+            fmt.warn(`JSON client guard passed with ${warned} warning(s)`);
+          } else {
+            fmt.error(
+              `JSON client guard found ${failed} failure(s), ${warned} warning(s)`
+            );
+          }
+        }
+      }
+      if (checks.some((check) => check.status === "fail")) {
+        process.exitCode = 1;
+      }
+    }
+  );
+}
 function doctorCommand() {
   const cmd = new Command("doctor").description("Run a comprehensive health check").option("--json", "Output as JSON").option("--quiet", "Suppress decorative output").option("--no-color", "Disable color output").action(async (options, command) => {
     const g = globalOutputOpts(command);
@@ -11862,6 +13125,7 @@ function doctorCommand() {
     }
   });
   cmd.addCommand(codexCommand());
+  cmd.addCommand(clientsCommand());
   return cmd;
 }
 
@@ -11907,7 +13171,7 @@ var integrationListColumns = [
     }
   }
 ];
-async function createClient2() {
+async function createClient3() {
   const auth = await resolveAuth();
   return new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
 }
@@ -11969,7 +13233,7 @@ var listCommand3 = new Command("list").description("List all connected integrati
     isTTY: isTTY(),
     noColor: false
   });
-  const client = await createClient2();
+  const client = await createClient3();
   const result = await client.mcpCall("integrations_list", {});
   const data = result;
   let integrations = [];
@@ -11994,7 +13258,7 @@ var syncCommand = new Command("sync").description("Trigger a manual sync for the
     isTTY: isTTY(),
     noColor: false
   });
-  const client = await createClient2();
+  const client = await createClient3();
   fmt.info(`Triggering sync for "${kind}"...`);
   try {
     const result = await client.mcpCall("integration_sync", { kind });
@@ -12032,7 +13296,7 @@ var CLIENT_IDS = {
   codex: CODEX_CLIENT_ID,
   gemini: "gemini-cli"
 };
-async function createClient3() {
+async function createClient4() {
   const auth = await resolveAuth();
   const client = new GadClient({ token: auth.token, apiUrl: auth.apiUrl });
   return { client, apiUrl: auth.apiUrl };
@@ -12094,11 +13358,11 @@ async function pathExists(path9) {
 }
 async function installCodexConfig(apiUrl, token, repoUrl) {
   const { homedir: homedir3 } = await import("node:os");
-  const { join: join3 } = await import("node:path");
+  const { join: join5 } = await import("node:path");
   const { chmod, copyFile: copyFile2, mkdir: mkdir3, readFile: readFile3, writeFile: writeFile3 } = await import("node:fs/promises");
-  const codexDir = join3(homedir3(), ".codex");
-  const configPath = join3(codexDir, "config.toml");
-  const envPath = join3(codexDir, ".env");
+  const codexDir = join5(homedir3(), ".codex");
+  const configPath = join5(codexDir, "config.toml");
+  const envPath = join5(codexDir, ".env");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   await mkdir3(codexDir, { recursive: true });
   const existingConfig = await pathExists(configPath) ? await readFile3(configPath, "utf8") : "";
@@ -12140,7 +13404,7 @@ var statusCommand = new Command("status").description(
     isTTY: isTTY(),
     noColor: false
   });
-  const { client, apiUrl } = await createClient3();
+  const { client, apiUrl } = await createClient4();
   let statusData = {
     status: "unknown",
     proxyVersion: "\u2014",
@@ -12199,7 +13463,7 @@ var logsCommand = new Command("logs").description("Tail MCP connection log with
   });
   const c = createColor(false);
   const lineCount = Number.parseInt(options.lines ?? "20", 10);
-  const { client } = await createClient3();
+  const { client } = await createClient4();
   try {
     const result = await client.mcpCall("integration_sync_logs", {
       limit: lineCount
@@ -12365,6 +13629,9 @@ var installCommand = new Command("install").description("Generate MCP configurat
         repoUrl
       );
       fmt.success(`Wrote Codex MCP config to ${configPath} and ${envPath}`);
+      fmt.info(
+        "Restart Codex, start a fresh chat, then call tools_discover; tools_discover and tools_enable should be visible before enabling more Great Arrow tools."
+      );
       return;
     }
     const config = generateMcpConfig(
@@ -12379,8 +13646,8 @@ var installCommand = new Command("install").description("Generate MCP configurat
       return;
     }
     const { writeFile: writeFile3 } = await import("node:fs/promises");
-    const { join: join3 } = await import("node:path");
-    const outputPath = join3(process.cwd(), ".mcp.json");
+    const { join: join5 } = await import("node:path");
+    const outputPath = join5(process.cwd(), ".mcp.json");
     await writeFile3(outputPath, configJson + "\n", "utf-8");
     fmt.success(`Wrote ${clientName} MCP config to .mcp.json`);
   }
@@ -13073,7 +14340,7 @@ var retryifyAsync = (fn, options) => {
           throw error;
         const delay2 = Math.round(interval * Math.random());
         if (delay2 > 0) {
-          const delayPromise = new Promise((resolve) => setTimeout(resolve, delay2));
+          const delayPromise = new Promise((resolve3) => setTimeout(resolve3, delay2));
           return delayPromise.then(() => attempt.apply(void 0, args));
         } else {
           return attempt.apply(void 0, args);
@@ -13332,23 +14599,23 @@ var Temp = {
     }
   },
   truncate: (filePath) => {
-    const basename = path2.basename(filePath);
-    if (basename.length <= LIMIT_BASENAME_LENGTH)
+    const basename2 = path2.basename(filePath);
+    if (basename2.length <= LIMIT_BASENAME_LENGTH)
       return filePath;
-    const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename);
+    const truncable = /^(\.?)(.*?)((?:\.[^.]+)?(?:\.tmp-\d{10}[a-f0-9]{6})?)$/.exec(basename2);
     if (!truncable)
       return filePath;
-    const truncationLength = basename.length - LIMIT_BASENAME_LENGTH;
-    return `${filePath.slice(0, -basename.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
+    const truncationLength = basename2.length - LIMIT_BASENAME_LENGTH;
+    return `${filePath.slice(0, -basename2.length)}${truncable[1]}${truncable[2].slice(0, -truncationLength)}${truncable[3]}`;
   }
 };
 node_default(Temp.purgeSyncAll);
 var temp_default = Temp;
 
