@groundnuty/macf 0.2.0-rc.0

package/dist/cli/commands/repo-init.js

@@ -0,0 +1,304 @@
+import { execFileSync } from 'node:child_process';
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { generateToken } from '@groundnuty/macf-core';
+const STATUS_LABELS = [
+    { name: 'in-progress', color: 'fbca04', description: 'Actively being worked on' },
+    { name: 'in-review', color: '0e8a16', description: 'PR created, awaiting review' },
+    { name: 'blocked', color: 'e11d48', description: 'Needs help or input' },
+    { name: 'agent-offline', color: 'b60205', description: 'Agent VM unreachable' },
+];
+const AGENT_LABEL_COLOR = '1d76db';
+function ensureDir(filePath) {
+    const dir = dirname(filePath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+}
+/**
+ * Detect owner/repo from git remote. Uses execFileSync (no shell injection).
+ */
+function detectRepoFromGit(cwd) {
+    try {
+        const remote = execFileSync('git', ['remote', 'get-url', 'origin'], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        const match = /github\.com[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?$/.exec(remote);
+        if (match)
+            return `${match[1]}/${match[2]}`;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function validateVersion(version) {
+    const validPatterns = [/^v\d+$/, /^v\d+\.\d+$/, /^v\d+\.\d+\.\d+$/];
+    const isTag = validPatterns.some(p => p.test(version));
+    if (!isTag && version !== 'main') {
+        process.stderr.write(`Warning: "${version}" is not a tag ref. Production repos should pin to a tag (v1, v1.0, or v1.0.0).\n`);
+    }
+}
+export function generateWorkflow(actionsVersion) {
+    return [
+        'name: Agent Router',
+        'on:',
+        '  issues:',
+        '    types: [labeled, closed]',
+        '  issue_comment:',
+        '    types: [created]',
+        '  pull_request:',
+        '    types: [opened]',
+        '  pull_request_review:',
+        '    types: [submitted]',
+        'jobs:',
+        '  route:',
+        `    uses: groundnuty/macf-actions/.github/workflows/agent-router.yml@${actionsVersion}`,
+        '    secrets: inherit',
+        '',
+    ].join('\n');
+}
+const DEFAULT_LABEL_TO_STATUS = {
+    'in-progress': 'In Progress',
+    'in-review': 'In Review',
+    'blocked': 'Blocked',
+};
+function makeAgentEntry(agent, useWindows, sessionName, defaults) {
+    const sshUser = 'ubuntu';
+    const entry = {
+        app_name: agent,
+        host: '<agent-host-ip>',
+        tmux_session: useWindows ? sessionName : agent,
+        ssh_user: sshUser,
+        tmux_bin: 'tmux',
+        ssh_key_secret: 'AGENT_SSH_KEY',
+    };
+    if (useWindows)
+        entry.tmux_window = agent;
+    // Default workspace_dir = /home/<ssh_user>/repos/<owner>/<repo>. Covers
+    // the common case where agents are cloned into ~/repos/<owner>/<repo>
+    // on the host. Users override per-agent if their layout differs.
+    if (defaults) {
+        entry.workspace_dir = `/home/${sshUser}/repos/${defaults.owner}/${defaults.repo}`;
+    }
+    return entry;
+}
+export function generateAgentConfig(agents, sessionName, defaults) {
+    if (agents.length === 0) {
+        return JSON.stringify({
+            agents: {
+                '<agent-name>': {
+                    app_name: '<github-app-name>',
+                    host: '<agent-host-ip>',
+                    tmux_session: '<tmux-session-name>',
+                    ssh_user: 'ubuntu',
+                    tmux_bin: 'tmux',
+                    ssh_key_secret: 'AGENT_SSH_KEY',
+                    workspace_dir: '/home/ubuntu/repos/<owner>/<repo>',
+                },
+            },
+            label_to_status: { ...DEFAULT_LABEL_TO_STATUS },
+        }, null, 2) + '\n';
+    }
+    const useWindows = !!sessionName && agents.length > 1;
+    const agentEntries = {};
+    for (const agent of agents) {
+        agentEntries[agent] = makeAgentEntry(agent, useWindows, sessionName, defaults);
+    }
+    return JSON.stringify({
+        agents: agentEntries,
+        label_to_status: { ...DEFAULT_LABEL_TO_STATUS },
+    }, null, 2) + '\n';
+}
+/**
+ * Merge-preserving regenerate for #76: update only tmux_session/tmux_window