 // node_modules/.pnpm/atomically@2.1.1/node_modules/atomically/dist/index.js
-function writeFileSync(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
+function writeFileSync3(filePath, data, options = DEFAULT_WRITE_OPTIONS) {
   if (isString(options))
-    return writeFileSync(filePath, data, { encoding: options });
+    return writeFileSync3(filePath, data, { encoding: options });
   const timeout2 = options.timeout ?? DEFAULT_TIMEOUT_SYNC;
   const retryOptions = { timeout: timeout2 };
   let tempDisposer = null;
@@ -13675,7 +14942,7 @@ var Configstore = class {
       }
       if (error.name === "SyntaxError") {
         if (this._clearInvalidConfig) {
-          writeFileSync(this._path, "", writeFileOptions);
+          writeFileSync3(this._path, "", writeFileOptions);
           return {};
         }
         throw error;
@@ -13687,7 +14954,7 @@ var Configstore = class {
   set all(value) {
     try {
       import_graceful_fs.default.mkdirSync(path4.dirname(this._path), mkdirOptions);
-      writeFileSync(this._path, JSON.stringify(value, void 0, "	"), writeFileOptions);
+      writeFileSync3(this._path, JSON.stringify(value, void 0, "	"), writeFileOptions);
     } catch (error) {
       handlePermissionError(error);
     }
@@ -14639,14 +15906,14 @@ var TimeoutError = class extends Error {
 
 // node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/timeout.js
 async function timeout(request, init, abortController, options) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const timeoutId = setTimeout(() => {
       if (abortController) {
         abortController.abort();
       }
       reject(new TimeoutError(request));
     }, options.timeout);
-    void options.fetch(request, init).then(resolve).catch(reject).then(() => {
+    void options.fetch(request, init).then(resolve3).catch(reject).then(() => {
       clearTimeout(timeoutId);
     });
   });
@@ -14654,7 +15921,7 @@ async function timeout(request, init, abortController, options) {
 
 // node_modules/.pnpm/ky@1.14.3/node_modules/ky/distribution/utils/delay.js
 async function delay(ms, { signal }) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     if (signal) {
       signal.throwIfAborted();
       signal.addEventListener("abort", abortHandler, { once: true });
@@ -14665,7 +15932,7 @@ async function delay(ms, { signal }) {
     }
     const timeoutId = setTimeout(() => {
       signal?.removeEventListener("abort", abortHandler);
-      resolve();
+      resolve3();
     }, ms);
   });
 }
@@ -16383,6 +17650,10 @@ program2.addCommand(memoryCommand);
 program2.addCommand(workspace_default);
 program2.addCommand(todo_default);
 program2.addCommand(claim_default);
+program2.addCommand(work_default());
+program2.addCommand(worktree_default);
+program2.addCommand(install_hooks_default);
+program2.addCommand(guardrailsCommand());
 program2.addCommand(doctorCommand());
 program2.addCommand(integrations_default);
 program2.addCommand(mcp_default);