+ * fields from user input, preserve app_name/host/ssh_key_secret/ssh_user
+ * /tmux_bin/unknown-fields, preserve top-level label_to_status and extras.
+ * Agents not in the --agents list are left alone.
+ */
+export function patchAgentConfig(existingJson, agents, sessionName, defaults) {
+    let parsed;
+    try {
+        parsed = JSON.parse(existingJson);
+    }
+    catch {
+        throw new Error('Existing agent-config.json is not valid JSON; aborting rather than overwrite.');
+    }
+    if (!parsed.agents || typeof parsed.agents !== 'object') {
+        throw new Error('Existing agent-config.json has no `agents` object; aborting.');
+    }
+    const useWindows = !!sessionName && agents.length > 1;
+    const agentEntries = { ...parsed.agents };
+    for (const agent of agents) {
+        const existing = parsed.agents[agent];
+        if (!existing) {
+            agentEntries[agent] = makeAgentEntry(agent, useWindows, sessionName, defaults);
+            continue;
+        }
+        const patched = { ...existing };
+        patched.tmux_session = useWindows ? sessionName : agent;
+        if (useWindows) {
+            patched.tmux_window = agent;
+        }
+        else {
+            delete patched.tmux_window;
+        }
+        if (!patched.ssh_key_secret)
+            patched.ssh_key_secret = 'AGENT_SSH_KEY';
+        // Inject workspace_dir default for old entries that lack it, so
+        // existing configs self-upgrade to enable helper invocation without
+        // requiring a hand-edit. Users can customize afterwards.
+        if (!patched.workspace_dir && defaults) {
+            patched.workspace_dir = `/home/${patched.ssh_user || 'ubuntu'}/repos/${defaults.owner}/${defaults.repo}`;
+        }
+        agentEntries[agent] = patched;
+    }
+    const out = { ...parsed, agents: agentEntries };
+    if (!out.label_to_status) {
+        out.label_to_status = { ...DEFAULT_LABEL_TO_STATUS };
+    }
+    return JSON.stringify(out, null, 2) + '\n';
+}
+export async function createLabel(owner, repo, token, spec) {
+    const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/labels`, {
+        method: 'POST',
+        headers: {
+            'Accept': 'application/vnd.github+json',
+            'Authorization': `Bearer ${token}`,
+            'X-GitHub-Api-Version': '2022-11-28',
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            name: spec.name,
+            color: spec.color,
+            description: spec.description,
+        }),
+    });
+    if (res.status === 201)
+        return 'created';
+    if (res.status === 422)
+        return 'exists';
+    return 'failed';
+}
+function writeFileSafe(path, content, force) {
+    if (existsSync(path) && !force) {
+        process.stderr.write(`Skipping existing file (use --force to overwrite): ${path}\n`);
+        return 'skipped';
+    }
+    ensureDir(path);
+    writeFileSync(path, content);
+    return 'created';
+}
+/**
+ * Bootstrap a repo for MACF routing.
+ */
+export async function repoInit(projectDir, opts) {
+    const absDir = resolve(projectDir);
+    validateVersion(opts.actionsVersion);
+    const repo = opts.repo ?? detectRepoFromGit(absDir);
+    if (!repo) {
+        throw new Error('--repo required (or run from a git repo with a GitHub origin remote)');
+    }
+    const parts = repo.split('/');
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        throw new Error(`Invalid repo format: "${repo}". Expected "owner/repo".`);
+    }
+    const [owner, repoName] = parts;
+    const agentList = opts.agents ? opts.agents.split(',').map(s => s.trim()).filter(Boolean) : [];
+    const workflowPath = join(absDir, '.github', 'workflows', 'agent-router.yml');
+    const configPath = join(absDir, '.github', 'agent-config.json');
+    const workflowResult = writeFileSafe(workflowPath, generateWorkflow(opts.actionsVersion), opts.force);
+    // Agent-config handling: always merge-preserve when the file exists,
+    // regardless of --force (#82). Previously --force was required even to
+    // add new agents to an existing config; the "fresh template wins"
+    // semantic was a UX trap — users running `macf repo-init --agents foo`
+    // on an existing repo saw "Skipping existing file" and thought agents
+    // were scaffolded when nothing changed.
+    //
+    // --force now only controls the workflow file (agent-router.yml) — the
+    // workflow is regenerated from scratch (no fields to preserve), so the
+    // old "don't overwrite" guard still makes sense there.
+    //
+    // Patch is safe to call repeatedly: unchanged inputs produce the same
+    // output (idempotent), new agents are added, existing agent entries
+    // preserve app_name/host/ssh_key_secret/ssh_user/tmux_bin/workspace_dir,
+    // and top-level label_to_status + unknown keys pass through.
+    const entryDefaults = { owner: owner, repo: repoName };
+    let configResult;
+    if (existsSync(configPath)) {
+        const patched = patchAgentConfig(readFileSync(configPath, 'utf-8'), agentList, opts.sessionName, entryDefaults);
+        writeFileSync(configPath, patched);
+        configResult = 'updated';
+    }
+    else {
+        const fresh = generateAgentConfig(agentList, opts.sessionName, entryDefaults);
+        const writeRes = writeFileSafe(configPath, fresh, false);
+        configResult = writeRes; // 'created' (file didn't exist) is the expected path
+    }
+    const allLabels = [...STATUS_LABELS];
+    for (const agent of agentList) {
+        allLabels.push({
+            name: agent,
+            color: AGENT_LABEL_COLOR,
+            description: `Assigned to ${agent}[bot]`,
+        });
+    }
+    let token;
+    try {
+        token = await generateToken();
+    }
+    catch (err) {
+        process.stderr.write(`Warning: could not generate token (${err instanceof Error ? err.message : 'unknown'}). Skipping label creation.\n`);
+        printResults(workflowResult, configResult, [], [], []);
+        printNextSteps(configResult, agentList);
+        return;
+    }
+    const created = [];
+    const existed = [];
+    const failed = [];
+    for (const spec of allLabels) {
+        const result = await createLabel(owner, repoName, token, spec);
+        if (result === 'created')
+            created.push(spec.name);
+        else if (result === 'exists')
+            existed.push(spec.name);
+        else
+            failed.push(spec.name);
+    }
+    printResults(workflowResult, configResult, created, existed, failed);
+    printNextSteps(configResult, agentList);
+}
+function printResults(workflowResult, configResult, created, existed, failed) {
+    if (workflowResult === 'created')
+        console.log('✓ Created .github/workflows/agent-router.yml');
+    if (configResult === 'created')
+        console.log('✓ Created .github/agent-config.json');
+    if (configResult === 'updated')
+        console.log('✓ Patched .github/agent-config.json (preserving existing entries)');
+    if (created.length > 0)
+        console.log(`✓ Created labels: ${created.join(', ')}`);
+    if (existed.length > 0)
+        console.log(`  Labels already exist: ${existed.join(', ')}`);
+    if (failed.length > 0)
+        console.error(`✗ Failed to create labels: ${failed.join(', ')}`);
+}
+function printNextSteps(configResult, agentList) {
+    console.log('\nNext steps:\n');
+    if (configResult === 'created' && agentList.length === 0) {
+        console.log('  1. Edit .github/agent-config.json to set your agents\' hosts and tmux sessions');
+    }
+    else if (configResult === 'created') {
+        console.log('  1. Edit .github/agent-config.json and replace <agent-host-ip> placeholders');
+    }
+    else if (configResult === 'updated') {
+        console.log('  1. Review .github/agent-config.json — existing entries preserved, only tmux fields updated');
+    }
+    console.log('  2. Set repo secrets (Settings → Secrets and variables → Actions):');
+    console.log('       - AGENT_SSH_KEY: SSH private key for connecting to agent hosts');
+    console.log('       - TS_OAUTH_CLIENT_ID: Tailscale OAuth client ID');
+    console.log('       - TS_OAUTH_SECRET: Tailscale OAuth secret');
+    console.log('  3. Install your agent GitHub Apps on this repo');
+    console.log('  4. Commit and push: git add .github/ && git commit -m "chore: bootstrap MACF routing"');
+}
+//# sourceMappingURL=repo-init.js.map

package/dist/cli/commands/repo-init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-init.js","sourceRoot":"","sources":["../../../src/cli/commands/repo-init.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAsBtD,MAAM,aAAa,GAAyB;IAC1C,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;IACjF,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE;IAClF,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,qBAAqB,EAAE;IACxE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,EAAE;CAChF,CAAC;AAEF,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEnC,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;YAClE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,iDAAiD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7E,IAAI,KAAK;YAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,OAAO,mFAAmF,CACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,cAAsB;IACrD,OAAO;QACL,oBAAoB;QACpB,KAAK;QACL,WAAW;QACX,8BAA8B;QAC9B,kBAAkB;QAClB,sBAAsB;QACtB,iBAAiB;QACjB,qBAAqB;QACrB,wBAAwB;QACxB,wBAAwB;QACxB,OAAO;QACP,UAAU;QACV,wEAAwE,cAAc,EAAE;QACxF,sBAAsB;QACtB,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAwCD,MAAM,uBAAuB,GAAqC;IAChE,aAAa,EAAE,aAAa;IAC5B,WAAW,EAAE,WAAW;IACxB,SAAS,EAAE,SAAS;CACrB,CAAC;AAQF,SAAS,cAAc,CACrB,KAAa,EACb,UAAmB,EACnB,WAA+B,EAC/B,QAA6B;IAE7B,MAAM,OAAO,GAAG,QAAQ,CAAC;IACzB,MAAM,KAAK,GAAqB;QAC9B,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC,KAAK;QAC/C,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,eAAe;KAChC,CAAC;IACF,IAAI,UAAU;QAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1C,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,aAAa,GAAG,SAAS,OAAO,UAAU,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,WAAoB,EACpB,QAA6B;IAE7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE;gBACN,cAAc,EAAE;oBACd,QAAQ,EAAE,mBAAmB;oBAC7B,IAAI,EAAE,iBAAiB;oBACvB,YAAY,EAAE,qBAAqB;oBACnC,QAAQ,EAAE,QAAQ;oBAClB,QAAQ,EAAE,MAAM;oBAChB,cAAc,EAAE,eAAe;oBAC/B,aAAa,EAAE,mCAAmC;iBACnD;aACF;YACD,eAAe,EAAE,EAAE,GAAG,uBAAuB,EAAE;SAChD,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAEtD,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,YAAY,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,MAAM,EAAE,YAAY;QACpB,eAAe,EAAE,EAAE,GAAG,uBAAuB,EAAE;KAChD,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,MAAyB,EACzB,WAAoB,EACpB,QAA6B;IAE7B,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAoB,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,MAAM,YAAY,GAAqC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAE5E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,YAAY,CAAC,KAAK,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC/E,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAqB,EAAE,GAAG,QAAQ,EAAE,CAAC;QAClD,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC,KAAK,CAAC;QACzD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,OAAO,CAAC,WAAW,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,cAAc;YAAE,OAAO,CAAC,cAAc,GAAG,eAAe,CAAC;QACtE,gEAAgE;QAChE,oEAAoE;QACpE,yDAAyD;QACzD,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,SAAS,OAAO,CAAC,QAAQ,IAAI,QAAQ,UAAU,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3G,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,MAAM,GAAG,GAAoB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IACjE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACzB,GAAG,CAAC,eAAe,GAAG,EAAE,GAAG,uBAAuB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAa,EACb,IAAY,EACZ,KAAa,EACb,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,KAAK,IAAI,IAAI,SAAS,EAAE;QAC9E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,QAAQ,EAAE,6BAA6B;YACvC,eAAe,EAAE,UAAU,KAAK,EAAE;YAClC,sBAAsB,EAAE,YAAY;YACpC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,OAAe,EAAE,KAAc;IAClE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sDAAsD,IAAI,IAAI,CAAC,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,CAAC;IAChB,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,UAAkB,EAClB,IAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEnC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,2BAA2B,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,KAAK,CAAC;IAEhC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/F,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IAEhE,MAAM,cAAc,GAAG,aAAa,CAClC,YAAY,EACZ,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EACrC,IAAI,CAAC,KAAK,CACX,CAAC;IAEF,qEAAqE;IACrE,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,wCAAwC;IACxC,EAAE;IACF,uEAAuE;IACvE,uEAAuE;IACvE,uDAAuD;IACvD,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,yEAAyE;IACzE,6DAA6D;IAC7D,MAAM,aAAa,GAAuB,EAAE,KAAK,EAAE,KAAM,EAAE,IAAI,EAAE,QAAS,EAAE,CAAC;IAC7E,IAAI,YAA+C,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,gBAAgB,CAC9B,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,EACjC,SAAS,EACT,IAAI,CAAC,WAAW,EAChB,aAAa,CACd,CAAC;QACF,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnC,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,YAAY,GAAG,QAAQ,CAAC,CAAE,qDAAqD;IACjF,CAAC;IAED,MAAM,SAAS,GAAgB,CAAC,GAAG,aAAa,CAAC,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,SAAS,CAAC,IAAI,CAAC;YACb,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,eAAe,KAAK,OAAO;SACzC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,aAAa,EAAE,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,+BAA+B,CACpH,CAAC;QACF,YAAY,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC7C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,YAAY,CAAC,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACrE,cAAc,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,YAAY,CACnB,cAAqC,EACrC,YAA+C,EAC/C,OAA0B,EAC1B,OAA0B,EAC1B,MAAyB;IAEzB,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC9F,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,cAAc,CACrB,YAA+C,EAC/C,SAA4B;IAE5B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,IAAI,YAAY,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;IAClG,CAAC;SAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;IAC9F,CAAC;SAAM,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,yFAAyF,CAAC,CAAC;AACzG,CAAC"}

package/dist/cli/commands/rules-refresh.d.ts

@@ -0,0 +1,14 @@
+export interface RulesRefreshResult {
+    readonly rules: readonly string[];
+    readonly scripts: readonly string[];
+    readonly hookInstalled: boolean;
+}
+/**
+ * Copy canonical rules + scripts into <targetDir>/.claude/. Target must
+ * exist and be a directory. Returns copied filenames for caller logging.
+ *
+ * Unlike `macf update`, this does not read `.macf/macf-agent.json` — it
+ * runs against any Claude Code workspace, MACF-init'd or not.
+ */
+export declare function rulesRefresh(targetDir: string): RulesRefreshResult;
+//# sourceMappingURL=rules-refresh.d.ts.map

package/dist/cli/commands/rules-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-refresh.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/rules-refresh.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAyClE"}

package/dist/cli/commands/rules-refresh.js

@@ -0,0 +1,67 @@
+/**
+ * macf rules refresh: distribute canonical coordination rules + helper
+ * scripts to a workspace, without requiring full `macf init`.
+ *
+ * `macf update` refreshes these assets too, but only for workspaces that
+ * already have a `.macf/macf-agent.json`. Several Claude Code workspaces
+ * coordinate with MACF agents but don't (or can't) run full `macf init`:
+ *
+ *   - groundnuty/macf — the framework repo where code-agent lives; its
+ *     .claude/ is hand-curated and predates `macf init`.
+ *   - groundnuty/macf-science-agent — same situation for science-agent.
+ *   - Any workspace operated by a bot that isn't a MACF-registered agent
+ *     but still wants the canonical coordination rules (escalation,
+ *     mergeStateStatus interpretation, @mention routing, etc.).
+ *
+ * For those workspaces, `macf rules refresh --dir <path>` copies the same
+ * canonical files that `macf init` / `macf update` would copy, with no
+ * dependence on App credentials, registry, certs, or pin state.
+ */
+import { existsSync, statSync } from 'node:fs';
+import { copyCanonicalRules, copyCanonicalScripts } from '../rules.js';
+import { installGhTokenHook, installPluginSkillPermissions, installSandboxFdAllowRead } from '../settings-writer.js';
+/**
+ * Copy canonical rules + scripts into <targetDir>/.claude/. Target must
+ * exist and be a directory. Returns copied filenames for caller logging.
+ *
+ * Unlike `macf update`, this does not read `.macf/macf-agent.json` — it
+ * runs against any Claude Code workspace, MACF-init'd or not.
+ */
+export function rulesRefresh(targetDir) {
+    if (!existsSync(targetDir)) {
+        throw new Error(`Target directory does not exist: ${targetDir}`);
+    }
+    if (!statSync(targetDir).isDirectory()) {
+        throw new Error(`Target is not a directory: ${targetDir}`);
+    }
+    const rules = copyCanonicalRules(targetDir);
+    const scripts = copyCanonicalScripts(targetDir);
+    // Refresh the attribution-trap PreToolUse hook entry (merge-preserving,
+    // per #140). Keeps non-init'd workspaces (the macf repo itself, CV,
+    // etc.) in sync with the same structural guard as macf-init'd agents.
+    installGhTokenHook(targetDir);
+    // Pre-approve macf-agent plugin skills so SessionStart auto-pickup
+    // + /macf-status / /macf-issues don't hit interactive approval
+    // dialogs. See macf#189 sub-item 2.
+    installPluginSkillPermissions(targetDir);
+    // Install /proc/self/fd/** in sandbox.filesystem.allowRead so
+    // every Bash tool call stops failing with permission-denied on
+    // the harness fd. macf#200.
+    installSandboxFdAllowRead(targetDir);
+    if (rules.length > 0) {
+        console.log(`Refreshed ${rules.length} canonical rule file(s) in .claude/rules/:`);
+        for (const name of rules)
+            console.log(`  ${name}`);
+    }
+    else {
+        console.log('No canonical rule files found in CLI package (nothing to copy).');
+    }
+    if (scripts.length > 0) {
+        console.log(`Refreshed ${scripts.length} helper script(s) in .claude/scripts/:`);
+        for (const name of scripts)
+            console.log(`  ${name}`);
+    }
+    console.log('Refreshed gh-token guard hook in .claude/settings.json');
+    return { rules, scripts, hookInstalled: true };
+}
+//# sourceMappingURL=rules-refresh.js.map

package/dist/cli/commands/rules-refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules-refresh.js","sourceRoot":"","sources":["../../../src/cli/commands/rules-refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAQrH;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,8BAA8B,SAAS,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEhD,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE9B,mEAAmE;IACnE,+DAA+D;IAC/D,oCAAoC;IACpC,6BAA6B,CAAC,SAAS,CAAC,CAAC;IAEzC,8DAA8D;IAC9D,+DAA+D;IAC/D,4BAA4B;IAC5B,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAErC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,4CAA4C,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IACjF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wCAAwC,CAAC,CAAC;QACjF,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAEtE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC"}

package/dist/cli/commands/self-update.d.ts

@@ -0,0 +1,14 @@
+export interface SelfUpdateResult {
+    readonly updated: boolean;
+    readonly previousCommit: string;
+    readonly newCommit: string;
+}
+/**
+ * Run the self-update sequence in `sourceRepoDir` (typically the
+ * result of findCliPackageRoot()).
+ *
+ * Set MACF_SELF_UPDATE_SKIP_BUILD=1 to skip the `npm run build` step
+ * (used by unit tests that don't want to exercise npm).
+ */
+export declare function selfUpdate(sourceRepoDir: string): SelfUpdateResult;
+//# sourceMappingURL=self-update.d.ts.map

package/dist/cli/commands/self-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-update.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/self-update.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAUD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB,CA4FlE"}

package/dist/cli/commands/self-update.js

@@ -0,0 +1,112 @@
+/**
+ * macf self-update — pulls main + rebuilds the CLI's own dist/ (#144).
+ *
+ * Solves the stale-dist recurrence where operators `npm link`-ed to the
+ * macf source repo hit silent no-op behavior after a CLI-behavior PR
+ * merged: the installed binary points at an older `dist/cli/index.js`
+ * because no one ran `npm run build`.
+ *
+ * This command fetches + ff-merges origin/main into the local source
+ * checkout, then runs `npm run build` to refresh `dist/`. No-op when
+ * already up-to-date. Refuses to run on a dirty tree or divergent
+ * local commits — operator cleans up by hand; we don't guess.
+ *
+ * Bootstrap limitation: this command only helps CLI versions at or
+ * after #144. Pre-#144 upgrades were silent; existing workspaces pick
+ * up detection on first rebuild after this PR lands.
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+function git(cwd, ...args) {
+    return execFileSync('git', args, {
+        cwd,
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+}
+/**
+ * Run the self-update sequence in `sourceRepoDir` (typically the
+ * result of findCliPackageRoot()).
+ *
+ * Set MACF_SELF_UPDATE_SKIP_BUILD=1 to skip the `npm run build` step
+ * (used by unit tests that don't want to exercise npm).
+ */
+export function selfUpdate(sourceRepoDir) {
+    if (!existsSync(join(sourceRepoDir, '.git'))) {
+        throw new Error(`${sourceRepoDir} is not a git-cloned install (no .git/ directory). ` +
+            `self-update only works for npm-link dev installs, not tarball extracts. ` +
+            `See the bootstrap-limitation note in #144.`);
+    }
+    // Refuse dirty trees — operator may have in-flight work we'd lose.
+    // Clamp the status output to the first 20 lines so a pathological
+    // dirty state (e.g. `rm -rf node_modules/` before the rebuild) doesn't
+    // produce a wall of text in the error. 20 lines is enough context for
+    // a typical few-modified-files case; beyond that the operator needs
+    // to run `git status` themselves anyway. Per science-agent's #144
+    // review non-blocker.
+    const status = git(sourceRepoDir, 'status', '--porcelain');
+    if (status !== '') {
+        const lines = status.split('\n');
+        const shown = lines.slice(0, 20).join('\n');
+        const truncation = lines.length > 20
+            ? `\n... (${lines.length - 20} more; run \`git status\` to see them all)`
+            : '';
+        throw new Error(`working tree is dirty in ${sourceRepoDir}:\n${shown}${truncation}\n` +
+            `self-update refuses to overwrite uncommitted changes. ` +
+            `Commit or stash first, then re-run.`);
+    }
+    const previousCommit = git(sourceRepoDir, 'rev-parse', 'HEAD');
+    // Fetch origin/main (don't merge yet — we want to decide based on
+    // divergence first).
+    git(sourceRepoDir, 'fetch', 'origin', 'main');
+    const remoteCommit = git(sourceRepoDir, 'rev-parse', 'origin/main');
+    if (previousCommit === remoteCommit) {
+        console.log(`Already up-to-date at ${previousCommit.slice(0, 7)} — no update needed.`);
+        return { updated: false, previousCommit, newCommit: previousCommit };
+    }
+    // Check for divergence: if local HEAD isn't an ancestor of remote,
+    // ff-only would fail — surface a clear error instead of letting git
+    // spit its usual "non-fast-forward" message.
+    try {
+        git(sourceRepoDir, 'merge-base', '--is-ancestor', previousCommit, remoteCommit);
+    }
+    catch {
+        throw new Error(`local HEAD has diverged from origin/main (non-fast-forward, ff-only would fail). ` +
+            `Rebase or reset manually, then re-run self-update. Local: ${previousCommit.slice(0, 7)}, ` +
+            `remote: ${remoteCommit.slice(0, 7)}.`);
+    }
+    console.log(`Fast-forwarding ${previousCommit.slice(0, 7)} → ${remoteCommit.slice(0, 7)}...`);
+    git(sourceRepoDir, 'merge', '--ff-only', 'origin/main');
+    // Only reinstall deps when package-lock.json actually changed between
+    // commits. `npm ci` is load-bearing when deps move (nukes node_modules
+    // and reinstalls from lockfile — correctness-critical for a rebuild)
+    // but on the common case where a PR touches only `src/`, it's
+    // minutes of wasted cold-cache time. Caught in the post-#140 audit
+    // pass, 2026-04-20. `git diff --quiet` exits 0 on no-diff, non-zero
+    // on any diff — exactly the signal we want.
+    let lockChanged = false;
+    try {
+        execFileSync('git', ['diff', '--quiet', previousCommit, remoteCommit, '--', 'package-lock.json'], { cwd: sourceRepoDir, stdio: 'ignore' });
+    }
+    catch {
+        lockChanged = true;
+    }
+    if (lockChanged) {
+        console.log('package-lock.json changed; will run `npm ci` to refresh node_modules.');
+    }
+    else {
+        console.log('package-lock.json unchanged; skipping `npm ci` (deps already up-to-date).');
+    }
+    if (process.env['MACF_SELF_UPDATE_SKIP_BUILD'] !== '1') {
+        if (lockChanged) {
+            execFileSync('npm', ['ci'], { cwd: sourceRepoDir, stdio: 'inherit' });
+        }
+        console.log('Running `npm run build` to refresh dist/...');
+        execFileSync('npm', ['run', 'build'], { cwd: sourceRepoDir, stdio: 'inherit' });
+    }
+    const newCommit = git(sourceRepoDir, 'rev-parse', 'HEAD');
+    console.log(`CLI refreshed — now at ${newCommit.slice(0, 7)}.`);
+    return { updated: true, previousCommit, newCommit };
+}
+//# sourceMappingURL=self-update.js.map

package/dist/cli/commands/self-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-update.js","sourceRoot":"","sources":["../../../src/cli/commands/self-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAQjC,SAAS,GAAG,CAAC,GAAW,EAAE,GAAG,IAAc;IACzC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/B,GAAG;QACH,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,aAAqB;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,aAAa,qDAAqD;YACnE,0EAA0E;YAC1E,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,sBAAsB;IACtB,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC3D,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE;YAClC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,GAAG,EAAE,4CAA4C;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,4BAA4B,aAAa,MAAM,KAAK,GAAG,UAAU,IAAI;YACnE,wDAAwD;YACxD,qCAAqC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAE/D,kEAAkE;IAClE,qBAAqB;IACrB,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAEpE,IAAI,cAAc,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,yBAAyB,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACvF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACvE,CAAC;IAED,mEAAmE;IACnE,oEAAoE;IACpE,6CAA6C;IAC7C,IAAI,CAAC;QACH,GAAG,CAAC,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mFAAmF;YACjF,6DAA6D,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI;YAC3F,WAAW,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CACzC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,mBAAmB,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9F,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAExD,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,4CAA4C;IAC5C,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,YAAY,CACV,KAAK,EACL,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,mBAAmB,CAAC,EAC5E,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CACxC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,KAAK,GAAG,EAAE,CAAC;QACvD,IAAI,WAAW,EAAE,CAAC;YAChB,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;QAC3D,YAAY,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,0BAA0B,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC"}

package/dist/cli/commands/status.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Show status of registered agents by pinging their /health endpoints.
+ *
+ * If projectDir is given, uses that project's config for registry access
+ * (scopes the view to that project's peers). Otherwise loads all agents
+ * from the global index and uses the first one's config.
+ */
+export declare function showStatus(projectDir?: string): Promise<void>;
+//# sourceMappingURL=status.d.ts.map

package/dist/cli/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAgBA;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkFnE"}